PAN Translator
What They Say → What We Solve

"ML-powered NGFW on PAN-OS 12.2 'Ceres' with App-ID, FE400 ASIC, and integrated security subscriptions — including the new Advanced IP Defense and Advanced Virtual Patching — managed through Strata Cloud Manager."

"Another firewall vendor trying to sell me expensive hardware I'll have to replace in 4 years."

Lead with TCO, not features. HW refresh cycles are 4-5 years. The real play is showing that the PA-series + SCM Pro + security subscriptions replace 3-4 point products (FW + IPS + URL + DNS + IoT/OT). SCM has exactly two tiers — Essentials (free) and Pro (paid) — and SCM Pro is bundled into the ESA via a single auth code. Position the NGFW as the on-ramp to the full platform — not the destination. Hard dates to lean on: PA-5450 End-of-Sale Nov 22, 2026 → PA-5500 Series; K2-Series End-of-Life Feb 28, 2026.

"$1.5B+ ARR SASE platform — Prisma Access 6.2 with ZTNA 2.0, Enterprise DLP, Enterprise CASB, Prisma Browser, and Prisma SD-WAN — all in one agent."

"Sounds expensive. We just want to replace our VPN and maybe add some web filtering."

Start with GlobalProtect migration. GP → Prisma Agent is the lowest-friction entry. Show them the Prisma Browser demo — IT and procurement teams love the SaaS visibility, and browser telemetry now lands natively in Cortex XDR and XSIAM as of XDR 5.2. Once the agent is deployed, expanding to ZTNA 2.0 and full SASE is an upsell conversation, not a new sale. Note GlobalProtect is not retired — the Prisma Access Agent transition is a migration.

"AI-driven SOC platform replacing SIEM, SOAR, XDR, ASM and ITDR. XSIAM 3.6 (GA Jul 20, 2026): >$600M ARR up 100% y/y, 740 customers, >17 PB/day ingested, 60% achieve MTTR under 10 minutes. Tiers are NG-SIEM, Enterprise and Premium."

"We just renewed our Splunk/Sentinel contract. We're not ripping that out anytime soon."

Don't fight the renewal. Flank it. Position XSIAM as the next-gen layer on top. Start with Cortex XDR 5.2 endpoint data (Pro EP or EP Cloud on the Enterprise Runtime Security base), add cloud telemetry, then ask: "What would it take to retire your SIEM when that contract ends?" Plant the seed 12-18 months early. The ~$1M avg ARR per customer makes this worth the long game. Note Enterprise Plus is retired — quote Premium when the customer needs the full cloud posture bundle.

"Cortex Cloud 2.2 — unified CNAPP + CDR across four modules: Application Security, Cloud Posture Security, Cloud Runtime Security and Security Operations. Code-to-cloud visibility, SmartScore, autonomous AI agents, and runtime protection."

"We already have Wiz for posture. We're good on cloud security."

Wiz doesn't do runtime. Agentless-only CSPM is a snapshot — not protection. Lead with CDR (Cloud Detection & Response) and runtime enforcement. Show the gap: "What happens between your Wiz scans?" Then layer in the platform story — Cortex Cloud + XSIAM = cloud telemetry feeding the SOC natively. Prisma Cloud is legacy; the official path is "upgrade from Prisma Cloud to Cortex Cloud." For Kubernetes firewalling, CN-Series is End-of-Sale Nov 1, 2026 and is replaced by AI Runtime Firewall (Prisma AIRS).

"Prisma AIRS 3.0 (Mar 23, 2026) secures agentic AI — AI Model Security, AI Runtime Security, AI Agent Security, AI Red Teaming and AI-SPM. 100+ customers, nine-figure pipeline."

"We're still figuring out our AI strategy. It's too early for AI security."

Shadow AI is already in their environment. Employees are using ChatGPT, Copilot, and custom LLMs whether IT approved them or not. Lead with discovery: "Do you know how many AI apps your users are accessing today?" Protect AI is fully absorbed, giving PAN model-level security no one else has, and Portkey (closed May 29, 2026) becomes the AI Gateway for Prisma AIRS. AIRS is now funded by Software NGFW Credits and is the stated replacement for CN-Series via AI Runtime Firewall.

"~$25B CyberArk acquisition, closed Feb 11, 2026 and rebranded Idira, GA May 12, 2026 — Idira Privileged Access Manager, Idira Secrets Hub, Certificate Manager, Idira Secure AI Agents. PAM for human, machine, and agentic AI identities. The identity pillar completes the platform."

"We already have an identity vendor. CyberArk is just PAM — we need more than that."

Machine identities are the blind spot. Most customers have human PAM covered but zero governance over service accounts, API keys, and AI agent identities. Lead with: "How many non-human identities do you have?" The answer is always 10-50x more than human accounts. Idira + XSIAM identity telemetry is the cross-sell, and it is shipping: Idira Endpoint Privilege Manager integrates via Cortex Marketplace as of XSIAM 3.5, and ITDR 2.0 landed in XDR 5.2 with Conditional Access Policies for Okta, Entra and on-prem AD plus AD Security Posture Management.

"Chronosphere (closed Jan 29, 2026 at $3.35B, brand retained, >$300M ARR) is the Palo Alto Networks Observability platform. Telemetry Pipeline reduces data volumes 30%+. Metrics, logs, traces — all cloud-native. Embrace (mobile RUM) intent announced Jul 21, 2026, close expected Q1 FY2027."

"We have Datadog. Observability isn't a security problem."

Datadog costs are the real pain. Customers are getting crushed by Datadog's per-host and custom metrics pricing. Chronosphere's Telemetry Pipeline can sit in front of ANY backend and cut costs 30%+, and it is natively integrated into Cortex XDL 2.0. Start there. Then show how Chronosphere bridges the ITOps/SecOps gap — one telemetry plane for both teams. Be precise on naming: there is no product called "Cortex Observability"; the Cortex tie-in is a Cortex AgentiX integration and it is not yet GA.

"Cortex AgentiX 1.4 (July 2026) — agentic AI workforce trained on 1.2B playbook executions. 6 prebuilt agents. 98% MTTR reduction. No-code builder with MCP support, frontier model choice, Cortex XTI, FedRAMP Moderate and High. Licensed per user per year: Enterprise (4 users / 800 CU) or Base (2 users / 400 CU)."

"AI hype. Our team doesn't trust automated remediation — too risky."

Start with investigation, not remediation. Most SOC teams are drowning in Tier-1 triage. Position the Threat Intel and Email Investigation agents first — they investigate and recommend, humans approve. Once trust is built, expand to autonomous remediation. The 1.2B execution dataset is the moat no competitor can replicate. Positioning note: Palo Alto calls AgentiX "the natural evolution of our market-leading SOAR platform" — but XSOAR (8.13 on-prem, 8.15 SaaS) is still sold standalone, so don't tell a customer XSOAR is going away.