🛡️ PANW $33.4M Gross, $0.29M Net: A Short Call Just Got Rolled Straight Through Palo Alto's Biggest Print of the Year

📅 2026-08-12 | 🔥 Unusual Activity Detected

✅ Updated 2026-08-13 pre-market — the next-day OPRA open interest confirmed the roll on both legs. The November $320 call rose 191 → 2,157 (+1,966) — the exact print size, landing at the very top of our published 2,000–2,157 range — and the August $300 call fell 2,680 → 1,734 (−946), confirming the buy-back. Both the STO and the provisional BTC ⏳ labels are confirmed. The roll-up-and-out reading holds. See the ✅ RESOLVED box.

---

🎯 The Quick Take

At 11:15:50 ET, a desk printed a negotiated floor block on Palo Alto Networks: bought 1,966 August 21 $300 calls at $84.30 and, in the same package, sold 1,966 November 20 $320 calls at $85.75 — ≈$33.4M of gross premium changing hands for a net credit of only ≈$0.29M, about $1.45 per contract. The reason this is a roll and not two unrelated bets: Palo Alto's company-confirmed fiscal Q4 and full-year earnings land September 1, 2026, which is 11 days after the August contract dies and 80 days before the November contract does. Someone just chose to be short calls through the single biggest print of the year, for almost no extra cash.

---

🏢 Company Overview

Palo Alto Networks, Inc. (NASDAQ: PANW) is a cybersecurity company built around platformisation — consolidating what enterprises used to buy from a dozen point-vendors onto a handful of Palo Alto platforms in exchange for larger, stickier multi-year commitments. Three-and-a-half pillars make up the platform: Network Security (next-gen firewalls plus the Prisma family — SASE, Cloud, and Prisma AIRS for AI runtime security), Cortex (security operations — XSIAM, XDR, XSOAR, now extended with Cortex AgentiX), a new Identity Security pillar built on the CyberArk acquisition and rebranded Idira (launched May 12, 2026), and an emerging Observability pillar built on the Chronosphere acquisition that has already surpassed $300M in ARR.

• Market capitalization: ≈$313.2 billion (Stock Analysis)
• Sector / industry: Technology sector, Software — Infrastructure industry (Stock Analysis company profile); under GICS this maps to Information Technology → Software → Systems Software
• Fiscal year end: July 31 — so the quarter that just closed is fiscal Q4 and the full-year 2026 report, not a routine quarterly print
• 52-week range $139.57 – $387.20, forward P/E ≈93.7–98.0x, TTM revenue $10.61B, gross margin ≈72%

The stock has more than doubled in 2026 (+108.4% YTD) and is up ≈78% in the three months this trade's earnings window covers — a very different backdrop for selling upside calls than a flat tape.

---

💰 The Trade, Plain English

A desk bought back a call that was 9 days from expiring and almost pure stock, and re-sold a new call $20 higher and 91 days later, right through the company's most important report of the fiscal year. This printed as a 🤝 floor block — a negotiated, price-agreed trade with a known counterparty, not an aggressive sweep. Because it took no liquidity, the BUY/SELL labels below are reported from the tape, not proven by an aggressor read.

Gross premium traded: ≈$33.4M. Net credit collected: ≈$0.29M ($16,858,450 − $16,573,380), or about $1.45 per contract across 1,966 contracts. That gap — $33.4M of paper moving for barely a quarter-million dollars net — is the entire signature of a roll, not a fresh directional bet.

---

✅ RESOLVED — The Roll Is Confirmed on Both Legs

Updated 2026-08-13 pre-market. Resolving OPRA snapshot timestamped August 13 (reflects the August 12 close, after this print); baseline is the August 12 snapshot (reflects the August 11 close, before this print).

Both branches landed on the side we published. The November line captured the print to the contract (+1,966 against 1,966), and the August line fell rather than holding flat or rising — the outcome we said would mean this was "not the close it appears to be." It was the close.

One nuance worth stating plainly. The August buy-back retired 946 contracts against a 1,966-lot print — 48% of the size — so roughly half the August volume changed hands between other holders rather than extinguishing the short. The four-session grind lower in open interest (2,723 → 2,705 → 2,682 → 2,680 → 1,734) is now a decisive step down, not a drift.

Net effect on the position: near-dated upside obligation reduced, longer-dated obligation created at a higher strike. The short call was genuinely rolled up and out, and the ≈$0.29M net figure reflects a real adjustment rather than two unrelated prints.

---

🤓 What This Actually Means — Plain English

Break this down leg by leg, because the pricing tells the whole story.

The August $300 call was basically a share substitute, not a bet. Against a $382.87 spot, that call is $82.87 in the money — 98.3% of its $84.30 price was pure intrinsic value. Only $1.43 was time value. An option that cheap in optionality with 9 days left barely behaves like an option anymore; it behaves like owning ≈196,600 shares of stock with a little less capital tied up. Buying it back to close a short position costs almost nothing extra, because there's almost nothing left to buy back except the stock-like part.

The November $320 call is a completely different animal. Intrinsic value is $62.87, but it printed at $85.75 — $22.88 of time value, roughly 16 times richer in optionality than the leg being closed. That premium exists because the option has 91 days to run and sits directly over Palo Alto's fiscal Q4 and full-year report on September 1, plus first FY2027 guidance, plus the expected close of the Embrace acquisition. Selling that much time value means selling a real, priced-in view on how the stock behaves around the biggest news event on the calendar.

Put those two together and the roll reading is hard to avoid. The desk bought back an obligation that had almost nothing left to lose or gain, and re-sold a brand-new one $20 higher in strike and squarely across the earnings date — for a net credit of just $1.45 a contract. If they wanted to bank premium, they gave almost all of the incoming $22.88 straight back by moving the strike $20 higher. That only makes sense if the objective was duration and strike room, not cash. Two honest readings survive: if this is a covered-call overwrite against long stock, raising the strike by $20 on ≈196,600 effective shares buys roughly $3.9M of extra upside room in exchange for staying capped for 91 more days across an earnings event — mildly constructive. If it's an outright short call with no stock behind it, extending an uncapped, open-ended-risk position through the year's biggest print for almost no extra premium is a materially riskier decision, especially with the refreshed analyst target band sitting well above the $320 strike (more on that below). The tape cannot tell us which one this is.

---

📈 Technical Setup

YTD Chart

Palo Alto is up ≈108.4% year-to-date and has rallied ≈47% off its June 9 cycle low of $260.52, hitting a 52-week high of $385.04 on August 10 — two days before this trade printed. That June low followed a –5.64% drop on June 3, the day after fiscal Q3 earnings, when the market saw through a headline +31% revenue beat to an organic growth rate of only ≈14% once CyberArk's contribution was stripped out. That reaction is the closest precedent for what September 1 could look like.

Gamma-Based Support & Resistance

Reading gex.json as of this snapshot (spot ≈$384.18):

• 🟠 $400 is the only material resistance level the chain returns — "Moderate" strength, ≈4.1% above spot. Being honest about the data: the chain did not return a material gamma support level below spot today, so there's no dealer-positioning floor to point to on the downside right now.
• The November $320 short strike sits well below both spot and the $400 resistance wall — it is not near any level the gamma structure is currently defending, which is consistent with it being a deep-in-the-money obligation rather than an at-the-money bet on a pin.

Implied Move

From PANW_implied_move.json:

• August 14 (2 days): implied move ≈±4.07% / ≈$15.63 → range $368.66 – $399.92
• August 21 expiry (9 days, the leg being closed): implied move ≈±7.86% / ≈$30.22 → range $354.07 – $414.51
• September 18 (37 days, past both fiscal earnings and past the November strike's midpoint in time): implied move ≈±18.71% / ≈$71.91 → range $312.38 – $456.20

The September range is more than twice as wide as the August range — not a smooth, gradual widening, but a jump. That jump is the market pricing the September 1 earnings print directly into the options chain. It's exactly the risk the desk chose to be short calls through when it rolled from August to November.

---

🎪 Catalysts

Already happened

• June 2, 2026 — fiscal Q3 2026 earnings: revenue $3.0B (+31% YoY), non-GAAP EPS $0.85 (a $0.06 beat), next-generation-security ARR $8.1B (+60% YoY), RPO $18.4B (+36% YoY) (company press release). But CyberArk alone contributed $388M of revenue and $1.6B of ARR that quarter — strip it out and organic revenue growth was only ≈+14%, not +31%.
• June 3, 2026 — stock fell –5.64% as the market focused on that organic-growth gap; the stock bottomed at $260.52 on June 9, 2026 before rallying ≈47% to $385.04 by August 10 (Stock Analysis price history).
• February 2026 — CyberArk ($25B) acquisition completed, later rebranded Idira, launched May 12, 2026 (Idira page). January 2026 — Chronosphere ($3.35B) closed. April 14, 2026 — Koi Security (≈$400M) closed.
• July 21, 2026 — Embrace acquisition announced (real-user monitoring for the observability platform), expected to close in fiscal Q1 2027 (company press release).
• August 3, 2026 — company confirmed the September 1 earnings date (company press release).
• August 6, 2026 — China opened a formal cybersecurity review of Palo Alto's products, citing national-security risk (MarketBeat, citing Reuters); the stock rallied to a 52-week high days later, implying the market currently treats China exposure as immaterial.
• August 10, 2026 — cybersecurity stocks surged off the Black Hat conference, with Palo Alto hitting new highs (MarketBeat).
• August 12, 2026 — Citizens JMP raised its price target from $320 to $415, one of nine price-target actions since late June that have clustered the refreshed analyst band at $380–$433 (MarketBeat price-target history).

Ahead — inside the traded windows (catalyst dates kept separate from the option expiration dates below)

• 2026-08-21 — August option expiration (fixed date, not a catalyst). Nothing company-specific is scheduled to happen before this date; it's a catalyst desert, which is exactly why the desk was comfortable closing the August call so cheaply.
• 2026-09-01, after the close — fiscal Q4 and full-year 2026 results, plus first FY2027 guidance (company-confirmed). This is the single most important event on the calendar and it falls inside the November window, 11 days after the August contract would have expired.
• A caution worth stating plainly: at least one widely used data feed, MarketBeat's own PANW quote page, still shows an estimated "Next Earnings: August 17, 2026" — which would place earnings inside the August 21 expiration (MarketBeat). That estimate is stale and wrong; the company's own August 3 release supersedes it. Anyone trading the August contract "for earnings" would be trading a print that was never coming.
• August 1 – October 31, 2026 — Embrace acquisition expected to close, inside the November window (company press release).
• 2026-11-20 — November option expiration (fixed date, not a catalyst).
• ≈late November – early December 2026 — fiscal Q1 2027 earnings, unconfirmed. This is a genuine coin-flip on either side of the November 20 expiration. Palo Alto's FY2026 reporting cadence slipped roughly two weeks later at every step this year (FQ2 on February 17, FQ3 on June 2, FQ4 on September 1) — a historically mid-to-late-November print could easily slip past November 20 if that pattern continues. No company confirmation exists yet either way.

On valuation: the "consensus" price target you'll see quoted flat on most sites (≈$337–345) sits below spot — but that consensus is stale. Every price-target action since late June clusters $380–$433 (MarketBeat price-target history), and the refreshed low end of that band ($380) already sits $60 above the $320 strike being sold in this trade.

---

👤 Four Ways to Read This

🎲 The YOLO trader

If you want to bet Palo Alto keeps ripping through earnings, the clean way to express it is buying your own out-of-the-money call into the September 1 print with a defined, known-in-advance max loss — not mirroring a $16.86M short call whose other side you can't see. Remember the refreshed analyst band tops out near $433 and the low end ($380) already sits above where this desk is short — if you fade this trade you're leaning on real sell-side support, but you're also betting against a book that clearly has size and, likely, a hedge you can't observe.

📈 The swing trader

The near-term technical map is thin: the only material gamma level the chain returns is $400 resistance (Moderate strength), and there's currently no comparable gamma support below spot to lean on for a floor. That leaves the implied-move ranges as your best guide — expect the stock to trade inside roughly $354–$415 through August 21, but be aware that range effectively doubles in width by September 18 as the market prices in the earnings print. Watch whether price holds above $354 (the low end of the August implied-move range) into the August 21 expiration; a break below that on no news would be a signal worth respecting given the calendar is otherwise empty.

💰 The premium collector

The lesson here, not the trade itself: this desk deliberately extended a short call through the biggest catalyst of the year for almost no extra premium — $1.45 a contract on $22.88 of time value sold. If you're collecting premium on Palo Alto, decide on purpose whether you want earnings exposure. Selling calls that expire before September 1 avoids the gap risk entirely; selling calls that span it (like the November leg here) should be sized smaller and priced with the understanding that a repeat of the June 3 –5.64% single-day move, in either direction, is a real possibility — and remember a short call carries open-ended risk above the strike, not a capped loss, unless you also hold the stock or a matching long call.

🌱 The beginner

Two things worth remembering. First: this trade rolled a call, meaning the desk closed one short call and opened a different one — buying back the near-worthless-in-time-value August contract and selling a fresh, richer November contract $20 higher. It's a housekeeping move, not necessarily a fresh opinion. Second, and more important for your own trading: always check the confirmed earnings date, not an estimated one. Palo Alto's own company release confirms September 1, but at least one popular stock-data site still shows an outdated "estimated August 17" date that would have put earnings inside a completely different, wrong expiration. Trading an option "for earnings" using the wrong date is one of the easiest and most avoidable mistakes in options trading — always click through to the company's own investor-relations page before you size a trade around an earnings date.

---

⚠️ Honest Limits — What the Tape Cannot Prove

• This was a negotiated floor block at mid pricing, not a lit trade. It took no liquidity, so the BUY/SELL labels are reported from the tape, not proven by an aggressor read, and the %-across / IV-change checks that work on lit trades do not apply here.
• The August $300 call's close status is not yet proven — size (1,966) sits below prior open interest (2,680), so tomorrow's ≈06:30 ET OPRA snapshot is the definitive test, not today's tape.
• OPRA cannot identify the counterparty, the broker, or whether this position is hedged with stock. A covered-call overwrite (long stock, short call) and a naked short call look identical on the option tape alone — the two readings above (mildly constructive vs. materially riskier) cannot be separated from this print.
• Gamma levels and implied-move ranges are model outputs derived from open interest and quoted implied volatility, not observed dealer positioning or a guarantee of where price goes.
• Research gaps flagged in the underlying catalyst file, carried forward honestly: the exact calendar day CyberArk's acquisition closed within February 2026 could not be verified from a primary source; Palo Alto's FQ3 2026 platformisation deal count could not be verified; a distinct sell-side consensus EPS for fiscal Q4 2026 (versus the company's own $0.96–$0.98 guidance) was not verified; the fiscal Q1 2027 earnings date is unannounced; specific 2026–2027 Ignite conference dates could not be retrieved; no scheduled investor or analyst day was found; Form 4 insider-transaction detail and 13F institutional-flow data could not be retrieved; and Palo Alto's China revenue exposure could not be quantified from a primary source.

This analysis is for informational purposes only and is not investment advice. Options trading involves substantial risk, including the potential for rapid and unlimited losses on short, uncapped positions, and is not suitable for all investors.

---

Last updated: 2026-08-13 (pre-market) — the next-day OPRA open-interest snapshot confirmed the roll on both legs. Nov-20 $320C 191 → 2,157 (+1,966, exactly the print size): OPEN (STO); Aug-21 $300C 2,680 → 1,734 (−946 against 1,966, 48% of size): CLOSE (BTC) confirmed, was BTC ⏳. The ⏳ callout was replaced with the ✅ RESOLVED box; no thesis or title change was required.