Key Highlights

  • The 52-week range runs from US$20.39 to US$45.28. The latest news is operational.
  • For fiscal 2026, the year, revenue was US$859.5m, up 4.5% on US$822.7m.
  • Against about 71.5m shares outstanding at the 10-K cover date, US$705.1m of cash and securities is roughly US$9.86 a share of the US$40.04 price, with no drawn debt.
  • Disclosure is thin where it matters most. With one reportable segment, investors cannot verify from the filings how fast Arbor is growing.

Why the market is paying attention

That capitalises the Westford, Massachusetts network-monitoring and cybersecurity group at about US$2.91bn on aggregated market data figures. The 52-week range runs from US$20.39 to US$45.28.

The latest news is operational. On 24 July NETSCOUT (NASDAQ:NTCT) said it had doubled the capacity of Arbor Cloud, its managed 'scrubbing' service, which absorbs hostile traffic before it reaches a customer's network, to 33 terabits per second across 16 global centres, citing mega-botnets and threat actors using AI.

First-quarter fiscal 2027 results, covering the June quarter, are due on 6 August: the first real test of whether that backdrop is converting into orders.

What the company does

NETSCOUT sells two product families built on deep packet inspection, which reads network traffic in flight and turns it into usable telemetry. The first is service assurance and observability, sold as nGenius and Omnis, used by carriers and enterprises to diagnose why an application or a 5G service is failing. The second is cybersecurity, sold under the Arbor name and focused on denial-of-service defence, from Sightline detection and Edge Defense appliances to Arbor Cloud.

Customers are service providers, enterprises and public sector bodies. The fiscal 2026 Form 10-K reports 2,073 employees and no customer or channel partner above 10% of revenue. The United States supplied US$474.4m of fiscal 2026 revenue, the rest of the world US$163.3m, Europe US$158.8m and Asia US$63.1m.

One caveat matters throughout: NETSCOUT reports a single operating segment, splitting revenue only by product versus service and by geography, not cybersecurity versus service assurance.

Latest financial and operating performance

For fiscal 2026, the year, revenue was US$859.5m, up 4.5% on US$822.7m. Product revenue was US$370.1m and service revenue US$489.3m, so roughly 57% of the top line is service income.

GAAP operating income was US$109.8m, a 12.8% margin, and net income US$95.5m, or US$1.30 a diluted share; fiscal 2025 is not comparable because it carried a US$427.0m goodwill impairment charge. Non-GAAP operating margin was 25.4%, non-GAAP earnings US$2.48 a share against US$2.22, and adjusted EBITDA 26.5% of revenue, up from 25.3%.

The March quarter was softer: revenue of US$203.0m against US$205.0m a year earlier, with product revenue down to US$80.7m from US$89.5m.

The balance sheet is the standout. Cash and marketable securities reached US$705.1m from US$492.5m, with nothing drawn on a US$600m revolving facility. Operating cash flow was US$294.5m against US$217.7m, per SEC XBRL data.

Deferred revenue and customer deposits totalled US$498.9m, US$330.6m of it due within twelve months, and product backlog rose to about US$50m from US$33m. Restructuring charges fell to US$0.9m from US$20.5m. Fiscal 2027 guidance is revenue of US$885m to US$915m and non-GAAP earnings of US$2.65 to US$2.80 a share.

The catalyst, and what it is actually worth

The premise behind the Arbor expansion is well evidenced by NETSCOUT's own data. Its DDoS Threat Intelligence Report of recorded more than eight million attacks across 203 countries in the second half of 2025, a 219% rise in mentions of malicious AI tools on underground forums, and peak attacks of 30 terabits per second.

Read closely, though, and the escalation is in intensity rather than count: NETSCOUT describes attack volume as steady at roughly eight million per half-year. Such a market rewards capacity, which is what 33 Tbps of headroom buys.

The financial mechanics are less dramatic. Scrubbing is sold by subscription, so it accrues through service revenue rather than as a step change in product sales. The clearest near-term contributor is an acquisition: NETSCOUT closed the purchase of DigiCert, Inc.'s DDoS protection assets, worth about US$20m annualised. Guidance implies roughly US$40.5m of extra revenue at the midpoint, so about half the growth is bought, not organic.

The bull case

The valuation case rests on cash. Against about 71.5m shares outstanding at the 10-K cover date, US$705.1m of cash and securities is roughly US$9.86 a share of the US$40.04 price, with no drawn debt. Excluding it, the business trades at a little over eleven times the midpoint of non-GAAP guidance.

Profitability is improving: non-GAAP operating margin of 25.4% and an adjusted EBITDA margin of 26.5% both rose, and cash generation of US$294.5m was more than three times GAAP net income. Deferred revenue is up about 11%, fulfillable backlog has climbed to US$45.8m from US$25.1m, and 20.5m shares of buyback authority remain.

The bear case and the risks

Disclosure is thin where it matters most. With one reportable segment, investors cannot verify from the filings how fast Arbor is growing. Chief executive Anil Singhal's statement that fiscal 2026 growth came from both cybersecurity and service assurance is not accompanied by numbers.

Product revenue was falling at year end. Fourth-quarter product revenue dropped almost 10% year on year and total revenue slipped. The 10-K notes sales cycles of three to twelve months, so a few delayed carrier or government orders can move a quarter.

Industry concentration cuts both ways. The risk factors name financial services, the public sector, healthcare and the service provider market as concentrated exposures, and warn that shutdowns, continuing resolutions and sequestration can delay procurements and payments. The United States alone was 55% of fiscal 2026 revenue.

NETSCOUT also dismissed PricewaterhouseCoopers LLP and engaged KPMG LLP for fiscal 2027, reporting no disagreements or reportable events. And the gap between GAAP operating income of US$109.8m and US$218.5m non-GAAP is wide, so the forward multiple depends on which measure you accept.

What investors should watch next

6 August. First-quarter fiscal 2027 results, and whether the US$885m to US$915m revenue range moves.

Product revenue and backlog. A second consecutive year-on-year decline would suggest the backlog build was timing rather than demand.

Deferred revenue. Growth above the US$330.6m current balance is the cleanest available proxy for Arbor Cloud traction.

Buyback pace. With US$705.1m of net cash and 20.5m shares authorised, repurchases near US$40 would signal how management views the valuation.

The next threat report. The half-yearly telemetry for the first half of 2026 will show whether attack volumes have left their plateau.

Investor takeaway

The headline premise holds only partly. NETSCOUT's telemetry does show attackers adopting AI tooling and peak attacks reaching 30 terabits per second, and the company has answered by doubling Arbor Cloud capacity. What the filings do not yet show is faster growth: revenue rose 4.5% in fiscal 2026 and is guided up 4.7% at the midpoint, roughly half of that from acquired assets.

What has clearly improved is the financial base, US$705.1m of cash, no drawn debt, US$294.5m of operating cash flow and non-GAAP margins above 25%. The 6 August result will indicate whether the market is paying for a security growth story or a cash-rich infrastructure supplier. This article is information only, not a recommendation.

This article is for informational purposes only and does not constitute investment advice or a recommendation to buy, sell, or hold any security. Share prices can rise or fall, and past performance does not guarantee future results. Investors should conduct independent research and consult a licensed financial adviser before making investment decisions.