Palo Alto Networks
| Palo Alto Networks, Inc. | |
|---|---|
| Type | Public |
| Traded as | Nasdaq: PANW S&P 500 component |
| Industry | Computer security |
| Founded | 2005 |
| Founder | Nir Zuk |
| Headquarters | Santa Clara, California, United States |
| Key people | Nikesh Arora (Chairman and chief executive officer) Nir Zuk (Founder and chief technology officer) |
| Products | Next-generation firewalls, Prisma, Cortex, Strata, Unit 42 |
| Employees | Approximately 16,000 |
| Website | paloaltonetworks.com |
Palo Alto Networks, Inc. is an American cybersecurity company headquartered in Santa Clara, California. It is among the largest security companies in the world by revenue and market value, serving more than 70,000 organisations in over 150 countries, including 85 of the Fortune 100.
The company was founded in 2005 by Nir Zuk, an Israeli engineer who had previously worked at Check Point and NetScreen Technologies, and who had begun working with computers during his military service in Unit 8200 of the Israeli Intelligence Corps, where he led software development. Its founding product was the next-generation firewall, which inspected traffic by application rather than by network port, an idea that made the existing generation of firewalls obsolete and around which the entire industry subsequently reorganised.
Palo Alto Networks listed on the New York Stock Exchange on 20 July 2012, raising US$260 million in the fourth largest technology offering of that year, and transferred its listing to Nasdaq in October 2021. Nikesh Arora, formerly of Google and SoftBank, became chairman and chief executive in June 2018. The company's market capitalisation passed US$200 billion for the first time in May 2026.
It hosts the Unit 42 threat intelligence and incident response organisation, runs the Ignite conference, and is a partner organisation of the World Economic Forum.
History
The next-generation firewall
Nir Zuk's argument in 2005, which he had made unsuccessfully inside Check Point, was that the firewall had stopped working.
A traditional firewall controls traffic by port and protocol: it permits traffic on port 80, which is the web, and blocks traffic on other ports. The assumption underlying this, that an application can be identified by the port it uses, had ceased to be true. Applications had learned to tunnel over the web ports because those were the ones left open, so that by the mid-2000s a firewall permitting port 80 was permitting essentially everything, including peer-to-peer file sharing, instant messaging, remote access tools and whatever an employee chose to install.
Zuk's proposal was to identify traffic by what it actually was rather than by the port it used, inspecting content to determine the application, the user and the content itself, and then applying policy in those terms: this group of users may use this application but not transfer files with it.
The technical obstacle was performance. Inspecting every packet deeply enough to identify an application, at the line rates enterprise networks require, was not possible on general-purpose processors. Palo Alto Networks built purpose-designed hardware with separate processing paths for networking, security and management, which allowed a single pass over the traffic to serve all the inspection functions rather than chaining them.
The resulting product, released in 2007, was called the next-generation firewall, a term the analyst firm Gartner adopted and which became a recognised product category. The incumbents, principally Check Point, Cisco and Juniper, responded by adding application awareness to existing products, which was slower and, for several years, considerably less effective.
Growth and listing, 2007 to 2018
The company grew rapidly through the replacement cycle of enterprise firewalls, which occurs every five to seven years and which for a decade favoured the new entrant.
It listed on the New York Stock Exchange on 20 July 2012 at US$42 a share, raising US$260 million.
Litigation with Juniper Networks over patents, and with Zuk's former employer over the circumstances of the founding, was settled in 2014 with Palo Alto Networks paying Juniper US$175 million in cash and stock.
In 2014 the company founded the Cyber Threat Alliance with Fortinet, McAfee and Symantec, a non-profit intended to encourage the sharing of threat intelligence between companies that compete commercially, on the reasoning that the attackers share information and the defenders did not. By 2018 it had 20 members including Cisco, Check Point, Juniper and Sophos, and it has continued as one of the few sustained examples of industry cooperation in the sector.
The acquisition programme began in the same period and became the company's principal mechanism of expansion. Cyvera, bought in April 2014 for approximately US$200 million, brought endpoint protection and became Traps and then Cortex XDR. LightCyber in 2017 brought behavioural analytics. Evident.io, bought in March 2018 for US$300 million, created the Prisma Cloud division.
The Arora era, 2018 to 2026
Nikesh Arora joined as chairman and chief executive in June 2018. He had been chief business officer at Google and then president of SoftBank, and his compensation package, among the largest ever granted to an American chief executive, was itself a subject of comment.
His strategy was consolidation, and it was stated openly. The security industry's central problem from the customer's perspective is that a large organisation runs products from dozens of vendors that do not work together, each requiring separate management, separate alerts and separate expertise. Arora's argument was that customers would prefer a small number of platforms, and that the way to build one was to buy the components and integrate them properly.
The programme has been conducted at scale. Acquisitions have included Demisto in February 2019 for US$560 million, bringing security orchestration; Twistlock in May 2019 for US$410 million and PureSec for US$47 million, bringing container and serverless security; Zingbox for US$75 million, bringing device security; Aporeto for US$150 million; CloudGenix in April 2020 for US$420 million, bringing software-defined networking; Crypsis in August 2020 for US$265 million, which became the incident response half of Unit 42; Expanse in December 2020 for US$1.25 billion, bringing attack surface management; Bridgecrew in 2021; Cider Security in November 2022 for US$300 million; Talon Cyber Security in November 2023 for US$625 million; Dig Security in December 2023 for US$400 million; and Protect AI in July 2025 for US$500 million, addressing the security of machine learning systems.
Two very large transactions followed. CyberArk, agreed in July 2025 for approximately US$25 billion and completed in February 2026, is the largest acquisition in the history of the cybersecurity industry and brought privileged access management, the discipline concerned with controlling the credentials that administrators and machines use, which is where a very large proportion of serious breaches originate. Chronosphere, announced in November 2025 for US$3.35 billion and completed in January 2026, brought observability, extending the company beyond security into the adjacent problem of understanding what systems are doing.
Koi Security followed in February 2026 at an estimated US$400 million, and an agreement to acquire Portkey was announced in April 2026.
The company's market capitalisation passed US$200 billion in May 2026. In August 2026 China opened a security review of its products in the Chinese market, part of a broader pattern of reciprocal restrictions on foreign technology.
Products
Palo Alto Networks organises its portfolio into three platforms, a structure introduced under Arora and intended to make the breadth comprehensible.
Strata
Strata is the network security platform and contains the company's original business.
The PA-Series next-generation firewalls are physical appliances ranging from small branch devices to chassis systems for data centres and service providers, including the K2-Series announced in 2019 for 5G and connected device workloads. VM-Series and CN-Series provide the same capability as virtual machines and as containers. All run PAN-OS, the company's operating system, and are managed through Panorama.
The underlying technologies are App-ID, which identifies applications regardless of port or encryption; User-ID, which associates traffic with a named person through directory integration; Content-ID, which inspects for threats and data loss; and Device-ID. Subscription services layered on these include Threat Prevention, URL Filtering, WildFire, which detonates unknown files in a sandbox and distributes signatures to all customers within minutes, DNS Security and IoT Security.
Prisma Access delivers the same controls from the cloud to users wherever they are, which became the dominant deployment pattern when the pandemic dispersed the workforce that the appliance model had assumed would be in an office. The combination of network and security delivered as a cloud service is the category the industry calls SASE, secure access service edge, in which Palo Alto Networks competes principally with Zscaler, Netskope and Cisco.
Prisma
Prisma Cloud secures applications built and run in cloud environments, covering configuration and compliance, workload protection for virtual machines, containers and serverless functions, identity permissions, data security and the security of the software supply chain. It was assembled from Evident.io, RedLock, Twistlock, PureSec, Aporeto, Bridgecrew, Cider and Dig, and the integration of those components into a coherent product took several years and was, for a period, the principal criticism made of the acquisition strategy.
The category, which analysts call the cloud-native application protection platform, exists because cloud infrastructure fails differently from the data centre: the common breach is not an intrusion through a network perimeter but a storage bucket left publicly readable or an over-permissioned credential, and preventing it requires understanding configuration rather than inspecting traffic.
Cortex
Cortex, announced in February 2019, is the security operations platform.
Cortex XDR collects telemetry from endpoints, networks and cloud and applies behavioural analysis to detect activity that no signature would catch. Cortex XSOAR, built on Demisto, automates the response, executing predefined sequences of investigation and containment so that an analyst is presented with a case rather than an alert. Cortex Xpanse, from Expanse, continuously maps an organisation's internet-exposed assets, a problem that sounds trivial and is not, since large organisations routinely do not know what they have connected. Cortex XSIAM, introduced in 2022, combines these into a replacement for the security information and event management systems that have been the centre of security operations for twenty years, on the argument that those systems were built to store logs for compliance rather than to detect attacks.
XSIAM has been among the company's fastest-growing products and is a direct attack on Splunk, acquired by Cisco in 2024, and on Microsoft Sentinel.
Unit 42
Unit 42 is the threat intelligence and incident response organisation, named after the answer in The Hitchhiker's Guide to the Galaxy. It publishes research on malware families, ransomware groups, state-sponsored activity and vulnerabilities, and its reports are among the more widely cited in the field.
Following the Crypsis acquisition in 2020 it also performs incident response, meaning that it is engaged directly by organisations that have been breached, including by those that are not customers of the company's products. This gives the research team direct visibility of real intrusions, which is the most valuable input to threat intelligence and which most vendors lack.
The unit's annual reports on ransomware, cloud threats and incident response are used as reference points across the industry, and its analysts are frequently the first to publish on significant campaigns.
Business and strategy
The platform argument
Palo Alto Networks' strategy rests on a proposition about how enterprise security is bought.
A large organisation typically runs products from between 50 and 100 security vendors. Each produces alerts; none understands the others' context; the integration work falls on a security team that cannot recruit enough people to do it; and the result is that serious incidents are missed among a very large volume of noise. The industry's fragmentation is a consequence of every new attack technique producing a new startup, and of buyers purchasing point solutions to each problem as it arose.
Arora's argument is that buyers have reached the limit of their capacity to integrate, that they will consolidate on a small number of platforms, and that the vendors positioned to be those platforms will take a disproportionate share. The company has pursued this by acquiring components, integrating them into the three platforms, and offering commercial arrangements under which a customer committing to more of the portfolio pays less for each part.
The strategy has critics. Integrating acquired products properly is difficult and Palo Alto Networks has not always done it quickly; a platform purchase creates exactly the dependence that buyers say they wish to avoid; and best-of-breed competitors including CrowdStrike in endpoint, Zscaler in network access and Wiz in cloud have each argued that a specialist product is better than a component of a suite. The counter-evidence is that all of those companies have themselves become platforms by acquisition.
Finances
Revenue passed US$1 billion in the financial year ending July 2016, US$4 billion in 2021 and approximately US$8 billion in 2024, with growth in the high teens as a percentage and rising.
The composition has shifted substantially from appliance sales to subscription and support, which is now the large majority, and the company's reporting emphasises next-generation security annual recurring revenue, a measure covering the Prisma and Cortex businesses, which has grown far faster than the total.
The company became consistently profitable on a reported basis in 2023, having previously reported losses driven principally by stock-based compensation, which remains large.
A change of commercial approach in 2024, under which the company offered free periods to customers migrating from competitors in order to accelerate consolidation, reduced near-term revenue and caused a sharp fall in the share price, which subsequently recovered as the strategy produced the intended larger commitments.
Competition
The company competes against different opponents in each of its segments.
In network security the principal rivals are Fortinet, which competes aggressively on price and is strong in mid-market and distributed environments, Check Point, Zuk's former employer, Cisco and Juniper.
In cloud security, Wiz, acquired by Google in 2025 for a reported US$32 billion, has been the most effective competitor, having built a product that could be deployed without agents and that customers found dramatically easier to adopt, and its purchase by Google places a very well-funded competitor in the segment.
In endpoint and security operations, CrowdStrike is the principal rival, along with SentinelOne and Microsoft, whose Defender products are bundled with enterprise licences that most large organisations already hold and which is therefore the most structurally dangerous competitor in the industry.
Microsoft's position deserves particular note. Security is among its largest businesses, its products are included in licensing agreements customers buy for other reasons, and it therefore competes on a basis that specialist vendors cannot match. The counter-argument, which Palo Alto Networks and others make, is that an organisation should not buy its security from the supplier of the systems being secured.
Corporate affairs
Leadership
Nir Zuk, the founder and chief technology officer, remains the company's technical voice and is among the more outspoken figures in the industry, given to declaring categories of product obsolete, including some of his own company's. He began at Check Point, where he was an early engineer and where he holds credit for work on stateful inspection, moved to OneSecure which became NetScreen, acquired by Juniper, and founded Palo Alto Networks after concluding that the incumbents would not replace their own products.
Nikesh Arora has been chairman and chief executive since June 2018. Born in Ghaziabad, India, and educated at Banaras Hindu University, Northeastern and Boston College, he held senior roles at T-Mobile and Google, where as chief business officer he ran the commercial organisation, and was president of SoftBank under Masayoshi Son for two years. His arrival marked the company's transition from a product company to an acquisitive platform company, and his compensation, largely in performance-linked equity, has been among the largest in American business and has been substantially earned on the share price's performance.
Other senior figures have included Dipak Golechha as chief financial officer, Lee Klarich as chief product officer, and BJ Jenkins, who joined as president with the Talon acquisition. Mark McLaughlin, chief executive from 2011 to 2018 and the person who led the company to its listing, became vice chairman.
Employees and facilities
The company employs approximately 16,000 people. Its headquarters campus in Santa Clara, opened in 2017, is notable for its architecture and for being built around collaboration space rather than individual offices.
It maintains substantial operations in Tel Aviv, reflecting both the founder's background and the concentration of security engineering talent in Israel, and in India, where its Bengaluru site is among its largest. Other significant locations include Amsterdam, Singapore, Tokyo and Sydney.
From 2018 the company opened cybersecurity training facilities internationally under the Global Cyber Range Initiative, addressing the industry's persistent shortage of trained practitioners, and it operates academic programmes providing curriculum and equipment to universities and colleges.
Research and disclosure
Palo Alto Networks operates a vulnerability disclosure programme and publishes security advisories for its own products, which have on several occasions been significant. Vulnerabilities in PAN-OS and in the GlobalProtect remote access component have been exploited by state-linked groups, including a critical flaw disclosed in April 2024 that was being used before a patch was available, and the company's handling of such disclosures is watched closely because a firewall is by definition exposed to the internet and compromising it grants access to everything behind it.
The general problem, which applies to the whole security industry, is that products deployed at the perimeter to protect an organisation are themselves among the most attractive targets, and the sector's record on the security of its own software has been mixed.
Controversies and criticism
Acquisition integration. The most persistent criticism is that the company has bought more than it has integrated, and that customers have at times found themselves running several products from the same vendor that do not share data or management. Prisma Cloud in particular was assembled from eight acquisitions and took years to become coherent. The company's answer is that integration is the work and that it has now largely been done.
Pricing and licensing. Enterprise customers have criticised the complexity of the licensing model, in which the hardware is a modest part of the cost and the subscriptions attached to it are the substance, and renewals have been a source of friction.
The CyberArk price. The US$25 billion agreed for CyberArk in July 2025 was received poorly by investors on announcement, the share price falling on concern about the multiple paid and about the dilution, and the transaction remains the largest bet the company has made. The strategic argument, that identity is where breaches now begin and that a security platform without it is incomplete, is widely accepted; the argument is about the price.
Israel and geopolitics. The company's Israeli engineering base and the military intelligence backgrounds of a substantial part of its technical leadership have made it a target of criticism in some quarters during and after the Gaza war, as has been the case across the Israeli security technology sector. China's security review announced in August 2026 reflects a separate dynamic, in which security products from American companies are increasingly excluded from Chinese government and critical infrastructure use, as American rules exclude Chinese vendors.
Concentration risk. The broader question raised by the consolidation strategy is whether it is desirable for a small number of companies to hold the security of a very large share of the world's enterprises, since a serious flaw in a widely deployed platform becomes a systemic event. The CrowdStrike update failure of July 2024, which disabled millions of Windows systems worldwide, is the clearest recent demonstration of the risk, and it applies to any vendor at that scale.
Assessment
Palo Alto Networks is the clearest example in enterprise security of a company built twice: first on a single correct technical insight, and then on an argument about how the industry would be bought.
The first was Zuk's observation that port-based firewalls had stopped describing reality, which was obvious in retrospect, was resisted by the incumbents whose products depended on it, and which created a new product category that the entire industry eventually adopted. It is among the cleaner examples of a startup displacing established competitors by attacking an assumption rather than a feature.
The second is Arora's consolidation thesis, which is still being tested. The evidence in its favour is that the company has grown revenue substantially faster than the market while raising the amount each customer spends, and that its principal competitors have adopted the same approach. The evidence against is that no security platform has yet demonstrated that it can absorb a new category as fast as attackers create one, and that the best products in most categories continue to come from companies that do one thing.
The purchase of CyberArk at US$25 billion is the decision on which the next phase depends. If identity proves to be the centre of enterprise security, as the pattern of recent breaches suggests, the price will look reasonable. If it proves to be one component among many, the company will have paid a very large sum for a position that a partnership would have provided.