Palo Alto Networks wants fewer tools on your security bill

A security team can buy another tool in an afternoon and spend years making it cooperate with the others. Alerts arrive in different formats. Analysts shuttle between consoles. Someone becomes the unofficial translator for software that was supposed to make work easier. Palo Alto Networks has built its current sales argument around that person: give them fewer systems to stitch together, and more time to investigate an actual attack.

The business listed here as Alto is Palo Alto Networks’ UK operation, part of the American cybersecurity group. Its products protect company networks, remote workers, cloud applications and increasingly the identities and AI agents moving among them. This is enterprise infrastructure: the machinery behind the employee login and the team called when something goes wrong.

Its campaign to consolidate that machinery has a name, “platformization.” The word will not win a poetry prize. The proposition deserves attention. Palo Alto wants customers to replace collections of security products with connected platforms, while giving the supplier a larger role in the security budget. The important question is how much operational work disappears along with the old contracts.

A dozen ideas, then one firewall

The company’s origin involved more narrowing than its present catalogue suggests. In Sequoia’s account, co-founders Nir Zuk and Rajiv Batra spent much of 2005 refining their idea. Zuk met more than 50 enterprises. Investors pushed for one clear entry point; he had arrived with about a dozen possibilities. The first firewall shipped in 2007, and the group went public in 2012.

Zuk’s competitive instincts were less restrained. Sequoia recalls his BMW carrying the plate CHKPKLR, a jab at incumbent Check Point. Customer conversations supplied the discipline behind the provocation. The useful lesson for another founder is the sequence: find the specific buying problem before trying to sell the whole vision.

The catalogue follows the attack

Today, a firewall is one part of a much broader purchase. Hardware and software firewalls control network traffic. Prisma SASE combines networking and cloud-delivered security so employees and branches can reach applications under common access policies. For a distributed employer, the practical goal is to protect the connection wherever the worker happens to be.

Cortex XSIAM tackles the security operations centre, where teams collect signals, investigate suspicious behaviour and respond. It brings together functions previously spread across log analysis, detection and response, attack-surface management and workflow automation. A buyer can use it to connect related alerts into an incident and automate parts of the response. That is a more concrete benefit than acquiring another screen with a colourful risk score.

Cortex Cloud, introduced in February 2025, joined the next version of Prisma Cloud with Cortex cloud detection and response. The company’s explanation was revealing: cloud and enterprise security teams remained disconnected. Finding a risky configuration and detecting an attack against it had too often belonged to separate workflows. Bringing those jobs together changed the product’s architecture as well as its name. For buyers, the appeal is that cloud risk can become part of an incident investigation instead of remaining on a separate list of issues for another team.

Prisma AIRS extends the remit to AI systems, including assessment and runtime protection. Its March 2026 update, AIRS 3.0, addressed agents that can act across applications. Idira, built on CyberArk, covers identity security for people, machines and agents. Unit 42 adds another kind of expertise: threat researchers, incident responders and consultants who investigate attacks and help organisations prepare for them.

Xerox counted the handoffs

Xerox offers a useful test of the proposition. In Palo Alto Networks’ published customer account, the company describes an expensive, inflexible external security provider and a fragmented collection of tools. Restrictions on data throughput also forced choices about which information to collect. The first problem was operational: the defenders could not easily see and control the whole workflow.

Xerox moved toward an internal security operations centre using Cortex XSIAM. Its case study reports $10.2 million in direct savings over five years and ten full-time-equivalent roles reallocated, including first-line positions. Those are customer-case-study results, not a price list or a promise that every deployment will produce the same return.

“There were shards of glass all over the place.”

Cyndi McLean, Xerox cybersecurity operations leader, describing the previous tool environment

PassportCard’s account points to similar workflow pressure in a different business. The international insurer deployed XSIAM with consultant SySec and reported 80% of security operations automated, 90% faster case remediation and a doubling of productivity. The partner matters: somebody had to implement the system and manage response and escalation. Software capability and the organisation running it belong in the same discussion.

A reader can copy the measurement discipline without copying the purchase. Count the manual handoffs in one incident, record the time spent waiting for data, and identify who owns each response. Then run a bounded evaluation. An attractive dashboard is weak evidence; a repeatable reduction in investigation work is considerably better.

That evaluation should include an ordinary bad day. Ask the vendor to demonstrate an incomplete data feed, a mistaken alert and an automated action that needs a human decision. Who notices the missing information? Who can reverse the response? A useful trial makes the answers observable, with the customer’s own data. That is how a team moves from admiring automation to trusting it with a business process.

The price of getting onto the platform

Palo Alto earns money from products, subscriptions, support and services. In fiscal 2026, the global group reported $11.48 billion in revenue, including $9.20 billion from subscription and support. That recurring component explains why winning a broader customer relationship matters. A hardware sale can begin an account; renewals and additional capabilities can keep it growing.

Moving customers has a cost of its own. In its February 2024 earnings discussion, management described upfront free periods and payment flexibility as part of the consolidation effort. Customers already paying incumbent suppliers needed a way through the overlap. The commercial obstacle was not simply whether the new technology worked; it was whether buying it meant paying twice during transition.

The IBM relationship made that logic tangible. Palo Alto acquired QRadar SaaS assets, with completion announced in September 2024, and offered eligible customers no-cost migration services through IBM Consulting. IBM’s original announcement put the purchase price at approximately $500 million. IBM also became a user of Cortex XSIAM and Prisma SASE. Supplier, customer and implementation partner were now tied into the same strategy.

The larger transaction was CyberArk. Announced in July 2025 at an approximately $25 billion equity value, the cash-and-stock deal closed in February 2026. It brought identity security into the platform plan; the Idira brand followed in May. The announced deal value describes that transaction, not today’s valuation of Palo Alto Networks or the cost of a customer subscription.

When the firewall needed defending

The consolidation argument has to survive an uncomfortable fact: security products can become an attacker’s entry point. In April 2024, Palo Alto Networks disclosed CVE-2024-3400, a critical vulnerability in certain versions and configurations of PAN-OS involving GlobalProtect. An unauthenticated attacker could execute code with root privileges on an affected firewall. Exploitation was observed in the wild.

The company said researchers at Volexity alerted it to suspicious activity at a customer on April 10. Investigation traced the traffic to a compromised firewall, and Palo Alto published fixes and remediation guidance. This was a failure in the protective equipment itself. A consolidated supplier relationship does not remove the need to monitor that equipment, patch it and investigate signs of compromise.

There is also a less dramatic dependency to evaluate. If a required third-party system cannot provide useful data, or a team cannot safely automate an action, putting more products under one brand will not complete the workflow. Palo Alto’s own platform guidance acknowledges the need for third-party and legacy integrations. That is the right place for a buyer to ask difficult questions before signing.

Consolidation also changes the buyer’s negotiating position. As more workflows depend on a supplier, replacement becomes a larger project. The sensible comparison includes the time needed to export data, retrain staff and reconnect surviving tools. The inference for buyers is straightforward: compare the cost of leaving alongside the cost of joining, while choices are still open.

Fewer consoles still takes work

The alternatives depend on the job. Fortinet and Check Point compete in network security; Zscaler and Netskope in secure access; CrowdStrike and Microsoft in security operations. Palo Alto’s position rests on spanning several buying decisions and connecting their data. The comparison therefore belongs at the level of a real workload: detection quality, integration effort, response controls and total operating cost.

Its public culture statements emphasise disruption, collaboration, execution, inclusion and integrity. The execution part has become especially consequential as products and acquired businesses converge. Zuk retired in August 2025, and longtime product leader Lee Klarich assumed the technology role. The engineering task continues under different leadership: make the growing portfolio cooperate as convincingly as the sales story says it will.

For a business with fragmented security operations and staff to manage the transition, that is a proposition worth testing. For one whose current tools already fit, whose integrations must remain specialised, or whose team cannot absorb a migration, the calculation changes. Begin with the workflow that hurts. Ask which steps disappear, who remains accountable and what the system costs after introductory terms expire. Fewer logos on the invoice is easy to verify. Fewer blind spots takes more work.