| Licensing model | Hardware appliance plus per-device subscriptions activated on the firewall: Advanced Threat Prevention, Advanced URL Filtering, Advanced WildFire, Advanced DNS Security, SD-WAN, GlobalProtect, IoT Security, Enterprise DLP and others. A firewall without a valid Support licence cannot update PAN-OS. Virtual and container firewalls are bought as Software NGFW Credits on one- to five-year terms; unused credits expire at term end.Sources: PAN-OS admin guide: subscriptions · PAN-OS admin guide: activate subscription licenses · VM-Series deployment guide: Software NGFW credits | Software, licensed per firewall. It installs as a package on the OPNsense or pfSense CE box you already run, or from an image as ZedmosOS on x86 hardware you own. No hardware in the licence, and nothing expires unused. |
| Management console | Panorama as a virtual appliance or M-Series hardware, licensed for 25, 100, 1,000 or 5,000 managed firewalls; Strata Cloud Manager as SaaS, Essentials free with an NGFW purchase and Pro as a paid upgrade. MSSP multi-tenancy is the separate Strata Multitenant Cloud Manager. Cloud-delivered services need a device certificate issued through the Customer Support Portal and renewed every 90 days.Sources: Panorama admin guide: Panorama models · Strata Cloud Manager: licenses and support · Strata Multitenant Cloud Manager: bulk configuration · NGFW administration: install device certificate | One console, multi-tenant from the first firewall. Run it as a container on your server under your domain, or use ours at console.zedmos.com, operated from Frankfurt. If it is unreachable, every firewall keeps enforcing. |
| Jurisdiction | A US company headquartered in Santa Clara, California, listed on the Nasdaq Global Select Market (PANW). Strata Cloud Manager can be activated in a chosen region, including Germany and the European Union. 18 U.S.C. § 2713 obliges US providers to disclose customer data regardless of where it is stored.Sources: Form 10-K, fiscal 2025 · Strata Cloud Manager: regions · 18 U.S.C. § 2713 | A German company. A self-hosted console keeps firewall logs, personal data under the GDPR (CJEU C-582/14), in your own controllership. Our licence and threat-intelligence services run in Frankfurt. |
| Hardware lifecycle | About six months' notice before End-of-Sale, then five years of technical assistance and hardware replacement provided the support contract never lapses; a lapsed contract cannot be reinstated. First-generation PA-7000 components and the K2-Series reach End-of-Life on 28 February 2026; the PA-5450's End-of-Sale date is 22 November 2026.Sources: End-of-life policy · Hardware end-of-life dates · End-of-sale announcements | The support period is the software's: at least five years from placing on the market (CRA Art. 13(8)), published, and independent of any box. The hardware is yours to keep or replace. |
| Exploit record | 15 entries in the CISA Known Exploited Vulnerabilities catalogue (version 2026.09.11), 6 of them flagged for known ransomware use; 12 concern PAN-OS. Two were added in 2026.Sources: CISA KEV — Palo Alto Networks | 0 entries. Published, with our CRA class, an SBOM per release, the disclosure path and the support period, on a page that stays up whatever the number becomes. |
| MSP billing | The MSSP Path of the NextWave Partner Program, with an MSSP Pay-as-you-go SKU described as consumption-based; partners in the retired CSSP programme must migrate to it or to Software NGFW Credits by 1 October 2026. No minimum commitment is published.Sources: End-of-life announcements: CSSP to MSSP PAYG · NextWave partner program framework | MSP tier: multi-tenant, unlimited firewalls, billed monthly in arrears on the month-end count. Your brand on the console and on the box. |
| AI and data loss prevention | Precision AI across a cloud-delivered suite of security subscriptions. AI Access Security is a standalone licence delivered via cloud security gateways; Enterprise DLP is documented as a cloud-based service, enforced on the NGFW and on Prisma Access.Sources: Precision AI launch, May 2024 · paloaltonetworks.com: AI Access Security · Enterprise DLP overview | DLP and the AI gateway run on the box. 61 content detectors; prompts, uploads and files checked before they leave; the model that decides runs on your hardware. |
| Price changes, 2026 | A 10 % hardware list-price increase took effect in April 2026, disclosed on the fiscal Q3 2026 earnings call and attributed to memory and storage component costs.Sources: Globe and Mail, June 2026 · Q4 fiscal 2026 earnings call transcript | No hardware in the price. The licence is not tied to an appliance list, so a hardware price change does not propagate into a renewal. |
| What Palo Alto Networks has that Zedmos does not | Fiscal 2026 revenue of $11.48 billion, 70,000+ customers, Unit 42 threat intelligence and incident response, a Leader in the inaugural 2025 Gartner Magic Quadrant for Hybrid Mesh Firewalls after eleven consecutive Leader placements for Network Firewalls, and 24/7 support through a global network of support centres.Sources: Q4 fiscal 2026 earnings release · Gartner Hybrid Mesh Firewall press release, 2025 · paloaltonetworks.com: support services | None of those. A small German vendor with a published exploit record, a console you own, and a licence that does not care which box it runs on. |