Palo Alto Networks
Palo Alto Networks is the company that made 'next-generation firewall' a category: policies by application and user, not just port. Beyond the PA-Series it sells Prisma (SASE) and Cortex (XDR/SOC). Expensive, and it needs people who really know it.
- Headquarters
- United States
- Positioning
- Enterprise
- Official website
- www.paloaltonetworks.com
Who it suits
Banks and large enterprises with a dedicated security team that need SSL inspection, fine-grained zoning and audit-ready reporting.
Overview
Palo Alto Networks today
Palo Alto Networks is a US company headquartered in Santa Clara, California. It is the vendor that made "next-generation firewall" a category: policies are written by application (App-ID) and by user (User-ID), not just by IP address and port. In February 2026 it completed the purchase of CyberArk, which brings privileged access and identity security into the same portfolio.
The three product groups
- Strata (network security): the PA-Series firewalls, from the PA-400 and the newer PA-500 models for branches, through the PA-1400 and PA-3400 for head offices, up to the PA-5400 and PA-7500 for data centers. Software versions are VM-Series and CN-Series. All run PAN-OS; the current release, 12.1 (Orion), adds support for post-quantum cryptography.
- Prisma (SASE): Prisma Access for staff working away from the office and Prisma SD-WAN for branches.
- Cortex (detection and response): Cortex XDR for endpoints, Cortex XSIAM for security operations, and Cortex Cloud for cloud workloads.
Management and licensing
A firewall can be managed on its own through the web interface, in groups through Panorama, or from Strata Cloud Manager in the cloud. Protection features are sold as separate subscriptions, such as Advanced Threat Prevention, Advanced URL Filtering, Advanced WildFire and DNS Security. Software firewalls can be bought with flexible credits shared across several instances.
Palo Alto suits large organizations: banks, foreign mining and energy companies, and groups whose parent company already sets the standard. The catch is that you need people who really understand it. Configured like an ordinary port-based firewall, it costs a lot and delivers little extra. For a 30-person office it is rarely worth it.
Strengths
- App-ID and User-ID let you write clear rules such as "accounts staff may use online banking but may not upload files to personal cloud storage", instead of opening or closing whole ports.
- The same PAN-OS runs on everything from the PA-400 to the PA-7500 and VM-Series, so policies and team skills carry across branches and the data center.
- SSL/TLS inspection, zoning and reporting are detailed, which suits organizations that go through regular audits.
- Palo Alto publishes end-of-sale and end-of-life dates for hardware and PAN-OS releases well in advance, which helps with replacement budgeting.
Things to know before choosing
- Hardware and subscriptions cost much more than mid-market brands, and each protection feature is its own subscription. Make sure the quotation lists exactly which ones are included.
- You need people who genuinely know PAN-OS. In Laos they are still few, so many organizations rely on an outside team to run it.
- Full SSL inspection is CPU-heavy. Size the firewall from throughput figures with inspection turned on, not the headline number, or it will struggle in real use.
- Product names and licence packaging change often (Strata Cloud Manager, credits for software firewalls). Keep licence documents and expiry dates in one place.
Using it in Laos
In Laos, Palo Alto is mostly found at banks, foreign-owned mining and energy companies, and organizations whose parent company mandates it. Hardware and subscriptions are ordered through distributors in Thailand. Branch models are often in stock, but larger units usually have to be ordered and can take several weeks.
What to plan for:
- High availability: run the main firewall as an active/passive pair. Waiting for a replacement from Thailand is too long for a banking system.
- Power and heat: rack models have two power supplies; put them on separate UPS feeds and keep the server room cool, especially in April and May.
- Skills: people who know PAN-OS and Panorama are scarce in Vientiane. Plan training or a support contract from the day you buy.
- SSL inspection: you must push a certificate to every managed device and exclude banking systems and apps that use certificate pinning.
Compared with alternatives
Fortinet gives more performance for the money and is easier to staff, which makes it the better choice for SD-WAN across many branches. Check Point suits organizations with many firewalls that want central policy management with a clear change history. Sophos suits mid-sized organizations without a security team that want an MDR service. Choose Palo Alto when you have a team that will actually use App-ID, User-ID and SSL inspection.
Product lines
- PA-Series NGFW
- VM-Series
- Prisma Access
- Prisma SD-WAN
- Cortex XDR
- Cortex XSIAM
- Cortex Cloud
Solutions that use this brand
Next-Generation Firewall (NGFW)A firewall that knows which app and which user, with IPS, web filtering, HTTPS inspection and VPN, sized on real all-features-on…
Secure Remote Access (VPN/ZTNA)Staff and contractors reach internal systems from anywhere through VPN or ZTNA with MFA, seeing only what they need.
Zero Trust & Network Access Control (NAC)Check every user and device before it joins, with 802.1X and NAC. Plugging into a LAN port no longer means reaching the servers.
Endpoint Protection & EDREDR that watches behaviour, not just virus lists. It stops ransomware mid-run and cuts an infected PC off the network at once.
SOC & SIEM MonitoringFirewall, server and endpoint logs in one SIEM, with people watching the alerts and a clear plan for when something happens.
SD-WAN for BranchesProvincial branches run two internet links at once. If one fails, the other takes over within seconds, and everything is…
Vulnerability Assessment & Penetration TestingScan and test systems, websites and networks to find weaknesses before someone else does, with a report ordered by what to fix…FAQ
What happens if our Palo Alto subscriptions expire?
The firewall keeps passing traffic under the existing policy. But Threat Prevention, URL Filtering and WildFire updates stop, and without support you can't upgrade PAN-OS or get a replacement unit. Check each subscription's end date, because they may not line up.
Should we use Panorama or Strata Cloud Manager?
Panorama runs on-premises as an appliance or VM, which suits policies that require management data to stay in-house. Strata Cloud Manager lives in the cloud and adds analytics, which suits many branches with stable internet. With only one or two firewalls, the on-box web interface is enough.
Can we use Palo Alto firewalls with another brand for endpoint protection?
Yes, and it is common. The firewalls do not depend on Cortex XDR. What a single vendor gives you is firewall and endpoint events in one view, which matters more to a SOC team than to a small organization.
All brand names and trademarks belong to their respective owners. Mention does not imply official partnership unless explicitly stated. Products are sourced through legitimate distribution channels.
Send us a floor plan or a few photos of the site
We’ll come back with a few questions, then a first design. The first consultation is free, in Lao, Thai or English, on WhatsApp or our Facebook page.