Cortex — Endpoint Protection
Cortex Prevent
Endpoint Protection Platform
The entry-level PANW endpoint product that gets you into the account. ML-driven NGAV with a seamless upgrade path to XDR Pro — same agent, same console, no re-imaging.
~$50–60
Per Endpoint/Yr
1 Agent
Prevent → Pro → MDR
Gartner
EPP Leader × 3
Product brief
One-line value
The entry-level PANW endpoint product that gets you into the account. ML-driven NGAV with a seamless upgrade path to XDR Pro — same agent, same console, no re-imaging.
- Who buys: not a separate section on this page
- Pains solved: not a separate section on this page
- Discovery questions
- Key capabilities
- Competitors: not a separate section on this page
- Related plays: not a separate section on this page
- Details
Discovery questions
Pre-Sales
Scoping Checklist
Data points to collect before quoting endpoint protection. Current SKU names, not legacy 3.x tiering.
Endpoint Count by OS — Windows, macOS and Linux seats to protect, plus server vs workstation split. Sizes Cortex XDR Pro EP (the current successor to the legacy Prevent tier).
Incumbent AV/EPP & Contract End Date — Symantec/Broadcom SEP, Trellix, Sophos or Defender AV — seat count, annual spend and exact renewal date.
Dual-Agent Constraints — Which agents must coexist during migration, and whether third-party EDR stays in place (AES can run alongside third-party EDR).
Legacy vs Current SKU — Confirm whether the account is on a legacy XDR 3.x Prevent contract to be renewed/converted, or a greenfield quote on Cortex XDR Pro EP + Enterprise Runtime Security (XDR) + Core Analytics.
OS Images & Agent Certification — Golden images, kernel restrictions and OS versions to certify against XDR agent 9.3 (released Jul 26, 2026).
Device Control & Encryption Requirements — USB/peripheral policy scope and whether BitLocker/FileVault management replaces an existing tool.
Data Residency & Tenant Region — Required tenant region and any sovereignty or air-gap constraint.
Upgrade Trigger — Whether detection/investigation (EDR analytics, UEBA, Forensics, Host Insights) is needed now — if so, quote the Pro EP add-on catalog rather than an EPP-only footprint.
Log Volume for Analytics — Estimated GB/day if the account will also take XSIAM NG-SIEM (Analytics tier minimum 100 GB/day).
Deployment Services Scope — Number of sites, deployment waves, and whether a Cortex XMDR Specialization partner or Unit 42 will assist.
Sales Conversations
Discovery Questions
Questions to uncover legacy AV pain points and qualify the Prevent on-ramp opportunity.
01
What endpoint protection product are you running today, and when does that contract expire?
02
Have you experienced any malware incidents in the last 12 months that your current AV missed or was slow to detect?
03
Are you managing your endpoint protection from a cloud console, or is it still on-premises with a local server?
04
Do you have compliance requirements (PCI DSS, HIPAA, CMMC) that require documented endpoint protection coverage and disk encryption?
05
Are you running Palo Alto NGFWs today? If so, would unified endpoint + network visibility be valuable for your security team?
06
Is your current AV vendor providing ML-based behavioral detection, or are you still primarily reliant on daily signature updates?
07
What's your appetite for growing into full EDR and SOC capabilities in the next 12–24 months? Prevent gives you that runway without re-deploying agents.
08
How many endpoints are you protecting across Windows, macOS, and Linux — and are all of them currently covered by an active EPP license?
Key capabilities
Overview
What is Cortex Prevent?
Cortex Prevent is PANW's entry-level endpoint protection platform—the EPP tier of the XDR license stack. It replaced the legacy Traps agent and is delivered via the same cloud-managed XDR agent, meaning customers who grow into Pro or MDR require no re-imaging or agent replacement—they simply license up.
Prevent is the platform on-ramp. It establishes the PANW beachhead on every endpoint, enabling the full Cortex platform conversation—XDR Pro detection, Unit 42 MDR, XSOAR automation, and ultimately XSIAM. Every Prevent customer is a future XDR Pro, XSIAM, or MDR opportunity.
Legacy packaging — read before quoting.
“Cortex Prevent” is the EPP tier of the legacy Cortex XDR 3.x four-tier model (Prevent / Pro per Endpoint / Pro per GB / Cloud per Host). Current Cortex XDR 5.x licensing is Cortex XDR Pro EP (on-prem endpoints) and Cortex XDR EP Cloud (cloud workloads and containers), both on the Enterprise Runtime Security (XDR) + Core Analytics base, with the same add-on catalog as XSIAM. Sell Cortex XDR Pro EP for AV displacement — the same agent, now at version 9.3, with AES included at no extra deployment — and use XSIAM NG-SIEM/Enterprise where the SOC is the buying centre. The detail on this page is retained because installed-base renewals and migrations still run on it.
“Cortex Prevent” is the EPP tier of the legacy Cortex XDR 3.x four-tier model (Prevent / Pro per Endpoint / Pro per GB / Cloud per Host). Current Cortex XDR 5.x licensing is Cortex XDR Pro EP (on-prem endpoints) and Cortex XDR EP Cloud (cloud workloads and containers), both on the Enterprise Runtime Security (XDR) + Core Analytics base, with the same add-on catalog as XSIAM. Sell Cortex XDR Pro EP for AV displacement — the same agent, now at version 9.3, with AES included at no extra deployment — and use XSIAM NG-SIEM/Enterprise where the SOC is the buying centre. The detail on this page is retained because installed-base renewals and migrations still run on it.
Best-fit for Prevent: Organizations replacing legacy AV (Symantec, McAfee/Trellix, Sophos). Especially powerful when the prospect is already a PANW firewall customer—enables immediate platform consolidation narrative.
What's Included
Prevention Capabilities
Multi-method prevention that stops known malware, unknown zero-days, fileless attacks, and ransomware.
Next-Gen Antivirus (NGAV)
Blocks known and unknown malware using a multi-method approach: signature-based, local machine learning, behavioral heuristics, and WildFire cloud analysis in sequence.
Behavioral Protection
Detects and blocks behavioral-based attacks—malicious process behaviors, script-based attacks, and living-off-the-land techniques—without relying on signatures.
Exploit Prevention
Multi-stage exploit protection blocking heap spray, ROP chains, and privilege escalation before the payload executes. Effective against zero-days without needing a signature.
Fileless Malware Prevention
Detects and blocks attacks that never write to disk—PowerShell abuse, WMI exploitation, in-memory code injection. Critical for modern ransomware and nation-state TTPs.
Device Control
Granular USB and removable media policies by device type, serial number, or user/group. Enforces data protection policies at the hardware layer across all managed endpoints.
Host Firewall
Application-level firewall policies managed centrally from the cloud console. No separate firewall agent required — enforced through the unified XDR agent.
Disk Encryption Management
BitLocker (Windows) and FileVault (macOS) enforcement and key escrow management from the cloud console. Satisfies PCI, HIPAA, and CMMC encryption-at-rest requirements.
WildFire Integration
Unknown files auto-submitted to PANW's WildFire cloud sandbox. Verdicts returned in minutes; shared across 70,000+ customers — one detection protects the entire install base.
Details
Competitive Positioning
AV Displacement Positioning
How to position Prevent against the most common legacy AV vendors in the installed base.
Symantec (Broadcom) Endpoint Security
Large legacy installed base. Displace on modern ML/behavioral coverage, cloud management simplicity, and PANW platform upgrade path. Broadcom acquisition has created license complexity and support concerns customers are eager to escape.
Trellix (McAfee + FireEye)
Major post-merger disruption created licensing confusion and product uncertainty. Displace on platform cohesion, AI/ML capabilities, and the clear PANW upgrade trajectory from Prevent → XDR Pro → XSIAM.
Sophos Intercept X
Strong in SMB/mid-market; Sophos's MDR service creates stickiness. Displace on PANW ecosystem integration, WildFire intelligence breadth, and the single-agent upgrade path. Sophos has no comparable platform consolidation story.
Microsoft Defender Antivirus
Organizations not on M365 E5 lack Defender XDR capabilities. Displace on behavioral detection depth, non-Microsoft asset coverage (Linux, network, cloud), and management flexibility outside Azure.
Trend Micro Apex One
Common in Asia-Pacific mid-market accounts. Displace on cloud management centralization, PANW ecosystem integration, and the consolidation story from EPP to full SIEM/SOC platform.
Webroot / Malwarebytes
SMB point solutions with no enterprise upgrade path. Displace on enterprise-grade capabilities, compliance documentation, and MSSP delivery via Optiv — without the feature gaps of entry-level AV tools.
Platform Expansion
The Upgrade Path
Prevent is Step 1. One agent, same console — each step unlocks more capability without re-deployment.
1
Cortex Prevent Start Here
Replace legacy AV. Establish the XDR agent on all endpoints. Get NGAV, behavioral protection, exploit prevention, WildFire, and device control. ~$50–60/endpoint/yr. No data lake, no EDR analytics.
2
Cortex XDR Pro per Endpoint
Add a Pro license — no agent change, no re-imaging. Unlocks EDR analytics, UEBA, causality chain investigation, 30-day data retention, and automated response. ~$81/endpoint/yr. Optiv services opportunity: tuning, policy migration, content packs.
3
Unit 42 MDR (Cortex Pro)
Add Unit 42 24/7 monitoring on top of XDR Pro. Requires XDR Pro license as prerequisite. Unit 42 analysts operate in the same XDR console — no new tooling. Replaces a standalone MDR vendor without disrupting the endpoint stack.
4
Cortex XSIAM
Graduate to the full AI-driven SOC platform. XDR Pro endpoint agents feed XSIAM natively — no re-instrumentation. XSIAM Enterprise includes XDR Pro per Endpoint, adds NG-SIEM, full SOAR, cloud detection, and ASM. Replaces legacy SIEM entirely.
Licensing
Pricing & Licensing
~$50–60
Per Endpoint / Year
100+
Endpoint Minimum (Direct)
30-day
Trial Available
- ✓ Per endpoint, per year — subscription model, no perpetual licenses
- ✓ Cortex Data Lake not included at Prevent tier — data lake ingestion unlocked at Pro
- ✓ Volume discounts apply at enterprise scale; multi-year discounts available
- ✓ MSSP pricing track available for Optiv to deliver to SMB clients at scale
- ! No setup fee for cloud deployment; no reboot required on agent installation