CHKP · Research
Check Point Says Revenue Hit Bottom at $670M. Subscriptions Grow 11%, the Appliance Base Shrinks Faster, and Buybacks Ran at 156% of Owner Cash
Third quarter revenue fell 1.1% as firewall refreshes dried up, the fourth quarter outlook is flat at the midpoint, and owner cash of $896.0M still trails the $1.40B the company spent on its own stock.
Spreadsheet & IC Deliverables: Download the formula-linked CHKP 5-tab Excel (.xlsx) workbook and printable 1-page tearsheet.
Download CHKP .xlsx →- Cash left for shareholders after all capex and stock pay
- $896M
- Share buybacks
- $1.4B
- Revenue growth
- -1.1%
1. Verdict and what this piece answers
Verdict: Hold off, conviction 3 of 5. Check Point is the opposite of the other security names we covered this week. Cloudflare, Zscaler and SentinelOne grow fast and have never paid their owners.
Check Point pays its owners close to a billion dollars a year and has stopped growing. Owner cash, meaning operating cash flow of $1,156.6M less $33.7M of equipment and capitalized software, less $226.9M of stock pay, was $896.0M for the twelve months ended Sep 30, 2026, our calculation [3][9][14].
It has been positive in every year we can see, between $874.0M and $967.2M from 2022 to 2025 [9].
The problem is the top line. Revenue fell 1.1% in the third quarter to $669.8M, after gains of 4.8% and 1.3% in the first two quarters, as product sales fell 19.1% and maintenance fell 6.6% [2][3][14].
The chief executive now calls the third quarter the trough and says the recovery is taking longer than expected [14]. The fourth quarter outlook, given on the call, is $720M to $770M, flat at the midpoint [15]
2. Rating metrics
| Metric | Value |
|---|---|
| R&D share of revenue | 16.8%, research and development expense of $456.7M on $2,725.4M of revenue, fiscal 2025, our calculation [9]. The first nine months of 2026 show 17.1%, but that is after $80M of Israeli research grants booked as a reduction of the expense; before the grants it was 21.1%, our calculation [14] |
| GAAP net margin | 38.8%, net income of $1,056.9M on $2,725.4M of revenue, fiscal 2025, flattered by a one-time tax benefit in the third quarter of 2025 [9][14]. First nine months of 2026: 28.4%, net income of $570.6M on $2,011.8M [14]. Financial income of $123.8M in the nine months, earned on corporate cash, adds about 6 points; the research grants add about 4 points before tax, our calculation [14] |
| API quality | 4 of 5, our scoring: a documented management REST API, tool integrations and public MCP servers for outside agent clients, software kits in more than one language with release notes, and a large partner ecosystem [1][13]. Public pricing is the missing point: Check Point sells mainly through distributors and resellers and does not publish a usable price list [1] |
| Toll-gate score | 2 of 4 pass, 2 partial (section 2b), the best among the security names we have covered |
2b. Thesis and the toll-gate test
Gil Shwed is considered the inventor of the modern firewall, and the company he founded in 1993 still makes most of its money from that idea [1]. Check Point sells security gateways, hardware and software that sit between a network and the outside world, inspecting traffic and blocking threats, plus the subscriptions that keep those gateways current and the management software that sets their rules [1].
The 20-F describes four pillars today: network security across data centers, branches and clouds; workspace security for email, endpoints, browsers and mobile devices; exposure management; and security for models and agents [1].
The bet is that agents create more traffic, and that traffic still has to pass a gateway. An agent calling outside models, pulling data from software tools and acting on a company's systems produces network flows that someone must inspect and govern.
Check Point's answer is a firewall release, R82.20 from July 2026, that inspects model traffic, protects model-based applications and helps govern agents at the network layer [11]. If enterprises route agent traffic through the gateway they already own, Check Point collects.
| Test | Result | Evidence |
|---|---|---|
| Owns the record | Partial | Check Point holds each customer's security policy, the rule base that decides what traffic is allowed, and its ThreatCloud intelligence service feeds every gateway [1]. Policy is hard to migrate, which is why the new subscription offer includes credits to move rules off another vendor's firewall [11]. But the asset and identity records belong to others, and the 20-F names Palo Alto Networks, Fortinet, Cisco and Zscaler as direct competitors for the same customers [1] |
| Owns the connection | Pass | Gateways sit inline on traffic at more than 100,000 organizations, and nothing reaches the network without passing them [1][7]. R82.20 extends that inline position to model and agent traffic [11]. |
| Prices close to outcomes | Partial | Revenue comes from appliances and licenses, security subscriptions and maintenance [1]. The new Firewall-as-a-Subscription, available Nov 1, 2026, sizes and prices gateways on threat prevention throughput, so more agent traffic means a bigger bill [11]. That is better than a per-seat price, but nothing ties price to attacks blocked or agents governed |
| R&D on the gate vs features | Pass | The four deals since mid-2025 all target the gate: Lakera for protecting agent applications from prompt injection and data leakage, Cyata for discovering and governing autonomous agents, Veriti and Cyclops for exposure management [1]. R82.20 brings agent governance into the firewall itself [11]. The weak point is the level of spending: 16.8% of revenue is low for a security vendor [9] |
3. Growth
| Measure | Value | Change |
|---|---|---|
| Fiscal 2023 revenue | $2,414.7M | +3.6% [9] |
| Fiscal 2024 revenue | $2,565.0M | +6.2% [9] |
| Fiscal 2025 revenue | $2,725.4M | +6.3% [9] |
| Twelve months ended Sep 30, 2026 | $2,756.7M | Our calculation [9][14] |
| First nine months of 2026 | $2,011.8M | +1.6% [14] |
| Q1 2026 revenue | $668.4M | +4.8% [2] |
| Q2 2026 revenue | $673.6M | +1.3% [3] |
| Q3 2026 revenue | $669.8M | -1.1% [14] |
| Q3 2026 security subscriptions | $338.6M | +10.9% [14] |
| Q3 2026 products and licenses | $105.5M | -19.1% [14] |
| Q3 2026 software updates, maintenance and services | $225.7M | -6.6% [14] |
| Q4 2026 revenue outlook | $720M to $770M | -3.3% to +3.4% against $744.9M a year earlier, our calculation [9][14][15] |
| Fiscal 2026 revenue outlook | $2,732M to $2,782M | +0.2% to +2.1% against fiscal 2025, our calculation [9][15] |
The mix tells the story. Security subscriptions, the threat prevention, email, browser, access and exposure services that ride on top of the gateways, grew 10.9% in the third quarter and passed half of revenue for the first time, at 50.6%, our calculation [14].
Everything else is shrinking, and faster than before. Appliance sales fell 19.1% in the third quarter and 12.4% over nine months, and the finance chief tied the drop to fewer firewall refresh projects, which also cut attached support and professional services [14][15].
Maintenance, which follows the installed base of appliances, fell 6.6%, from a 3.3% decline in the second quarter [3][14].
The outlook, given on the call and not furnished on Form 6-K, is $720M to $770M of fourth quarter revenue and $351M to $362M of fourth quarter subscriptions, which would be growth of 8.0% to 11.4% against $325.1M a year earlier, our calculation
4. New products and shipping pace
Since Nadav Zafrir became chief executive in December 2024, Check Point has bought five companies or teams and reorganized its product line around four pillars [1]. The 20-F describes the exposure management pillar as the combination of Cyberint, bought in 2024, and Veriti, bought in 2025, which together merge threat intelligence, dark web monitoring, attack surface discovery and automated fixes across other vendors' tools [1].
Lakera, a Swiss company bought in October 2025, protects applications built on language models from prompt injection, data leakage and model manipulation [1]. In February 2026 Check Point added Cyclops, which inventories every asset across cloud, on-premises and software services, and Cyata, which discovers and governs autonomous agents [1].
The product cadence shows in two 2026 launches. In July, firewall release R82.20 introduced network-layer inspection of model traffic and agent governance [3][11].
On Oct 26, Check Point announced Firewall-as-a-Subscription: one monthly or annual payment over three years covering the hardware, the R82.20 inspection, threat prevention, live updates, cloud management with built-in agents and premium support, with throughput upgrades any time and new hardware after 36 months [11]. It answers the appliance decline by turning hardware refreshes delayed by capital budgets into an operating expense.
5. Net revenue retention
Check Point does not disclose net revenue retention, gross retention or annual recurring revenue. We use two proxies from the filings: security subscription growth, which measures how much existing and new customers add on top of their gateways, and software updates and maintenance revenue, which tracks the renewal of the installed base.
The renewal base is now shrinking; maintenance was essentially flat for three years and its decline deepened each quarter of 2026 [1][3][14]. Subscriptions keep compounding at 10% to 12%.
Read together, the proxies suggest net retention near 100% on the old base, with expansion coming almost entirely from selling subscriptions into existing gateways while fewer gateways get refreshed. That is an inference, not a disclosed figure.
6. Free cash flow and owner cash
| Period | Operating cash flow | Equipment and capitalized software | Stock pay | Owner cash |
|---|---|---|---|---|
| Fiscal 2022 | $1,098.5M | $22.1M | $131.4M | $945.0M [9] |
| Fiscal 2023 | $1,037.9M | $18.6M | $145.3M | $874.0M [9] |
| Fiscal 2024 | $1,052.4M | $24.2M | $149.7M | $878.5M [9] |
| Fiscal 2025 | $1,199.4M | $26.6M | $205.6M | $967.2M [9] |
| Twelve months ended Jun 30, 2026 | $1,132.9M | $33.2M | $234.2M | $865.5M, our calculation [2][3][9] |
| Twelve months ended Sep 30, 2026 | $1,156.6M | $33.7M | $226.9M | $896.0M, our calculation [3][9][14] |
Owner cash recovered $30.5M from the June figure but is still 7.4% below fiscal 2025, our calculation. Third quarter operating cash flow was $264.3M against $240.6M a year earlier, helped by collections, and it absorbed $10M of hedging costs against a $3M benefit a year earlier [14].
Stock pay eased in the quarter, $54.8M against $62.1M, but is still up 14.3% over nine months, $170.5M against $149.2M [14]. Stock pay took 19.6% of operating cash flow over the last twelve months, against 14.0% in 2023, our calculation [9][14].
The company's own adjusted free cash flow, which does not subtract stock pay, was $258M in the quarter, and the full year outlook is $1,136M to $1,166M [14][15].
Our standard also removes interest earned on corporate cash. Check Point earned $123.8M of financial income in the first nine months of 2026, up from $84.5M, on more than $4B of cash and securities
7. Acquisitions
| Deal | Closed | Price | What it added |
|---|---|---|---|
| Veriti Security Ltd. | June 2025 | $92.5M total consideration | Automated exposure management across other vendors' tools [1] |
| Lakera | October 2025 | $201.8M total consideration | Protection for agent and model applications [1] |
| Cyclops Security Ltd. | February 2026 | $53.7M total consideration | Asset inventory across cloud, on-premises and software services [1] |
| Cyata Security Ltd. | February 2026 | $44.0M total consideration | Discovery and governance of autonomous agents [1] |
| Rotate Ltd. team | February 2026 | Not disclosed | Talent for workspace products sold through managed service providers [1] |
The four priced deals total $392.0M, our calculation [1]. Cash paid for acquisitions, net of cash acquired, was $273.1M in 2025 and $94.4M in the first nine months of 2026, with none in the third quarter [9][14].
All were paid in cash from the balance sheet; none required new shares. None of the targets disclosed revenue, so we cannot compute a revenue multiple, and the deals are too small to move owner cash, a little over 40% of one year's owner cash in total.
Goodwill and other intangible assets were $2,186.2M at Sep 30, 2026, 29% of total assets [14].
8. Risks and catalysts
Risks. Appliance decline: product revenue fell 19.1% in the third quarter, the subscription offer may speed the fall before it helps, and the October price increase could slow refreshes further [11][14][15].
Competition: Palo Alto Networks, Fortinet, Cisco and Zscaler sell into the same budgets, and cloud-delivered access services compete with the gateway itself [1]. Security of its own products: in June 2026 Check Point disclosed a Remote Access VPN vulnerability through which it identified instances of unauthorized access to customer environments; the company said it had not determined the matter was reasonably likely to be material [5].
Stock pay: up 14.3% over nine months [14]. Israel: headquarters and most research staff are there, and the 20-F flags regional conflict as a risk [1].
Catalysts: fourth quarter results and a 2027 outlook, expected in February 2027 (unconfirmed; the 2025 results came on Feb 12, 2026, and no date has been announced); management appearances at seven investor conferences from Nov 12 to Dec 14, 2026, including the BMO, RBC, UBS and Nasdaq events (confirmed by the company) [14]; whether the price increase of Oct 4 shows up in fourth quarter product revenue (pending)
9. Valuation anchor and balance sheet
Owner cash has been positive in every year from 2022 to 2025 and over the last twelve months, so the three-year condition for a base value is met [9][14]. The anchor band is $874.0M to $967.2M of annual owner cash, with the last twelve months at $896.0M, and the clean anchor, after removing interest on corporate cash, is about $743M, our calculation.
We set the base on the band low because the trend is still down from fiscal 2025. This piece does not compare the anchor with the market value of the company.
| Item | Dec 31, 2025 | Sep 30, 2026 |
|---|---|---|
| Cash and cash equivalents | $1,800.0M | $496.0M [14] |
| Marketable securities and short-term deposits | $2,541.7M | $3,626.9M [14] |
| Convertible senior notes, net | $1,972.1M | $1,976.3M; $2,000.0M principal [14] |
| Deferred revenue, current and long-term | $2,180.4M | $1,991.6M [14] |
| Total shareholders' equity | $2,882.1M | $2,638.1M [14] |
| Treasury shares at cost | $15,555.8M | $16,482.0M [14] |
In December 2025 Check Point sold $2.0B of 0% convertible senior notes due 2030, netting about $1.8B after costs and capped calls [1][14]. At the initial conversion rate the notes convert into about 8.2M shares, our calculation, roughly 8% of the 101.4M basic shares used for third quarter earnings, before the capped calls [1][14].
Principal must be repaid in cash [1]
10. Superintelligence angle
Mixed. The tailwind: superintelligence agents generate traffic, call outside models and act on corporate systems, and all of that crosses a network that Check Point already guards.
R82.20, Lakera and Cyata put the company in a position to inspect and govern agents where they touch the network, and throughput pricing means more agent traffic should mean a bigger bill [1][11]. The threat: agents mostly reach models and software services over encrypted cloud connections that may never pass an on-premises gateway, and cloud-delivered competitors such as Zscaler and Cloudflare sit closer to that path [1].
The June VPN disclosure shows the cost when cheap, automated vulnerability hunting finds a hole in the gateway itself [5].
11. Leadership and control
Nadav Zafrir has been chief executive since December 2024, when founder Gil Shwed moved to executive chair of the board [1]. Both roles are confirmed in the 20-F, in the Sep 2, 2026 meeting results, where shareholders approved the chief executive's and the executive chair's pay as separate proposals, and in the Sep 14, 2026 board announcement, which quotes Shwed as executive chairman [1][6][7].
Zafrir co-founded Team8, a venture group that builds and backs security and data companies, and previously commanded the Israeli military intelligence technology unit 8200 [1]. Roei Golan has been chief financial officer since 2023 [1].
Nataly Kremer is chief product officer and head of research and development [1]. Sherif Seddik, president of international sales since 2023, became chief revenue officer on May 1, 2026, replacing Itai Greenberg [2].
Control is concentrated but not locked. There is one class of shares.
Shwed beneficially owned 26,492,908 shares, 25.03% of the class, at Feb 28, 2026, including options; directors and officers as a group held 25.43%
12. Questions for the owner and predictions
Questions for the owner. First, how much of 2026 revenue is from agent and model security products, and is it priced by throughput, by agent or by outcome?
Second, why did buybacks run at 156% of owner cash in a year when revenue turned down, and will the pace continue with $2.0B of notes outstanding and option proceeds falling? Third, how much of the fourth quarter outlook depends on the Oct 4 price increase rather than more units?
Fourth, conviction on a 1 to 5 scale: our view is 3. The gate and the cash are real, but revenue is shrinking, owner cash is below its 2025 level and the turnaround is unproven.
Scoring of the Oct 31 predictions at the third quarter print: revenue landed inside the $655M to $685M outlook at $669.8M (hit); security subscriptions grew 10% or more, at 10.9% (hit); product revenue declined again, by 19.1% (hit) [14]. Still open: twelve-month owner cash at Dec 31, 2026 below $900M, and fiscal 2026 revenue growth below 4%.
New predictions to register: fourth quarter 2026 revenue lands inside the $720M to $770M outlook (70%); fourth quarter security subscriptions grow 9% or more (65%); fourth quarter product revenue declines again year on year (55%); fiscal 2026 revenue growth is below 4% (90%, raised from 70%); twelve-month owner cash at Dec 31, 2026 is below $900M (50%, cut from 65%).
Data gaps and filing notes. This piece is built on the 20-F and the first, second and third quarter 6-Ks.
The fourth quarter and full year outlook comes from two secondary accounts of the call because the company did not furnish it on Form 6-K [15][16]. The first quarter 6-K showed operating cash flow of $445.3M with no capitalized software, but the second quarter 6-K shows six-month operating cash flow of $616.7M and $3.6M of capitalized software, which implies first quarter operating cash flow of $447.1M and $1.8M of capitalized software moved into investing, a restatement the company did not explain
Stock Profiles & Comparable Companies
CHKP Stock Profile →Related Coverage & Peer Deep-Dives
View All →Fortinet Owns the Gate Every Packet Crosses and Keeps Most of the Toll
Fortinet's cash left for shareholders reached $3,126.9M over twelve months, but a hardware surge and a rising inventory pile need watching.