OMS
OMS by Platforms
Two Platforms, One Vision
Flip the lens — see how the entire Optiv Market System collapses into Palo Alto Networks' two unified management planes.
Guide
Two Platforms, One Vision: Palo Alto Networks is consolidating its security portfolio into two management planes — Strata Cloud Manager (SCM) for network/infrastructure security and Cortex (XSIAM) for security operations. Idira (formerly CyberArk, acquisition closed Feb 11, 2026, GA May 12, 2026) is being integrated into both as the identity fabric.
Strata Cloud Manager
Network & Infrastructure Security Platform
| OMS Domain | What SCM Covers |
|---|---|
| Infrastructure | NGFWs (PA-400 to PA-7500) on PAN-OS 12.2 "Ceres", IoT/OT Security (PA-400R and PA-50R ruggedized; K2-Series reached end-of-life Feb 28, 2026), DNS Security, Advanced IP Defense, Advanced Virtual Patching, all CDSS subscriptions |
| Infrastructure (SASE) | Prisma Access 6.2, Prisma SD-WAN, Prisma Browser, Enterprise CASB, Enterprise DLP, ADEM |
| AI Security | Prisma AIRS 3.0 — AI Model Security, AI Runtime Security, AI Agent Security, AI Red Teaming, AI-SPM; AI Runtime Firewall replaces CN-Series (end-of-sale Nov 1, 2026) |
| Data Protection | Enterprise DLP across SASE and NGFW, data classification, Prisma Browser masking/blocking |
| Privacy | DLP enforcement, Prisma Browser mask/block/prevent controls for privacy compliance |
| Risk | SCM Compliance Centre, security posture visibility, config compliance across all managed devices. SCM has two tiers only — Essentials (free) and Pro (paid); SCM Pro ships in the ESA via a single auth code |
| Identity * | Idira identity integration, identity-based firewall policy, User-ID, Next-Generation Trust Security certificate lifecycle (Mar 23, 2026) |
Cortex / XSIAM
Security Operations & Cloud Platform
| OMS Domain | What Cortex Covers |
|---|---|
| Operations | XSIAM 3.6 (SIEM + SOAR + XDR 5.2, with ASM, Exposure Management and ITDR 2.0 as modules) — tiers are NG-SIEM, Enterprise and Premium; AgentiX 1.4, MCP, natural-language XQL and natural-language dashboards, frontier model choice |
| Operations (Observability) | Chronosphere (brand retained; there is no "Cortex Observability" product) — Telemetry Pipeline, metrics/logs/traces; Cortex AgentiX integration is announced but not yet GA |
| Infrastructure (Endpoint) | Cortex XDR 5.2 agent (Pro EP / EP Cloud on the Enterprise Runtime Security base) — endpoint detection, prevention and forensics, with Agentic Endpoint Security (AES) integral to the agent from 5.2 |
| Infrastructure (Cloud) | Cortex Cloud — four modules: Application Security, Cloud Posture, Runtime Security and Exposure Management |
| Application Security | Cortex Cloud ASPM, code-to-cloud scanning, WildFire sandboxing, container runtime |
| Offensive Security | Prisma AIRS AI Red Teaming, Unit 42 (including Frontier AI Defense), XSIAM detection validation, Exposure Management |
| Risk | Exposure Management (now a distinct XSIAM/XDR module, separate from Xpanse/ASM), Xpanse Expander 2.14, Cortex Cloud compliance, attack surface visibility |
| Identity * | Idira Privileged Access Manager for SOC privileged access, Idira Endpoint Privilege Manager via Cortex Marketplace (XSIAM 3.5), ITDR 2.0 in XDR 5.2, identity-correlated threat detection |
* Idira Identity Integration: CyberArk closed Feb 11, 2026 (~$25B) and was rebranded Idira, GA May 12, 2026 at IMPACT 2026. It serves as the identity fabric across both SCM and Cortex. Shipping today: Idira Endpoint Privilege Manager integrates with XSIAM via Cortex Marketplace (XSIAM 3.5), ITDR 2.0 landed in XDR 5.2, and Next-Generation Trust Security brings machine-identity integration into SCM. Confirmed product names are Idira Privileged Access Manager, Idira Secrets Hub, Certificate Manager and Idira Secure AI Agents.