SC

Strategy Canon

Palo Alto Networks: sourced choices

46 product and go-to-market choices, oldest first. Back to the case study

  1. 2005Product · Initial product Zuk founded the company to build 'a completely new kind of firewall', recruiting 25 NetScreen engineers and raising $9.4 million. PAN3
  2. 2005Product · Cloud services Zuk proposed cloud-delivered security services in 2005, when, in his account, everybody thought the idea was crazy. PAN1
  3. 2005Go_To_Market · Funding and incubation Zuk raised seed money from Greylock and Sequoia and spent months at Greylock's offices brainstorming with investors and prospective customers. PAN5
  4. 2007Go_To_Market · Category name The founders chose to call the product a 'next-generation firewall' rather than an application visibility and control tool, despite sales resistance. PAN1
  5. 2007Go_To_Market · Proof of concept Sales offered a one-week trial in tap mode, connected to a switch or optical tap outside the traffic path, to 'show you what you're missing'. PAN1
  6. 2007Go_To_Market · Win rate Zuk recalled that once a customer ran a proof of concept, the chance of a sale was 90% or more. PAN1
  7. 2007-06-21Product · Application identification The PA-4000 series launched able to identify applications inside web traffic, for example telling Yahoo Mail from corporate e-mail, and apply policy to them. PAN22
  8. 2007-06-21Product · Deployment modes Customers could run the box out-of-band as a monitor, inline beside their existing firewall, or inline as its replacement. PAN22
  9. 2008-10-06Product · Performance In an independent test the PA-4020 kept about 1.6 Gbps with intrusion prevention, antivirus and content filtering all on, about 20% below its 2 Gbps rating. PAN7
  10. 2009-10-16Product · App-ID App-ID identified more than 900 applications regardless of port, protocol, encryption or evasive tactic. PAN32
  11. 2009-10-16Product · User-ID User-ID tied firewall policy to users and groups drawn from Active Directory rather than IP addresses. PAN32
  12. 2009-10-16Product · Single-pass architecture The firewall processed each packet once in a single-pass, parallel architecture built from the ground up, which the company contrasted with rivals' ASIC hardware designed for simpler jobs. PAN32
  13. 2009-10-16Product · Virtual wire The box could be inserted as a transparent 'virtual wire' without changing network addressing. PAN32
  14. 2010-03Go_To_Market · Entry point Gartner observed the company often entered enterprises through URL-filtering selections, where its per-box charge compared well. PAN9
  15. 2010-03Go_To_Market · Geography Almost all sales were in North America in 2009, with an international channel growing. PAN9
  16. 2010-03Go_To_Market · Analyst demand Palo Alto Networks generated the most firewall inquiries from Gartner clients in 2009. PAN9
  17. 2011Go_To_Market · Leadership Mark McLaughlin became CEO in 2011 and persuaded the board to delay the IPO while the company hired sales, support and finance leaders. PAN1
  18. 2011-08Go_To_Market · Sales motion The company marketed next-generation firewalls as a consolidation purchase, publishing customer accounts that replaced Cisco firewalls plus separate intrusion prevention, proxy and URL-filtering appliances with cost savings. PAN35
  19. 2012-10-05Product · Consolidated functions The platform combined App-ID, User-ID and Content-ID so policy could be set by application, user and content, replacing separate 'helper' devices such as web filters and intrusion prevention appliances. PAN2
  20. 2012-10-05Product · WildFire WildFire, a cloud-based malware analysis service, was sold as a subscription alongside threat prevention and URL filtering. PAN2
  21. 2012-10-05Go_To_Market · Channel model Substantially all revenue came through distributors and resellers in a 'high touch, channel fulfilled' model in which partners bought at a discount and resold. PAN2
  22. 2012-10-05Go_To_Market · Insertion points The company sold either as a firewall replacement or as a replacement for a firewall 'helper', then aimed to replace the core firewall at refresh. PAN2
  23. 2012-10-05Go_To_Market · Customer base The company had more than 9,000 end-customers in over 100 countries, and revenue grew from $48.8 million in fiscal 2010 to $255.1 million in fiscal 2012. PAN2
  24. 2012-10-05Go_To_Market · Analyst position Gartner placed the company as a leader in its 2011 Magic Quadrant for enterprise network firewalls. PAN2
  25. 2014-02-28Go_To_Market · Positioning Zuk described the product as consolidating multiple security devices into a single device, against the practice of adding a new device for every problem. PAN5
  26. 2014-03-24Product · Endpoint The company bought endpoint-protection start-up Cyvera for $200 million to join endpoint, firewall and threat cloud in one platform; it became Traps. PAN27
  27. 2014-05-28Go_To_Market · Litigation The company settled Juniper's patent suits for $75 million in cash and $100 million in stock and warrants. PAN17
  28. 2019-09Product · Prisma Prisma, announced in fiscal 2019, grouped public-cloud security, SaaS security and Prisma Access, a cloud-delivered network security service for remote users and sites. PAN19
  29. 2019-09Product · Cortex Cortex grouped XDR detection and response, Cortex Data Lake, Demisto orchestration and AutoFocus threat intelligence. PAN19
  30. 2019-09Product · Fiscal 2019 acquisitions In fiscal 2019 the company bought RedLock, Demisto, PureSec and Twistlock to fill cloud and automation gaps. PAN19
  31. 2019-09Product · Subscriptions Subscriptions sold on the firewall base included Threat Prevention, URL Filtering, WildFire, GlobalProtect, DNS Security and VM-Series virtual firewalls. PAN19
  32. 2019-09Go_To_Market · Distributors Four distributors accounted for 74.6% of fiscal 2019 revenue. PAN19
  33. 2019-09Go_To_Market · Revenue mix Subscription and support were 62.2% of fiscal 2019 revenue. PAN19
  34. 2019-09-04Go_To_Market · Specialist sales Arora expanded the Prisma and Cortex specialist teams from 500 to 1,500 people and committed $100-125 million of extra investment. PAN25
  35. 2020Product · Attack surface The company bought Expanse for external attack-surface management in 2020. PAN4
  36. 2022-12-14Go_To_Market · Market share Arora said the company had been the largest security vendor by a small margin at 1.5% of industry spend and had reached about 3-4%. PAN21
  37. 2023-11Go_To_Market · Free incident response The company offered its largest customers free incident-response help; about 400 of the top 1,500 accepted within 90 days. PAN10
  38. 2024-02-20Product · XSIAM Cortex XSIAM, the security-operations platform, had more than 65 customers and had replaced 19 different SIEM vendors. PAN20
  39. 2024-02-20Go_To_Market · Platformization terms Customers who consolidated could start using the platforms at once and pay when their other vendors' contracts ran out, on average about six months of free use. PAN20
  40. 2024-02-21Go_To_Market · Market reaction Guidance for 12 to 18 months of slower billings growth sent the shares down 28%, the worst day since the 2012 IPO. PAN13
  41. 2024-05-21Product · QRadar migration The company agreed to buy IBM's QRadar SaaS assets for $500 million and to migrate QRadar customers to XSIAM. PAN11
  42. 2024-05-21Go_To_Market · Largest contract A healthcare provider signed a $150 million contract, the largest in company history, after receiving incident-response services. PAN11
  43. 2025-02-13Go_To_Market · Platformizations The company reported more than 1,150 platformizations among its top 5,000 customers and targeted 2,500 to 3,500 by fiscal 2030. PAN30
  44. 2025-08-18Go_To_Market · Results Fiscal 2025 revenue was $9.2 billion and next-generation security ARR $5.6 billion, up 32%. PAN12
  45. 2026-02-12Product · Identity security The company completed its roughly $25 billion acquisition of CyberArk to add identity security to the Cortex and Strata platforms. PAN14
  46. 2026-09-16Go_To_Market · Results Fiscal 2026 revenue was $11.5 billion, up 24%, with fiscal 2027 guidance of $14.1-14.2 billion. PAN31