Palo Alto Networks lists at approximately $35,000 to $90,000 per PA-Series next-generation firewall, $45 per protected resource per month on Prisma Cloud Enterprise, and $9 to $36 per endpoint per month across the Cortex XDR tiers. For a large enterprise deploying 40 firewalls, 8,000 endpoints, and 12,000 cloud resources, the three-year list TCO lands at $11M to $18M, of which 35 to 50 percent is open to negotiation through the Palo Alto Platform Discount and competitive replacement discount. This page covers every 2026 Palo Alto Networks line item, the platform consolidation discount math, and the negotiation levers that move enterprise contracts.
The 2026 Palo Alto portfolio
Palo Alto is organised around three platform brands. Each has its own SKU structure and its own negotiation pattern:
| Platform | Primary brands | Pricing model |
|---|---|---|
| Network Security (Strata) | PA-Series NGFW, VM-Series, CN-Series, Panorama, Prisma Access | Per appliance plus per-subscription |
| Cloud Security (Prisma Cloud) | Prisma Cloud, Prisma Cloud Compute, Prisma Cloud Code | Per protected resource and per credit |
| SecOps (Cortex) | Cortex XDR, Cortex XSIAM, Cortex Xpanse, Cortex XSOAR | Per endpoint, per ingested GB, per analyst |
Palo Alto's commercial strategy in 2024 to 2026 has been "platformisation": pushing customers from single-product purchases to multi-platform bundles at a structurally lower per-unit price but higher absolute commitment. The Platform Discount programme offers 30 to 60 percent off list when a customer commits to two or more platforms with a three-year minimum term.
PA-Series next-generation firewall pricing
Hardware NGFW pricing is appliance-based with mandatory annual subscriptions for full functionality:
| Model | Throughput | List appliance price | Typical full-stack subscription |
|---|---|---|---|
| PA-410 (branch) | 1 Gbps threat prevention | $2,000 | $2,400 per year |
| PA-440 (small office) | 3 Gbps | $5,500 | $5,400 per year |
| PA-1410 (medium branch) | 5 Gbps | $25,000 | $18,000 per year |
| PA-3410 (campus core) | 15 Gbps | $50,000 | $36,000 per year |
| PA-5430 (large campus) | 57 Gbps | $90,000 | $72,000 per year |
| PA-7080 (data centre) | 200 Gbps | $400,000+ | $160,000+ per year |
The subscription stack typically includes Threat Prevention, URL Filtering (Advanced), WildFire (Advanced), DNS Security, and SD-WAN. Without subscriptions, the appliance is a stateful firewall only. The annual subscription cost for a fully featured campus firewall is 60 to 80 percent of the appliance cost. Over a five-year asset life, subscriptions cost 3 to 4 times the appliance.
Prisma Access SASE pricing
Prisma Access is the cloud-delivered SASE platform replacing many remote-access VPN deployments. Pricing is per user per year with bandwidth-based mobile user tiers:
| Prisma Access SKU | Per user per year (list) | Includes |
|---|---|---|
| Mobile Users Edition | $110 to $165 | ZTNA, GlobalProtect, threat prevention |
| Networks Edition (per Mbps) | $210 per Mbps per year | Branch SASE |
| Business Plus Bundle | $220 per user per year | All Mobile features plus Advanced URL, Advanced Threat Prevention |
| ZTNA Connector | Included in Mobile | Application-level access |
| Prisma SD-WAN | $1,800 to $9,000 per site per year | SD-WAN with security stack |
The Prisma Access blended cost for a 10,000-mobile-user enterprise lands at $1.4M to $2.2M per year on Business Plus. The negotiated rate at $1M-plus commit is typically 25 to 40 percent off list.
Prisma Cloud pricing
Prisma Cloud bills on protected resources via a credit-based system. One credit covers one workload, defined as one host or one container or one serverless function or 100 IP addresses. The 2026 list:
| Prisma Cloud edition | Per credit per year | Coverage |
|---|---|---|
| Cloud Workload Protection only (CWPP) | $540 per credit | Container, host, serverless runtime protection |
| Cloud Security Posture Management (CSPM) | $300 per credit | Misconfiguration detection, compliance |
| Enterprise Edition (full CNAPP) | $640 per credit | CWPP plus CSPM plus IaC scanning plus DSPM |
| Prisma Cloud Compute Edition (legacy) | Different SKU, on-premise | Self-hosted CWPP |
A 12,000-resource enterprise on Enterprise Edition lists at $7.68M per year. Realised cost at $2M-plus commit is typically 35 to 50 percent off list, landing at $3.8M to $5.0M.
The credit model has two structural traps. First, the "100 IP addresses equals one credit" mapping inflates credit consumption for organisations with large public IP ranges. Second, ephemeral workloads (CI/CD containers spinning up and down) are billed by peak concurrent count, not average, which can multiply Prisma Cloud bills 2 to 5x for customers with dynamic infrastructure.
Cortex XDR, XSIAM, and SOC pricing
Cortex is Palo Alto's SecOps brand. The 2026 SKUs:
| Cortex SKU | Pricing | Position |
|---|---|---|
| Cortex XDR Prevent | $9 per endpoint per month | Endpoint protection (EPP) |
| Cortex XDR Pro Endpoint | $22 per endpoint per month | EDR, threat hunting |
| Cortex XDR Pro Everywhere | $36 per endpoint per month | Network plus identity plus cloud telemetry |
| Cortex XSIAM | Per ingested GB and per endpoint | SIEM replacement, AI-driven SOC |
| Cortex Xpanse Expander | From $250,000 per year | Attack surface management |
| Cortex XSOAR (now part of XSIAM) | Per analyst seat | SOAR, playbooks |
Cortex XSIAM is the highest-stakes Cortex product because Palo Alto is positioning XSIAM as the Splunk-replacement SIEM. XSIAM pricing combines a per-endpoint base with per-ingested-GB telemetry pricing similar to Splunk. The XSIAM commercial proposition is that the per-endpoint base plus included telemetry covers most workloads without the per-GB ingestion blow-up Splunk customers experience.
The Platform Discount programme
Palo Alto's most aggressive commercial lever in 2026 is the Platform Discount. The headline numbers:
| Platforms committed | Discount on combined list | Minimum term |
|---|---|---|
| Single platform (Strata or Cloud or Cortex) | 15 to 25 percent | 1 year |
| Two platforms | 30 to 40 percent | 3 years |
| Three platforms (full portfolio) | 40 to 55 percent | 3 years |
| Three platforms plus services lock | 50 to 60 percent | 5 years |
The Platform Discount is the highest single commercial lever in any Palo Alto negotiation. The trade-off is multi-year lock-in and committed spend across products the customer may not yet need. The negotiating discipline is to time the platform commitment to coincide with genuine portfolio expansion (replacing existing point solutions) rather than as a discount on shelfware.
The competitive replacement lever: Palo Alto's most aggressive deal discounts are reserved for customers replacing competing platforms. A demonstrated Cisco Secure (replacing Talos, Umbrella, AnyConnect) replacement deal regularly lands 50 to 65 percent off list. A demonstrated Check Point or Fortinet firewall replacement deal lands similarly. A demonstrated Splunk replacement deal for XSIAM is the largest single discount lever in the 2026 catalogue.
Negotiation framework
The Palo Alto enterprise negotiation runs through a standard cycle. The buyer-side framework that consistently produces 35 to 55 percent off list:
Phase 1 (12 months pre-renewal): Map the estate. Inventory every Palo Alto SKU, every appliance, every Prisma Cloud credit consumption, every Cortex endpoint. Identify shelfware. Establish the baseline.
Phase 2 (9 months pre-renewal): Establish competitive alternatives. Run formal proof-of-concept against credible alternatives in each category: Fortinet or Check Point on NGFW, Wiz or Lacework on Cloud Security, CrowdStrike or Microsoft Defender on Endpoint, Splunk or Microsoft Sentinel on SIEM. The credible POC is the negotiation anchor.
Phase 3 (6 months pre-renewal): Engage Palo Alto. Surface the competitive POC results. Request a structured proposal under the Platform Discount programme. Demand pricing on a multi-year commit with seat-flex clauses.
Phase 4 (3 months pre-renewal): Finalise. Negotiate price-protection clauses for years two and three (cap annual increases at CPI or 5 percent, whichever is lower). Negotiate exit terms (mid-term reduction rights for divestiture, M&A, or proven non-use). Sign.
Hidden cost drivers
Five Palo Alto cost drivers that frequently surprise buyers:
- Subscription renewal escalation: Annual NGFW subscriptions inflate 8 to 14 percent per year at renewal unless price-protection is contracted upfront. Across a 40-firewall estate over five years, uncapped escalation can add $1.2M to $2.4M.
- Prisma Cloud credit overage: Dynamic workloads (containers, serverless) blow through committed credit pools. Overage pricing is 1.2 to 1.5x the standard credit rate.
- Cortex XDR endpoint creep: Endpoint count growth (new joiners, virtual desktops, server expansion) inflates Cortex bills 12 to 20 percent per year without active right-sizing.
- Hardware refresh cycles: PA-Series end-of-life forces hardware refresh on a 5 to 7 year cycle. Refresh costs are typically 75 to 100 percent of the original purchase price.
- Professional Services creep: Palo Alto's Unit 42 incident response and Professional Services arms are heavily upsold during incidents. Maintain a pre-incident PS rate card in the master agreement to avoid retainer pricing during active incidents.
How to cut Palo Alto spend in 2026
Five levers, ranked by typical cost impact:
- Platform Discount commitment timed to portfolio expansion: 40 to 60 percent off combined list when timed to genuine consolidation (replacing competing point products).
- Prisma Cloud credit right-sizing and ephemeral workload audit: 25 to 40 percent reduction in Prisma Cloud bills through credit pool right-sizing and architectural adjustment for ephemeral workloads.
- Cortex XDR tier mix optimisation: Most enterprises overprovision Pro Everywhere when Pro Endpoint suffices. Mixed-tier rollout saves 35 to 50 percent on Cortex.
- Subscription bundle vs separate purchase: NGFW subscription bundles are typically 15 to 25 percent below the same subscriptions purchased separately.
- Multi-year price-protection clauses: Locking annual subscription escalation at CPI or 5 percent saves $1.2M to $2.4M over five years on a 40-firewall estate.
For competing platform analysis and the broader cybersecurity field, see CrowdStrike vs Defender pricing 2026, Microsoft Sentinel pricing 2026, Defender XDR suite pricing, cybersecurity licensing, cloud security licensing, and the Cisco vendor hub for Cisco Secure comparison. For engagement, see our cloud contract negotiation service or software licensing advisory.