GlobalProtect &
Prisma Agent

Where PAN Wins

• SASE, not just SSE: Zscaler is a Visionary in the 2025 Gartner SASE MQ because they lack real SD-WAN. PAN is a 3X SASE Leader with native Prisma SD-WAN. If the customer needs branch connectivity, Zscaler sends them to a third-party vendor.
• ZTNA 2.0 vs. 1.0: ZPA is a ZTNA 1.0 solution — "allow and ignore." Once access is granted, traffic is implicitly trusted with no deep inspection. Prisma Access continues inspecting every byte after connection via SP3.
• Full L7 vs. Proxy: PAN's Single-Pass Parallel Processing (SP3) inspects App-ID, threats, and DLP simultaneously with minimal latency. Zscaler's proxy only sees web traffic, not custom protocols.
• Natively integrated secure browser: Only PAN has a natively integrated enterprise browser (Prisma Access Browser) for BYOD. Zscaler has no equivalent — they rely on third-party RBI.
• NGFW-to-cloud policy consistency: If the customer has PAN NGFWs on-prem, the same policies extend identically to cloud users. Zscaler customers maintain separate ZIA/ZPA + on-prem policies — zero policy fragmentation with PAN.

Where They're Strong

• SSE market position: #1 on Ability to Execute in 2025 Gartner SSE MQ; 4X SSE Leader, 10X SWG Leader. Massive Fortune 500 installed base (40%).
• Pure proxy architecture: Outbound-only, no inbound listeners — theoretically smaller attack surface for SSE-only deployments.
• Scale: 500B transactions/day across 160+ PoPs. Proven at massive scale with extensive SaaS optimization.
• TLS inspection claims: Claims 100% SSL inspection with no performance degradation via multitenant proxy architecture.
• ZDX (Digital Experience Monitoring): Deep DEM integration with ZIA/ZPA sessions, strong ISP and SaaS latency visibility.

Landmines to Set

• "Where is Zscaler in the SASE MQ?" — Point out Zscaler is Visionary (not Leader) in the 2025 SASE MQ due to their SD-WAN gap. They need a separate SD-WAN vendor, creating policy fragmentation.
• "Does ZPA inspect traffic after access is granted?" — The answer is no. ZPA grants access then goes dark. 100% of breaches happen on allowed activity.
• "How do you handle BYOD without an agent?" — Zscaler has no natively integrated enterprise browser. Force them to describe their agentless solution vs. Prisma Access Browser.
• "How many separate consoles do you log into?" — ZIA and ZPA historically have separate management consoles with separate policies — operational friction.
• "What about server-initiated connections?" — ZPA architecture makes server-to-client traffic (patch management, helpdesk tools) difficult without complex B2B configuration.

Traps They Set

• "PAN uses firewalls and VPNs with exposed IPs that can be exploited" — Counter: Prisma Access is a cloud-delivered SASE platform, not a VPN. Prisma Agent connects to 100+ global PoPs with a dedicated data plane per customer — no exposed IP addresses, no noisy neighbor problems. This is the same architecture as Zscaler, but with deeper inspection.
• "Zscaler is the SSE leader" — Counter: "We agree Zscaler leads in SSE. But SSE is only half of SASE. In the 2025 SASE MQ, Zscaler is a Visionary, not a Leader. If you want secure branches, MPLS migration, and remote users with one platform and one policy, only PAN delivers that."

Key Objections

Where PAN Wins

• Security depth: PAN has the most comprehensive threat prevention stack (WildFire, ATP, DNS Security, Advanced URL Filtering) — built from the same engine as the world's most-deployed NGFW. Netskope's threat capabilities are comparatively lighter, relying more on third-party feeds.
• Platform breadth: PAN covers NGFW + SASE + SD-WAN + Endpoint (Cortex XDR) + Browser. Netskope is SSE-centric with no NGFW consistency for on-prem enforcement points.
• ZTNA 2.0: Prisma Access provides continuous traffic inspection post-connection. NPA (Netskope Private Access) still follows an access-grant-and-trust pattern — no continuous deep inspection.
• Prisma Access Browser: For BYOD and unmanaged device scenarios, PAN's natively integrated browser has no Netskope equivalent.

Where They're Strong

• DLP leadership: Industry-leading inline DLP depth and granularity; #1 for Completeness of Vision in SSE MQ (3X).
• Cloud-native architecture: Built ground-up for cloud with deep SaaS API integrations and strong SaaS Security Posture Management (SSPM).
• Intelligent steering: Netskope Client is praised for flexible per-app split tunnel configurations.
• SASE MQ Leader: Named a Leader in the 2025 Gartner SASE MQ alongside PAN and Fortinet.

Landmines to Set

• "What does Netskope do for on-prem security?" — They have no NGFW product line. Organizations maintaining any on-prem enforcement need a separate vendor — creating policy fragmentation.
• "How does NPA handle legacy protocols and server-initiated connections?" — NPA is newer vs. Prisma Access; lacks support for complex legacy protocols.
• "What's your SD-WAN story for branch connectivity?" — Netskope has limited SD-WAN compared to PAN's native Prisma SD-WAN.

Traps They Set

• "Netskope has better DLP" — Counter: Netskope's inline DLP is strong for SaaS and web. But PAN's Enterprise DLP covers network, endpoint (USB/printer control via PAA), SaaS, and cloud with a single policy. PAN also has the Prisma Access Browser for browser-level DLP enforcement. Compare apples to apples — full-stack DLP coverage, not just inline web DLP.
• "Netskope is cloud-native, PAN is a firewall company" — Counter: Prisma Access runs on the same hyperscaler backbone (AWS+GCP) as any cloud-native vendor, with SP3 architecture processing all security in a single pass. The NGFW heritage is an advantage — it means deeper security inspection, not a liability.

Key Objections

Where PAN Wins

• Unified SASE vs. multi-product: PAN Prisma SASE is a single platform from a single vendor. Cisco's SASE requires orchestrating Umbrella + Duo + Secure Client + SD-WAN — each with separate contracts, consoles, and support paths.
• Analyst recognition: PAN is the #1 SASE Leader (highest Ability to Execute) in the 2025 Gartner SASE MQ. Cisco is a Challenger — Gartner sees execution gaps.
• ZTNA 2.0 vs. legacy VPN: Cisco Secure Client with AnyConnect roots is still fundamentally a VPN replacement with limited ZTNA depth. PAN provides genuine ZTNA 2.0 with continuous post-connection inspection.
• No secure browser: Cisco has no natively integrated enterprise browser for BYOD. PAN has Prisma Access Browser.

Where They're Strong

• Ubiquitous install base: AnyConnect/Secure Client is the #1 installed VPN client globally. Near-universal enterprise familiarity creates significant switching friction.
• Cisco ecosystem lock-in: Deep integration across ASA/FTD firewalls, ISE, Duo, and Umbrella for customers already in the Cisco stack.
• Duo MFA: Market-leading MFA with native integration into Secure Client. Strong identity story.
• Enterprise account presence: Massive enterprise account teams and support infrastructure.

Landmines to Set

• "How many separate consoles does your security team log into?" — Umbrella, Duo admin, ISE, Secure Connect, Viptela SD-WAN vManage — expose the management fragmentation.
• "Where is Cisco in the SASE MQ?" — Challenger, not a Leader. Gartner sees execution gaps in their unified SASE story.
• "Does Cisco Secure Client do continuous post-connect inspection?" — No. It's a VPN replacement with ZTNA 1.0, not continuous zero trust.

Traps They Set

• "We're already a Cisco shop — it's simpler to stay" — Counter: Cisco has an installed base, but their SASE story stitches together Umbrella (acquired), Duo (acquired), Viptela SD-WAN (acquired) — each with separate management. PAN Prisma SASE was built as a platform, not assembled through acquisitions. You can keep Cisco for networking while using PAN for security.
• "Cisco Duo gives us MFA built-in" — Counter: PAN supports SAML, RADIUS, LDAP, OTP, certificate-based, and smart card auth natively. Cloud Identity Engine provides centralized identity federation. Duo is strong for MFA but doesn't address the broader SASE, DLP, or continuous inspection requirements.

Key Objections

Where PAN Wins

• App-ID depth: PAN's App-ID is the industry's most granular L7 application identification with hundreds of sub-app identifications. FortiGate is widely described as "L4 with some L7" — inferior application granularity for policy enforcement.
• ZTNA 2.0 vs. ZTNA 1.0: Fortinet ZTNA is a basic access broker — grant and ignore. PAN continuously verifies trust and inspects traffic post-connection.
• Security track record: Fortinet has had repeated critical NGFW CVEs with slow patch response timelines. PAN's security patching and Unit 42 threat research provide a cleaner track record.
• Cloud-native vs. adapted: Prisma Access is architected cloud-native on AWS+GCP. FortiSASE is FortiOS adapted to cloud — architectural differences matter at scale.

Where They're Strong

• Cost / SMB positioning: Generally less expensive; SD-WAN included natively in every FortiGate with no extra license. Compelling for cost-sensitive deployments.
• Native OS integration: FortiOS as single codebase across NGFW, SD-WAN, ZTNA, switching, and Wi-Fi — tight integration within the Fortinet stack.
• 2025 SASE MQ Leader: Fortinet is a Leader in the 2025 Gartner SASE MQ — strong execution at scale.
• Routing capability: FortiGate widely praised for advanced routing and SD-WAN features.

Landmines to Set

• "Ask Fortinet to demonstrate L7 application identification at the sub-app level — how many sub-app actions can FortiGate enforce policy on vs. PAN's App-ID?"
• "Does FortiClient ZTNA do continuous deep inspection after access is granted, or does it grant access and go dark?"
• "Ask about FortiSASE's PoP footprint and cloud-native scalability vs. PAN's 100+ PoPs across 87 countries on hyperscaler backbone."

Traps They Set

• "Fortinet is cheaper and good enough" — Counter: FortiClient customers often need separate DLP, CASB, and posture tools. PAN bundles all of that. FortiSASE still requires a separate DLP tool, CASB tool, and endpoint DLP. TCO evaporates when you factor in security outcomes and operational overhead.
• "FortiOS is a single codebase" — Counter: A single codebase is good for integration but doesn't address the fundamental architecture gaps — FortiSASE is FortiOS adapted to cloud, not cloud-native. And "FortiDamager" management inconsistency is a well-known pain point among practitioners.

Key Objections

Where PAN Wins

• Different categories entirely: CrowdStrike competes with Cortex XDR for endpoint/EDR, not with Prisma Agent for ZTNA/SASE. Don't let customers conflate them in "zero trust" discussions.
• SASE is not CrowdStrike: CrowdStrike has no SWG, no CASB, no SD-WAN, and no remote access infrastructure. They have no answer for "how do users securely connect to corporate apps?"
• Data protection gap: CrowdStrike's DLP is endpoint-only with no network-based data protection. PAN's Enterprise DLP covers network, endpoint, SaaS, and cloud simultaneously.
• Network-layer blind spots: Falcon's ZTNA is identity-centric only — no network traffic inspection, no app-layer policy, no continuous deep packet inspection.

Where They're Strong

• Endpoint security leadership: 6X consecutive Gartner EPP MQ Leader. Widely considered best-in-class EDR/XDR. Single lightweight Falcon agent.
• AI-native platform: Charlotte AI for detection triage, investigation, and agentic response workflows.
• Identity threat detection speed: 85% faster identity attack detection with adaptive MFA and risk-based access.
• Operational simplicity: Single console, single agent — praised for ease of management in the endpoint domain.

Landmines to Set

• "Ask CrowdStrike: how do users securely connect to corporate applications from home? What's your remote access story?" — They don't have one. Falcon doesn't replace VPN or provide SASE.
• "CrowdStrike's DLP is endpoint-only. How do you enforce data protection for SaaS apps, cloud resources, and network traffic?" — They can't.

Traps They Set

• "CrowdStrike does Zero Trust too" — Counter: CrowdStrike is excellent at endpoint security and identity-based MFA — that's their lane. But they have no SWG, no CASB, no SD-WAN, and no remote access infrastructure. CrowdStrike and PAN are complementary — many enterprises run both. If you're looking for ZTNA, secure BYOD, SaaS visibility, and remote access, that's Prisma Access. EDR is a separate evaluation.

Key Objections