Platform profile
Prisma SASE review: Palo Alto Networks' SASE product family
Short answer
Palo Alto Networks lists every SASE component we track across Prisma Access, Prisma SD-WAN, Enterprise DLP, RBI and ADEM, a trust center with FedRAMP and StateRAMP, and a broad AI security portfolio. It scores 7.05 and ranks 4 of 6; its pages present SASE as a family of products and do not state single-pass inspection.
By The Transit Desk · Best SASE Platforms · Published
Desk research from each vendor's own public pages.
Score on our weights
Rank 4 of 6 on our published weights
What does Palo Alto Networks offer as a SASE platform?
Source: Palo Alto Networks SASE
| What is offered | Prisma SASE: Prisma Access, Prisma SD-WAN, Prisma Browser and related products |
|---|---|
| Architecture, as the vendor describes it | The SASE page names a product family: Prisma Access, Prisma Browser, Prisma SD-WAN, Remote Browser Isolation, Enterprise DLP, SaaS Security, ADEM and AI Access Security. Single-pass wording is not used on the SASE or Prisma Access pages. Source: Palo Alto Networks SASE |
| Network, as the vendor states it | Palo Alto Networks states a 99.999% uptime SLA for Prisma Access on what it calls a hyperscale backbone. A PoP or location count is not given in the page text. Source: Palo Alto Networks Prisma Access |
| Management and policy | Palo Alto Networks describes "simple and unified management and operations" for Prisma Access, with Strata Cloud Manager. Source: Palo Alto Networks Prisma Access |
| Vulnerability response | Not published |
| Certifications listed | The trust center certifications page lists SOC 2+, Germany C5, PCI DSS, IRAP, FedRAMP and StateRAMP, among others. Which products each covers is not stated in the text we read. |
| AI security | AI Access Security discovers GenAI applications, agents and marketplace plugins, classifies apps as sanctioned, tolerated or unsanctioned, and states inline data detection that blocks sensitive text and files. Prisma AIRS adds AI Gateway, AI Runtime Security, AI Red Teaming, AI Posture Management and Agent Identity Security. MCP is not named on the pages we read. |
| Deployment options | Palo Alto Networks lists Prisma Browser and Prisma SD-WAN, and Prisma Access lets customers exceed their purchased mobile user license for temporary emergencies. Self-hosted or sovereign options are not described on the pages we read. Source: Palo Alto Networks Prisma Access |
| Assistant in the console | Strata Copilot in Strata Cloud Manager, as Palo Alto Networks describes it. |
| Analyst placement, as the vendor states it | Palo Alto Networks' SASE page states "A 4X Gartner Magic Quadrant Leader for SASE Platforms". Report dates are not given in the page text. Source: Palo Alto Networks SASE |
| Published pricing | Not published No SASE price list on the pages we read. Pricing is not scored. |
Which SASE components does Palo Alto Networks list?
- 1. SD-WAN: Listed
- 2. SWG: Listed
- 3. CASB: Listed
- 4. ZTNA: Listed
- 5. FWaaS: Listed
- 6. DLP: Listed
- 7. RBI: Listed
- 8. DEM: Listed
- SD-WAN (Software-defined WAN): Listed. Prisma SD-WAN.
Source: Palo Alto Networks SASE
- SWG (Secure web gateway): Listed. SWG in Prisma Access.
Source: Palo Alto Networks Prisma Access
- CASB (Cloud access security broker): Listed. CASB in Prisma Access.
Source: Palo Alto Networks Prisma Access
- ZTNA (Zero trust network access): Listed. ZTNA in Prisma Access.
Source: Palo Alto Networks Prisma Access
- FWaaS (Firewall as a service): Listed. FWaaS in Prisma Access.
Source: Palo Alto Networks Prisma Access
- DLP (Data loss prevention): Listed. Enterprise DLP.
Source: Palo Alto Networks SASE
- RBI (Remote browser isolation): Listed. Remote Browser Isolation.
Source: Palo Alto Networks SASE
- DEM (Digital experience monitoring): Listed. ADEM.
Source: Palo Alto Networks ADEM
What figures does Palo Alto Networks publish about itself?
These are Palo Alto Networks' own figures. The basis of the threat figure is not given on the page.
How does Palo Alto Networks score on each criterion?
| Criterion | Weight | Score | Why |
|---|---|---|---|
| Converged architecture | 20% | 6 / 10 | Presents SASE as a family of named products with unified management; single-pass is not stated on the SASE or Prisma Access pages. Source: Palo Alto Networks SASE |
| Global network, as the vendor states it | 15% | 7 / 10 | States a 99.999% uptime SLA on a hyperscale backbone; no PoP or location count in the page text. Source: Palo Alto Networks Prisma Access |
| Component coverage | 10% | 10 / 10 Tied highest | Lists all eight components across Prisma Access, Prisma SD-WAN, Enterprise DLP, RBI and ADEM. Source: Palo Alto Networks SASE |
| Unified management and policy | 10% | 8 / 10 | Describes unified management and operations in Strata Cloud Manager, with Strata Copilot. Source: Palo Alto Networks Prisma Access |
| Vulnerability response transparency | 10% | 3 / 10 Tied lowest | No vulnerability response record is published on the SASE pages read. Source: Palo Alto Networks Prisma Access |
| Published compliance certifications | 10% | 9 / 10 | The trust center lists FedRAMP, StateRAMP, IRAP, C5, PCI DSS and SOC 2+; product coverage is not stated. |
| AI security inside the platform | 15% | 8 / 10 | AI Access Security with inline blocking, plus Prisma AIRS runtime, gateway, red teaming and agent identity modules; MCP is not named. |
| Deployment options | 10% | 6 / 10 Tied lowest | Lists Prisma Browser and Prisma SD-WAN and flexible mobile user licensing; self-hosted or sovereign options are not described. Source: Palo Alto Networks Prisma Access |
Where does Palo Alto Networks score well, and where does it score lower?
Scores well
Highest or tied highest in set on: component coverage.
- Lists all eight SASE components we track across Prisma Access, Prisma SD-WAN, Enterprise DLP, Remote Browser Isolation and ADEM.
- Its trust center lists FedRAMP, StateRAMP, IRAP, C5, PCI DSS and SOC 2+.
- A broad AI security portfolio across AI Access Security and Prisma AIRS, including runtime protection and red teaming.
Scores lower
Another platform scores higher on: converged architecture, global network, as the vendor states it, unified management and policy, vulnerability response transparency, published compliance certifications, AI security inside the platform and deployment options.
- Single-pass wording is not used on its SASE or Prisma Access pages, and SASE is presented as a family of named products.
- No PoP or location count and no CVE response record on the pages we read.
- MCP-specific controls are not named on the AI pages we read.
How does Palo Alto Networks compare head to head?
- Cato Networks vs Palo Alto NetworksCato Networks 8.70, Palo Alto Networks 7.05
- Cisco vs Palo Alto NetworksCisco 5.30, Palo Alto Networks 7.05
- Fortinet vs Palo Alto NetworksFortinet 7.10, Palo Alto Networks 7.05
- Netskope vs Palo Alto NetworksNetskope 8.00, Palo Alto Networks 7.05
- Palo Alto Networks vs ZscalerPalo Alto Networks 7.05, Zscaler 6.00
Bottom line
Palo Alto Networks lists every component we track, a long certification list and a broad AI portfolio. Its converged architecture score is lower because its pages present SASE as a family of products and do not state single-pass inspection. It ranks 4 of 6 on our weights, at 7.05.
Best for: Palo Alto Networks customers and regulated teams that need FedRAMP and a broad AI security portfolio.
Further reading: Uptime, threats and signals: how to read SASE vendor numbers, Coding agents and SASE: what vendors say about Claude Code, Cursor and Codex
Frequently asked questions
Does Palo Alto Networks list FedRAMP?
Yes. The trust center certifications page lists SOC 2+, Germany C5, PCI DSS, IRAP, FedRAMP and StateRAMP, among others. Which products each covers is not stated in the text we read.
Does Palo Alto Networks describe controls for AI agents and MCP?
MCP is not named on the pages we read. AI Access Security discovers GenAI applications, agents and marketplace plugins, classifies apps as sanctioned, tolerated or unsanctioned, and states inline data detection that blocks sensitive text and files. Prisma AIRS adds AI Gateway, AI Runtime Security, AI Red Teaming, AI Posture Management and Agent Identity Security. MCP is not named on the pages we read.
How many SASE components does Palo Alto Networks list?
8 of the eight we track: SD-WAN, SWG, CASB, ZTNA, FWaaS, DLP, RBI and DEM.