Sales Enablement
Competitive Intelligence
Know How Palo Wins
Battle cards organized by product group. Feature matrices, win themes, landmines, traps, and objection handling for every major competitor.
Seller brief
TL;DR
Battle cards organized by product group. Feature matrices, win themes, landmines, traps, and objection handling for every major competitor.
- Where we win and where they're strong
- Who to target: not a separate section on this page
- Discovery questions: not a separate section on this page
- Landmines and traps: not a separate section on this page
- Objection handling: not a separate section on this page
- Proof points: not a separate section on this page
- Technical differentiators: not a separate section on this page
- Details
Details
Battle Cards by Product
Choose Your Battleground
Select a product group to see competitive matrices, battle cards, landmines, and objection handling.
Network Security
Strata NGFW vs Fortinet, Check Point, and Cisco. SP3 performance, App-ID superiority, quantum readiness, and platform breadth.
SASE
Prisma SASE (Prisma Access 6.2, $1.5B+ ARR) vs Zscaler, Netskope, Fortinet SASE, and Cisco. ZTNA 2.0, Prisma Browser, SaaS SLAs, and cloud-native architecture.
SecOps / XSIAM
Cortex XSIAM 3.6 vs CrowdStrike Falcon NG SIEM, Splunk, and Microsoft Sentinel. AI-native SOC, 98% MTTR reduction, NG-SIEM / Enterprise / Premium tiering.
Endpoint Protection (EPP)
Endpoint prevention vs entry-level EPP. Multi-layer prevention, device control, host firewall, disk encryption. Current packaging is Cortex XDR Pro EP / EP Cloud on the Enterprise Runtime Security base; "Prevent" is legacy 3.x tiering still found in the installed base.
EDR — Detection & Investigation
Cortex XDR 5.2 vs advanced EDR. Tailored data collection, XTH threat hunting, third-party log ingestion. "Pro per Endpoint" is legacy 3.x tiering — quote Cortex XDR Pro EP today.
XDR — Full Visibility Platform
Cortex XDR 5.2 vs XDR platforms and SIEM alternatives. The bridge to XSIAM. "Pro per GB" is legacy 3.x tiering; current licensing is Cortex XDR Pro EP / EP Cloud on an Enterprise Runtime Security (XDR) + Core Analytics base.
Cloud Workload Protection
Cloud workload protection vs cloud-native security. Kubernetes, containers, and hybrid workload coverage under Cortex Cloud. "Cloud per Host" is legacy 3.x tiering. CN-Series goes end-of-sale Nov 1, 2026 — AI Runtime Firewall is the replacement.
XDR Managed (MDR)
Cortex MDR — Cortex XDR managed by Unit 42. Palo-operated, not partner-delivered. 24/7 detection & response.
XSIAM MDR — Managed XSIAM
Unit 42 Managed XSIAM 2.0 — AI SOC operated by Palo. 24/7 continuous detection engineering, machine-speed response, 250h IR guarantee. Palo-run, not partner-delivered.
Cloud Security
Cortex Cloud vs Wiz, Orca, CrowdStrike Falcon Cloud, and Microsoft Defender. Four modules: Application Security, Cloud Posture, Runtime Security and Exposure Management.
Identity Security
Idira — formerly CyberArk, GA May 12, 2026 — vs BeyondTrust, Delinea, SailPoint, and Okta. PAM, machine identity, AI agent security, and the XSIAM integration (Idira EPM via Cortex Marketplace, ITDR 2.0 in XDR 5.2).
ITOps & Observability
PAN + Chronosphere (closed Jan 29, 2026, $3.35B, brand retained, >$300M ARR) vs Datadog, Splunk Observability, Dynatrace, New Relic. Cloud-native observability meets security — note there is no product called "Cortex Observability".
AI Workforce
Cortex AgentiX 1.4 vs Splunk SOAR, Swimlane, Tines, and ServiceNow SecOps. Why agentic AI agents beat static playbooks. Per-user licensing, FedRAMP Moderate and High, frontier-model choice — and XSOAR is still sold standalone.
Compete by Solution
Solution-Specific Battle Cards
Deep-dive competitive intelligence organized by PAN solution area — perfect for deal-specific positioning.
Prisma AIRS
Prisma AIRS 3.0 vs Cisco/Robust Intelligence, HiddenLayer, Lakera, Wiz AI-SPM, and CrowdStrike. AI Model Security, AI Runtime Security, AI Agent Security, AI Red Teaming, AI-SPM.
CNAPP — Cortex Cloud vs Tenable NEW
Source-checked CNAPP landscape as of September 14, 2026. Tenable One Cloud Exposure led, plus Wiz now inside Google Cloud, CrowdStrike, Defender, Orca, Sysdig and Upwind. Includes Tenable One licensing ratios, the limits of Cortex vulnerability management outside the cloud, and an honest list of our own documented weaknesses.
Cortex Console NEW
Agentic enterprise operations — Console acquisition announced September 1, 2026, terms undisclosed. Two competitive lanes: AI service management against ServiceNow and Serval, and agentic SOC execution against Charlotte AI and Torq. Win on the security-to-IT handoff. No Cortex SKU or GA date announced yet.
Cortex AES (Koi) NEW
Agentic Endpoint Security — Koi acquisition closed April 14, 2026. Compete vs Snyk, GitGuardian, CrowdStrike, SentinelOne, and Defender for AI-tool risk on the endpoint. AES is now integral to the Cortex XDR agent from 5.2, with zero additional deployment.
Strata Cloud Manager
SCM Pro vs FortiManager, Check Point SmartConsole, Cisco FMC/SCC, and Juniper. AI-powered unified management for NGFW, SASE and AIRS — two tiers only, Essentials (free) and Pro (paid).
NGFW Hardware Refresh
Positioning current-gen PA-Series on PAN-OS 12.2 "Ceres" during EoL refresh cycles. Live dates: PA-5450 end-of-sale Nov 22, 2026 (→ PA-5500 Series), PA-7000 Series end-of-sale Dec 31, 2025 (→ PA-7500), K2-Series end-of-life Feb 28, 2026. Why stay with PAN vs Fortinet, Check Point, or Cisco.
GlobalProtect & Prisma Agent
GP to SASE migration play. Prisma Access Agent vs Zscaler, Netskope, Cisco, Fortinet. ZTNA 2.0, ADEM and PQC for GlobalProtect — GlobalProtect is not retired, this is a migration.
Enterprise Agreement
PAN EA/ELA vs Fortinet bundles, Check Point Infinity ELA, Cisco EA, Zscaler per-user, CrowdStrike per-endpoint. Urgent: legacy ELA SKUs go end-of-sale Aug 20, 2026, replaced by ELA8.
At a Glance
Platform Capability Comparison
How PAN's unified platform stacks up across key capability areas, current as of August 2026: PAN-OS 12.2 "Ceres", Prisma Access 6.2, XSIAM 3.6, Cortex XDR 5.2, Cortex Cloud, Prisma AIRS 3.0, Xpanse Expander 2.14, Cortex AgentiX 1.4.
| Capability | PAN | CrowdStrike | Microsoft | Cisco/Splunk | Fortinet | Zscaler | Wiz |
|---|---|---|---|---|---|---|---|
| Network Security | Leader | None | None | Moderate | Strong | None | None |
| SASE | Leader | None | Basic | Basic | Moderate | Strong | None |
| SecOps / SIEM | XSIAM 3.6 | Growing | Moderate | Legacy | Basic | None | None |
| Cloud Security | Cortex Cloud | Growing | Azure-first | Basic | Basic | Limited | Leader |
| Identity | Idira | Moderate | Entra | Basic | Basic | Basic | None |
| AI Security | AIRS 3.0 | Limited | Copilot | None | None | None | Limited |
| Endpoint (XDR) | XDR 5.2 | Leader | Defender | Basic | Moderate | None | None |
| Observability | Chronosphere | None | Basic | Splunk Obs | None | None | None |