Sell
Platformization
Why the Best Security Teams Consolidate
The average enterprise now runs 80+ security tools. Learn how Palo Alto Networks' platformization thesis unifies 7 pillars into one data model — and why 1,550+ customers are buying in at record pace.
The Problem
Vendor Sprawl Is Killing Security
Enterprises now average 80+ security tools across their stack — creating massive gaps, redundant spend, and alert fatigue that attackers exploit daily.
Integration Overhead
With 80+ tools, each requiring its own connectors, APIs, and maintenance — integration overhead alone can consume 30%+ of security engineering cycles.
Talent Shortage
3.5M+ unfilled cybersecurity roles globally. Each additional vendor multiplies staffing requirements.
Alert Fatigue
Siloed tools generate thousands of uncorrelated alerts daily — real threats hide in the noise.
The Thesis
One Platform. One Data Model.
Seven pillars unified under a single-pane management experience. Data gravity means better detection, faster response, and lower cost.
Network
Strata NGFWs
SASE
Prisma Access + SD-WAN
SecOps
XSIAM AI SOC
Cloud
Cortex Cloud CNAPP
AI Security
Prisma AIRS
Identity
Idira (formerly CyberArk)
Observability
Chronosphere (brand retained)
Proof Points
The Numbers Speak
Platformization isn't a theory — it's the fastest-growing motion at Palo Alto Networks. Figures below are Q3 FY2026 (quarter ended April 30, 2026, reported June 2, 2026).
Marquee Platformization Deals
$30M SASE + $20M XSIAM — full platform consolidation for a global automotive leader.
XSIAM-led SOC modernization for a major global technology supplier.
Expanded platform footprint around XSIAM for an IT services provider.
TCO Framework
Before vs. After Consolidation
The math on vendor consolidation is compelling. Typical customers reduce from 80+ fragmented tools to a unified platform with 30–40% TCO savings.
Positioning
How to Position Platformization
A 3-step conversation framework for engaging customers on consolidation.
Quantify Current Spend
Ask the customer to list every security tool in their stack with annual cost. Most are shocked when they realize they're running 80+ tools totaling far more than expected. Include maintenance, integration, and headcount costs — these hidden costs often exceed license spend.
Map Overlap to PAN Capabilities
Walk through their tool inventory and map each one to a PAN platform capability. Show where XSIAM replaces SIEM + SOAR + XDR, where SASE replaces VPN + SWG + CASB, and where Cortex Cloud replaces multiple CSPM/CWPP tools.
Model Consolidated TCO
Build a side-by-side comparison showing current vs. platformized cost. Include the platformization discount, reduced integration/headcount costs, and improved security outcomes. Typical result: 30–40% TCO reduction with better coverage.
Strategic Moves
Acquisitions That Enable Platformization
The 2026 acquisition run that extends PAN's platform into identity, observability, AI security, agentic endpoint, AI gateway, and mobile observability.
Idira (formerly CyberArk)
Largest PAN acquisition ever. Rebranded Idira, GA May 12, 2026 at IMPACT 2026, positioned as the next-generation identity security platform built for the AI enterprise. Adds privileged access management for human, machine, and agentic AI identities. Identity is now a core platform pillar. Say "Idira" — CyberArk is history, not the current brand.
Identity PillarChronosphere
Gartner MQ Leader in Observability. Brand retained — the umbrella term is the Palo Alto Networks Observability platform, and there is no product called "Cortex Observability". Observability ARR is now above $300M. Telemetry Pipeline is natively integrated into Cortex XDL 2.0 for 30%+ noise reduction. The AgentiX integration is not yet GA — do not demo or commit to it.
Observability PillarProtect AI
Bolsters Prisma AIRS with AI model security, vulnerability scanning, and ML supply chain protection. Extends AI security posture management.
AI SecurityKoi Security
Application Extension Security. Now GA inside the Cortex XDR agent as of Cortex XDR 5.2. Price was officially undisclosed — the ~$400M figure is press-reported, so caveat it in customer conversations.
ClosedPortkey
Brings the AI Gateway into Prisma AIRS 3.0 — inline control over model and agent traffic. Deal value was not disclosed; do not quote a number.
AI SecurityEmbrace
Mobile real user monitoring, extending the Observability pillar to the mobile app experience. Close expected in Q1 FY2027. Value undisclosed — treat as intent, not a shipping capability, and do not quote a price.
Pending CloseThe Next Wave
Agentic AI Accelerates Platformization
Cortex AgentiX transforms platformization from consolidation into autonomous operations — AI agents that act across every pillar.
1.2B Playbook Executions
AgentiX agents are trained on a decade of real-world SOAR data — the largest security automation dataset in the industry. They don't just alert; they investigate and remediate.
98% MTTR Reduction
Autonomous agents across Threat Intel, Email, Endpoint, Network, Cloud, and IT — with Chronosphere observability feeding in real-time telemetry for autonomous remediation.
Enterprise Guardrails
RBAC, scope-based access control, human-in-the-loop approvals, and full auditability. Agents operate within governance boundaries — not as black boxes.
Financial Performance
Platform Economics at Scale
Q3 FY2026 results (quarter ended April 30, 2026, reported June 2, 2026). Revenue $3.002B, up 31% y/y. NGS ARR $8.13B, up 60% — $1.63B of that from M&A, so ex-M&A NGS ARR is $6.5B, up 28%. FY2026 guidance: revenue $11.415–11.425B and non-GAAP EPS $3.77–3.79. FY2027 guidance has not been issued; Q4 and full-year FY2026 report on September 1, 2026.