Palo Alto Networks
Palo Alto Networks offers a portfolio covering assessing cloud exposure or protecting running workloads, endpoint protection and incident investigation, collecting and analyzing security-relevant events, managing protected keys, certificates or signing operations, applying access policy to users, applications or traffic, assessing or protecting AI models, applications or agents, applying policy to business browsing and application access and investigating and managing cybersecurity incidents. The entries in this catalog include Cortex Cloud, Cortex XDR, Cortex XSIAM, Next-Generation Trust Security, Prisma Access and Prisma AIRS, with 2 additional product or service profiles. Cortex Cloud focuses on cloud posture management and runtime protection. Cortex XDR focuses on endpoint detection and cross-domain threat investigation. Cortex XSIAM focuses on security operations analytics and automation. When reviewing Palo Alto Networks, compare the named products individually: a platform family, a specific module and a managed service can have different scopes and purchasing requirements. Selection should account for cloud permissions required for onboarding, the assets assessed, runtime coverage and how findings reach remediation owners. Portfolio detail - Cortex Cloud: the catalog lists Cloud security posture management, Cloud workload protection, Cloud entitlement analysis. - Cortex XDR: the catalog lists Threat hunting, Attack timeline analysis, Malware prevention. - Cortex XSIAM: the catalog lists Event correlation, Detection rules and analytics, Threat hunting. - Next-Generation Trust Security: the catalog lists Certificate lifecycle management, Certificate discovery, Public key infrastructure services. - Prisma Access: the catalog lists Zero trust network access, Cloud access security broker, Data loss prevention controls. - Prisma AIRS: the catalog lists AI application protection, Model security assessment, Prompt-related threat assessment. - Prisma Browser: the catalog lists Enterprise browsing policies, Browser data protection, Identity-aware application access. - Unit 42 Incident Response: the catalog lists Incident investigation, Containment planning, Recovery assistance. For procurement, map each required capability to a named offering and confirm the edition, dependencies and delivery responsibility with the vendor. Product-level entries below provide the operational context and evaluation questions for that comparison.
Documented Software Products (10)
Palo Alto Networks Cortex XDR
Extended detection and response platform integrating endpoint telemetry with network firewalls and cloud data for unified incident analysis.
Palo Alto Networks Prisma Cloud
Comprehensive CNAPP platform providing security across the entire application lifecycle, from code and build to runtime protection.
Palo Alto Networks Prisma Access
Cloud-delivered Security Service Edge (SSE) and SASE solution protecting remote workforces and branch offices with Zero Trust network access.
Cortex Cloud
Cortex Cloud from Palo Alto Networks focuses on cloud posture management and runtime protection. It is cloud security technology used for assessing cloud exposure or protecting running workloads. Capabilities - Cloud security posture management: Finds cloud configuration risks so teams can prioritize corrections across connected environments. - Cloud workload protection: Focuses on protecting workloads running in the cloud rather than only inspecting account configuration. - Cloud entitlement analysis: Examines cloud permissions to identify overly broad or risky access. - Runtime threat detection: Uses activity from running workloads to identify or respond to active threats. - Vulnerability prioritization: Helps order remediation work using the risk context available in the platform. - Cloud detection and response: Supports investigation and response for suspicious activity in cloud environments. Use and operational context Cortex Cloud is relevant to cloud and security teams working across accounts and workloads when the requirement centers on assessing cloud exposure or protecting running workloads. Scope the evaluation around the functions listed above and the assets or workflows that need coverage. A useful trial should use representative business conditions so the team can assess the quality of the results and the effort needed to act on them. Deployment and evaluation Deployment: Cloud service / SaaS. Before adoption, review cloud permissions required for onboarding, the assets assessed, runtime coverage and how findings reach remediation owners. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? Cortex Cloud focuses on assessing cloud exposure or protecting running workloads. - What should a proof of concept establish? Test the listed capabilities against representative assets and workflows, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
Cortex XDR
Cortex XDR from Palo Alto Networks focuses on endpoint detection and cross-domain threat investigation. It is endpoint security software used for endpoint protection and incident investigation. Capabilities - Threat hunting: Supports searching endpoint activity for suspicious patterns that warrant deeper investigation. - Attack timeline analysis: Organizes related activity into a sequence that supports understanding how an incident unfolded. - Malware prevention: Provides controls intended to detect or block malicious files and execution. - Policy management: Lets administrators apply protection settings to groups of managed endpoints. - Cloud workload protection: Extends the documented protection scope beyond employee workstations to cloud-hosted workloads. - Managed detection support: Can be evaluated alongside the vendor's managed service for organizations requiring analyst assistance. Use and operational context Cortex XDR is relevant to security teams administering employee devices or servers when the requirement centers on endpoint protection and incident investigation. Scope the evaluation around the functions listed above and the assets or workflows that need coverage. A useful trial should use representative business conditions so the team can assess the quality of the results and the effort needed to act on them. Deployment and evaluation Deployment: Cloud service / SaaS. Before adoption, review agent compatibility, policy tuning, alert investigation and the response actions available in the selected edition. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? Cortex XDR focuses on endpoint protection and incident investigation. - What should a proof of concept establish? Test the listed capabilities against representative assets and workflows, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
Cortex XSIAM
Cortex XSIAM from Palo Alto Networks focuses on security operations analytics and automation. It is security analytics technology used for collecting and analyzing security-relevant events. Capabilities - Event correlation: Connects related observations so analysts can investigate a potential incident in context. - Detection rules and analytics: Supports defining or maintaining the logic used to identify suspicious activity. - Threat hunting: Lets analysts investigate hypotheses across the security data available in the platform. - Incident investigation: Organizes evidence and investigative activity around incidents or cases. - Response automation: Connects detection and investigation with the automated actions documented for the offering. Use and operational context Cortex XSIAM is relevant to security operations teams investigating alerts and incidents when the requirement centers on collecting and analyzing security-relevant events. Scope the evaluation around the functions listed above and the assets or workflows that need coverage. A useful trial should use representative business conditions so the team can assess the quality of the results and the effort needed to act on them. Deployment and evaluation Deployment: Cloud service / SaaS. Before adoption, review source onboarding, detection content, query performance, data retention and the cost implications of event volume. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? Cortex XSIAM focuses on collecting and analyzing security-relevant events. - What should a proof of concept establish? Test the listed capabilities against representative assets and workflows, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
Next-Generation Trust Security
Next-Generation Trust Security from Palo Alto Networks focuses on TLS certificate discovery and lifecycle management. It is machine trust and certificate management technology used for discovering certificates and coordinating their lifecycle. Capabilities - Certificate lifecycle management: Coordinates certificate discovery, issuance, renewal or retirement within the documented management scope. - Certificate discovery: Builds visibility into certificates or cryptographic assets before lifecycle policies are applied. - Public key infrastructure services: Supports certificate issuance and trust infrastructure within the vendor's product scope. - Code signing workflows: Supports signing software or artifacts using the product's documented key access and policy model. - Certificate automation: Helps reduce repetitive certificate handling through the automation mechanisms described by the vendor. Use and operational context Next-Generation Trust Security is relevant to teams managing machine identities and certificate operations when the requirement centers on discovering certificates and coordinating their lifecycle. Scope the evaluation around the functions listed above and the assets or workflows that need coverage. A useful trial should use representative business conditions so the team can assess the quality of the results and the effort needed to act on them. Deployment and evaluation Deployment: Cloud service / SaaS; Self-managed / on-premises option documented by the vendor. Before adoption, review certificate discovery, supported issuance integrations, renewal policy and recovery procedures for trust infrastructure. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? Next-Generation Trust Security focuses on discovering certificates and coordinating their lifecycle. - What should a proof of concept establish? Test the listed capabilities against representative assets and workflows, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
Prisma Access
Prisma Access from Palo Alto Networks focuses on cloud-delivered secure access and zero trust access. It is secure access and networking technology used for applying access policy to users, applications or traffic. Capabilities - Zero trust network access: Grants access to the applications or resources defined by policy rather than relying solely on network location. - Cloud access security broker: Provides policy and visibility for the cloud application interactions covered by the product. - Data loss prevention controls: Adds sensitive-data policy enforcement to the access or traffic protection workflow. - Private application access: Connects authorized users to private applications according to access policy. - Remote workforce access: Addresses secure connectivity for users working beyond a traditional office network. - WAN connectivity integration: Combines access security with the networking functions documented for the platform. - User experience monitoring: Helps investigate connectivity and application experience rather than only security alerts. Use and operational context Prisma Access is relevant to teams supporting distributed users and application access when the requirement centers on applying access policy to users, applications or traffic. Scope the evaluation around the functions listed above and the assets or workflows that need coverage. A useful trial should use representative business conditions so the team can assess the quality of the results and the effort needed to act on them. Deployment and evaluation Deployment: Cloud service / SaaS. Before adoption, review identity integration, application reachability, traffic routing and the user experience during a staged rollout. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? Prisma Access focuses on applying access policy to users, applications or traffic. - What should a proof of concept establish? Test the listed capabilities against representative assets and workflows, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
Prisma AIRS
Prisma AIRS from Palo Alto Networks focuses on AI application protection and model security assessment. It is AI security technology used for assessing or protecting AI models, applications or agents. Capabilities - AI application protection: Addresses the documented security controls for applications using AI models or agents. - Model security assessment: Brings the documented model risks or testing activities into the AI security review process. - Prompt-related threat assessment: Examines the prompt-related attack scope described by the product. - AI asset discovery: Helps establish the AI assets included in the documented assessment scope. Use and operational context Prisma AIRS is relevant to teams deploying AI-enabled business services when the requirement centers on assessing or protecting AI models, applications or agents. Scope the evaluation around the functions listed above and the assets or workflows that need coverage. A useful trial should use representative business conditions so the team can assess the quality of the results and the effort needed to act on them. Deployment and evaluation Deployment: Self-managed / on-premises option documented by the vendor. Before adoption, review the AI assets in scope, model or application integrations, documented attack coverage and the interpretation of assessment findings. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? Prisma AIRS focuses on assessing or protecting AI models, applications or agents. - What should a proof of concept establish? Test the listed capabilities against representative assets and workflows, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
Prisma Browser
Prisma Browser from Palo Alto Networks focuses on enterprise browser controls and application access. It is enterprise browser technology used for applying security controls to browser-based application use. Capabilities - Enterprise browsing policies: Applies the documented browser controls to supported work sessions and applications. - Browser data protection: Addresses the data-handling controls included in the browser offering. - Identity-aware application access: Connects browser access with the identities or policies covered by the product. - Browser isolation: Uses the isolation approach documented for protecting browsing activity. - Unmanaged device access: Addresses access from personal or unmanaged devices within the supported deployment model. - Browser activity visibility: Provides records or visibility into the browsing activity covered by the product. Use and operational context Prisma Browser addresses enterprise application use through a managed browsing environment. Assess the browser's access and data-handling policies against real work sessions, including the identity integration and device conditions relevant to the organization's users. Deployment and evaluation Deployment: Cloud service / SaaS. Before adoption, review application compatibility, identity integration, browser controls and usability on the devices in scope. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? Prisma Browser focuses on applying security controls to browser-based application use. - What should a proof of concept establish? Test the listed capabilities against representative assets and workflows, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
Official Product Demos & Technical Videos (2)
Verified product demonstrations, architecture walkthroughs, and technical overviews direct from Palo Alto Networks.
XDR 5.0: Enter the Era of Modern Endpoint Security with AgentiX and Exposure Management
