PANW · CIK 1327567
What Palo Alto Networks, Inc. told the SEC could break it.
For a security-software company, much of what Palo Alto Networks flagged is physical and concentrated. It leans on a single electronics-manufacturing-services provider to assemble most of its products and on sole-source component suppliers clustered in Asia — an arrangement it says has already brought supply disruption and higher costs from tariffs and U.S. trade-policy shifts, and one it watches against China-Taiwan and U.S.-China tensions. The other concentrations sit in its channel and its geography: three distributors together drove 44.2% of fiscal 2025 revenue, and it has growing operations and employees in Israel — expanding further through the proposed CyberArk acquisition — that regional hostilities could disrupt.
4 self-disclosed vulnerabilities, pulled from its own filings — each in the company’s words, with the source. This is the risk register almost nobody reads.
In its own words
What could break it.
Sole-source dependency
- single EMS provider + sole-source component suppliers; Asia-concentrated component supply chainhigh
PANW relies on one electronics manufacturing services provider to assemble most products and on sole-source component suppliers (including for integrated circuits); these component suppliers are geographically concentrated in Asia, and PANW lacks volume purchase contracts — exposing it to price swings and regional disruption.
“We rely on an electronics manufacturing services provider (“EMS provider”) to assemble most of our products and sole source component suppliers for certain components.”
SEC filing →As of 2025
Customer concentration
- three distributors = 44.2% of total revenue (18.8%, 14.4%, 11.0%)medium
For fiscal 2025, three distributors each individually represented 10%+ of Palo Alto Networks' total revenue (18.8%, 14.4% and 11.0%) and in aggregate 44.2%; substantially all revenue flows through channel partners, and no single end-customer exceeded 10%.
“For fiscal 2025, three distributors represented 10% or more of our total revenue, representing 18.8 %, 14.4 %, and 11.0 % respectively. No single end-customer accounted for more than 10% of our total revenue in fiscal 2025, 2024, or 2023.”
SEC filing →As of 2025
Geographic concentration
- Israel operations and employees (growing, incl. proposed CyberArk acquisition)medium
PANW has business operations and employees in Israel and intends to grow its presence there (including via the proposed ~$25B CyberArk acquisition); these operations could be disrupted by political instability, civil unrest, terrorism, or the hostilities in Israel and the surrounding region.
“We have business operations in Israel and intend to continue growing our presence in Israel, including in connection with our proposed acquisition of CyberArk. Our operations in Israel could be disrupted by political instability, civil unrest, terrorist attacks, acts of violence, acts of war, or other military actions”
Regulatory & policy
- tariffs/sanctions/export controls + China-Taiwan and U.S.-China tensions on Asia-concentrated supply chainmedium
PANW's Asia-concentrated component supply chain is vulnerable to international regulations (tariffs, sanctions, import/export controls); it has previously experienced supply-chain disruption and increased costs from U.S. trade-policy changes and is monitoring China-Taiwan and U.S.-China tensions.
“international regulations, such as tariffs, sanctions and import and export controls. In the past, we experienced supply chain disruption and have incurred increased costs resulting from inflationary pressures and changes in U.S. trade policy. We are also monitoring the tensions between China and Taiwan, and between the U.S. and China”
The hidden graph
Who it depends on, and who depends on it.
Relationships surfaced from filings — including ones disclosed by the other side, which is how the non-obvious ones come to light.
Its customers
Its suppliers
Alphabet Inc. (Google Cloud Marketplace)
“our VM-Series virtual firewalls are sold on Amazon's AWS Marketplace, Microsoft's Azure Marketplace, Alphabet's Google Cloud Marketplace, and Oracle Corporation's Ora[cle Cloud Marketplace]”
Cited →Oracle Corporation (Oracle Cloud Marketplace)
“our VM-Series virtual firewalls are sold on Amazon's AWS Marketplace, Microsoft's Azure Marketplace, Alphabet's Google Cloud Marketplace, and Oracle Corporation's Ora[cle Cloud Marketplace]”
Cited →Microsoft Corporation (Azure Marketplace)
“our VM-Series virtual firewalls are sold on Amazon's AWS Marketplace, Microsoft's Azure Marketplace, Alphabet's Google Cloud Marketplace, and Oracle Corporation's Ora[cle Cloud Marketplace]”
Cited →Amazon.com, Inc. (AWS Marketplace)
“our VM-Series virtual firewalls are sold on Amazon's AWS Marketplace, Microsoft's Azure Marketplace, Alphabet's Google Cloud Marketplace, and Oracle Corporation's Ora[cle Cloud Marketplace]”
Cited →
In the MyPRIA app, this is checked against the companies you actually own.
← World Watch