Palo Alto Networks Courted Datadog and Okta, Then Paid $3.35B for Chronosphere Instead

$3.35 billion is what Palo Alto Networks agreed to pay for Chronosphere in July 2025, closing the deal in January 2026 — but only after CEO Nikesh Arora had already been turned down twice on far bigger targets: Datadog and Okta.

Neither of those bigger deals ever happened. Arora spent 2024 and 2025 quietly testing whether Okta and Datadog would sell, and both effectively said no — one over price, one because its CEO wasn't interested at all. So Palo Alto pivoted to buying a smaller, VC-backed rival instead, and Chronosphere's investors walked away with roughly 2x their last private mark on a company that had raised only $343 million. Here's the full sequence, what each side's numbers actually say, and why Palo Alto hasn't stopped shopping since.

Palo Alto Networks and Datadog: the deal that never happened

In spring 2025, Arora approached Datadog CEO Olivier Pomel about a hypothetical combination, at a moment when Datadog already carried a public market valuation above $40 billion. Pomel wasn't interested in pursuing it, and no formal offer was ever put on the table, according to reporting that surfaced the talks months later. That single conversation is now the whole story: there was no bidding war, no leaked term sheet, just a CEO-to-CEO feeler that went nowhere.

The timing looks worse for Palo Alto with every quarter that passes. Datadog's market cap has since climbed to roughly $85 billion — more than double what it was worth when Arora made his approach — on the back of revenue that grew 32% year-over-year in its most recent quarter. Whatever price might have worked in spring 2025 is not remotely on the table anymore, and Datadog has no obvious reason to reopen a conversation it already walked away from once.

Okta's talks stalled on price, not interest

The Okta conversation ran longer and got further. Arora and Okta CEO Todd McKinnon met repeatedly between late 2024 and early 2025, reportedly discussing real product complementarity between Palo Alto's platform and Okta's identity business before the talks stalled over price disagreements — not over whether the companies fit together strategically. That distinction matters: Okta's board apparently believed its stock was worth more than Palo Alto was willing to pay at the time.

Okta's subsequent run makes that stance look reasonable in hindsight. Its market cap has gone from about $15.05 billion at the end of January 2025 to roughly $28.31 billion as of September 4, 2026 — up more than 80% in about 19 months, fueled by strong fiscal results and a bullish read on its AI-driven identity products. Identity security is also the exact category Palo Alto ended up buying anyway, just from a different company: it agreed to pay $25 billion for CyberArk in July 2025, closing that deal on February 11, 2026 at $45 in cash plus 2.2005 Palo Alto shares per CyberArk share, a 26% premium to CyberArk's trailing 10-day average price.

Why Chronosphere ended up as the consolation prize

Chronosphere, founded in 2019, sells observability software that helps enterprises control the volume and cost of telemetry data — logs, metrics, and traces — thrown off by modern cloud systems, a smaller and more specialized rival to Datadog's monitoring business. It raised roughly $343 million in venture funding across rounds backed by Greylock (its first investor, in the 2019 Series A), Founders Fund, General Atlantic, Addition, Glynn Capital, Lux Capital, and GV, reaching a $1.6 billion valuation in a $115 million Series C extension in January 2023.

Palo Alto announced its intent to acquire Chronosphere for $3.35 billion in July 2025 and closed the deal on January 29, 2026, folding it into Cortex as an observability layer meant to sit alongside — rather than replace — Palo Alto's existing security tooling. At $3.35 billion, that's roughly 2.1x Chronosphere's last private mark and about 9.8x its total lifetime funding, a strong outcome for a company that never got to test the public markets or a Datadog-scale price tag, but a very good one for its Series A through C investors regardless.

Strategically, the pitch was straightforward: Chronosphere's whole product exists to cut the cost and volume of telemetry data before it ever reaches a monitoring or security tool, which is exactly the kind of AI-era data-management problem Palo Alto has been buying its way into all year rather than building from scratch. Chronosphere never disclosed customer counts or ARR publicly, so unlike the Wiz-Google deal — where Google was buying a company already past $1 billion in ARR — Palo Alto's price here has to be read as a bet on a smaller company's technology and team fitting into a much larger platform, not a bet on standalone revenue scale.

What this means for VC-backed security and observability startups

Chronosphere's 2.1x-on-last-mark, 9.8x-on-capital-raised outcome is a useful data point for any fund still holding a position in a well-capitalized, mid-scale infrastructure or security startup that never got a shot at going public. It's not a home-run multiple in the SpaceX or Wiz sense, but it's a real, cash-and-stock exit for a company sitting several tiers below category-leader scale — proof that "sell to the platform vendor that got turned down by the category leader" is a legitimate path to liquidity, not just a consolation prize in name only.

Founders Fund, Greylock, General Atlantic, and the rest of Chronosphere's cap table now book a realized return years earlier than an IPO would have delivered one, at a moment when the IPO window for mid-scale infrastructure companies remains narrow and unpredictable. For LPs evaluating a fund's marks on similar positions, Chronosphere is a reminder to price "second-place, well-funded challenger in a hot category" companies for a strategic acquisition outcome in the $2–4 billion range, not for a Datadog-scale public multiple that only the actual category leader is positioned to command.

Palo Alto's buying spree: at least seven deals in 2026

Chronosphere wasn't a one-off. Palo Alto Networks made at least seven acquisitions in 2026 alone, per PitchBook data cited in TechCrunch's reporting on its most recent purchase: Console, a two-year-old AI help-desk automation startup backed by Thrive Capital and DST Global, which TechCrunch reported — citing sources, since Palo Alto's own release didn't disclose terms — sold for about $500 million against a prior PitchBook valuation of $157 million, a roughly 3.2x markup for its backers on just $29 million raised.

The rest of the list: CyberArk ($25 billion, closed February 11), Koi (roughly $400 million, an Israeli agentic-endpoint-security startup that had raised only $48 million, closed April 14), and Portkey (an AI gateway startup, terms undisclosed, closed May 29). Combined disclosed spending across the four deals with published prices already exceeds $29 billion for the year — and that's before whatever undisclosed amount Portkey cost.

Deal values and dates compiled from Palo Alto Networks press releases, SEC filings, TechCrunch, and investing.com reporting on the Datadog/Okta talks. Portkey's price was not disclosed by either party.

The market's read on the spending

Palo Alto reported fiscal year 2026 revenue of $11.5 billion, up 24% year-over-year, with Next-Generation Security ARR at $9.1 billion (up 63%) and remaining performance obligations of $21.2 billion (up 34%) when it posted fiscal fourth-quarter results on September 1, 2026 — the same week it announced the Console deal. Both headline numbers beat analyst estimates. The stock still fell roughly 5% that session (and dipped further after hours), which several outlets attributed to investor unease over the pace of acquisition spending and the integration risk that comes with digesting seven companies in one year.

One read on this: investors seem comfortable with Palo Alto buying category leaders like CyberArk at full price, but are more skeptical of a scattershot approach across smaller agentic-security startups (Koi, Portkey, Console) layered on top of two mega-deals in the same twelve months — a lot of integration work to land at once, regardless of how sound any individual acquisition looks on paper.

Palo Alto isn't the first cybersecurity vendor to run this playbook, and the comparison is instructive. Cisco built its 2000s-era networking dominance largely through acquisition, and Broadcom's post-VMware roll-up strategy has drawn similar "can they actually integrate all of this" skepticism from public investors even as revenue kept climbing. The pattern in both cases: the stock takes a near-term hit on integration-risk concerns, then re-rates upward if — and only if — the acquired products actually get sold into the existing customer base rather than sitting alongside it unintegrated. Palo Alto's next two or three quarters of Next-Generation Security ARR growth will show which outcome this round of deals produces.

What the headline misses

The $3.35 billion figure attached to Chronosphere is the announced deal value from July 2025, not the number Palo Alto actually booked. Its SEC filings show the purchase consideration recorded at close was closer to $2.95 billion — $2.842 billion in cash plus $109 million in replacement equity awards — a reminder that headline M&A prices and GAAP purchase-price accounting routinely diverge, sometimes by hundreds of millions of dollars, depending on how unvested equity is valued between signing and close.

It's also worth being skeptical of the "rejected by Datadog and Okta" framing itself. Both companies turning down informal approaches is not the same as Palo Alto losing a competitive process — there's no evidence either deal ever reached a term sheet, a price, or a board vote. It's just as plausible to read this as Palo Alto testing the market cheaply through casual conversations, learning what it would cost, and rationally deciding CyberArk and Chronosphere were better uses of capital than overpaying for Datadog or Okta at their asking prices.

One more caveat: none of the Datadog or Okta talk details come from either company's own public disclosures — Datadog and Okta are both public companies subject to SEC reporting, and neither has confirmed the specifics of these conversations in a filing. The account here rests on reporting that surfaced after the fact, not on-the-record statements from Pomel, McKinnon, or Arora. That doesn't make it unreliable, but it does mean the exact dollar figures Palo Alto may have floated informally were never confirmed by any of the three companies involved.