Overview
Palo Alto Networks operates three security platforms: Strata (network security and next-gen firewalls), Prisma (cloud and SASE), and Cortex (XDR, XSOAR, XSIAM). The company's stated strategy is platformisation — bundling these three platforms and discouraging customers from running competing point products. Net new ARR from platform deals has been the focal point of investor communications since 2024.
Palo Alto's PA-Series next-generation firewalls remain the reference architecture in many large enterprise networks. Cortex XSIAM has emerged as a credible challenger to Splunk and Microsoft Sentinel in the SIEM space. Buyers should weigh platformisation discounts against the lock-in implications, particularly given Palo Alto's premium pricing posture and aggressive renewal behaviour.
The 2024 acquisition of QRadar SaaS assets from IBM and the continued maturation of Cortex XSIAM mean Palo Alto is making a serious bid to displace Splunk in the SIEM segment. Buyers evaluating the broader platform investment should validate XSIAM detection content and integration with non-Palo-Alto data sources during proof-of-concept work.
Key Features
- PA-Series and VM-Series next-generation firewalls
- Prisma Access SASE with global PoPs
- Prisma SD-WAN (formerly CloudGenix)
- Prisma Cloud (CWPP, CSPM, CIEM, code security)
- Cortex XDR cross-domain detection and response
- Cortex XSIAM next-generation SIEM
- Cortex XSOAR security orchestration and automation
- URL Filtering, Threat Prevention, WildFire malware analysis subscriptions
- GlobalProtect endpoint VPN/ZTNA agent
- Panorama centralised firewall management
- Unit 42 threat intelligence and incident response services
- AI Access Security for monitoring SaaS GenAI usage
Pricing
| Edition | Model | Typical Cost |
|---|---|---|
| PA-Series hardware NGFW | Capex + subscriptions | $5K–500K+ per appliance |
| VM-Series virtual NGFW | Per CPU/year | $1.5K–25K/CPU/year |
| Prisma Access SASE | Per user/year | $200–600/user/year |
| Cortex XSIAM | Per GB/day | Quote required |
Pricing verified May 2026. Platform bundle discounts often exceed 40% on multi-product deals. Subscription stacking (Threat Prevention + WildFire + URL Filtering) is standard.
Strengths
- Industry-leading next-generation firewall capability and visibility
- Broad platform coverage across network, cloud, and endpoint
- Strong threat intelligence via Unit 42 research team
- Cortex XSIAM is a genuine technical innovation in SIEM
- Mature global support and large partner ecosystem
Limitations
- Premium pricing — typically the most expensive option in any category
- Platformisation strategy creates lock-in risk; exit is costly
- Subscription stacking on top of hardware leads to unpredictable TCO
- Operational complexity is high — adequate staffing is essential
- Renewal negotiations are aggressive and audit-driven
Buyer Considerations
The platformisation decision is fundamentally a multi-year lock-in versus best-of-breed cost trade-off. Bundle discounts of 40%+ are real but exit costs three years later can erase the savings if business circumstances change. The most successful Palo Alto enterprise deployments scope the platform commitment to specific business outcomes (e.g., MPLS retirement, SOC consolidation) with clear measurement criteria rather than open-ended technology investment.