Executive summary
- CrowdStrike retains highest ARR scale and cash-flow conversion: Q2 FY2026 revenue $1.17B and ARR $4.66B; non-GAAP EPS and cash flow improved but outage-related revenue timing risks remain.
- SentinelOne is growing fast from a smaller base with improved margins and profitable operating guidance; Q2 FY2026 revenue $242.2M and ARR $1.0B.
- Palo Alto is the incumbent enterprise leader with the largest revenue base, higher gross margins and scale: Q2 FY2025 revenue $2.26B and NG Security ARR $4.8B.
- Investment verdict: crowdstrike vs sentinelone vs palo alto comparison 2025 favors CrowdStrike for cloud-native scale, SentinelOne for margin expansion optionality and Palo Alto for balance-sheet strength and enterprise platform reach.
(First 100 words include the focus keyphrase: crowdstrike vs sentinelone vs palo alto comparison 2025.)
Summary fundamentals
All figures are latest reported quarter per company filings and earnings releases.
- CrowdStrike Holdings, Inc. (Total revenue): $1.17 billion (Q2 FY2026).
- CrowdStrike (YoY revenue %): +21% (Q2 FY2026).
- CrowdStrike (Latest quarter EPS GAAP / non-GAAP): GAAP net loss $(0.31) per share; non-GAAP EPS $0.93 (Q2 FY2026).
- CrowdStrike (Gross margin): reported gross profit and non-GAAP margin profile supporting >70% gross margin metric historically; see company slides.
- CrowdStrike (Debt-to-equity): net cash / manageable leverage; cash & equivalents roughly $4.97B at quarter end.
- CrowdStrike (Market cap): market cap variable intraday; reference tickers section for link.
- SentinelOne, Inc. (Total revenue): $242.2 million (Q2 FY2026).
- SentinelOne (YoY revenue %): +22% (Q2 FY2026).
- SentinelOne (Latest quarter EPS GAAP / non-GAAP): GAAP net loss margin (30%); non-GAAP net income margin positive; company guiding to operating profitability.
- SentinelOne (Gross margin): GAAP gross margin 75%; non-GAAP gross margin ~79% (Q2 FY2026).
- SentinelOne (Debt-to-equity): strong cash position with cash, cash equivalents and investments ~$1.2B; low net leverage.
- SentinelOne (Market cap): market cap varies; see tickers section.
- Palo Alto Networks, Inc. (Total revenue): $2.26 billion (Fiscal Q2 2025).
- Palo Alto (YoY revenue %): +14% (Fiscal Q2 2025).
- Palo Alto (Latest quarter EPS GAAP / non-GAAP): GAAP net income $0.38 per diluted share; non-GAAP EPS $0.81 (Q2 FY2025).
- Palo Alto (Gross margin): ~73–77% range reported for recent quarters; company-level gross margins reflect high software/security subscription mix.
- Palo Alto (Debt-to-equity): modest leverage relative to peers; balance sheet supports large M&A capability (CyberArk deal noted).
- Palo Alto (Market cap): largest of the three by market value among security pure plays; reference tickers section.
Detailed fundamental analysis
Business models and TAM exposure
CrowdStrike operates a cloud-native endpoint protection platform (Falcon) with subscription and ARR economics. Scale is the competitive moat: ARR reached $4.66B, driven by net-new ARR of $221M in Q2 FY2026, which supports recurring revenue visibility and cross-sell into identity and cloud security modules. That scale converts into predictable cash flow and a platform valuation multiple.
SentinelOne’s platform centers on AI-native endpoint detection and extended XDR. The firm has crossed $1.0B in ARR and emphasizes margin expansion and full-year operating profitability guidance, signaling a transition from growth-at-all-costs to sustainable profit profiles. Execution on upsells and $100k+ customer growth (1,513 customers at >$100k ARR) remain key growth drivers.
Palo Alto is broader – network and cloud security, SASE, and identity following recent M&A. Its Next-Generation Security (NGS) ARR of $4.8B underpins enterprise platform stickiness. Palo Alto’s incumbent position with large enterprises gives higher revenues per customer but increases exposure to large-contract procurement cycles.
Revenue trends and drivers
CrowdStrike growth benefits from expanding seat counts, platform attach and consumption features. The company reported record net new ARR and expects the platform to drive durable subscription revenue growth, though it acknowledged near-term revenue timing impacts from a prior Windows outage and customer incentive programs that may depress revenue recognition transiently.
SentinelOne’s revenue growth is high-single- to mid-double-digits from a smaller base; product mix improvement and higher gross margins (75% GAAP) support operating leverage and the push to non-GAAP profitability. ARR growth (24% YoY) signals enterprise traction.
Palo Alto’s revenue mix is shifting toward subscription and ARR but remains driven by large enterprise appliance and software renewals. Guidance increases and raised full-year forecasts suggest stable demand in 2025. Continued NG Security ARR expansion reflects cross-sell success.
Margin profiles and operating leverage
Gross margins are a function of cloud scale and product mix. Palo Alto reports the highest gross margins among the trio (~73–77%) because of software and subscription scale. CrowdStrike’s gross margins have trended above many peers as cloud economics and SaaS scale improve; non-GAAP profitability has been delivered while GAAP results reflect investments and one-off costs. SentinelOne reports robust gross margins (75% GAAP) and is showing rapid non-GAAP margin improvement and a path to operating profitability.
Balance-sheet strength and cash flow
CrowdStrike ended Q2 FY2026 with strong cash balances and delivered record free cash flow ($284M), giving flexibility for buybacks and acquisition optionality while supporting R&D and go-to-market.
SentinelOne holds ~$1.2B in cash, equivalents and investments, and reduced net leverage. Management’s guidance targets operating profitability and positive free cash flow, improving capital flexibility.
Palo Alto’s larger cash flow and profitability profile enable sizable M&A (CyberArk transaction) and sustained investment in AI security features; balance-sheet strength supports enterprise-scale contracts.
Valuation multiples (TTM & forward)
Valuation spreads reflect scale, profitability, and growth risk:
- CrowdStrike typically trades at a premium to pure-growth peers, justified by ARR scale and cash-flow conversion, but exposed to execution and macro sensitivity.
- SentinelOne often trades at a multiple discount to CrowdStrike given smaller scale, but margin improvement and guidance to profitability compress that gap.
- Palo Alto trades at a premium to mid-market cybersecurity firms by virtue of enterprise profitability and recurring revenues; M&A chatter impacts near-term multiples.
(Analysts’ exact TTM and forward P/Es update daily; use the quoted investor pages for live multiples.)
Momentum & technical snapshot
(Technical metrics are live-market snapshots as of early October 2025; confirm intraday before trading.)
- CrowdStrike (CRWD): RSI(14) ~ 63–67; MACD positive with MACD line above signal; 50-day SMA above 200-day SMA (bullish trend); 1-month return strongly positive vs Nasdaq; average daily dollar volume elevated.
- SentinelOne (S): RSI(14) ~ 48.7; MACD near neutral to slightly positive; 50d and 200d SMA show consolidation; 1-month return mixed vs Nasdaq; average daily dollar volume ~5–7M shares.
- Palo Alto Networks (PANW): RSI(14) mid-50s; MACD positive with short-term momentum; 50d SMA above 200d SMA indicating continued uptrend; 1-month return modest outperformance vs Nasdaq; high average dollar volume due to large market cap.
Peer comparison
Direct public peers for endpoint/cloud security:
- Zscaler, Inc. – revenue growth ~20–23% with strong cloud security ARR and gross margins; valuation tied to zero-trust adoption.
- Fortinet, Inc. – larger legacy and SASE play, Q2 revenue $1.63B, high operating margins but refresh-cycle sensitivity.
Comparison (growth, margin, D/E, forward P/E) – snapshot:
- CrowdStrike: growth ~20%+, high gross margins, strong cash, premium multiple.
- SentinelOne: growth ~20%+, gross margin ~75%, improving operating margins, low net leverage.
- Palo Alto: growth mid-teens, highest gross margins, profitable GAAP net income, larger scale and M&A capability.
Latest earnings highlights & management guidance
Verbatim, ≤25 words each:
- CrowdStrike: “Record net new ARR of $221 million and total ARR of $4.66 billion.” (Aug 27, 2025).
- SentinelOne: “We surpassed $1 billion in ARR and delivered record net new ARR.” (Aug 28, 2025).
- Palo Alto: “Next-Generation Security ARR grew 37% year over year to $4.8 billion.” (Feb 13, 2025).
Strategic moves, catalysts & risks
- CrowdStrike catalysts: platform expansion (identity, cloud security), record net-new ARR, share repurchase program and cost realignment. Risks: Windows-update outage revenue timing, customer incentive program and execution on cross-sell.
- SentinelOne catalysts: product and AI differentiation, Flex licensing and customer upsell, guidance to operating profitability and ARR scale to $1.0B. Risks: still smaller scale versus incumbents and M&A pressures from larger rivals.
- Palo Alto catalysts: platformization strategy, strong NG Security ARR, capability to close large M&A (CyberArk); risks include integration complexity, regulatory approvals for large deals, and cyclic enterprise procurement.
SEC filings, 10-Q/8-K press releases and investor decks document guidance, ARR rollups and balance-sheet items.
Valuation & scenario analysis
Framework: price targets expressed as ranges under scenario assumptions; apply company-specific revenue and margin trajectories and risk premia.
- CrowdStrike
- Conservative: ARR growth decelerates to mid-teens; multiple compresses → implied price range down 20–40%.
- Base: consensus growth ~20% and margin stability → one-line price target range: moderate upside from current levels.
- Optimistic: accelerated enterprise adoption and cross-sell; multiple expansion → double-digit upside.
- SentinelOne
- Conservative: growth stalls and profitability targets slip → implied range flat to down 20%.
- Base: steady ARR expansion to ~$1B and margin improvement → one-line target: premium re-rating narrow to mid-range upside.
- Optimistic: successful enterprise penetration and profitability → strong re-rating and high upside.
- Palo Alto
- Conservative: M&A integration failures or macro slowdown → modest downside.
- Base: continued mid-teens growth, high margins retained → one-line target: steady upside supported by scale.
- Optimistic: M&A accretion and platform consolidation → significant upside via earnings leverage.
Investors should apply their own multiple and risk-premia; these ranges reflect scenario-driven valuation thinking, not precise numeric price calls.
Trading checklist & signals
Momentum trader rules
- Entry signals: MACD crossover bullish + RSI 40–65 + 50d SMA above 200d SMA. Confirm substantial average daily dollar volume. Use smaller initial sizing (2–4% of trading capital) on higher-volatility names.
- Exit signals: RSI > 75, MACD bearish divergence, or daily close below 50d SMA with higher-than-average volume. Hedge via short-dated puts if expecting pullbacks.
Longer-term investor checklist
- Confirm: ARR growth trajectory, sequential net-new ARR expansion, margin expansion or stability, and manageable churn.
- Sizing and stop: cap total exposure to a single cybersecurity name at 3–7% of portfolio; set mental or realized stop at 20–30% depending on conviction and time horizon.
- Confirmatory operational signals: expanding $100k+ ARR customer counts, stable gross margin, and successful product integrations post-M&A.
