Compete by Solution
Enterprise
Agreement
How to position the PAN EA/ELA against Microsoft E5, Cisco EA, CrowdStrike, Zscaler, Check Point, and Fortinet licensing. Win themes, financial justification, and a 5-step conversion playbook.
Overview
What Is the PAN Enterprise Agreement?
The EA is the umbrella commercial structure for bulk subscription and support assignment across a customer's Palo Alto Networks estate. The ELA is the specific variant that assigns Cloud-Delivered Security Services (CDSS) to hardware NGFWs.
PA-Series ELA (Hardware)
One- or three-year agreement covering all PA-Series NGFWs under a single hardware estate cap (total list-price value of covered hardware). A single auth code in the Customer Support Portal covers the entire fleet — no per-device subscription management.
- Built-in growth allowance — new firewalls added during the term are automatically covered
- Single renewal date, single contract — eliminates staggered subscription renewals
- Bulk activation via CSP dashboard
VM-Series ELA (Virtual)
Token-pool model for virtual NGFW deployments. Customer forecasts VM count; tokens are pre-credited with a buffer for growth. Each VM model draws a defined number of tokens scaled by performance tier.
- No retroactive true-up — deploy beyond forecast within bounded/unbounded periods without penalty
- Tokens transferable across sub-administrators in CSP
- Ideal for dynamic cloud environments where VM-Series instances scale up and down
ESA Pro (Support)
Launched November 2025, ESA Pro replaces the legacy ESA (end-of-sale November 1, 2025 for commercial). Includes Strata Cloud Manager (SCM) for proactive health monitoring and simplified troubleshooting.
CDSS Included in Standard ELA
- Advanced Threat Prevention (ATP) — inline IPS, C2/malware blocking
- DNS Security (ADNS) — ML-powered DNS-layer threat prevention
- PAN-DB URL Filtering — web category and URL intelligence
- Advanced WildFire (AWF) — cloud-delivered sandboxing and malware analysis
- GlobalProtect — remote-access VPN / zero trust network access
Note (March 2026): The legacy Precision AI Network Security Bundle (CORESEC SKU) reached end-of-sale Dec 31, 2025 (commercial). It is replaced by the Precision AI Pro Bundle, which adds Device Security (formerly IoT/OT Security).
Qualification
EA Eligibility Signals
PAN does not publish a universal minimum TCV. Qualification is account-team-driven — a joint decision between the field SE, AM, and deal desk. These are the practical signals that indicate EA candidacy.
| Signal | Threshold / Description |
|---|---|
| Hardware Estate | ≥ $1.5M hardware at list price; large PA-Series deployment already in place |
| Subscription Breadth | Customer already buying 2+ CDSS subscriptions à la carte (at 2.5+ subscriptions per device, an ELA becomes financially attractive) |
| Growth Trajectory | Planned expansion of firewall estate (branches, data center, cloud) over the agreement term |
| Multi-Pillar Potential | Existing Strata customer who is also a candidate for Prisma SASE or Cortex — ideal for full platformization deal |
| Renewal Event | Upcoming subscription or support renewal is the natural conversion trigger |
| Procurement Fatigue | Large or complex environment with multiple POs, different renewal dates, subscription management overhead |
Licensing Comparison
Competitive Licensing Matrix
How the PAN EA/ELA stacks up against Microsoft E5, Cisco Security EA, CrowdStrike Falcon, Zscaler, Check Point Infinity, and Fortinet bundle licensing models.
| Dimension | PAN EA/ELA | Microsoft | Cisco EA | CrowdStrike | Zscaler | Check Point | Fortinet |
|---|---|---|---|---|---|---|---|
| Licensing | Estate Cap+CDSS | Per-User Suite | SW Portfolio | Per-Endpoint | Per-User/Yr | Per-User/Yr | Per-Device |
| Min Entry | ~$1.5M estate | $57/user/mo E5 | $100K TCV | ~$60/dev/yr | No minimum | Not stated | Per-appliance |
| Scope | NGFW+All CDSS | XDR+SIEM+ID+EP | All Cisco Sec | EP+Add-ons | SASE/SSE Only | Full Suite | NGFW Subs |
| Breadth | Net+SASE+Cloud+SOC+ID | XDR+SIEM+CASB+ID | Net+SASE+XDR | EP-Centric | SASE/SSE | Net+Cloud+EP | Network Only |
| Growth | Built-in Allowance | EA Volume Tiers | 15% True Fwd | Vol Discounts | User Scaling | Tiered Disc | New PO/Device |
| Estate Deal | Yes—Single Auth | Yes (M365 EA) | Yes | Module Add-ons | Per-User | Yes (IPA/ELA) | No |
| AI Platform | Precision AI | Security Copilot | Cisco AI Asst | Charlotte AI | AI/ML Inline | ThreatCloud AI | FortiAI |
Why PAN EA Wins
Key Advantages
Predictable Spend
Fixed annual cost for the entire NGFW estate. No per-device subscription renewal scrambles, no budget surprises when adding hardware. Single renewal date, single contract — eliminates staggered renewals across dozens of devices.
Platform Consolidation
Pre-ELA: 50 PA-Series firewalls = 250+ line items with different expiry dates. Post-ELA: one auth code, one dashboard, one renewal — covering ATP, DNS Security, URL Filtering, WildFire, and GlobalProtect across the entire estate.
Higher TCV for Sellers
Two-platform customers have a lifetime value more than 5× that of single-platform. Three-platform customers: more than 40×. The EA is the commercial entry point to exponential customer value expansion.
Simpler Procurement
Single PO, single contract, single vendor for all NGFW security services. Multi-subsidiary sharing via token pool. Real-time consumption dashboard in CSP eliminates subscription audit problems.
Superior Security Outcomes
Precision AI powers all five CDSS services in concert. Strata TEI customers had up to 17 point solutions; consolidating onto the platform enabled a 65% reduction in incidents requiring manual investigation.
Customer Stickiness
Platformized customers have a 119% net retention rate with low single-digit churn — the highest in the cybersecurity sector. A closed EA deal is not a ceiling but a floor for future ARR expansion.
Seller Playbook
EA Conversion Play
The 5-step motion for converting existing à la carte PAN customers into a single-EA deal. Targets the existing installed base — not net-new sales.
"You're already invested in Palo Alto Networks. You've bought the hardware, you're renewing subscriptions piecemeal every year, and you're managing each device individually. The EA converts that operational overhead into a single agreement — same services, better price, predictable renewal, and built-in room to grow. And when you're ready to add Prisma SASE or Cortex, you're already in a commercial framework that makes that second pillar 5× more valuable than adding it standalone."
Baseline the Estate
- Pull the customer's CSP inventory: PA-Series and VM-Series device count, active subscriptions per device, renewal dates, total à la carte spend
- Calculate total CDSS spend if renewed à la carte for 3 years vs. ELA at the negotiated hardware estate cap rate
- Identify devices NOT running all 5 CDSS — gaps in coverage = additional risk exposure = ELA uplift story
Quantify the Operational Savings
- Estimate IT/procurement hours spent on annual subscription renewals (even 1–2 hrs/device/yr across 50 devices = 50–100 hours annually)
- Use Forrester Strata TEI benchmarks: 80% efficiency improvement in firewall deployment, policy changes, and new site setups
- Identify planned hardware purchases or branch expansions — show how ELA growth allowance avoids incremental POs
Build the Platformization Vision
- Map the customer's current multi-vendor security stack (SIEM, endpoint, SASE, cloud security)
- Identify which pillars could be consolidated: Strata → Prisma SASE (displace Zscaler?) → Cortex XSIAM (displace legacy SIEM?)
- Present the 5× lifetime value for two-platform and 40× for three-platform economics to the CISO and CFO
Time the Conversion to Legacy Contract Expiry
- Leverage PAN's programmatic "no-cost period" model: customer commits today, PAN provides deferred billing until legacy contracts expire
- Introduced Feb 2024 — legacy trade-ins, no-cost introductory offers, incentives to accelerate estate standardization
- Customer begins accruing platform benefits (better security, operational efficiency) before paying the new contract price
Executive Alignment
- EA deals require CISO + CFO alignment: CISO wants security outcomes; CFO wants budget predictability and consolidation savings
- Use Forrester TEI data for the CFO business case (174% ROI, $26.2M NPV, payback <6 months)
- Use incident reduction and breach risk metrics for the CISO case (65% fewer incidents, 50% breach risk reduction)
- Involve the account SE and CSM to deliver a live consumption analysis of the current estate
Financial Justification
Forrester TEI & ROI Data
Third-party validated metrics from Forrester TEI studies. Use these in procurement conversations to build the business case.
| Metric | Strata TEI (2024) | NGFW TEI | XSIAM TEI (2025) |
|---|---|---|---|
| ROI | 174% | 229% | 257% |
| NPV (3-year) | $26.2M | $9.82M | $5.6M |
| Payback Period | < 6 months | 7 months | < 6 months |
| Incident Reduction | 65% fewer manual investigations | 50% security pro reallocation | 85% fewer Tier-1 alerts by Year 3 |
| Efficiency Gain | 80% in deployment/policy | $5.18M end-user productivity | 85% MTTR reduction |
| Infrastructure Savings | $8.3M retired/avoided costs | $2.54M cost reduction | $3.1M legacy tool elimination |
Platformization Commercial Economics
Reference wins (Q2 FY2026): Global automotive leader — >$50M ($30M SASE + $20M XSIAM). Major technology supplier — >$40M XSIAM-led. IT services provider — $20M expansion completing network security + SecOps platformization.
Objection Handling
Common Objections & Responses
We're already renewing subscriptions à la carte — the EA is more expensive upfront.
Response: The upfront cost is often offset within the first year through operational savings alone. The 2024 Forrester TEI documents $2.2 million in savings from 80% efficiency gains in firewall deployment, policy changes, and new site setups. Calculate the per-device subscription cost × number of devices × subscriptions managed. At 2.5+ subscriptions per device, the ELA often prices favorably vs. à la carte. Even 1–2 hours per device per year for renewal management across a 50-device estate = 50–100 hours of IT labor annually — and the ELA provides a growth allowance at no extra cost.
We don't want to be locked in to a 3-year commitment.
Response: EA/ELA terms of 1 year are available — the multi-year is a financial choice, not a requirement. For VM-Series ELA, even if you deploy more VMs than forecasted within bounded/unbounded periods, no retroactive true-up is billed. The 119% net retention among platformized customers (Q2 FY2026) indicates that customers do not experience regret — they expand. Lock-in is actually a risk reduction argument: price protection, service continuity, and no renewal premium risk over the term.
Fortinet / Check Point / Cisco is cheaper.
Response: Unit price comparisons miss total cost. Fortinet's ENT bundle is per-device; add FortiManager, FortiAnalyzer, FortiSASE, FortiClient, and FortiXDR and the aggregate cost approaches PAN parity at materially lower integration quality. Forrester TEI (2024): 174% ROI, $26.2M NPV over 3 years — no comparable independent study from Fortinet covers the full security estate. Check Point's per-user model scales with headcount; PAN's hardware-estate model does not. Focus on security outcomes: 65% reduction in incidents requiring manual investigation, 30% of staff time recaptured.
We already have Microsoft E5 — security is included.
Response: E5 bundles identity, endpoint, and email security — but has no NGFW, no SASE, no SD-WAN, and no cloud workload protection at PAN depth. Sentinel SIEM is a separate consumption cost on top of E5, and Security Copilot adds per-SCU charges. Microsoft eliminated EA discount tiers Nov 2025 and is raising E5 pricing 5% in Jul 2026. In MITRE ATT&CK Round 6, Defender ranked #7 in prevention vs. Cortex XDR at #1 with 100% detection. PAN covers the network gap Microsoft cannot fill.
We want best-of-breed — one vendor can't be best at everything.
Response: PAN's platform is built through acquisition of best-of-breed components (Demisto → XSOAR, Bridgecrew → Prisma Cloud code security, Talon → browser security, CyberArk → identity). It is not a single-vendor monoculture but an integrated best-of-breed platform. IDC research: 45% of organizations are actively consolidating vendors in 2025–2026. Managing 17 point solutions means 17 vendor SLAs, 17 renewals, 17 integrations. The Forrester TEI documents a 50% reduction in data breach likelihood vs. pre-platform baseline.
We're not sure we'll expand our firewall estate enough to justify the growth allowance.
Response: The EA value is not contingent on expansion. Even a static estate benefits from simplified administration, single renewal date, and growth allowance that protects against unplanned additions. Modern enterprises always add NGFWs for cloud environments, new branch offices, cloud-delivered virtual NGFWs, or containerized deployments. The VM-Series ELA's no-true-up policy is particularly valuable for dynamic cloud environments.
We're in the middle of a Cisco / Fortinet / Check Point refresh — we'll consider PAN next cycle.
Response: This is the entry point for the platformization conversion play. PAN's programmatic approach allows customers to receive a no-cost extended period while legacy contracts wind down — there is no "wrong time" to start the EA conversation. The economics of an EA entered today, with deferred billing until legacy expiry, mean the customer begins accruing platform benefits before paying the new contract price.
Competitor Licensing Details
Vendor Deep Dives
Microsoft — E5 Security / Defender Suite / Sentinel
The largest incumbent in enterprise IT. Microsoft 365 E5 ($57/user/mo, rising to $60 in July 2026) bundles Defender XDR, Entra ID, Intune, Purview, and Sentinel SIEM into a single per-user license. The E5 Security add-on ($12/user/mo) bolts Defender XDR onto existing E3 estates. Security Copilot ($4/SCU/hr) adds AI-assisted investigation. The consolidation narrative — "you already own it" — is powerful, but security is a secondary priority within the M365 bundle, not the core mission.
Where PAN EA Wins
- Security-first vs. productivity-first: PAN was purpose-built as a security company with 300+ security patents. Microsoft's security is an add-on to a productivity platform — not the core business.
- Network security gap: Microsoft has no hardware NGFW, no SD-WAN, and no SASE. Organizations still need PAN or a competitor for perimeter and network security — Microsoft explicitly does not replace the firewall.
- MITRE ATT&CK superiority: Cortex XDR achieved 100% detection and #1 prevention rate in MITRE ATT&CK Evaluations Round 6. Defender achieved 71% technique-level detection and ranked #7 in prevention.
- Third-party data: XSIAM/Cortex XDR natively ingests and correlates data from any vendor in a single data lake. Defender XDR does not support third-party data sources — forcing fragmented investigation for mixed environments.
- Pricing escalation: Microsoft eliminated EA volume discount tiers Nov 2025. Orgs at Levels B/C/D face 6–12% resets. E5 rises 5% ($57→$60) in Jul 2026. The "already own it" argument erodes as costs compound.
Where They're Strong
- "Already in E5" narrative: For orgs on M365 E5, Defender/Sentinel feels like sunk cost. Procurement sees no incremental spend — Microsoft's most powerful weapon.
- Massive installed base: 400M+ paid M365 seats. Defender deploys via Intune with zero additional agents.
- Sentinel cloud-native SIEM: Genuine cloud-native SIEM with commitment tiers up to 52% off. Actively targeting QRadar/Splunk migration with AI tools.
- Security Copilot: Included in E5 starting summer 2026. Natural-language hunting, automated incident summaries, playbook generation.
- Identity via Entra: Dominant enterprise identity provider. Conditional Access + Defender for Identity creates a deeply integrated identity story.
Landmines to Set
- "Defender ranked #7 in prevention in MITRE Round 6 — failing 7 of 10 attack scenarios. Cortex XDR was #1. Ask Microsoft to explain the gap."
- "Calculate total Microsoft security spend: E5 + Sentinel ingestion + Security Copilot SCUs + Purview. Then compare to a PAN platform deal covering Network + SASE + SOC."
- "Microsoft eliminated EA discount tiers and raised E5 pricing 5% for Jul 2026. What does your 3-year total look like vs. PAN's fixed ELA?"
- "How does Defender XDR handle non-Microsoft data sources? If you have PAN firewalls or AWS workloads, does it correlate natively? Or do you need Sentinel as an added cost?"
- "What's your network security strategy? Microsoft has no NGFW, SD-WAN, or SASE. The 'consolidation' argument only applies to endpoint and identity."
Cisco — Security Enterprise Agreement
Software portfolio aggregation model with $100K minimum TCV — one of the lowest entry points in the market. Covers all Cisco security software: Secure Firewall, Duo, Secure Access (SASE), XDR, email security. 3- or 5-year terms with 0% financing available. 15% True Forward penalty-free growth.
Where PAN EA Wins
- Architecturally integrated vs. aggregated: Cisco EA is a software licensing aggregation model — it combines existing products under one contract but does not represent a natively integrated platform. PAN's EA is built around hardware estate consolidation + CDSS with platform integration by design.
- Post-Splunk integration still in progress: Cisco's portfolio post-Splunk is still being integrated. PAN's platform was built with integration as the design principle — Cortex XSIAM vs. Splunk+Cisco XDR convergence.
- Security-first vs. networking-first: Cisco security evolved from ASA/FTD and networking roots. PAN was purpose-built as a security platform from day one.
Where They Compete
- Lower entry point: $100K TCV minimum vs. PAN's ~$1.5M hardware estate threshold. Cisco EA is accessible to mid-market accounts PAN EA cannot reach.
- 15% True Forward is compelling: Penalty-free growth up to 15% above committed quantity — overconsumption adjusted at the next cycle, not retroactively. PAN's growth allowance should be specifically quantified in deal proposals to counter.
- 0% financing: Cisco offers 0% financing on EA deals — a strong procurement tool for CFOs managing cash flow.
- Deep networking install base: Cisco networking shops face high transition costs, creating significant switching friction.
Landmines to Set
- "Ask Cisco how many of the products in the EA are truly integrated vs. simply co-billed under one contract. Is there a shared data model across Firewall, Duo, XDR, and SASE?"
- "What is the Splunk integration roadmap? When will Cisco XDR and Splunk SIEM converge into a single SOC platform?"
- "Cisco EA covers software — but what about the hardware? PAN ELA covers the full NGFW estate including hardware lifecycle."
CrowdStrike — Falcon Per-Endpoint Tiers
Per-endpoint, per-year pricing across four tiers (Go/Pro/Enterprise/Complete). Competes in endpoint + identity + cloud workloads. No hardware NGFW, no SASE, no traditional network security. Module-based add-on model mirrors the à la carte problem PAN's EA solves.
Where PAN EA Wins
- Network security gap: CrowdStrike does not offer a hardware NGFW, SASE, or traditional network security capability. In the platform era, PAN multi-pillar EA covers Network + Cloud + SOC.
- SOC consolidation: PAN XSIAM directly competes with Falcon Enterprise + Complete for the SOC consolidation use case — with 257% ROI per the 2025 Forrester TEI.
- Module bloat: CrowdStrike's module-based add-on model (Identity Protection, Cloud Security, Next-Gen SIEM are all separate purchases) mirrors the à la carte problem PAN's EA solves — total spend can balloon unpredictably.
Where They Compete
- Endpoint dominance: CrowdStrike is the leader in endpoint detection and response — Falcon EDR/XDR is best-in-class for endpoint-centric security.
- Lower entry point: Starting at $59.99/device/year makes CrowdStrike accessible to organizations of all sizes.
- Identity protection: CrowdStrike's identity modules compete directly with PAN's CyberArk integration story.
Zscaler — Per-User Platform Bundles
Per-user, per-year SASE/SSE-native vendor. No hardware NGFW, no endpoint, no SOC/SIEM. A customer using Zscaler for SASE still needs a NGFW and SOC platform — directly contradicting the consolidation thesis.
Where PAN EA Wins
- Platform breadth: Zscaler covers SASE/SSE only. PAN's EA + platform pillars cover Network + SASE + Cloud + SOC + Identity. A Zscaler customer still needs to procure NGFW and SOC separately.
- PAN SASE is competitive: Prisma SASE surpassed $1.5B ARR growing ~40% YoY as of Q2 FY2026 — directly competitive with Zscaler's platform (ZIA + ZPA + ZDX).
- Multi-pillar deal structure: PAN platformization deal includes SASE as a second or third pillar alongside Strata, making the total deal larger while displacing Zscaler.
Where They Compete
- SSE/SASE purity: Zscaler is purpose-built for SASE — cloud-native from day one. The architecture argument is strong in SSE-specific evaluations.
- Lower entry point: No stated minimum; accessible to organizations of all sizes with per-user pricing.
Check Point — Infinity ELA / Platform Agreement
Per-user, per-year subscription covering the full Infinity architecture: Quantum (network), CloudGuard (cloud), Harmony (endpoint/email/SaaS). Broader scope than Fortinet but different pricing model than PAN — cost scales with headcount, not infrastructure.
Where PAN EA Wins
- Pricing model advantage for large orgs: Check Point's per-user model means TCO scales linearly with headcount. PAN's hardware-estate model scales with infrastructure — structurally cheaper for large-headcount, moderate-infrastructure enterprises.
- Platformization breadth: PAN EA naturally extends to SASE (Prisma), SOC (Cortex XSIAM), and Identity (CyberArk). Check Point's cross-pillar story remains largely within the Infinity umbrella without comparable SOC/SIEM depth.
- AI-native advantage: Precision AI (ML, DL, GenAI inline) vs. ThreatCloud AI. PAN's AI engine powers all CDSS services in concert; Check Point's engine is threat-intel focused.
Where They Compete
- Broader out-of-box scope: Infinity ELA includes network, cloud, and endpoint in one agreement — PAN ELA covers NGFW + CDSS with SASE and SOC as separate platform pillars.
- Claims 50% increase in operational efficiency and 20% reduction in security costs under the IPA model.
- Lower CVE count: Check Point cites 4 high/critical CVEs (2021–2024) vs. 43 for PAN — smaller attack surface from narrower product scope.
Landmines to Set
- "Calculate Check Point Infinity ELA cost at your current headcount, then project at 10% headcount growth over 3 years. Now compare to PAN ELA where cost is infrastructure-based, not headcount-based."
- "Ask Check Point about their SASE story — Harmony SASE was a separate acquisition. How does it compare to Prisma Access with 100+ global PoPs?"
Fortinet — FortiGuard Bundles (ATP / UTP / ENT)
Per-device subscription bundles tied to FortiGate hardware. There is no enterprise-wide licensing vehicle comparable to PAN's ELA — Fortinet's "enterprise licensing" is a higher-tier bundle applied per-appliance. SD-WAN, SASE, ZTNA, FortiManager, and FortiAnalyzer are all separate SKUs.
Where PAN EA Wins
- Estate-wide licensing vs. per-device: PAN ELA covers the entire fleet with one auth code. Fortinet requires per-device subscription renewal — each FortiGate gets its own renewal cycle.
- No estate-wide growth mechanism: PAN ELA has built-in growth allowance. Fortinet requires a new PO for each new appliance deployment.
- Narrower bundle scope: Even Fortinet's ENT bundle excludes SD-WAN, SASE, ZTNA, FortiManager, and FortiAnalyzer. PAN's ELA + platform deal covers these naturally.
- OT security is an add-on: Fortinet's ENT bundle does not include OT-specific device/protocol recognition — it requires an additional subscription even at the top tier.
Where They Compete
- Lower unit price per device: Fortinet ENT bundle ranges ~$2,000–$6,000/yr depending on hardware model — competitive on unit economics for smaller deployments.
- FortiCare Premium included: All bundles include FortiCare Premium support, which Fortinet uses as a differentiation point.
- Native SD-WAN and ZTNA: Fortinet claims SD-WAN and ZTNA are included without separate licensing — a compelling message for cost-sensitive buyers.
Landmines to Set
- "Ask Fortinet to quote the total cost for 50 firewalls with ENT bundle + FortiManager + FortiAnalyzer + FortiSASE + FortiClient across all devices — then compare that to a PAN ELA."
- "How many separate renewal events does your team manage for Fortinet subscriptions annually? The PAN ELA eliminates that to one."
- "What happens when you add 10 new FortiGates mid-term? New PO each time. PAN ELA growth allowance covers this automatically."