PAN Portfolio — Quick Reference

Resources

Quick Reference
Everything in One Page

A compact, printable cheat sheet with key numbers, platform overview, competitor positioning, and contacts.

Platform Overview

  • Strata (NGFW), PAN-OS 12.2 "Ceres": PA-500 Series to PA-7500 with FE400 ASIC — ML threat prevention, App-ID, Advanced IP Defense, Advanced Virtual Patching. Managed in Strata Cloud Manager (Essentials free / Pro paid).
  • Prisma SASE: $1.5B+ ARR — Prisma Access 6.2, Prisma SD-WAN, Prisma Browser, Enterprise CASB, Enterprise DLP. SASE 4.0 (Sept 2025) is the last numbered release.
  • Cortex XSIAM 3.6 (GA Jul 20, 2026): >$600M ARR, 740 customers, >17 PB/day — unified SIEM + SOAR + XDR + ASM + ITDR. Tiers: NG-SIEM / Enterprise / Premium.
  • Cortex XDR 5.2 (agent 9.3) — AES integral to the agent, ITDR 2.0, Prisma Browser native integration.
  • Cortex AgentiX 1.4: agentic SOC platform, per-user licensing, FedRAMP Moderate + High. XSOAR 8.13 on-prem / 8.15 SaaS still sold standalone.
  • Cortex Cloud 2.2: Application Security, Cloud Posture Security, Cloud Runtime Security, Security Operations. Prisma Cloud is legacy.
  • Cortex Xpanse Expander 2.14: standalone ASM or module inside XSIAM/XDR. Exposure Management is now a separate XSIAM/XDR module.
  • Prisma AIRS 3.0: agentic AI security — model, runtime, agent security, red teaming; Portkey AI Gateway; funded by Software NGFW Credits.
  • Identity — Idira (formerly CyberArk, ~$25B, closed Feb 11, 2026; GA May 12, 2026): Privileged Access Manager, Secrets Hub, Certificate Manager, Secure AI Agents.
  • Observability (Chronosphere): $3.35B acquisition, brand retained, >$300M ARR, 30%+ noise reduction. Embrace (mobile RUM) intent announced Jul 21, 2026.

Key Numbers

Q3 FY2026 Revenue $3.002B / +31%
Next-Gen Security ARR $8.13B / +60%
RPO $18.4B / +36%
XSIAM ARR >$600M / +100%
XSIAM Daily Ingestion >17 PB/day
SASE ARR $1.5B+
Observability ARR >$300M
Platform Deals 1,550+
Net Retention Rate 119%
NGS ARR ex-M&A $6.5B / +28%
XSIAM Customers 740
Mean Time to Resolve <10 min
XSIAM Avg ARR / Customer ~$1M

Competitor One-Liners

  • vs. CrowdStrike: Single-agent XDR only; no native SIEM, SOAR, or ASM. XSIAM is a unified SOC platform at a fraction of the cost.
  • vs. Microsoft Sentinel: Unpredictable ingestion costs, no native endpoint, heavy professional services. XSIAM delivers better outcomes out of the box.
  • vs. Splunk: Legacy SIEM with bolt-on SOAR. No native XDR. XSIAM replaces Splunk at lower TCO with better automation.
  • vs. Fortinet: Broad but shallow — no unified SOC, weak cloud-native. PAN wins on depth and cloud-first architecture.
  • vs. Zscaler: SSE-only, no SD-WAN, no endpoint. Prisma SASE is a complete platform with Prisma SD-WAN and Prisma Browser.
  • vs. Wiz: CSPM/CNAPP but no runtime CDR. Cortex Cloud 2.2 delivers code-to-cloud plus runtime protection in one platform.

Scoping Quick Checklist

  • Incumbent vendors per domain plus contract end dates (SIEM, EDR, CNAPP, SASE, PAM)
  • Daily log ingestion in GB/day — XSIAM Analytics tier minimum is 100 GB/day; optional Cortex Data Lake tier add-on minimum 50 GB/day
  • XSIAM tier decision: NG-SIEM, Enterprise, or Premium (Enterprise Plus is retired/grandfathered — Premium carries the full cloud posture bundle)
  • Endpoint counts split on-prem vs cloud: Cortex XDR Pro EP vs Cortex XDR EP Cloud on the Enterprise Runtime Security (XDR) + Core Analytics base. Legacy 3.x Prevent / Pro per Endpoint / Pro per GB / Cloud per Host only applies to installed base
  • Add-on modules required: XTI, ITDR, Forensics, Host Insights, Attack Surface Management, Exposure Management, Advanced Email Security, DLP
  • Cloud accounts, workloads and container hosts for Cortex Cloud 2.2 module selection (Application Security, Cloud Posture Security, Cloud Runtime Security, Security Operations)
  • Firewall refresh triggers: PA-5450 End-of-Sale Nov 22, 2026 → PA-5500 Series; PA-7000 Series EOS Dec 31, 2025 → PA-7500; PAN-OS version and EOL date per platform
  • Kubernetes/container firewalling: CN-Series is End-of-Sale Nov 1, 2026 and is replaced by AI Runtime Firewall (Prisma AIRS) — size AIRS instead. Software NGFW Credits remain the licensing model (max 64 vCPUs per deployment profile)
  • OT/ICS and ruggedized sites: K2-Series is End-of-Life as of Feb 28, 2026 (replacements PA-5445, PA-7500); use PA-400R / PA-50R for ruggedized 5G, plus IoT/OT Security subscription and PAN-OS 12.2 proactive OT microsegmentation
  • Licensing vehicle: legacy ELA SKUs go End-of-Sale Aug 20, 2026 and are replaced by ELA8 — check ELA/ESA status now. SCM Pro activates through the ESA
  • Identity scope for Idira attach: number of privileged users, secrets stores, certificates, IdP in use (Okta, Entra, on-prem AD) for ITDR 2.0 Conditional Access
  • Compliance and data-residency requirements (PCI, HIPAA, SOC 2, FedRAMP Moderate/High, EU AI Act, ISO 42001) plus services scope (Unit 42 IR retainer, Managed XSIAM, migration hours)

Partner Architect Contacts

  • Ford — SASE & Strata specialist. Prisma Access, SD-WAN, NGFW, DLP, IoT, OT.
  • Chad — Cloud & Strata specialist. Cortex Cloud, AIRS, NGFW, compliance.
  • Charles — Cortex & Strata specialist. XSIAM, XDR, SOAR, ASM, threat intel, endpoint.
  • TBD — Idira (formerly CyberArk) / Identity specialist. PAM, secrets, certificates, IGA, identity governance.

Key Links