CrowdStrike, Palo Alto & Okta: My Cybersecurity Buy Prices

CRWD — CrowdStrike Holdings · PANW — Palo Alto Networks · OKTA — Okta, Inc. Bucket: Tracked-not-held Status: Tracked (all three). Entry conditions documented before any trigger hits. Date: September 30, 2026 · Prices: September 30, 2026 close

The Lens

In the epic poem The Odyssey, Odysseus famously tied himself to the mast when he and his crew sailed past the Sirens. His self control to prevent his own doom is akin to what’s happening here. These stocks look enticing given the need for enhanced security in the AI era, but self discipline is the difference between sustained gains and losses.

Executive Summary

My take: CrowdStrike, Palo Alto Networks and Okta are interesting businesses that I want to understand better. I’m ready to own all three if they get cheaper, but I won’t buy at today’s multiples. Deploying capital with discipline means waiting for a price that my rules accept, not chasing a chart that’s sitting at its highs.

Where things stand (Sept 30, 2026):

All three are within 2% of their 52-week highs. They’re up 185–234% from their spring lows.
All three trade well above their own history. On forward P/E, PANW is 73% above its five-year median, CRWD 121% above, and OKTA 33% above.
None has a proven moat on today’s numbers.
- PANW had one, then spent $21B on acquisitions that don’t yet earn their keep.
- CRWD has the stickiest customers of the three (115% net retention) but still posts a GAAP loss.
- OKTA is profitable and getting leaner, but its customers aren’t locked in (107% net retention).

What would make me a buyer: two conditions, one per stock. First, the stock falls 15% or more from its own high. Second, it clears my valuation gate.

	Price	15% pullback trigger	Valuation gate (own-history fwd P/E)	Biggest open question
OKTA	$209.11	$180.63	≈$160	Can it hold off Microsoft’s bundling?
PANW	$397.31	$337.71	≈$233	Will CyberArk earn its cost?
CRWD	$266.35	$227.54	≈$120	Can growth turn into GAAP profit?

Three caveats on that table:

The trigger is about the stock, not the market. A selloff in the broader market doesn’t count. Each stock’s own price has to come down, and when it does, I still need to know why before I buy. A sector-wide selloff is one thing; a breach, a lawsuit or a guidance cut is another.
PANW and OKTA technically pass the peer half of my gate today, because each is cheap next to the others. That isn’t the same as cheap, and I’m not treating it as a green light. Whether the rule should require both tests is still an open decision (see the trigger sheet).
The plan: deep dives in the order above, starting with OKTA because it’s closest to both lines.

Nothing here is a recommendation to buy or sell. These are my own entry rules, written down before the prices get there.

1. The Setup

Tennis has all-court players and surface specialists. An all-court player wants to beat you anywhere: grass, clay, hard court. A specialist bets that one surface matters enough to own it outright. Security buying is in the middle of that same argument right now. Palo Alto and CrowdStrike are both trying to be the all-court player, selling one “platform” that replaces a dozen point products. Okta is the specialist. Its pitch is that identity (who is allowed to log into what) should be run by a neutral company that doesn’t care whose firewall or endpoint agent you use. And Microsoft plays every match at home, with the crowd already in the stands because the security is bundled into licenses the customer already pays for. The question for this post isn’t who wins the tournament. It’s at what price each player becomes worth backing under my rules.

2. What They Do

PANW sells network firewalls (hardware and software) plus a growing list of cloud, security-operations, and (since February 2026) identity products. Most revenue is subscriptions and support: $9.2B of $11.48B in FY26. It sells mainly through distributors (PANW 10-K FY26, p.63).

CRWD sells the Falcon platform. A lightweight software agent sits on every laptop, server, and cloud workload and streams data to CrowdStrike’s cloud, and customers add paid “modules” (identity, cloud, SIEM) to that one agent. Subscriptions were 95% of FY26 revenue: $4.56B of $4.81B (CRWD 10-K FY26, p.83).

OKTA sells cloud identity: single sign-on, multi-factor authentication, and access management for both employees and the customers of the businesses it serves. Revenue is subscription-based (98% in FY26), sold per user (OKTA 10-K FY26, p.65).

3. Who Else Is on the Field

PANW: Winning side of a contested fight (consolidator).

Named competitors: PANW’s 10-K names more rivals than either peer. It lists Alphabet, Cisco, and Microsoft; then “Check Point…, CrowdStrike…, Delinea…, Fortinet…, Okta…, SailPoint…, and Zscaler”; then observability vendors Datadog, Dynatrace, and Elastic (PANW 10-K FY26, Item 1, p.13).
Strategy: stated outright as “consolidating disparate point products” (p.4).
Concentration: no end customer is ≥10% of revenue. Two distributors each handled 15% of FY26 revenue (30% combined), and one held 19% of receivables (p.13, p.68). That’s channel concentration, not demand concentration.
Why “winning” and not “rotation”: revenue grew 24.5% in FY26 ($9.22B → $11.48B). But $930M of that came from the Chronosphere and CyberArk acquisitions (p.82), so organic growth was about 14.4% (($11,480 − $930) ÷ $9,221.5 − 1). Remaining performance obligations (RPO), meaning contracted revenue not yet recognized, rose from $15.8B to $21.2B (p.74), but that also includes acquired backlog.
Open item: market share isn’t disclosed. “Winning” rests on growth and backlog, not measured share.

CRWD: Winning side of a contested fight.

Named competitors: none. CRWD lists only categories: “legacy antivirus,” “alternative endpoint security providers,” “network security vendors who are supplementing their core perimeter-based offerings with endpoint or cloud security solutions” (that describes PANW), “identity security vendors” (that describes OKTA), and “legacy SIEM vendors.” It also claims “we do not believe any of our competitors currently have a true platform offering equivalent to the Falcon platform” (CRWD 10-K FY26, Item 1, pp.16–17). That’s the company’s claim, not a finding.
Concentration: no customer or channel partner is ≥10% of revenue or receivables (CRWD 10-K FY26, pp.87–88).
Why “winning”: ARR (annual recurring revenue, the yearly value of subscriptions in force) grew 25% to $5.84B at July 31, 2026. Net new ARR in Q2 FY27 was $332.8M against $221.1M a year earlier, up 50.5% (CRWD 10-Q Q2 FY27, p.39). That growth is re-accelerating two years after the July 19, 2024 outage.

OKTA: Two-horse race, unsettled.

Named competitor: “Our principal competitor is Microsoft” (OKTA 10-K FY26, p.13). It names no one else.
Positioning: Okta calls itself “the leading independent identity partner” (Item 1). “Independence” is the second competitive factor it lists, right after “flexibility” (p.13).
Concentration: no customer is ≥10% of revenue or receivables (p.76).
Why “unsettled” and not “winning”: revenue growth is 10.6% (Q2 FY27, $805M vs $728M; OKTA 10-Q, p.5). Net retention fell from 111% to 107% (see §8). Those numbers fit a company holding its position against a bundler, not one taking ground from it.

How the three relate

PANW vs. CRWD — direct. PANW names CRWD. CRWD’s “network security vendors… supplementing… with endpoint” describes PANW’s Cortex line. Both pitch consolidation; they compete for the same “platform” budget.
PANW vs. OKTA — newly direct. PANW closed CyberArk (identity security) on Feb 11, 2026 for $21.1B (PANW 10-K FY26, p.79) and names Okta and SailPoint as competitors. At the same time, Okta lists Palo Alto Networks among the integrations in its integration network (OKTA 10-K FY26, p.10). So they’re partners at the integration level and rivals at the budget level.
CRWD vs. OKTA — mostly complementary, edging toward overlap. Okta’s filings don’t mention CrowdStrike anywhere. CRWD sells Identity Protection, which detects identity-based attacks rather than managing logins. On Feb 20, 2026 it bought SGNL, “a leader in continuous identity security,” for $628M (CRWD 10-Q Q2 FY27, p.30). Both moves push CRWD toward Okta’s surface.
The fourth player. Microsoft is named by PANW and is Okta’s only named competitor. CRWD doesn’t name it, and from FY27 CRWD sells through the Microsoft Marketplace (CRWD 10-K FY26, p.15). For Okta, Microsoft is the whole fight. For CRWD, it’s a rival and a sales channel at once.

4. Moat + Margin Durability

How to read this section. Investors in fast-growing software pay for growth, sticky customers and scale long before any of it shows up in returns on capital. A moat, though, is only proven when returns on capital beat the cost of capital for years. So this section asks three separate questions and answers each one plainly:

Does it earn its keep today? Do returns on capital beat the cost of capital?
Are customers sticky? Do existing customers stay and spend more?
Does it get better with scale? Do margins and cash generation improve as revenue grows?

Question 1 is the proof. Questions 2 and 3 show whether a moat is forming.

	1. Earns its keep today?	2. Sticky customers?	3. Better with scale?
PANW	Yes before CyberArk, no after. 15.2% (FY25) → 2.0% (FY26) vs. a ~10.4–11.3% hurdle	Partly. 56% of its $21.2B backlog runs past 12 months; retention not disclosed	No, stalled. Gross margin −190 bps, cash margin after stock comp down 2 pts
CRWD	Not yet. GAAP operating loss every period	Yes. 115% net retention; customers stayed through the 2024 outage	Not yet. Gross margin flat, costs only starting to fall as a share of revenue, thin cash margin after stock comp
OKTA	No. 3.0% vs. ~8.5–13.0%	No. 107% net retention, below the 115% bar and down from 111%	Yes, but mostly through cost control rather than pricing power

4.1 Does it earn its keep today? (ROIC vs. WACC)

Plain English. ROIC (return on invested capital) asks how much after-tax operating profit the business earns on the money tied up in it. WACC (weighted average cost of capital) is the return investors demand for providing that money. It works as a hurdle rate.

Method, the same for all three:

Operating income: GAAP operating income, adjusted only for genuine one-time items.
Stock-based compensation: not added back. It equals 15.5% of revenue at PANW (FY26), 23.1% at CRWD (TTM) and 16.4% at OKTA (TTM), and it’s a real cost, paid through dilution or through buybacks that offset dilution.
Tax: a normalized 21%. Reported rates are distorted: PANW’s FY24 rate was −160.8%, and CRWD and OKTA carry full U.S. valuation allowances.
Invested capital = debt + equity − cash, at period end.
“Ex-GW” strips out goodwill and acquired intangibles and adds their after-tax amortization back to NOPAT.

WACC, an estimate (debt is too small to matter, so WACC ≈ cost of equity):

Risk-free rate: 5.24%, the 10-year Treasury on Sept 28, 2026 (FRED).
Equity risk premium: 4.23–4.51% (Damodaran), stretched to a 5.0% upper bound as my own assumption.
Beta: PANW 1.22; CRWD 1.25; OKTA 0.77–1.56 (sources conflict).
Result: PANW 10.4–11.3%, CRWD 10.5–11.5%, OKTA 8.5–13.0%. No conclusion flips anywhere inside these ranges.

What the table says:

PANW cleared its hurdle by about 400–490 bps in FY24–FY25. Then $29.0B of goodwill and intangibles from CyberArk and Chronosphere landed on the balance sheet, and those two businesses lost $797M at the operating line since closing (PANW 10-K FY26, p.82). Shareholders own the total-capital return, because that’s what management paid on their behalf.
OKTA has the same split. The core business earns 28.5% on the capital it actually uses, but $5.49B of acquisition goodwill pulls the total to 3%.
CRWD has no excess return to measure yet. Invested capital is near zero because customers prepay. That’s an attractive funding model, but it isn’t a return.
Trough test: untested for all three. None has been through a sector downturn while earning positive returns.

Secondary view, adding SBC back (for reference only): PANW 33.6% (FY25) and 7.2% (FY26); OKTA 9.4% (TTM), which lands inside its WACC range; CRWD not meaningful. Okta’s moat only appears if employee stock is treated as free, which is why this view is secondary.

4.2 Are customers sticky?

What counts:

NDR (net dollar retention): take last year’s customers only and compare what they pay now with what they paid then. At ≥115%, the existing base grows on its own.
Gross retention: how much revenue is kept before counting any upsell.
Backlog share past 12 months: the share of contracted backlog (remaining performance obligations, RPO) that runs beyond a year. ≥50% means customers commit for multiple years.
Behaviour under stress.

Each company defines retention its own way. CRWD’s is ARR-based and excludes incident-response services; OKTA’s is based on annual contract value over a trailing 12 months. Compare them with care.

4.3 Does it get better with scale?

The three tests:

Gross margin up ≥300 bps over about three years.
GAAP operating costs as a share of revenue down ≥5 points.
Free cash flow minus stock comp, as a share of revenue, positive and rising.

Free cash flow alone flatters all three because it ignores stock comp, so the third test subtracts it.

Why each moved:

PANW got more efficient through FY25. Then the acquisitions reversed it: two loss-making businesses joined, and gross margin fell. The filings don’t split deal costs from mix, so that’s an open item. Recurring revenue still outgrows hardware: NGS ARR rose 33% against product revenue up 12.4% in FY25 (10-K FY25 p.44).
CRWD is a 25%-growth company still spending close to its gross profit, and stock comp eats most of its cash margin. The latest quarter is the first sign of real leverage.
OKTA’s improvement comes mostly from holding spending flat. R&D went $656M → $639M and sales and marketing $1,036M → $1,018M, FY24 to FY26 (10-K p.65), while revenue grew 29%. That’s real, but it’s a management choice, not a moat, and it can reverse in a quarter.

4.4 Where a moat would come from

PANW: switching costs, and the backlog evidences them: multi-year contracts covering firewalls built into customers’ networks. Platform breadth makes switching costs stronger; it isn’t a separate moat source. This fits its §7 “winning a contested fight” classification: the fight is over new spending, and the installed base stays put.
CRWD: switching costs, prospective. The 115% retention and the post-outage behaviour are the evidence. This fits §7.
OKTA: switching costs, prospective, through 7,000+ pre-built integrations (10-K p.10). But §7 undercuts it: a switching cost only protects you if the alternative costs the customer something, and Microsoft’s identity product is often already paid for. The 107% retention says §7 wins.

4.5 What would change the answers

4.6 Verdict

5. Entry Trigger

Each stock is up 185%-230% from 52-week lows so a 15% pullback would leave each of these far above where they traded in the spring. Below I’ve laid out numerous tables to estimate valuations.

The main points from these tables are:

The cheapness ranking is the same every way you measure it. OKTA is cheapest, then PANW, then CRWD. On forward EV/Sales, CRWD trades at about 4× OKTA’s multiple while growing about 2.5× as fast.
Against each other, PANW and OKTA pass the gate and CRWD fails. That only shows relative value, not that any of them is cheap.
Against their own history, none of them passes. Each is roughly 2× its own median price-to-sales.
The valuation gate sits well below the price triggers. It’s about 25% below today’s price for OKTA, 42% for PANW and 55% for CRWD. So a 15% or 20% pullback would arrive long before any of them is cheap against its own history.

Given these, I would consider buying each of these only if valuations dropped at least 15% from current levels but would have to drop to $233/share, $120, and $160 for PANW, CRWD, and OKTA, respectively.

6. The Close

The all-court players and the specialist are all standing on the baseline at their best ranking of the year. Palo Alto has bought its way onto every surface and now has to show the purchases earn their keep. CrowdStrike plays the best tennis of the three but charges the highest ticket price, and it still hasn’t posted a GAAP profit. Okta is the cheapest seat, but its retention numbers say the home crowd hasn’t moved.