Hot Sales Plays
Prioritized for Maximum Impact

Converting existing Palo Alto customers from ala-carte purchases to an Enterprise Agreement, consolidating spend into a single platform deal for higher TCV. Urgent right now: legacy ELA SKUs go End-of-Sale Aug 20, 2026 and are replaced by ELA8 — every open ELA conversation needs to be papered or re-quoted onto ELA8. ELA8 SKU detail is not yet published, so quote through the PAN account team.

Qualifying Signals

• Multiple active subscriptions across product pillars
• $1.5M+ hardware estate or renewal base
• Procurement fatigue from managing many POs and renewals
• Legacy ELA in flight or expiring — two weeks to the Aug 20, 2026 End-of-Sale
• Enterprise Support Agreement in place (SCM Pro activates through the ESA via a single auth code)

Accounts qualifying for an Enterprise Agreement but not positioned yet. Pre-conversion targets where eligibility criteria are met but the conversation hasn't started. Position ELA8 — legacy ELA SKUs are End-of-Sale Aug 20, 2026, so any account that would have landed on the old paper needs the new vehicle.

Qualifying Signals

• Subscription breadth across two or more pillars
• Strong growth trajectory in Palo spend year-over-year
• Multi-pillar potential with untapped solution areas — Cortex, Cortex Cloud, Prisma AIRS 3.0, Idira
• Never had a licensing agreement reviewed; buying subscription-by-subscription

Accounts running GlobalProtect VPN that can migrate to full Prisma SASE — Prisma Access 6.2 + Prisma SD-WAN + ZTNA — for a modern secure access architecture. The Prisma Access Agent transition from GlobalProtect is ongoing; GlobalProtect is not retired, so this is a migration, not a forced cutover.

Qualifying Signals

• GlobalProtect currently deployed for remote access
• Growing remote/hybrid workforce with VPN scaling issues
• Interest in ZTNA or zero trust network access projects
• Post-quantum requirements — PAN-OS 12.2 adds PQC for GlobalProtect

Accounts with firewall hardware approaching EoL/EoS. Upgrade to 5th-gen NGFWs on PAN-OS 12.2 "Ceres" (released Jul 30, 2026) and bundle SCM Pro plus the new subscriptions for maximum deal value. Two hard dates drive the pipeline: PA-5450 goes End-of-Sale Nov 22, 2026 and is replaced by the PA-5500 Series (up to 300 Gbps threat, up to 375 Gbps App-ID, up to 4x PA-5400 threat performance, eight 400G interfaces, FE-400 ASIC), and PA-7000 Series went End-of-Sale Dec 31, 2025 in favor of the PA-7500 (over 1.5 Tbps App-ID). K2-Series is End-of-Life as of Feb 28, 2026 — replacements are PA-5445 and PA-7500. Attach the two new 12.2-era subscriptions on every refresh: Advanced IP Defense (GA Aug 4, 2026) — cloud-delivered zero-trust IP enforcement built on telemetry from 70,000+ customers, DNS-resolution validation plus 40+ security attributes, blocking C2 that bypasses DNS and URL inspection without requiring TLS decryption, enforced via an Advanced IP Defense profile attached to a zone and requiring an Advanced IP Defense license; and Advanced Virtual Patching — frontier-AI vulnerability discovery with a vaulted-protection detection engine, positioned as collapsing the industry-average 55-day exposure window (licensing detail not yet published — quote through PAN). Also new: Quantum-Safe Security (GA Jan 30, 2026) and six AI-powered Network Security Agents delivered through Strata Cloud Manager.

Qualifying Signals

• PA-5450 in the estate — End-of-Sale Nov 22, 2026, last supported OS is PAN-OS 12.2
• PA-7000 Series or K2-Series still in production (both past End-of-Sale / End-of-Life)
• PAN-OS 11.1 or 11.2 estate (EOL May 2027) or anything on 10.x (already EOL)
• Compliance requirements mandating supported hardware
• Performance gaps or throughput limitations — 5th-gen adds 400G interfaces, 300 Gbps threat inspection and active clustering to 1.4 Tbps

Positioning Prisma Browser (the current official name — no longer "Prisma Access Browser") for BYOD, contractor, and unmanaged device use cases. Fast-attach, low-friction entry point into SASE. Two new hooks: native integration with Cortex XDR and XSIAM shipped with XDR 5.2, and NGFW-native Prisma Browser identification in PAN-OS 12.2. Most-secure-browser-for-agentic-AI positioning announced Mar 23, 2026.

Qualifying Signals

• BYOD policy or growing contractor workforce
• Unmanaged devices accessing corporate web applications
• Need for browser-level security without endpoint agents
• Existing Cortex XDR or XSIAM tenant — browser telemetry lands natively as of XDR 5.2
• Employees using agentic AI tools and browser extensions in the browser

Competitive SASE displacement. Accounts running competitor SASE/SSE (Zscaler, Netskope, Fortinet, Cisco) where the play is to displace with Prisma SASE.

Qualifying Signals

• Zscaler or Netskope deployed with SSE gaps or limitations
• ZTNA 1.0 limitations driving need for ZTNA 2.0 upgrade
• Browser security needs unmet by current SSE vendor — Prisma Browser is the differentiator
• No SD-WAN story from the incumbent; Prisma SD-WAN closes the loop on full SASE

Consolidate the customer's security stack onto the PAN platform across all five pillars — Network, SASE, SecOps, Cloud, Identity — plus Observability (Chronosphere, brand retained, >$300M ARR) and AI Runtime. Identity is now a core pillar: attach Idira (formerly CyberArk, closed Feb 11, 2026 at ~$25B, GA'd May 12, 2026) — Idira Privileged Access Manager, Idira Secrets Hub, Certificate Manager and Idira Secure AI Agents, with Idira Endpoint Privilege Manager integrating into XSIAM via Cortex Marketplace as of XSIAM 3.5. In containers and AI workloads, note that CN-Series is End-of-Sale Nov 1, 2026 and is explicitly replaced by AI Runtime Firewall (Prisma AIRS), with a VM-Series-to-AI-Runtime-Firewall migration path shipped June 2026 — that migration is itself a platform conversation. Proof point: Next-Generation Security ARR is $8.13B, up 60% y/y.

Qualifying Signals

• Customer managing 30+ security tools across ITOps, SecOps, DevSecOps
• Active projects in AI Runtime security, cloud posture, or identity governance
• Budget pressure driving vendor consolidation conversations
• Network security, SASE, or SIEM renewals within 12 months
• CN-Series deployed for Kubernetes — End-of-Sale Nov 1, 2026 forces an AI Runtime Firewall conversation
• Existing CyberArk estate, or no PAM/secrets governance at all — Idira attach
• Separate observability vendor (Datadog, New Relic) alongside the SOC stack

Deploy Cortex AgentiX 1.4 (July 2026) to establish a proactive, real-time agentic workforce for the SOC. AI agents trained on 1.2 billion playbook executions that autonomously investigate, contain, and remediate threats — reducing MTTR by 98% and manual work by 75%. Licensed per user per year: Enterprise (4 users, 800 compute units/yr, includes threat intel management) or Base (2 users, 400 CU/yr). 1.4 adds frontier model choice, Cortex XTI and FedRAMP Moderate and High. Palo Alto positions AgentiX as the natural evolution of its SOAR platform; XSOAR (8.13 on-prem, 8.15 SaaS) is still sold standalone. Two attach motions ride alongside: Agentic Endpoint Security (AES, from the Koi acquisition that closed Apr 14, 2026) is now integral to the Cortex XDR agent as of XDR 5.2 with zero additional deployment, discovering AI agents, MCP servers, plugins and browser extensions; and Unit 42 Frontier AI Defense (Apr 2026) sells the assessment layer through Exposure Analysis, Autonomous Security Blueprint and Agentic Defense Transformation, including six months free of Cortex XDR, Xpanse and Koi.

Qualifying Signals

• SOC teams overwhelmed by alert volume — analysts burning out on manual triage
• Using legacy SOAR (Splunk SOAR, Swimlane, Phantom) with static playbooks
• MTTR measured in hours or days, not minutes
• Exploring AI/ML for security automation or autonomous response
• Public sector or regulated accounts needing FedRAMP Moderate or High
• Unknown AI agent, MCP server and browser-extension footprint — AES discovery
• Board asking for an AI risk assessment — lead with Unit 42 Frontier AI Defense