Customer Trends & Growth Analysis in Cybersecurity SaaS Portfolio Q1-Q3 2026 Earnings

Executive Summary

Across this cybersecurity / infra SaaS portfolio (PANW, NET, OKTA, CRWD, ZS), customer demand is broadly healthy to strong, with platformization, AI security, and Zero Trust driving expansion. The clearest outperformance signals come from PANW, CRWD, ZS, and NET, all showing robust ARR/RPO growth and strong new-product traction. Okta’s demand is recovering but remains comparatively muted, with guidance and commentary implying a more cautious customer environment and slower growth.

Pricing power and retention are generally strong across the portfolio, aided by platform consolidation and value-based selling, though budget scrutiny is elongating or complicating some sales processes. The main risk is macro-driven caution and potential seat pressure (OKTA) versus spending priority on AI- and Zero Trust–related projects (PANW, CRWD, ZS, NET).

---

Portfolio-Level Customer Trends

1. Demand & Growth Indicators

Revenue / ARR / RPO growth snapshot

Portfolio view:

• Demand is strongest at NET, CRWD, PANW, and ZS, all showing >20% top-line/ARR and strong RPO growth, signaling sustained booking strength and visibility.
• Okta is the outlier, with low-double-digit revenue and high-single-digit cRPO growth, suggesting more moderate demand, even as large deals and new AI-agent identity products begin to contribute.

2. Pricing Power & Discounting Behavior

While explicit discount metrics are not disclosed, we can infer pricing power from margins, platform strategies, and commentary:

• PANW

  • Gross margin expanded (total to 76.9%, product to 80.2%), and operating margin topped 30%.
  • Large platform deals (e.g., $33M SASE with US Federal; $100M telecom deal) indicate ability to command substantial contract values, likely through consolidation value.
  • Tuck-in acquisitions at ~2.5% of market cap and high-margin NGS ARR growth suggest strong value perception and limited pricing stress.

• NET

  • Gross margin at 75.3% within target but down 350 bps y/y, reflecting heavy AI/network investments rather than pure price erosion.
  • Messaging focuses on TCO savings (>30% in some cases), elimination of egress fees, and pool-of-funds contracts; this suggests pricing power leveraged through cost-out and consolidation, not discounting to win on headline price.
  • Growth in large customers (> $1M and $5M cohorts) at record rates indicates willingness to scale spend on Cloudflare’s platform.

• OKTA

  • No adverse margin commentary; free cash flow margins of ~29–31% guided, and Rule of 40 focus.
  • Market described as cautious, but not price-aggressive; consolidation to Okta implies value-based pricing (replacing legacy stacks).
  • Some seat-count reductions are noted but offset by upsell into AI/agent identities—this is volume rather than price pressure.

• CRWD

  • Non-GAAP gross margin 78% (subscription 81%); operating income 21% of revenue and improving.
  • Management stresses disciplined pricing and margin protection even while aggressively growing.
  • Falcon Flex increases customer choice and TCV; strong record net new ARR >$1.35B from Flex suggests the model raises effective ARPU over time, reflecting healthy pricing power.

• ZS

  • Gross margin ~79.9%, near 80% guidance, with strong 52% FCF margin.
  • Z Flex (flexible commit model) and integrated platform strategy are pitched around cost savings and point-product replacement; evidence of strong traction (Z Flex TCV up 70% q/q) suggests customers perceive good value.
  • AI security ARRs beating multi-year targets early (AI Security to >$500M ARR; Data Security to ~$450M ARR) indicate customers are paying up for new analytical/AI capabilities.

Portfolio conclusion on pricing:
Pricing power remains intact to strong across the portfolio. Where there is pressure, it is more about macro scrutiny and deal timing than structural price cuts. All five companies lean heavily on platform and cost-savings narratives, which generally support premium pricing and multi-module expansion.

3. Retention, Expansion, and Logo Dynamics

Explicit or implied retention metrics:

• NET

  • Dollar-based net retention (DBNRR) 119%, up 5 pts q/q and 9 pts y/y—strong and improving.
  • Large customers (> $100K) up 23% y/y to 4,009 and now 73% of revenue (vs. 67%)—clear logo quality and expansion strength.

• OKTA

  • NRR around 106%, with strong gross retention and upselling into products like Identity Governance.
  • Millions-of-dollars cohort grew 17%—expansion is working in larger accounts, but at a lower intensity than others in the portfolio.

• CRWD

  • Not giving a numeric NRR here, but:
    • Record net new ARR (+73% y/y).
    • Large seven- and eight-figure expansions in cloud, identity, and SaaS security.
    • Falcon Flex adoption driving higher NRR and consolidation.
  • These collectively signal very strong expansion within existing base and minimal churn.

• PANW

  • RPO +24%, NGS ARR +29%, SASE ARR +34%, software firewall revenue +23%.
  • Platformization “drove multiple large deals,” and software form factors now 44% of TTM product revenue.
  • Indicates strong expansion across modules and high stickiness, though explicit NRR is not provided.

• ZS

  • RPO +35%, ARR +26%; Zero Trust Branch, Zero Trust Everywhere, and AI Security pillars showing large seven-figure deals.
  • Organic growth in the “core $2B ARR” is slower; faster growth is in newer AI/Data/Branch pillars, which likely boosts expansion within the installed base.
  • Strong FCF and high margins imply stable retention and limited churn.

Portfolio retention picture:

• Best expansion momentum: NET (quantified), CRWD, PANW, ZS.
• Solid but less exuberant: OKTA, with 106% NRR and growth in million-dollar cohorts but lower ARR/cRPO growth overall.

4. Sales Cycles, Conversion, and Go-to-Market

Length, complexity, and conversion trends:

• PANW

  • Not explicitly stating cycle lengths, but:
    • Multiple very large integrated deals (federal, telecom).
    • “Platformization” clearly resonating; SASE and software firewall growth robust.
  • Implied: High close rates and strong win rates, especially in displacement deals.

• NET

  • Seven consecutive quarters of sales productivity improvement; sales force capacity growing at fastest pace in over two years.
  • Bookings from partner-initiated opportunities doubled y/y, aiding SASE growth.
  • RPO +43% and strong Q4 pipeline indicate rising win rates and successful transition from product-led to enterprise-led sales, not elongated cycles.

• OKTA

  • Market described as cautious; guidance embeds conservatism.
  • Focus on sales specialization by buyer persona and increasing field capacity.
  • Healthy AE tenure and low attrition improving productivity, but current growth metrics suggest some lingering sales frictions (budget scrutiny, seat pressures, or competition from embedded identity).
  • Q4 is seasonally largest; management is optimistic on execution, implying a solid but not explosive sales backdrop.

• CRWD

  • Flex licensing model speeds adoption cycles and upsell; record net new ARR indicates high conversion of pipeline into ARR.
  • MSSP/channel, hyperscaler marketplaces (e.g., AWS Security Hub) broaden reach and simplify procurement, likely shortening or smoothing cycles, especially in mid-market and long-tail enterprise.

• ZS

  • Market conditions “tight,” with cautious IT budgets, but Zero Trust/AI security still top priorities.
  • Z Flex program explicitly designed to reduce procurement friction and enable larger, faster deals, and is working (TCV up 70% q/q; >$175M TCV).
  • Zero Trust Branch is “mature” but GTM still being fine-tuned; only ~10% penetration of large enterprise customers—indicates a long runway but also some GTM complexity to solve.

Portfolio view:

• Sales effectiveness is improving at NET, CRWD, and ZS, with mechanisms (partners, marketplaces, flexible commit programs) that appear to facilitate and accelerate deal closure despite macro caution.
• PANW’s large wins suggest well-functioning enterprise sales motion.
• OKTA appears the most impacted by cautious budgets and is still in the process of fully realizing benefits from its refined GTM model.

5. Product Traction & Customer Adoption Patterns

Key adoption vectors:

• PANW

  • Strong traction in:
    • NGS ARR (+29%), SASE ARR (+34%), and software firewalls (+23% revenue).
    • Prisma AIRS 2.0, AI security, and autonomous AI agents (Agentyx) for SOCs.
    • Quantum-ready PanOS 12.1 and 5th-gen firewalls.
  • Customer wins include:
    • One-third of Fortune 500 SASE customers.
    • Large US Federal and telecom displacement deals.
  • Conclusion: High product-market fit in AI security, SASE, and quantum readiness; broadening wallet share in large accounts.

• NET

  • Adoption trends:
    • Workers platform as a key growth driver for AI inference workloads.
    • SASE momentum via partner-led sales.
    • Quantum-safe protocols rolled out network-wide.
    • Larger cohorts (> $1M and >$5M spend) at record growth.
  • Customers often start with security and expand to compute/inference, indicating natural land-and-expand motion.
  • Conclusion: Very strong cross-sell and deepening usage across security + edge compute + AI.

• OKTA

  • Product traction in:
    • Okta Identity Governance, Privileged Access, and Identity Security Posture Management.
    • New offerings such as Auth0 for AI agents and securing AI identities.
    • Significant AI security deployment in financial services with notable ACV uplift.
  • Emerging driver: AI agents as new identity type; Okta positions as neutral control plane for cross-platform AI access.
  • Conclusion: Early but promising traction in AI identity, with solid large-deal activity; however, this is currently offset by overall slower growth in core markets.

• CRWD

  • Strong adoption across:
    • Falcon NextGen SIEM/SIM (record net new ARR).
    • Falcon Shield (SaaS app security with record net new ARR).
    • Cloud security, identity, and SaaS protection with large expansions.
    • Charlotte AI SOC and broader AI-driven automation features.
  • Falcon Flex drives consolidation and incremental module uptake.
  • Conclusion: Broad-based traction across multiple modules, with SIEM and cloud/identity emerging as high-growth adjacencies.

• ZS

  • High-velocity product growth:
    • AI Security segment >80% y/y and surpassing FY26 $400M ARR target three quarters early; expected >$500M ARR by year-end.
    • Data Security Everywhere ARR at ~$450M with strong seven-figure wins.
    • ZDX CoPilot bookings +80% y/y.
    • Zero Trust Everywhere and Zero Trust Branch: over 450 customers and significant upsell.
  • Combined data fabric + AI (via Avalor + Red Canary) differentiates its SOC/AI SecOps offerings.
  • Conclusion: Very strong traction in new AI/Data/branch pillars, outgrowing the core business and becoming a major ARR contributor.

Portfolio adoption picture:

• Leaders in new-product traction: ZS (AI security and data security), CRWD (NextGen SIEM, cloud/identity/SaaS), PANW (NGS, SASE, AI security, quantum), and NET (Workers AI, SASE, quantum-safe).
• OKTA shows targeted but smaller-scale traction in AI-agent identity and governance—promising but early relative to peers.

---

Company-by-Company Assessment

Palo Alto Networks (PANW)

Customer-related trends

• Demand: Strong; Q1 revenue +16%, NGS ARR +29%, RPO +24%. Large platform deals across US Federal and telecom indicate healthy enterprise appetite.
• Pricing & retention: Improving margins and strong ARR growth point to solid pricing power and high stickiness. Platformization (multiple product sales) is a key driver.
• Sales cycles: Large multi-product deals and federal wins imply robust enterprise conversion and competitive wins versus incumbents.
• Product traction: Excellent in SASE (+34% ARR), software firewalls (+23% revenue), AI security (Prisma AIRS 2.0, Agentyx), and quantum-ready firewalls.

Outlook vs. portfolio:
PANW appears positioned to outperform on customer growth, supported by:

• Platform consolidation momentum.
• Dual tailwinds from AI security and quantum readiness.
• Strong visibility via large and growing RPO.

---

Cloudflare (NET)

Customer-related trends

• Demand: Very strong. Q3 revenue +30.7% (acceleration), RPO +43%, strong Q4 pipeline. Large customer cohorts (> $100K) +23% and now 73% of revenue.
• Pricing & retention: DBNRR 119% and improving. Customers see >30% TCO reductions via platform consolidation and egress-fee elimination—value-based pricing with room to expand spend.
• Sales cycles & GTM:
  • Transition to enterprise sales is driving larger deal sizes and higher productivity for seven consecutive quarters.
  • Partner-led bookings doubled y/y, especially for SASE.
• Product traction:
  • Strong adoption of Workers platform (AI inference).
  • SASE, quantum-safe security, and multi-cloud integrations (Oracle OCI).
  • AI-native companies starting on security and expanding to compute/inference.

Outlook vs. portfolio:
NET is a clear outperformance candidate driven by:

• High and accelerating growth.
• Improving DBNRR and enterprise mix.
• Deepening role in AI workloads and Zero Trust/SASE.

---

Okta (OKTA)

Customer-related trends

• Demand: Mixed. Guidance for FY26 revenue growth only ~10–11%, current RPO +9%. Q3 had strong large deals and solid cash flow, but management repeatedly characterizes the environment as cautious.
• Pricing & retention: NRR ~106% with strong gross retention, implying healthy but not best-in-class expansion. Some seat-count reductions (macro and seat compression) are offset by upsell in AI/agent identities.
• Sales cycles & GTM:
  • Consolidation trends (replacing legacy identity vendors with Okta) are positive, but sales cycles are influenced by macro caution.
  • Focus on sales specialization and increasing sales capacity; positive signs (low attrition, higher AE tenure) indicate improving productivity, but impact on growth is still ramping.
• Product traction:
  • Identity Governance, Privileged Access, and Identity Security Posture Management performing well.
  • Auth0 for AI agents and cross-app access via Model Context Protocol position Okta as a neutral AI identity layer.
  • Management sees AI identity TAM as potentially larger than existing workforce+customer identity markets.

Outlook vs. portfolio:
OKTA is the most likely to underperform on near-term growth among this group:

• Growth and cRPO lag peers.
• Environment characterized as cautious, with continued macro sensitivities.
• That said, there is optionality in AI agent identity, which could support a longer-term re-acceleration if execution and market adoption align.

---

CrowdStrike (CRWD)

Customer-related trends

• Demand: Very strong and re-accelerating.
  • Ending ARR +23% to $4.92B; net new ARR +73% y/y to a record.
  • FY26 ARR growth guided at 23% with second-half net new ARR growth at least 50% y/y.
• Pricing & retention:
  • Non-GAAP gross margin 78%, subscription 81%; operating margin 21%.
  • Flex licensing model increases TCV and NRR, indicating strong ability to expand ARPU while protecting margins.
• Sales cycles & GTM:
  • Flex, MSSP partnerships (e.g., Kroll), and AWS marketplace integration facilitate rapid expansions and broader reach.
  • High win-rates displacing legacy SIEM/AV vendors, especially in cloud and endpoint.
• Product traction:
  • NextGen SIEM/SIM, Falcon Shield, cloud security, identity security, and SaaS protection all show record or significant net new ARR.
  • LogScale (observability) and AI-driven Charlotte SOC enhance cross-sell and platform adoption.

Outlook vs. portfolio:
CRWD is among the strongest positioned to outperform, with:

• Clear demand re-acceleration.
• Deep adoption of new high-value modules (SIEM, identity, cloud).
• Strong platform story in the “Agentic era” of AI.

---

Zscaler (ZS)

Customer-related trends

• Demand: Solid to strong with differentiation in new pillars.
  • Q1 revenue +20%; ARR +26% to $3.2B; RPO +35%.
  • AI Security ARR growth >80% y/y; Zero Trust Everywhere and Data Security pillars are scaling rapidly.
• Pricing & retention:
  • Gross margin ~80%; FCF margin 52%.
  • Z Flex enables flexible commits while driving TCV up 70% q/q, suggesting customers are willing to commit meaningfully when procurement friction is reduced.
• Sales cycles & GTM:
  • Macro described as tight, but Zero Trust and AI security remain high CIO/CSO priorities.
  • Z Flex directly addresses deal friction and forecastability, and is seeing strong adoption.
  • Zero Trust Branch go-to-market is still being fine-tuned; low penetration (~10% of large enterprises) indicates room but also ongoing sales execution work.
• Product traction:
  • AI Security ARR surpassing FY26 target three quarters early and on track for >$500M ARR by year-end.
  • Data Security Everywhere at ~$450M ARR.
  • ZDX CoPilot bookings +80% y/y.
  • Strong adoption of Agentic SecOps (AI Red Team, AI Guard) and Zero Trust Branch.

Outlook vs. portfolio:
ZS is a likely outperformer on product-driven growth, especially in AI/Zero Trust, with:

• High-growth new pillars offsetting slower-growing $2B core business.
• Strong RPO growth and substantial underpenetration in key products (Zero Trust Branch).

---

Portfolio Implications: Where Growth May Outperform or Face Pressure

Likely Outperformers on Customer Dynamics

• Cloudflare (NET)

  • Accelerating revenue and RPO.
  • Improving DBNRR (119%) and large-customer growth.
  • Strong AI and SASE traction.
  • GTM productivity improving and partner ecosystem scaling.

• CrowdStrike (CRWD)

  • Record net new ARR and strong guidance for continued acceleration.
  • Broad-based product traction (SIEM, identity, cloud).
  • Strong pricing power and expansion via Flex.

• Palo Alto Networks (PANW)

  • Robust NGS/SASE/software firewall growth and large strategic wins.
  • High RPO and raised long-term ARR target to $20B by FY30.
  • Strong AI and quantum security positioning.

• Zscaler (ZS)

  • Strong ARR/RPO growth; exceptional momentum in AI security and data security segments.
  • Z Flex and Zero Trust Everywhere/Branch provide significant expansion levers.

Areas Under Relative Pressure

• Okta (OKTA)
  • Significantly lower top-line and cRPO growth than peers (10–11% vs. >20% elsewhere).
  • Macro caution impacts budgets and seat counts, dampening expansion.
  • Nonetheless, strong financial foundation and promising AI identity initiatives provide long-term upside, but near-term customer growth is likely to lag the rest of the portfolio.

---

Key Takeaways

• Demand is broadly robust across the portfolio, especially in AI security, Zero Trust, SASE, and observability/identity adjacencies.
• Platformization and consolidation are core themes, driving larger deal sizes, strong expansion, and high pricing power at PANW, CRWD, ZS, and NET.
• Retention and expansion are strong to very strong, with Cloudflare’s DBNRR at 119% and CrowdStrike, Zscaler, and Palo Alto showing compelling ARR/RPO and expansion dynamics. Okta’s 106% NRR is solid but less dynamic.
• Sales motions are increasingly enterprise- and partner-led, with programs like Falcon Flex (CRWD), Z Flex (ZS), NSA/SASE platforms (PANW, NET), and specialized GTM (OKTA) designed to ease procurement friction and maximize wallet share.
• Relative performance outlook based on customer dynamics:
  • Outperformers: NET, CRWD, PANW, ZS.
  • Under relative pressure near term: OKTA, due to slower growth and cautious end markets, despite solid retention and promising AI identity opportunities.

From a portfolio perspective, weighting toward CRWD, NET, PANW, and ZS is supported by the current customer momentum, while OKTA looks more like a medium- to long-term recovery and AI identity optionality story rather than a near-term growth leader.