Palo Alto Networks’ growth shows where enterprise security budgets are going. Companies dealing with too many tools and rising attack volume tend to favor vendors that can combine cloud security and network defense inside one platform.
The more useful question is why that growth is happening. Security leaders are rewarding vendors that reduce complexity while improving visibility and policy consistency across hybrid environments. That makes the story a window into how companies buy security.
When one vendor grows through AI, cloud security and a broader platform all at once, it suggests buyers still want fewer vendors across a fragmented stack.
Start your morning with the signal that matters.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Arora’s growth playbook
Under CEO Nikesh Arora, Palo Alto Networks has expanded step by step, adding products and markets while keeping innovation at the center of its plans.
It competes with many large rivals and has outgrown many of them, largely by buying companies and folding their technology into its own products. Those deals fit its broader platform strategy.
AI and machine learning
A big driver of Palo Alto’s growth is its use of artificial intelligence (AI) and machine learning (ML). Building AI and ML into its products helps it spot threats earlier. The company argues this keeps its protection current as threats change.
Its Cortex XDR platform is one example. It pulls together data from endpoints and cloud services to find and stop threats.
Buying its way into new markets
Palo Alto Networks has bought several companies to strengthen different parts of its business. Those deals bring in people and technology that fill gaps in its existing products.
The acquisitions also push the company deeper into cloud security, which matters more as businesses move operations online.
Cloud security and zero trust
Cloud security and zero trust are two of Palo Alto’s main focuses. Demand for cloud security has grown as companies move workloads to the cloud. Palo Alto sells products meant to protect data wherever it is stored.
Start your morning with the signal that matters.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
The company promotes zero trust, a model that assumes threats can come from inside or outside the network. Every user and device has to prove itself, every time.
What could slow it down
Threats keep getting more sophisticated, and security vendors have to keep up. Palo Alto has so far stayed near the front.
Demand for security will keep growing as more devices come online. Palo Alto is well placed to benefit, though rivals such as CrowdStrike and Microsoft are chasing the same platform deals.
For buyers, the takeaway is practical. Consolidating on one platform can cut cost and complexity, but it also concentrates risk with a single vendor, so negotiate exit terms and test how well each module performs on its own before committing.
Related buying guide: If this vendor coverage has you comparing extended detection platforms more directly, see our guide to the best XDR tools in 2026.
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Citrix NetScaler CVE-2026-19490: The Auth Bypass That Went From PoC to Probes in a Day
CVE-2026-19490 is a CVSS 9.3 NetScaler Gateway/AAA auth bypass. A public PoC on Sept 2 was followed by live probes within a...
PaperCut NG/MF: The Print Server That Learned Remote Code Execution Again
CVE-2026-81578 and CVE-2026-82078 chain to pre-auth RCE on PaperCut Application Server. Confirm Emergency Patch Release 2, restrict admin exposure, and hunt like...
JFrog Artifactory CVE-2026-82329: Empty Join Key, Full Admin Token, Busy Scanners
CVE-2026-82329 lets attackers forge Artifactory admin tokens via a deterministic empty join key. Mass scanning peaked near 406,000 attempts; patch fixed builds...
Friday’s brief: Apache’s HTTP/2 fix, then Check Point break-ins, a ScreenConnect add-on and a GitHub secret stealer
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.