Here's what makes cybersecurity giant Palo Alto Networks tick and why we like the stock so much

Published Mon, Mar 6 202310:39 AM EST

Palo Alto Networks (PANW) last month had its best single trading day in about a year, exactly one week after the next-generation cybersecurity company became our newest Investing Club holding. The catalyst for the 12.5% surge on Feb. 22 was an incredible fiscal second quarter , reported the previous day. It's no wonder: With cyber criminals trying to breach computer systems at every turn, Palo Alto Networks is at the heart of keeping our digital world up and running. Here's an in-depth look at the company's various business lines and its finances to show why we like this stock so much. Market opportunity In our Feb. 15 initiation commentary , we recognized that cybersecurity isn't completely immune to a weaker macro environment. But it should be one of — if not the — most resilient areas of enterprise spending. If a threat were to arise, causing disruptions to your business, you don't want to be the one that left the company vulnerable because you cut spending. JPMorgan analysts agree. In a recent note, the firm said there's currently less than $200 billion of enterprise spending despite "over a trillion dollars of estimated annual cost and value destruction related to cybercrime." This discrepancy between money spent on digital defense and the cost of not having adequate protection — along with the simple fact that security is a never-ending arms race and bad actors are becoming more bold and sophisticated — is a key driver of growth. And those bad actors aren't just criminals working out of a basement, oftentimes they're backed by nation-states and are therefore equipped with plenty of resources and political agendas. Analysts at JPMorgan added that digital transformation initiatives and an expansion of so-called attack surfaces are two more areas of opportunity. The adoption of hybrid work, which means more devices and access points in and out of the office, has led to an increased need for new solutions. If an employee is working remotely, it's no longer enough for a company to secure its on-premise servers and public cloud infrastructure. The company must now think about securing remote devices, users' internet access points, and the data being transmitted. This type of security has to be done for each and every work situation, even when employees are on the move or accessing the internet from an unknown location like a hotel room, or a Starbucks. Why Palo Alto Networks? PANW YTD mountain Palo Alto Networks (PANW) 1-year performance Palo Alto Networks is a great way to play a secular growth industry. The Silicon Valley firm, which was started in 2005 and went public in 2015, is focused on five key areas of cybersecurity. It has a stock market value of around $58 billion. Network security Products here include physical, virtual, and cloud-delivered firewalls. In addition, Palo Alto Networks offers add-on security services that enable customers to secure their content, applications, users, and devices across the company's network security platform as well as Prisma and Cortex product lines. The Panorama management platform allows customers to centrally monitor Palo Alto's network security platform regardless of form factor, location, or scale. Secure access service edge Prisma Access is Palo Alto's cloud-delivered security offering that helps organizations deliver consistent security to remote networks and mobile users. When combined with Prisma SD-WAN, Prisma Access offers a security solution for customers to better secure their remote workforces. Cloud security This segment includes "cloud native" security products designed for both hybrid and multi-cloud environments — think built from the ground up for cloud computing. The primary offering on this front is Prisma Cloud , which provides security and compliance insights. The platform uses machine learning to profile user, workload, and application behaviors to identify and prevent advanced threats. Companies today can run any combination of cloud infrastructures. They may seek a hybrid model in which some data is stored on premises for security or latency reasons, while less sensitive data is stored on public cloud serves. Azure from Club holding Microsoft (MSFT) is the leader in hybrid cloud computing. Companies can also leverage multiple public cloud offerings with different strengths. Amazon Web Services (AWS) from Club stock Amazon (AMZN) is the leader in the pure public cloud space. Security operations Products include endpoint security, security analytics and security automation solutions delivered via Palo Alto's Cortex portfolio as software as a service (SaaS). Wall Street tends to reward subscription-based offerings with a higher multiple due to the sticky and recurring nature of these revenue streams. The portfolio includes Cortex XDR , Cortex XSOAR , and Cortex Xpanse . Threat intelligence and security consulting (Unit 42) In addition to a slew of product and software subscription offerings, Palo Alto offers "up-to-date threat intelligence and deep cybersecurity expertise before, during and after attacks" through its so-called Unit 42 threat research and security consulting team. Unit 42 offers incident response, risk management, board advisory, and proactive cybersecurity assessment services. Taking all of these segments together, Palo Alto Networks is a company capable of delivering on every aspect of cybersecurity under one roof. Once Palo Alto brings a new customer into its installed base, it can then leverage that relationship to cross-sell additional products to enhance protection or to consolidate its systems into a single platform. Analysts on Wall Street are expecting broader industry growth and Palo Alto is expected to grow revenue by at least 20% annually for the foreseeable future. There's also an expectation for margin expansion as management sharpens its focus on profitability. Top line trends Revenue and billings grew at a significant rate over the past three years coming out of the Covid pandemic. But that growth actually accelerated as cyber-attacks became more frequent. Those growth rates are understandably expected to slow down in fiscal 2023 as companies have become more cautious with IT budgets due to high inflation and heightened geopolitical uncertainty. Nevertheless, with both total revenue and billings both expected to grow north of 20% off the larger base, we see little cause for concern, attributing the slowdown to these macro dynamics and not to some fundamental issue at Palo Alto. Billings represent total revenue plus the change in deferred revenue. Deferred revenue represents money collected by a company for products and services that have not yet been delivered. This revenue will become realized (no longer deferred) as the products and services are delivered. This is a normal occurrence with service-oriented business that use longer-term contracts. In fiscal year 2022, Palo Alto Networks generated $1.4 billion in sales from its products, a 21.7% increase versus the prior fiscal year and accounting for nearly 25% of total revenue. The company reported $4.1 billion from subscription and support offerings, a 32% increase versus fiscal 2021. Subscription and support accounted for around 75% of total revenue. The chart below shows product offerings as a percentage of total revenue decreased from 2020 each year into estimates for fiscal 2023; over the same period, subscriptions and support increased. We like this for two reasons: first, a larger portion of sales coming from services is great because services tend to support a higher valuation multiple versus product sales; and second, it shows an increasing share of revenue coming from this more highly valued revenue stream. Product revenue is generally derived from sales of the company's machine learning-powered Next-Generation Firewall solutions. Subscription provides tools including the latest antivirus, intrusion prevention, web filtering, modern malware prevention and data loss prevention. Along with both product and subscription purchases, customers tend to purchase support services for ongoing security updates, upgrades, bug fixes, and repairs. Second-quarter results for fiscal 2023 Palo Alto beat expectations on both the top and bottom lines, generating a 26% year-over-year increase in revenue to $1.66 billion. Adjusted earnings per share (EPS) for the quarter was $1.05. Billings increased 26% year over year to $2.03 billion, ahead of the $1.97 billion expected on the Street. Perhaps most important given the market's renewed focus on profitability, management showed its focus on profits: Operating income rose 55% to $377 million for a third consecutive quarter of generally accepted accounting principles (GAAP) profitability. Of course, cash is king, which is why we were thrilled to see $685 million in free cash flow, far ahead of expectations of $388 million. Deals over $1 million grew 19% annually, while deals over $5 billion rose 84% and deals over $10 million increased 144%. Guidance Management provided a better-than-expected forecast for the full fiscal year. Total billings are expected to hit between $9.1 billion and $9.2 billion, which at the $9.15 billion midpoint is higher than analysts' estimates of $9.05 billion. Adjusted net income-per-share is expected in the range of $3.97 to $4.03, which at the $4-per-share midpoint is well above analysts' forecasts for $3.42 a share. Lastly, the adjusted free cash flow margin is expected in the range of 36.5% to 37.5%, up from a prior estimate of 34.5% to 35.5%. Financial Statements We like that the operating income line continues to trend higher. We also want to highlight the gross margin of "product" versus "subscription and support" as it shows the company's total gross margin profile can sustain — if not expand — over time. That's because subscription and support as share of revenue will grow even when product gross margins compress as they did in 2022 due to supply chain challenges. Palo Alto Networks' balance sheet, as of the company's fiscal year 2023 second quarter and represented in the chart below, shows that the company is in a good spot in terms of liquidity. Though a strict calculation of Palo Alto's current ratio, a ratio we covered in more detail in our review of financial statements , may raise some eyebrows, as current liabilities exceed current assets as of the end of the fiscal second quarter, we like to adjust this ratio when looking at companies that deal with a significant amount of deferred revenue. The thinking is that deferred revenue isn't a liability that requires a cash outlay but rather one that simply represents money taken in for services still owed. It's almost like an interest-free loan that gets paid back with products or services rather than cash. When adjusting for this line item, we calculate a current ratio of about 1.2 times, indicating a solid liquidity position, as seen in the chart below. This means Palo Alto is in a good position to meet upcoming financial obligations. Along with the healthy liquidity position, Palo Alto is free cash flow positive. That is an important factor to because it shows a company's ability to self-fund future growth, versus needing to take on additional debt, or sell shares into the market and dilute existing shareholders. Looking at the last three full fiscal years of cash flows, seen in the chart below, there have been ups and downs. For the most part, Palo Alto funds growth with cash on hand or cash generated via its operations. That's not to say a debt or equity offer is totally out of the question — that will largely depend on the available investment opportunities — but it does mean that management has options for growing without negatively impacting shareholder value by weakening the balance sheet or diluting existing shareholders. While the company does trade at a high multiple on earnings, it generates free cash flow in excess of earnings. In the second quarter of 2023, Palo Alto generated free cash flow of $656.3 million versus adjusted net income of $331.7 million, representing an adjusted free cash flow conversion ratio (free cash flow divided by adjusted net income) of nearly 2 times, a very strong result. This high conversion ratio means that as expensive as the stock screens on an adjusted earnings basis, it looks a lot more attractive from a free cash flow perspective. Given fiscal 2023 (FY2023) earnings and free cash flow of $3.92 per share and $7.84 per share, respectively, the stock, at roughly $187, is valued at about 48 times fiscal year 2023 earnings estimates but only about 24 times free cash flow. Bottom line: we predict further upside despite the high PE ratio. Customers Palo Alto Networks' customers are typically medium to large enterprises, service providers, and government entities that operate in a diverse set of industries including education, energy, financial services, health care, internet and media, manufacturing and telecommunications. Customers include nearly all of the Fortune 100 and a majority of the Global 2000 companies in the world. Perhaps more importantly, over the past three years no single customer accounted for more than 10% of Palo Alto's total revenue. This combination of large customers and low customer concentration points to revenue resiliency — meaning the customer base is well established and a downturn for any one customer won't too severely impact the company's top-line performance. Compensation and ESG Executive pay In 2022, management revamped its executive compensation program in order to better align named executive officer (NEO) compensation with shareholder interests. This includes an update that makes 100% of equity compensation performance based (with the exception of new hire awards). There is also an "ESG modifier" that adjusts annual incentive cash compensation plus or minus 10% based on performance relative to climate, inclusion and human capital metrics. (ESG stands for environmental, social and corporate governance, a new benchmark by which companies and personnel can be evaluated.) To this point, 94% of CEO Nikesh Arora's compensation is considered "at risk" with 88% coming in the form of performance-based stock units (PSUs) and another 6% tied to the cash incentive opportunity. As for the other NEOs, on average 92% of compensation is considered at risk with 84% coming in the form of PSUs and another 8% tied to the cash incentive opportunity. In addition, Palo Alto maintains a completely independent "Compensation and People Committee" as well as independent compensation consultants that review the company's compensation strategy annually. Given Wall Street's increased scrutiny on matters such as stock-based compensation, we find the updates to be a notable positive. Anything that better aligns executive compensation with shareholder interests is going to be viewed favorably by investors who have become more sensitive to dilution of their stakes. Palo Alto Networks' ESG practices, meanwhile, are overseen by the ESG and Nominating Committee, which provides counsel to the board in these matters. Environmental Palo Alto has several ambitious goals in place, including a 35% reduction of scope 1 and 2 greenhouse gas (GHG) emissions by the end of fiscal 2027 (versus fiscal 2021 levels), a commitment to getting 65% of the company's suppliers (based on total spend) to set "science-based targets" by the end of fiscal 2027, and a commitment to reduce the emissions associated with customers using Palo Alto's products by 40% by the end of 2027. Palo Alto Networks intends to be net zero across its Scope 1 and 2 emissions by fiscal 2030, by reducing emissions by 90%, as compared to fiscal 2021. Moreover, the company intends to be net zero across all Scope 1, 2 and 3 emissions by fiscal 2040. Source: WRI/WBCSD Corporate Value Chain (Scope 3) Accounting and Reporting Standard (PDF) , page 5. For those unfamiliar with GHG classifications, the Environmental Protection Agency (EPA) defines scope 1 emissions as "direct greenhouse (GHG) emissions that occur from sources that are controlled or owned by an organization (e.g., emissions associated with fuel combustion in boilers, furnaces, vehicles)." Scope 2 emissions "are indirect GHG emissions associated with the purchase of electricity, steam, heat, or cooling. Although scope 2 emissions physically occur at the facility where they are generated, they are accounted for in an organization's GHG inventory because they are a result of the organization's energy use." Scope 3 emissions "are the result of activities from assets not owned or controlled by the reporting organization, but that the organization indirectly affects in its value chain. Scope 3 emissions include all sources not within an organization's scope 1 and 2 boundaries. The scope 3 emissions for one organization are the scope 1 and 2 emissions of another organization. Scope 3 emissions, also referred to as value chain emissions, often represent the majority of an organization's total greenhouse gas (GHG) emissions." Social Management has adopted a "FLEXWORK" framework which is intended to provide employees with more flexibility and choice regarding how and when they work. Management says this approach will not only make the company "the cybersecurity workplace of choice" but also help scale the company's efforts to improve inclusion and diversity. Corporate governance Some notable guidelines in this bucket include a board in which 75% of directors are independent; an Audit Committee, ESG and Nominating Committee, Compensation and People Committee, and Security Committee that are all 100% independent; no poison pill in place; and a single class share structure to name a few. A "poison pill" is a defensive strategy corporations can use to dissuade outside buyers or active investors from becoming involved via the purchase of a large number of shares. Essentially, it provides management the ability to offset these attempts by distributing additional shares for free or at a steep discount to everyone except the hostile actor, thereby diluting their influence. We like that Palo Alto doesn't have a poison pill as it means that management can and will be held accountable. As we've seen with Salesforce (CRM) recently, sometimes an outsider (or in Salesforce's case, five known outsiders in the form of activist investors ) is exactly what a company needs to ensure the best outcome for all shareholders. We also favor the single share class structure as it prevents the company from being hostage to those who hold shares with outsized voting rights. Recently, we saw Constellation Brands (STZ) do away with its dual-class structure. While there was a steep one-time cost required to get rid of Constellation Brands' lass B shares, we thought it the right move by management as the new structure better aligns management with shareholder interests over the long term. Competition Palo Alto buckets the competitive landscape into five categories. Large companies that incorporate security features in their products, like Club holding Cisco Systems (CSCO), or other large companies capable of bringing other competitive solutions to market Independent vendors that offer a mix of network and endpoint security products such as Check Point Software Technologies (CHKP), Fortinet (FTNT), and Zscaler (ZS) Smaller startups Cloud-oriented security providers Companies like CrowdStrike (CRWD), that offer solutions for both security operations and endpoint security Palo Alto has competition coming from all sides. However, that's often the case for industry leaders that's trying to serve all of its customers' needs. (Jim Cramer's Charitable Trust is long PANW, MSFT, AMZN, CRM, CSCO. See here for a full list of the stocks.) As a subscriber to the CNBC Investing Club with Jim Cramer, you will receive a trade alert before Jim makes a trade. Jim waits 45 minutes after sending a trade alert before buying or selling a stock in his charitable trust's portfolio. If Jim has talked about a stock on CNBC TV, he waits 72 hours after issuing the trade alert before executing the trade. THE ABOVE INVESTING CLUB INFORMATION IS SUBJECT TO OUR TERMS AND CONDITIONS AND PRIVACY POLICY , TOGETHER WITH OUR DISCLAIMER . NO FIDUCIARY OBLIGATION OR DUTY EXISTS, OR IS CREATED, BY VIRTUE OF YOUR RECEIPT OF ANY INFORMATION PROVIDED IN CONNECTION WITH THE INVESTING CLUB. NO SPECIFIC OUTCOME OR PROFIT IS GUARANTEED.

Nikesh Arora, Palo Alto Networks

Adam Galica | CNBC