Quick Reference
Everything in One Page

Platform Overview

• Strata (NGFW), PAN-OS 12.2 "Ceres": PA-500 Series to PA-7500 with FE400 ASIC — ML threat prevention, App-ID, Advanced IP Defense, Advanced Virtual Patching. Managed in Strata Cloud Manager (Essentials free / Pro paid).
• Prisma SASE: $1.5B+ ARR — Prisma Access 6.2, Prisma SD-WAN, Prisma Browser, Enterprise CASB, Enterprise DLP. SASE 4.0 (Sept 2025) is the last numbered release.
• Cortex XSIAM 3.6 (GA Jul 20, 2026): >$600M ARR, 740 customers, >17 PB/day — unified SIEM + SOAR + XDR + ASM + ITDR. Tiers: NG-SIEM / Enterprise / Premium.
• Cortex XDR 5.2 (agent 9.3) — AES integral to the agent, ITDR 2.0, Prisma Browser native integration.
• Cortex AgentiX 1.4: agentic SOC platform, per-user licensing, FedRAMP Moderate + High. XSOAR 8.13 on-prem / 8.15 SaaS still sold standalone.
• Cortex Cloud: Application Security, Cloud Posture, Runtime Security and Exposure Management. Prisma Cloud is legacy.
• Cortex Xpanse Expander 2.14: standalone ASM or module inside XSIAM/XDR. Exposure Management is now a separate XSIAM/XDR module.
• Prisma AIRS 3.0: agentic AI security — model, runtime, agent security, red teaming; Portkey AI Gateway; funded by Software NGFW Credits.
• Identity — Idira (formerly CyberArk, ~$25B, closed Feb 11, 2026; GA May 12, 2026): Privileged Access Manager, Secrets Hub, Certificate Manager, Secure AI Agents.
• Observability (Chronosphere): $3.35B acquisition, brand retained, >$300M ARR, 30%+ noise reduction. Embrace (mobile RUM) intent announced Jul 21, 2026.

Key Numbers

Competitor One-Liners

• vs. CrowdStrike: Single-agent XDR only; no native SIEM, SOAR, or ASM. XSIAM is a unified SOC platform at a fraction of the cost.
• vs. Microsoft Sentinel: Unpredictable ingestion costs, no native endpoint, heavy professional services. XSIAM delivers better outcomes out of the box.
• vs. Splunk: Legacy SIEM with bolt-on SOAR. No native XDR. XSIAM replaces Splunk at lower TCO with better automation.
• vs. Fortinet: Broad but shallow — no unified SOC, weak cloud-native. PAN wins on depth and cloud-first architecture.
• vs. Zscaler: SSE-only, no SD-WAN, no endpoint. Prisma SASE is a complete platform with Prisma SD-WAN and Prisma Browser.
• vs. Wiz: CSPM/CNAPP but no runtime CDR. Cortex Cloud delivers code-to-cloud plus runtime protection in one platform.

Scoping Quick Checklist

• Incumbent vendors per domain plus contract end dates (SIEM, EDR, CNAPP, SASE, PAM)
• Daily log ingestion in GB/day — XSIAM Analytics tier minimum is 100 GB/day; optional Cortex Data Lake tier add-on minimum 50 GB/day
• XSIAM tier decision: NG-SIEM, Enterprise, or Premium (Enterprise Plus is retired/grandfathered — Premium carries the full cloud posture bundle)
• Endpoint counts split on-prem vs cloud: Cortex XDR Pro EP vs Cortex XDR EP Cloud on the Enterprise Runtime Security (XDR) + Core Analytics base. Legacy 3.x Prevent / Pro per Endpoint / Pro per GB / Cloud per Host only applies to installed base
• Add-on modules required: XTI, ITDR, Forensics, Host Insights, Attack Surface Management, Exposure Management, Advanced Email Security, DLP
• Cloud accounts, workloads and container hosts for Cortex Cloud module selection (Application Security, Cloud Posture, Runtime Security and Exposure Management)
• Firewall refresh triggers: PA-5450 End-of-Sale Nov 22, 2026 → PA-5500 Series; PA-7000 Series EOS Dec 31, 2025 → PA-7500; PAN-OS version and EOL date per platform
• Kubernetes/container firewalling: CN-Series is End-of-Sale Nov 1, 2026 and is replaced by AI Runtime Firewall (Prisma AIRS) — size AIRS instead. Software NGFW Credits remain the licensing model (max 64 vCPUs per deployment profile)
• OT/ICS and ruggedized sites: K2-Series is End-of-Life as of Feb 28, 2026 (replacements PA-5445, PA-7500); use PA-400R / PA-50R for ruggedized 5G, plus IoT/OT Security subscription and PAN-OS 12.2 proactive OT microsegmentation
• Licensing vehicle: legacy ELA SKUs go End-of-Sale Aug 20, 2026 and are replaced by ELA8 — check ELA/ESA status now. SCM Pro activates through the ESA
• Identity scope for Idira attach: number of privileged users, secrets stores, certificates, IdP in use (Okta, Entra, on-prem AD) for ITDR 2.0 Conditional Access
• Compliance and data-residency requirements (PCI, HIPAA, SOC 2, FedRAMP Moderate/High, EU AI Act, ISO 42001) plus services scope (Unit 42 IR retainer, Managed XSIAM, migration hours)

Partner Architect Contacts

• Ford — SASE & Strata specialist. Prisma Access, SD-WAN, NGFW, DLP, IoT, OT.
• Chad — Cloud & Strata specialist. Cortex Cloud, AIRS, NGFW, compliance.
• Charles — Cortex & Strata specialist. XSIAM, XDR, SOAR, ASM, threat intel, endpoint.
• TBD — Idira (formerly CyberArk) / Identity specialist. PAM, secrets, certificates, IGA, identity governance.

Key Links

• Cortex XSIAM Deep Dive — Full product page with 3.6 features
• Learn Center — Training, certs, and demo resources
• Compete / Battle Cards — Positioning vs every competitor
• Deal Playbook — Registration and co-sell mechanics
• OMS Mapping — Optiv coverage matrix
• Conversation Guides — Discovery and objection handling
• Better Together — Cortex, Prisma, Idira and Observability bundles