Palo Alto Networks (PANW): what its 10-K says it depends on

Customers

Largest distributor (accounts receivable)

concentrated in · 19% of our gross accounts receivablenamed as a risk

As of July 31, 2026, one distributor individually represented 19% of our gross accounts receivable.Risk factors (Item 1A)

Also named by FTNT, ON

Two largest distributors

earns from · 30% of our total revenuenamed as a risk

For fiscal 2026, two distributors individually represented 10% or more of our total revenue and in the aggregate represented 30% of our total revenue.Risk factors (Item 1A)

U.S. government

earns fromnamed as a risk

Additionally, the U.S. government may require certain products to be manufactured domestically or in other relatively high-cost manufacturing locations, and we may not manufacture all products in locations that meet such requirements, affecting our ability to sell our offerings to the U.S. government.Risk factors (Item 1A)

Also named by ADI, AIR, APH, ASTS, ATI, AVAV, AWK, BA and 46 more

Suppliers

Flextronics International, Ltd. (Flex)

depends onnamed as a risk

Our substantial reliance on Flex or other manufacturing partners subjects us to concentration risks, such as reduced control over the manufacturing process, quality assurance, product costs and supply, and timing.Risk factors (Item 1A)

Partners and platforms

Third-party cloud service providers

depends onnamed as a risk

We rely on data center facilities operated by third-party cloud service providers to host and operate our cloud-based products and services.Risk factors (Item 1A)

Also named by AXON, CBOE, PDFS, U

Google Cloud Marketplace

earns from

For example, our VM-Series virtual firewalls are sold on Amazon’s AWS Marketplace, Microsoft’s Azure Marketplace, Alphabet’s Google Cloud Marketplace, and Oracle Corporation’s Oracle Cloud Marketplace either directly to end-customers or as part of the respective cloud hosting service provider’s offerings under a usage-based licensing model.Business (Item 1)

Also named by CDW, IONQ

Amazon Web Services (AWS) Marketplace

earns from

For example, our VM-Series virtual firewalls are sold on Amazon’s AWS Marketplace, Microsoft’s Azure Marketplace, Alphabet’s Google Cloud Marketplace, and Oracle Corporation’s Oracle Cloud Marketplace either directly to end-customers or as part of the respective cloud hosting service provider’s offerings under a usage-based licensing model.Business (Item 1)

Also named by QBTS

Microsoft Azure Marketplace

earns from

For example, our VM-Series virtual firewalls are sold on Amazon’s AWS Marketplace, Microsoft’s Azure Marketplace, Alphabet’s Google Cloud Marketplace, and Oracle Corporation’s Oracle Cloud Marketplace either directly to end-customers or as part of the respective cloud hosting service provider’s offerings under a usage-based licensing model.Business (Item 1)

Oracle Cloud Marketplace

earns from

For example, our VM-Series virtual firewalls are sold on Amazon’s AWS Marketplace, Microsoft’s Azure Marketplace, Alphabet’s Google Cloud Marketplace, and Oracle Corporation’s Oracle Cloud Marketplace either directly to end-customers or as part of the respective cloud hosting service provider’s offerings under a usage-based licensing model.Business (Item 1)

Other companies

Foreign currency forward contracts

exposed to its price · $2.2 billionnamed as a risk

As of July 31, 2026, the total notional amount of our outstanding foreign currency forward contracts was $2.2 billion.Risk factors (Item 1A)

Also named by SLB

CyberArk Software Ltd.

approximately 4,223 additional headcountnamed as a risk

Our recent CyberArk acquisition has expanded the scope and size of our business by adding substantial assets and operations to our existing business.Risk factors (Item 1A)

Centripetal Networks, Inc.

$114 millionnamed as a risk

For example, on January 31, 2024, in the Centripetal Networks, Inc. lawsuit against us, the jury returned a verdict of non-willful infringement, and a judgment was issued on October 3, 2024 assessing damages of $114 million, plus statutory interest, which is currently on appeal.Risk factors (Item 1A)

2030 Convertible Senior Notes

$1.25 billion aggregate principal amountnamed as a risk

In addition, our effective tax rates could be affected by fluctuations in the market price of our common stock and changes in the fair value of CyberArk’s $1.25 billion aggregate principal amount of 0.00% Convertible Senior Notes due 2030 (the “2030 Notes”) and the fair value of the capped call transactions (the “Capped Calls”) we acquired in connection with the CyberArk acquisition.Risk factors (Item 1A)

Chronosphere, Inc.

named as a risk

In particular, we believe there are significant benefits and synergies that may be realized from our recent acquisitions of CyberArk and Chronosphere, including through leveraging our combined products, scale, and enterprise customer bases.Risk factors (Item 1A)

Competitors

Microsoft Corporation

competes withnamed as a risk

large companies that incorporate security or observability features in their products, such as Alphabet Inc., Cisco Systems, Inc., and Microsoft Corporation, or those that have acquired, or may acquire, security vendors and have the technical and financial resources to bring competitive solutions to the market;Risk factors (Item 1A)

Also named by DDOG, GTLB, HPQ, WDAY

Cisco Systems, Inc.

competes withnamed as a risk

large companies that incorporate security or observability features in their products, such as Alphabet Inc., Cisco Systems, Inc., and Microsoft Corporation, or those that have acquired, or may acquire, security vendors and have the technical and financial resources to bring competitive solutions to the market;Risk factors (Item 1A)

Also named by DDOG, EXTR

CrowdStrike Holdings, Inc.

competes withnamed as a risk

independent vendors that may offer a mix of security products, such as Check Point Software Technologies Ltd., CrowdStrike Holdings, Inc., Delinea, Inc., Fortinet, Inc., Okta, Inc., SailPoint Technologies, Inc., and Zscaler, Inc., vendors that may offer a mix of observability products, such as DataDog, Inc., Dynatrace, Inc., and elasticsearch B.V., or vendors that may offer a mix of security and observability products;Risk factors (Item 1A)

Also named by HLT

Fortinet, Inc.

competes withnamed as a risk

independent vendors that may offer a mix of security products, such as Check Point Software Technologies Ltd., CrowdStrike Holdings, Inc., Delinea, Inc., Fortinet, Inc., Okta, Inc., SailPoint Technologies, Inc., and Zscaler, Inc., vendors that may offer a mix of observability products, such as DataDog, Inc., Dynatrace, Inc., and elasticsearch B.V., or vendors that may offer a mix of security and observability products;Risk factors (Item 1A)

Zscaler, Inc.

competes withnamed as a risk

independent vendors that may offer a mix of security products, such as Check Point Software Technologies Ltd., CrowdStrike Holdings, Inc., Delinea, Inc., Fortinet, Inc., Okta, Inc., SailPoint Technologies, Inc., and Zscaler, Inc., vendors that may offer a mix of observability products, such as DataDog, Inc., Dynatrace, Inc., and elasticsearch B.V., or vendors that may offer a mix of security and observability products;Risk factors (Item 1A)

Places

Israel

operates innamed as a risk

We have business operations in Israel, which meaningfully expanded as a result of the acquisition of CyberArk, and we intend to continue growing our presence in Israel.Risk factors (Item 1A)

Also named by AIOT, AKAM, AMAT, AMGN, APP, ASTS, AVY, BSX and 31 more

Asia

depends onnamed as a risk

The manufacturing operations of some suppliers are geographically concentrated in Asia, making our supply chain vulnerable to regional disruptions and international regulations, including tariffs, sanctions, and export controls.Risk factors (Item 1A)

Also named by AAPL, AYI, CART, CB, CDW, CHD, CLS, COHR and 31 more

United States

operates in

All of our hardware products are assembled in the U.S.Business (Item 1)

Also named by ABBV, ADP, AJG, AMGN, APA, AXGN, AXP, BALL and 139 more

Hazards

San Francisco Bay Area earthquakes

operates innamed as a risk

Our corporate headquarters are located in the San Francisco Bay Area, a region known for seismic activity.Risk factors (Item 1A)

Also named by FFIV, FTNT, PLTR, PYPL, RBRK, RDDT, TWLO, XYZ and 1 more

China-Taiwan tensions

named as a risk

We are also monitoring the tensions between China and Taiwan, and between the U.S. and China, which have increased our costs and could have an adverse impact on our business or results of operations in future periods.Risk factors (Item 1A)

Also named by CLS, FTNT, IOT, MRVL, ORCL, SYK, ZBRA

Commodities and inputs

Memory components

exposed to its pricenamed as a risk

For example, there is currently a global shortage of memory-related components, and certain of our hardware appliances require higher memory content, which has led to and may continue to lead to increased production costs.Risk factors (Item 1A)

Also named by BBY, CSCO, LBTYA, MCHP, NTAP

Integrated circuit components

depends onnamed as a risk

Our hardware products rely on key components, including integrated circuit components, purchased from a limited number of suppliers, including sole source providers.Risk factors (Item 1A)

Laws and programs

General Data Protection Regulation (GDPR)

subject to · 4% of annual worldwide turnovernamed as a risk

For example, we are subject to the E.U. General Data Protection Regulation (“E.U. GDPR”) and the U.K. General Data Protection Regulation (“U.K. GDPR,” and collectively the “GDPR”), each of which imposes stringent data protection requirements and provides for costly penalties for noncompliance (up to the greater of (a) €20 million under the E.U. GDPR or £17.5 million under the U.K. GDPR, and (b) 4% of annual worldwide turnover), and confers the right upon data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations.Risk factors (Item 1A)

Also named by A, AB, ABNB, ADBE, ADP, AGX, AIOT, AJG and 100 more

OECD Pillar Two global minimum tax

subject to · 15% global minimum taxnamed as a risk

Our effective tax rate and cash tax payments could increase in future years as a result of these changes.Risk factors (Item 1A)

Also named by ABNB, ACN, ADI, ADM, ADSK, AKAM, ALB, AMAT and 70 more

California Consumer Privacy Act (CCPA)

subject tonamed as a risk

We are also subject to U.S. privacy and data protection laws, including the California Consumer Privacy Act (the "CCPA"), which, among other requirements, requires enhanced disclosures, affords California residents with certain rights regarding their personal data, and creates a private right of action for data breaches caused by a lack of reasonable security.Risk factors (Item 1A)

Also named by AAP, AIOT, AKAM, ALL, APP, AYI, BAC, BBSI and 69 more

Health Insurance Portability and Accountability Act (HIPAA)

subject tonamed as a risk

Additionally, the U.S. Department of Justice has issued rules regarding access to or transfer of certain bulk sensitive personal data by countries of concern or covered persons, and we are subject to the Health Insurance Portability and Accountability Act ("HIPAA"), both of which carry significant enforcement penalties for non-compliance.Risk factors (Item 1A)

Also named by ADI, BBY, BR, BWIN, CART, CTSH, DGX, IQV and 8 more

Russia sanctions

subject tonamed as a risk

We are subject to these governmental sanctions and export controls, which may subject us to liability if we are not in full compliance with applicable laws.Risk factors (Item 1A)

Also named by ACN, AIR, BAM, BF/B, CW, DASH, DIS, GIS and 5 more

U.S. export controls (encryption)

subject tonamed as a risk

In addition, because we incorporate encryption technology into our products, certain of our products are subject to U.S. export controls and may be exported outside the United States only with the required export license or license exception.Risk factors (Item 1A)

Also named by ADI, DD, FLS, FTNT, HPE, MDB, NVT, Q and 1 more

E.U.-U.S. Data Privacy Framework

subject tonamed as a risk

We anticipate future legal challenges and developments to approved data transfer mechanisms, including to the E.U.-U.S. DPF, which could result in additional compliance costs and harm our business.Risk factors (Item 1A)

Also named by TWLO

U.S. and Chinese import tariffs

subject tonamed as a risk

For example, U.S. and Chinese import tariffs have impacted some of our components, increasing our costs and potentially requiring us to further raise prices on our hardware products.Risk factors (Item 1A)

China Cybersecurity Law and Data Security Law

subject tonamed as a risk

For example, in China, our products may be required to comply with cybersecurity and data security laws, including the Cybersecurity Law, the Data Security Law, and related regulations, and may be subject to network security review, critical information infrastructure protection requirements, and mandatory product certifications.Risk factors (Item 1A)

Technology

PAN-OS authentication bypass vulnerability

named as a risk

For example, in May 2026, we became aware of an authentication bypass vulnerability in certain versions of our PAN-OS software and published a security advisory, provided software updates, and engaged in customer outreach, support, and remediation efforts.Risk factors (Item 1A)