Protect the way business now runs.

Too many tools, each seeing part of the attack

Palo Alto Networks starts from a problem every large security team knows. Companies bought security one product at a time, for the network, laptops and servers, cloud accounts and identities. Each product sees part of an attack, and analysts move between screens to connect the parts. The annual report states the answer the company sells: help customers simplify their security architectures by consolidating disparate point products. In November 2024 chief executive Nikesh Arora cited Gartner research that 75% of security leaders were pursuing vendor consolidation, while less than 15% of large enterprises had implemented any one security platform. That gap is the market the company is built for.

ingest all relevant security data once

Nikesh Arora · Chairman and Chief Executive Officer · Earnings call, fiscal first quarter 2025 · 2024-11-20

The belief that sets the company apart is about where the market ends up. On the same call Arora said security would converge on a smaller set of platform vendors over five to ten years, and that the company, having started the trend, intended to be one of the few. Palo Alto Networks bets that the buyer's wish for fewer vendors will matter more. That quarter it reoriented sales enablement around platformization across thousands of sellers.

Why now: the cloud and AI moved the attack

Two changes make the pitch more urgent than when the firewall business was built. The first is the cloud. At the Cortex Cloud launch in February 2025 the company cited its Unit 42 research team: 80% of security exposures were found in cloud attack surfaces, with a 66% increase in threats targeting cloud environments. The second is AI on both sides. In September 2026 the company began selling a Unit 42 service that uses frontier models from Anthropic and OpenAI to find exposures before attackers do, and Arora told investors on 1 September 2026 that advances in AI were lifting cybersecurity to the top of the CIO priority list.

Modern cybersecurity requires machine-speed defense.

Sam Rubin · Senior Vice President, Unit 42 · Press release on Unit 42 Continuous Frontier AI Defense · 2026-09-22

One case, followed from code to response

Take an illustrative case: a security team faces a long list of cloud findings and needs the one that is a real attack path. First, Cortex Cloud's application and posture modules link a weakness in code or configuration to the workload it affects and the people who can fix it; the company says it adds code and runtime context to every finding, groups related signals into cases and scores them by real exposure. Second, an agent on running workloads captures behavioral telemetry, so the team can tell a theoretical weakness from live activity. A security engineer still decides whether the risk is real.

Third, the case moves to the security operations center (SOC), the team that watches alerts and responds. Cortex XSIAM brings endpoint, network, identity and cloud data together, so an analyst investigates one case with its evidence attached instead of switching tools. Fourth, the SOC automates the repeatable parts of the response, keeps controls on actions with consequences and feeds lessons back into prevention. The judgment that stays with people is what to automate, and when an automated action is safe to let run.

The measured customer results the company publishes come from XSIAM in the SOC, such as Coveo's. The Cortex Cloud stories describe adoption and plans, such as Sabre's planned move from Prisma Cloud. Treat one platform from code to SOC as the direction of travel, and ask which parts a given Korean customer already runs together.

In Korea this changes the job. The country manager told the Korean press in November 2025 that what Korean companies need is not swapping features but redesigning the security system from the ground up (Signet's rendering of his Korean). A seller or engineer here helps a customer redraw its security across several budgets, rather than replacing one product with another.

Three platforms and a services arm

Palo Alto Networks sells three platforms and a services business. Network & AI Security holds the next-generation firewalls the company was first known for, plus secure access service edge (SASE), which delivers network security from the cloud. Cortex is the security operations family: Cortex XSIAM for the SOC, Cortex XDR for detection and response, and Cortex Cloud. Idira is its next-generation identity security platform; identity became a core pillar when the CyberArk acquisition closed in February 2026. Unit 42 provides threat research, incident response and consulting. The two products covered here, Cortex Cloud and Cortex XSIAM, appear in several Korea roles that sell, deploy or support them.

Cortex Cloud: cloud security rebuilt on the SOC platform

Cortex Cloud is the next generation of Prisma Cloud, launched in February 2025. It merges a cloud-native application protection platform (CNAPP), the tools that check code, configurations and cloud accounts for weaknesses, with cloud detection and response (CDR), which watches running workloads for attacks. The company rebuilt it on the Cortex security operations platform so that the cloud team and the SOC work from the same data. The product page lists four parts: application security, cloud posture, runtime security and exposure management. Customers can buy it on its own or add it to Cortex XDR or Cortex XSIAM, and existing Prisma Cloud customers are offered an upgrade.

CNAPP at no additional cost

Lee Klarich · Chief product officer at the time of the launch · Cortex Cloud launch press release · 2025-02-13

Signet reads that pricing as giving the posture layer away to runtime customers, where cloud security specialists compete, to win the runtime and SOC work it can tie into the rest of the platform. In Seoul the company presented Cortex Cloud 2.0 to the press in November 2025 as the cloud part of its platform pitch, and the Korean distributor's demonstration center, opened in June 2026, runs Cortex Cloud on AWS, Microsoft Azure and Google Cloud environments.

Cortex XSIAM: replacing the SIEM

Cortex XSIAM is the company's AI-driven security operations platform. A SIEM (security information and event management) is the log and alert system most SOCs run; XSIAM is pitched as its replacement. It prepares and enriches incoming data, stitches it into connected security events, applies machine learning detection and runs automated playbooks. The annual report says XSIAM customers can consolidate SIEM, extended detection and response, SOAR (automation of response steps), attack surface management and threat intelligence into one platform.

Who has bought it, and what was measured

The clearest measured case is Coveo, headquartered in Canada, which runs about 5,000 cloud instances and 1,000 workstations with a small SOC team. In the customer story, Coveo moved from ten separate tools to XSIAM and was fully deployed in three to four months with the company's professional services team. Coveo reports that automated playbooks now handle 65 cases a day without an analyst, median time to resolution fell to six seconds, the share of cases closed rose from 60% to over 99%, and each analyst saves 30 hours a week. Its SOC lead calls Cortex Cloud the next step. These are XSIAM results, reported by the customer in a vendor-published story.

Sabre shows both the cloud and SOC paths in a July 2025 customer account. It used Prisma Cloud for visibility and automated vulnerability fixes after moving to Google Cloud. Its wider SOC platform, including Cortex XDR and XSOAR, reduced time to contain security cases by 90% over two years and automatically handled 56% of alerts, as reported by Sabre. Its security chief looks forward to transitioning to Cortex Cloud; XSIAM is also being explored. The NHL separately lists Cortex Cloud for posture management and XSIAM for its SOC.

If you sell or support these products in Korea, be precise about which product produced which result. Coveo's numbers belong to XSIAM; Sabre's incident-response figures belong to its wider SOC platform, including XDR and XSOAR. The country manager said in February 2025 that the company has references in each field in Korea.