Compete by Solution
NGFW Hardware
Refresh
Turn EoL/EoS refresh cycles into platform expansion opportunities. Defend the installed base against Fortinet, Check Point, and Cisco while driving platformization.
Lifecycle Intelligence
EoL / EoS Timeline
Legacy platforms sorted by urgency. Use this to identify refresh-ready accounts and drive proactive conversations. Near-term dates: ION 1200-C / 1200-S-C end-of-sale Sep 1, 2026; CN-Series end-of-sale Nov 1, 2026 (replaced by AI Runtime Firewall); PA-5450 end-of-sale Nov 22, 2026.
| Legacy Platform | End-of-Sale | End-of-Life | Last PAN-OS | Replacement | Status |
|---|---|---|---|---|---|
| PA-3000 (3020/3050/3060) | Oct 2019 | Oct 2024 | 9.1 | PA-3400 | PAST EoL |
| PA-5000 (5020/5050/5060) | Jan 2019 | Jan 2024 | 8.1 | PA-5400 / PA-5500 | PAST EoL |
| PA-7000 20G-NPC / 20GQ-NPC | Jan 2019 | Jan 2024 | 10.0 | PA-7000-100G-NPC-A | PAST EoL |
| K2-Series (PA-5280-K2, PA-7050/7080-K2) | Feb 2021 | Feb 28, 2026 | 10.1 | PA-5445 / PA-7500 | PAST EoL — DO NOT QUOTE |
| PA-7050/7080-SMC, PA-7000-LPC | Feb 2021 | Feb 2026 | 10.1 | PA-7500 | PAST EoL |
| PA-7000-20GXM-NPC | May 2021 | May 2026 | 10.1 | PA-7000-100G-NPC-A | 2 MONTHS |
| PA-220 | Jan 2023 | Jan 2028 | 10.2 | PA-400 | EoL 2028 |
| PA-3200 (3220/3250/3260) | Aug 2023 | Aug 2028 | 11.1 | PA-3400 | EoL 2028 |
| PA-5200 (5220/5250/5260/5280) | Aug 2023 | Aug 2028 | 11.2 | PA-5400 / PA-5500 | EoL 2028 |
| PA-800 (820/850) | Aug 2024 | Aug 2029 | 11.1 | PA-1400 | EoL 2029 |
| PA-7000 Series Chassis (7050/7080, 100G-NPC-A, DPC-A) | Dec 31, 2025 | Dec 31, 2030 | 11.2 | PA-7500 | PAST EoS — PLAN NOW |
| ION 1200-C / ION 1200-S-C (Prisma SD-WAN) | Sep 1, 2026 | — | — | Current ION models | EoS IN <1 MONTH |
| CN-Series (container NGFW) | Nov 1, 2026 | — | — | AI Runtime Firewall (Prisma AIRS) | EoS — STOP SELLING |
| PA-5450 | Nov 22, 2026 | Nov 21, 2031 | 12.2 | PA-5500 Series | EoS THIS YEAR |
Current Portfolio
Current-Gen Hardware Quick Reference
5th-generation Strata portfolio — all models share PAN-OS, SP3 architecture, ML-powered threat prevention, Precision AI, and Strata Cloud Manager support. Current train is PAN-OS 12.2 "Ceres" (July 30, 2026). PA-5450 is end-of-sale Nov 22, 2026 — quote the PA-5500 Series for new data-center business.
| Series | Use Case | FW Throughput | Threat Prevention | Key Differentiator |
|---|---|---|---|---|
| PA-400 | Branch / SMB | Up to 5.2 Gbps | Up to 2.3 Gbps | Fanless, 5G options, PoE, ZTP |
| PA-500 Series | Enterprise Branch | Up to 2x PA-400 Series | 0.8–6 Gbps (PA-505 to PA-560) | 8 models, up to 24 high-speed ports, up to 330 W PoE, ZTP via SCM |
| PA-1400 | Small Campus / Large Branch | Up to 9.9 Gbps | Up to 6.2 Gbps | Replaces PA-800; PoE, 24yr MTBF |
| PA-3400 | Internet Edge / Campus | Up to 30.2 Gbps | Up to 11 Gbps | 3x perf vs PA-3200 in same 1RU |
| PA-5400 | Data Center / SP | — | Up to 90 Gbps (PA-5445) | 2.5x TP vs PA-5260; 48M sessions |
| PA-5450 | Hyperscale Modular — EoS Nov 22, 2026 | 200 Gbps | Up to 150 Gbps | Modular cards; last OS PAN-OS 12.2; EOL Nov 21, 2031; replaced by PA-5500 Series |
| PA-5500 Series | Quantum-Optimized DC | Up to 375 Gbps App-ID | Up to 300 Gbps (PA-5580) | PA-5580/5570/5560/5550/5540; FE-400 ASIC, up to eight 400G interfaces, up to 4x PA-5400 threat perf |
| PA-7500 | Platinum / Hyperscale Chassis | Over 1.5 Tbps App-ID | — | FE400 ASIC, 400M+ concurrent L7 sessions, active clustering to 1.4 Tbps |
| PA-400R Series | Ruggedized OT / Industrial | — | — | PA-410R, PA-410R-5G, PA-450R, PA-450R-5G, PA-455R-5G; IP65, −40 °C to 70 °C, 150 W PoE |
| PA-50R Series | Ruggedized 5G — OT / critical infrastructure | Not yet published | Not yet published | New ruggedized 5G family announced Aug 2026; individual model numbers and throughput not yet published — do not quote figures |
Competitive Positioning
Defend the Refresh
Competitors will aggressively pitch switching during EoL-driven refresh cycles. Here is the PAN-centric response framework for each.
vs. Fortinet — FortiGate
Fortinet estimates ~650,000 firewall units reaching EoS by late 2026 — they are actively targeting PAN customers at EoL. Their pitch: ASIC-based throughput at lower cost with built-in SD-WAN. The reality: performance degrades sharply with all security services enabled, and switching means a full policy rebuild.
Where PAN Wins
- 30% higher performance with services enabled: Third-party Miercom testing confirms PAN NGFWs deliver 30% higher throughput across all parameters when security services are enabled. Fortinet's ASIC advantage disappears under real workloads.
- Real-time zero-day protection: Inline ML and deep learning stops patient-zero threats in seconds. Fortinet has no inline ML/DL on device — threat updates take up to 60 minutes.
- Migration simplicity: PAN-to-PAN refresh preserves all App-ID rules, security policies, objects, and NAT via Panorama/SCM. Fortinet migration requires a full policy rewrite and team retraining (6–18 month project).
- True Zero Trust: User-ID, App-ID, Device-ID natively integrated with continuous verification. Fortinet lacks foundational Zero Trust components.
- AI security (AIRS): Dedicated AI runtime security for LLM/AI workloads. Fortinet has no dedicated AI access/security solutions.
- Platform continuity: Feature parity across hardware, virtual, container, and SASE. Fortinet features vary by form factor with multiple management modes.
Landmines to Set
- "Ask Fortinet to demonstrate full-services throughput with AV + IPS + SSL + App Control all enabled simultaneously — using your real traffic profile, not synthetic benchmarks."
- "Ask Fortinet to detail the migration timeline and cost for rebuilding all your PAN App-ID policies from scratch in FortiOS."
- "What happens to 15+ years of accumulated WildFire/Precision AI intelligence tailored to your environment when you switch vendors?"
Traps They Set
- "Fortinet is cheaper" — Counter: Competitive vendors offer aggressive upfront pricing but hide costs in licensing complexity, management overhead, and integration. PAN delivers 30% higher performance with services on, so Fortinet often needs a larger box to match. Forrester TEI: 229% ROI, 7-month payback for PAN NGFW.
- "Fortinet performs better on benchmarks" — Counter: Ask which benchmarks. ASIC advantage shows in single-service synthetic tests. With all security services enabled, PAN maintains performance via SP3; Fortinet degrades significantly. Request a head-to-head PoC with actual traffic.
vs. Check Point — Quantum NGFW
Check Point claims 99.9% malware prevention (Miercom 2025) and fewer CVEs. Their pitch: stability and security efficacy. The reality: Check Point is a firewall vendor, not a security platform. They lack unified SOC, cloud-native NGFW, and AI workload protection.
Where PAN Wins
- Platform breadth beyond firewall: Check Point is firewall-first. PAN integrates NGFW + SASE + XSIAM + AIRS + Cortex into a single platform with shared telemetry. Customers consolidating vendors benefit disproportionately.
- Management modernity: SCM with AI Copilot and predictive analytics vs. SmartConsole + SmartDashboard + CLI. PAN management is cloud-native; Check Point's is mature but on-prem-centric.
- Cloud-native leadership: PAN leads in Cloud NGFW (AWS, Azure, GCP), software NGFW and SASE via Prisma Access. For Kubernetes and AI workloads the current answer is AI Runtime Firewall (Prisma AIRS) — CN-Series is end-of-sale Nov 1, 2026 and explicitly replaced by it. Check Point CloudGuard has less cloud-native integration.
- Gartner validation: PAN named Leader — furthest in Completeness of Vision in inaugural 2025 Gartner Magic Quadrant for Hybrid Mesh Firewall.
Landmines to Set
- "Check Point claims 99.9% malware prevention in Miercom — ask them to clarify what traffic mix was used and whether inline ML is truly inline or retrospective."
- "Ask Check Point about their roadmap for unified identity, cloud security, and AI-powered SOC outside of the firewall. Where is the platform?"
- "Switching from PAN to Check Point means rebuilding policies, retraining teams, and losing accumulated WildFire/Precision AI intelligence — ask for the full migration cost and timeline."
Traps They Set
- "Check Point has fewer CVEs" — Counter: CVE count alone is misleading. PAN's higher count partly reflects broader product surface area as the market share leader. PAN patches fast with rapid zero-day response. The real question: does Check Point's narrow footprint help when you need SOC, cloud, and identity coverage?
- "PAN is EOLing things too fast" — Counter: PAN provides a consistent 5-year support tail after EoS. PA-5000 had 5 years (2019 EoS → 2024 EoL). This is announced well in advance. The question isn't lifecycle policy — it's whether you want a hardware swap or a full platform migration to a narrower vendor.
vs. Cisco — Secure Firewall
Cisco leverages deep networking install base to pitch security as an add-on. Their pitch: "stay in the Cisco ecosystem." The reality: Cisco Secure Firewall evolved from ASA/FTD acquisitions — management is fragmented across converging consoles, and the SASE PoP footprint is limited.
Where PAN Wins
- Security-first architecture: Cisco Secure Firewall evolved from ASA/FTD and networking roots — not purpose-built for security. PAN was purpose-built as a security platform from day one.
- Management unification: SCM unifies firewalls, Prisma Access, and SD-WAN in one console. Cisco Security Cloud Control is still converging multiple management interfaces (FMC, FDM, CSM, CDO, ASDM).
- Inline ML (first vendor): PAN was the first NGFW vendor to deploy inline ML on the device. Cisco has no equivalent. SP3 delivers predictable performance vs. Snort branch-off degradation.
- SASE completeness: Prisma Access has 100+ global PoPs vs. Cisco's 30+. Critical for latency-sensitive global deployments.
- TLS 1.3 full support: PAN has hardware-accelerated TLS 1.3 decryption. Cisco offers only partial (certificate-only) decryption.
Landmines to Set
- "Ask Cisco when their management consoles (FMC, CDO, vManage, SSE) will be fully unified into a single pane of glass."
- "Challenge Cisco's PoP count — 30+ vs. PAN's 100+. How does this affect latency for users in secondary markets?"
- "Ask Cisco about feature parity across ASA, FTD, and Meraki. Can they deploy the same policy across all form factors?"
Traps They Set
- "We're already a Cisco shop — it's simpler to stay" — Counter: Cisco security evolved from networking, not security. PAN integrates with Cisco ISE via User-ID. You can keep Cisco for networking while using PAN for security — many of the largest enterprises run exactly this model.
- "ThousandEyes gives us DEM built-in" — Counter: ThousandEyes at full enterprise tier is a separate license. PAN's ADEM is included in Prisma Access — no add-on required.
Expand the Deal
Bundle Opportunities During Refresh
The hardware refresh is the entry point into platform expansion. Use these bundles to grow every refresh from a hardware swap into a platformization motion.
Strata Cloud Manager Pro
ESA Pro (replacing legacy ESA, EoS Nov 2025) includes SCM with unified visibility across hardware, virtual, and cloud-delivered firewalls. AI-powered policy assessment, 7-day capacity forecasting, and built-in Panorama → SCM migration workflow.
Prisma SASE Expansion
HQ/DC hardware refresh naturally opens the SASE conversation. Prisma SASE (4.0, Sept 2025, was the last numbered release; 2026 messaging dropped version numbers) includes Prisma Browser, endpoint DLP and branch app acceleration, with Prisma Access now at release 6.2 (June 2026). Shared config management in SCM bridges NGFW and Prisma Access policies. Forrester TEI for SD-WAN + NGFW: 247% ROI, $28.5M benefits.
Cortex XSIAM Telemetry
Current-gen hardware (PAN-OS 11.x/12.x) generates dramatically richer ML-enriched telemetry vs. legacy devices. XSIAM uses NGFWs as telemetry sensors, feeding the AI-native SOC data lake. XSIAM ARR grew >200% YoY; average ARR per client exceeds $1M.
Prisma AIRS
AI Runtime Security protects AI applications, LLM model traffic, and AI workloads. Inspects AI traffic inline via the NGFW — protects against prompt injection, sensitive data leakage, toxic content. Multi-cloud support (AWS, Azure, GCP, private cloud).
Business Case
Financial Justification
Forrester Total Economic Impact study (2024) for PAN NGFW. Composite organization: 50,000 employees, $7B revenue, 400 sites, 1,200 security incidents/week.
| Benefit Category | 3-Year PV | Key Drivers |
|---|---|---|
| End-user productivity gain | $5.18M | Reduced disruption & downtime; 45% cloud work; 8% time recapture |
| Data breach risk reduction | $2.78M | 50% reduction in breach likelihood over 3 years |
| Security infrastructure cost avoidance | $2.54M | Legacy firewall retirement; 15% of $8M annual security spend |
| Security & IT ops efficiency | $2.47M | Incidents reduced 25%→60%; MTTR 120→96 min; reimaging -50% |
| Security stack management efficiency | $1.13M | 50% time reallocation for 15 FTEs via platform consolidation |
Cost of NOT Refreshing
- Data breach on unpatched EoL hardware: Average enterprise breach cost $4.45M+ (IBM 2023). EoL hardware running PAN-OS 8.1 is permanently unpatched and actively targeted.
- Compliance violations: PCI-DSS, HIPAA, SOC 2, FedRAMP, ISO 27001 all require security updates. EoL firewalls trigger audit findings or disqualification. Fines: $10K–$100K+ per violation.
- Cyber insurance premium increase: EoL hardware flagged as material risk. Premiums 15–30%+ higher; coverage may be denied for breaches through EoL devices.
- Performance gap: Encrypted traffic volumes grew 90%+ in 5 years. PA-3000/5000 cannot decrypt at scale — blind spot in 90%+ of internet traffic.
- Operational overhead: 35% more management time vs. current-gen PAN NGFW. Legacy PAN-OS 8.1 has no ML, no CDSS, no WildFire integration.
Objection Handling
Common Objections
The refresh is too expensive right now.
Response: Forrester data shows 229% ROI with 7-month payback — the economics of staying on legacy hardware are worse than refreshing. Average enterprise breach on unpatched EoL costs $4.45M+. PAN NGFW reduces security incident investigation by 25–60%, MTTR by 20%, and management time by 35%. The refresh pays for itself in OpEx reduction. Plus, customers consolidating onto multiple PAN products (NGFW + SASE or NGFW + XSIAM) receive aggressive bundle discounts, and ELA/flexible financing is available.
Migration is too complex — we'll lose our configs.
Response: PAN provides an automated Panorama → SCM migration workflow built directly into the product at no additional cost. PAN-to-PAN migration preserves all App-ID rules, security policies, objects, and NAT — unlike a cross-vendor migration that requires full rebuild. Start with non-critical devices, validate, then move production. Requires PAN-OS 10.2.3+ on managed devices. Professional Services offer migration packages for complex deployments. Competitors require full policy rebuilds and retraining — PAN refresh is a hardware swap with config preservation.
Fortinet / Check Point is offering us a great deal to switch.
Response: Competitive vendors offer aggressive upfront pricing but hide costs in licensing complexity, management overhead, and 6–18 month cross-vendor migration projects. You'll rebuild all firewall policies, retrain SOC teams, and re-integrate SIEM/SOAR. You also lose years of accumulated WildFire/Precision AI intelligence tailored to your environment — that learning goes to zero. PAN delivers 30% higher performance with services enabled (Miercom), so Fortinet often requires a larger box to match. And PAN platformized customers have 119% net retention — they're getting MORE value over time. A hardware-only competitive deal breaks that compounding platform value.
We'll just extend third-party support on legacy hardware.
Response: Third-party support (e.g., Park Place Technologies) can extend break-fix hardware maintenance, but it cannot provide security patch updates, fix new CVEs, deliver PAN TAC support, or grant access to new software features. Running unpatched EoL hardware with third-party support leaves the device permanently vulnerable to any CVE published after EoL. Compliance frameworks (PCI-DSS, HIPAA, NIST) require patching against known vulnerabilities — third-party hardware support does not satisfy this requirement.
Our security team is burned out on PAN CVEs.
Response: PAN has invested heavily in security hardening in PAN-OS 11.x/12.x — improved secure boot (UEFI), TPM module for key storage, faster patch velocity. Hardware refresh to current-gen gives clean, hardened hardware with no accumulated technical debt. High CVE count partially reflects PAN's market share leadership — more researchers, more scrutiny, more disclosed CVEs. PAN-OS 12.2 "Ceres" (July 30, 2026) is the current train and adds PAN-OS Shield inline protection plus Advanced Virtual Patching-era defences. The Enterprise Support Agreement (ESA) remains the current support vehicle, and Strata Cloud Manager Pro activates through it on a single auth code.
We're not ready to move off Panorama to SCM.
Response: Panorama is not being deprecated. New hardware (PA-3400, PA-5400, etc.) supports both Panorama and SCM natively. Migration can be phased over time — not required at hardware refresh. Panorama has no announced EOL, but Panorama multi-tenancy closed to greenfield deployments on April 15, 2026, and SCM shipped Panorama-migration tooling in mid-2026. SCM offers AI-powered Copilot, predictive analytics, unified NGFW + SASE policy management, and the six new AI-powered Network Security Agents announced Aug 4, 2026. Many customers start with hardware refresh on Panorama and migrate to SCM progressively.