Key points
- Five cybersecurity companies, five different business models
- Acquisitions complicate the growth comparisons
- Their revenue outlooks cover different fiscal years
Palo Alto Networks (PANW), CrowdStrike (CRWD), Fortinet (FTNT), Zscaler (ZS), and SentinelOne (S) all sell cybersecurity, but customers buy different things from each.
Palo Alto and Fortinet combine firewalls with software and services. CrowdStrike and SentinelOne build their platforms around software installed on computers and servers. Zscaler puts its security service between users and the applications they access.
Those differences matter when comparing their results. Hardware sales, subscriptions, and acquired businesses contribute to growth in different ways. This guide looks at what each company sells, how customers pay, and what the latest numbers show.
Product descriptions come from the companies' latest annual reports, and financial figures come from their latest quarterly releases. Fortinet's quarter ended June 30; the other four ended July 31. Share prices are September 25 closes.
Acquisitions are particularly important at Palo Alto and Zscaler. Palo Alto completed its $21.1 billion cash-and-stock purchase of identity security company CyberArk on February 11, 2026, according to its annual report. Zscaler bought managed detection and response provider Red Canary on August 1, 2025.
Who sells what
| Category | Palo Alto Networks | CrowdStrike | Fortinet | Zscaler | SentinelOne |
|---|---|---|---|---|---|
| Endpoint and EDR | Cortex XDR | Falcon Insight XDR | FortiEndpoint | - | Singularity Complete |
| Network firewall | PAN-OS firewalls | - | FortiGate | Zero Trust Firewall, cloud-delivered | - |
| SASE and zero trust access | Prisma Access | - | FortiSASE | ZIA and ZPA | - |
| SIEM and security operations | Cortex XSIAM | Falcon Next-Gen SIEM | FortiSIEM, FortiAnalyzer | Agentic Security Operations | Singularity AI-SIEM |
| Cloud security | Cortex Cloud | Yes | Yes | Zero Trust Cloud | Yes |
| Identity security | Idira | Yes | - | - | Singularity Identity |
| MDR | Unit 42 | Falcon Complete | FortiGuard services | Yes | Wayfinder MDR |
| AI security | Prisma AIRS | AI Detection and Response | FortiAI | Security for AI | Prompt Security |
The table reflects offerings described in each company's latest annual report. "Yes" means the report describes an offering without naming a separate product. A dash means the business section does not describe one; it does not establish that the company has none. Definitions follow the financial comparisons.
How the businesses work
| Company | Core technology | How customers pay |
|---|---|---|
| Palo Alto Networks | PAN-OS firewalls sold as hardware or deployed as virtual machines and containers, alongside cloud and software platforms | Product sales accounted for 20% of fiscal 2026 revenue; subscriptions and support accounted for 80% |
| CrowdStrike | A lightweight Falcon sensor on each device connected to a cloud platform, with 32 modules offered as of January 31, 2026 | Subscriptions accounted for 95% of revenue last quarter |
| Fortinet | FortiGate firewalls running FortiOS on the company's own FortiASIC security chips | Product sales accounted for about 38% of revenue last quarter; services made up the rest |
| Zscaler | A proxy cloud spanning more than 200 data centers that inspects traffic between users and applications | Subscriptions priced by user and, for some products, by usage |
| SentinelOne | An agent that runs AI models on each device, supported by a cloud security data lake | Subscriptions priced per agent, with tiers from Core to Enterprise |
How the latest quarters compare
| Company | Quarter ended | Revenue | Year-over-year growth | GAAP operating income (loss) | Operating cash flow | Sept. 25 close | Change in 2026 |
|---|---|---|---|---|---|---|---|
| Palo Alto Networks | July 31, 2026 | $3.41B | 34% | $172M | $1.36B | $374.74 | +103% |
| CrowdStrike | July 31, 2026 | $1.47B | 26% | ($33.2M) | $530.3M | $252.13 | +115% |
| Fortinet | June 30, 2026 | $2.05B | 26% | $689.3M | $1.04B | $173.46 | +118% |
| Zscaler | July 31, 2026 | $898.2M | 25% | ($15.5M) | $279.3M | $193.05 | -14% |
| SentinelOne | July 31, 2026 | $292M | 21% | ($90.8M) | ($6.5M) | $22.38 | +49% |
Operating cash flow is the net cash generated or used by operating activities during the quarter. Share-price changes run from December 31, 2025, through September 25, 2026, and account for CrowdStrike's four-for-one split in July.
All five also report non-GAAP operating results that exclude stock-based compensation and other specified costs. CrowdStrike, Zscaler, and SentinelOne reported operating profits on that adjusted basis, despite their GAAP operating losses.
Recurring revenue needs a closer look
Four companies report annual recurring revenue, or ARR, a measure of recurring revenue expressed on an annual basis. Their definitions and included products differ, so the figures are not directly comparable. Fortinet does not report ARR.
| Company | Measure | July 31, 2026 | Year-over-year growth |
|---|---|---|---|
| Palo Alto Networks | Next-Generation Security ARR, excluding hardware and some older offerings | $9.10B | 63%, including CyberArk |
| CrowdStrike | ARR | $5.84B | 25% |
| Zscaler | ARR | $3.771B | 25%; 20% excluding Red Canary |
| SentinelOne | ARR | $1.218B | 22% |
What each company expects for the full year
The outlooks cover different periods. Palo Alto and Zscaler are forecasting through July 2027, while the other three fiscal years end earlier.
| Company | Fiscal year ends | Revenue outlook | Expected growth |
|---|---|---|---|
| Palo Alto Networks | July 31, 2027 | $14.10B to $14.20B | 23% to 24% |
| CrowdStrike | January 31, 2027 | $5.991B to $6.011B | 24.5% to 24.9% |
| Fortinet | December 31, 2026 | $8.02B to $8.18B | 19% at the midpoint |
| Zscaler | July 31, 2027 | $3.908B to $3.938B | 16.6% to 17.5% |
| SentinelOne | January 31, 2027 | $1.202B to $1.207B | 20.0% to 20.5% |
Palo Alto, Fortinet, and Zscaler supplied their growth rates. The CrowdStrike and SentinelOne rates compare their guidance with prior-year revenue, shown here rounded to $4.81 billion and $1.00 billion, respectively.
Palo Alto's outlook includes a full year of CyberArk revenue. Palo Alto owned CyberArk for less than six months of fiscal 2026, which affects the year-over-year comparison.
What the security terms mean
Endpoint protection and EDR: Software that protects laptops, servers, and cloud workloads and records activity for investigation. EDR means endpoint detection and response. XDR extends detection and response across additional data sources.
Firewall: Hardware or software that inspects network traffic and applies security rules. Next-generation firewalls also identify applications and inspect traffic for threats.
SASE and zero trust access: SASE combines networking and security services delivered through the cloud. Zero trust network access connects users to specific applications rather than granting access to an entire corporate network, and is often offered as a VPN replacement.
SIEM and security operations: Tools that collect and analyze logs and alerts from multiple systems so security teams can investigate and respond to attacks.
Cloud security: Tools that find misconfigurations in cloud environments and protect the applications and workloads running there.
Identity security: Tools that protect accounts, credentials, and access privileges, including administrator access.
MDR: Managed detection and response. Analysts monitor customer systems and help respond to threats around the clock.
AI security: Tools designed to protect AI applications and agents, including defenses against prompt injection and controls intended to prevent sensitive data from leaking into AI tools.
Palo Alto Networks: firewalls, security operations, and identity
Palo Alto sorts its products into three platforms. Network & AI Security includes its firewalls, the Prisma Access cloud service, and Prisma AIRS for protecting AI applications and agents. Cortex covers security operations, including the XSIAM platform, which the company pitches as a replacement for traditional SIEM tools, and Cortex Cloud. Idira is the identity security platform formed from CyberArk.
Palo Alto also completed purchases of observability company Chronosphere in January and endpoint posture management company Koi in April. Its revenue grew 34% to $3.41 billion in the quarter ended July 31, and the company did not break out how much came from acquisitions, according to its results release. GAAP operating income fell to $172 million from $497 million, while non-GAAP operating income, which excludes share-based compensation, acquisition-related costs, and amortization of acquired intangible assets, rose to $1.0 billion from $768 million.
Fortinet: firewalls built on its own chips
Fortinet designs its own FortiASIC security processors, which the company says make its firewalls faster and more power efficient. Toshiba and Renesas manufacture the chips at foundries run by TSMC or by those companies, and about 87% of Fortinet's hardware is made in Taiwan, according to its annual report. The same FortiOS software runs its firewalls, SD-WAN, and FortiSASE, which the company says operates from more than 190 points of presence.
Product revenue grew 52% to $773 million in the quarter ended June 30, according to Fortinet's results release. Billings, which count invoices sent to customers, grew 33% to $2.37 billion. Its GAAP operating margin was 34%, the highest of the five.
CrowdStrike: one sensor, many modules
CrowdStrike installs one Falcon sensor on each device, and customers add modules without installing new software. The company offered 32 modules as of January 31, according to its annual report, covering areas from endpoint and cloud protection to its Next-Gen SIEM. CrowdStrike also sells Falcon Complete for fully managed protection. Charlotte AI, its AI assistant, automates analyst work.
CrowdStrike added a record $332.8 million of net new ARR in the quarter ended July 31, up 51% from a year earlier, according to its results release. CrowdStrike raised its full-year outlook for net new ARR growth to 34% at the midpoint. Ending ARR from accounts that have adopted Falcon Flex topped $2.29 billion, up 101%.
Zscaler: users never join the network
Zscaler's Zero Trust Exchange connects users, devices, and AI agents directly to applications without putting them on the corporate network, according to its annual report. Zscaler Internet Access secures traffic to the internet and software-as-a-service apps, and Zscaler Private Access connects users to internal apps. The company says its cloud processes more than 750 billion transactions a day. Zscaler had about 11,000 customers as of July 31.
Free cash flow fell to $60.8 million from $171.9 million a year earlier as spending on equipment and internal-use software rose to $218.5 million from $78.7 million, according to its results release. Zscaler expects revenue to grow about 19% in the current quarter and 16.6% to 17.5% for the full fiscal year. Its stock is the only one of the five that was down for 2026 through September 25.
SentinelOne: AI on the device, priced per agent
SentinelOne's agent runs AI models on the device itself to detect and stop threats, according to its annual report. The company says a feature called Rollback can return a device to its state before an attack. SentinelOne added AI security and data pipeline tools by acquiring Prompt Security and Observo AI in September 2025.
Revenue grew 21% to $292 million in the quarter ended July 31, according to its results release. Its GAAP operating margin was negative 31%, compared with negative 33% a year earlier, and its non-GAAP operating margin improved to 10% from 2%. The company raised its full-year revenue and operating income outlook.
For how each company is pitching products that secure AI, see our comparison of AI security stocks. Palo Alto's CyberArk deal is part of a wider wave of cybersecurity consolidation.
