Palo Alto Networks Cloud Delivered Security Services

Name: Palo Alto Networks Cloud Delivered Security Services
Brand: Palo Alto Networks
Rating: 4.4 (106 reviews)

Leader

The industry's most comprehensive AI security platform.

Est 2005|Valuation $306.8B|Raised $261.3M

LinkedIn 2.0M|Website|Web traffic 3.9M|FTEs 21,921|HQ Santa Clara, CA

MarketsFirewalls

Palo Alto Networks Cloud Delivered Security Services screenshot

Published Aug 27, 2026

01Common complaints

- Company sizes or stages where this product is overkill or insufficient - Small organizations without dedicated network security engineering may find Prisma Access and CDSS operationally heavy compared with simpler SSE tools. - Industries or use cases where competitors are relatively better suited - Pure SSE-first, internet-only access scenarios with minimal private application routing may be easier to implement with Zscaler or Cloudflare, depending on requirements. - Organizations prioritizing deep DLP/CASB functionality for SaaS may prefer Netskope in some evaluations. - Technical requirements that this product may not meet - Deployments that require fully static egress IP allowlisting across all regions can encounter operational friction when egress IP ranges change. - Budget constraints that favor alternatives - Organizations seeking transparent, predictable per-seat pricing without enterprise bundle negotiations may find Palo Alto’s quote-based model a poor fit. - Specific workflows or integrations where the product is less suitable - Complex routing and service-connection designs can extend implementation time; if an organization requires immediate turnkey rollout, some competitors may achieve faster time-to-value. - Red flags in the buying process - Expect enterprise contracting and bundled licensing; validate whether the vendor or reseller will provide trial or proof-of-concept access to test critical paths (identity, decryption exceptions, SaaS allowlisting) prior to full commitment. - Current limitations acknowledged by the vendor - Documentation and compatibility matrices identify specific feature constraints (for example, certain URL filtering features may not be supported in all contexts). Buyers should consult the latest compatibility matrix for precise limitations. - Features on the roadmap (not yet available) - Roadmap details are typically communicated by account teams and are not generally published in buyer-verifiable form; rely on contractual commitments and documented release notes for planning. - Scale limitations (at what volume/size does it break down?) - The vendor positions the solutions for enterprise scale; operational experience can vary by region, PoP proximity, policy complexity, and decryption load. - Security or compliance gaps - Certification scope for individual cloud-delivered components is not always enumerated publicly. Verify SOC 2 and ISO scope for the specific services you intend to use. - Technical debt or architectural limitations mentioned in reviews - Community threads reference configuration commit propagation issues and other operational behaviors that may be relevant for complex deployments. - API limitations or integration constraints - Integration specifics were not fully assessed in this run; buyers should evaluate Prisma Access integration documentation and run integration tests for required workflows.

Deal disqualifiers: what makes a POOR fit

Strong requirement for fully static egress IPs in all locations or extensive IP allowlisting requirements
Very small IT/security teams that require minimal-complexity SSE solutions
Procurement needs for transparent, self-serve pricing and minimal vendor negotiation

Why some customers left for competitors (churn reasons)

Some practitioners indicated a move to competitors (for example, Zscaler or Cloudflare) for reduced deployment complexity or simpler SSE-first operational models.

02Why they buy

- Competitive advantages supported by customer feedback (not only vendor claims) - Reviewers and practitioners have highlighted consistent policy application across Palo Alto management planes and a positive remote access experience in some deployments. - Practitioner discussions indicate Prisma Access and CDSS may be appropriate for network-centric environments and organizations that already use Palo Alto policy models extensively. - Unique features and capabilities relative to competitors - Integration of Palo Alto firewall policy and security services across multiple enforcement form factors can be a differentiator compared with some SSE-only vendors. - Features such as Prisma Access Traffic Replication (documented by the vendor) provide mechanisms for packet-capture or forensic visibility by integrating with cloud provider features like Google Cloud Packet Mirroring. - Differentiation rationale - Differentiation is often about the proportion of an organization’s network and security stack that an organization wants to operate under a single vendor (NGFW + cloud-delivered services + remote access), rather than a simple checklist of features. - Evidence considerations - Vendor and partner case studies emphasize consolidation and migration benefits; treat quantified ROI and TEI-style findings as sponsor-influenced unless methodology and raw inputs are independently verified. - Areas where competitors have advantages - Some competitors are perceived as easier to deploy for SSE-first patterns and may provide clearer packaging or pricing structures for certain buyer segments.

Why customers chose this product over alternatives

Organizations commonly cited standardization on Palo Alto firewalls and the desire to maintain consistent security profiles across enforcement points as drivers for choosing Prisma Access/CDSS.

03Field reports

- Detailed customer success stories with metrics - The vendor and partners publish customer stories and TEI-style reports describing deployments of Prisma SASE and related services. These documents often include claimed benefits and sometimes quantified metrics. - Specific results and quantified business impact - TEI-style reports commonly quantify ROI, cost savings, and risk reduction based on modeled assumptions. These documents should be treated as vendor- or partner-sponsored unless independently validated. - Implementation details and time to value - Case studies often describe decommissioning on-prem appliances and rolling out remote access and centralized security profiles; however, published case studies typically understate implementation headaches and do not always disclose time-to-value in operational terms. - Challenges faced during adoption and how they were resolved - Public community threads document routing and commit issues and other operational challenges. Vendor case studies rarely emphasize difficulties; procurement should request references that discuss challenges and remediation steps. - Note when metrics are vendor-published without independent verification - Where TEI-style collateral is provided, buyers should validate methodology, inputs, and whether benefits are modeled or measured. - Include mixed results - Community discussions indicate some deployments experienced notable operational challenges. Publicly documented failed projects are uncommon in vendor literature.

Summary of review platform sentiment

Review platforms and practitioner forums indicate a mix of positive and negative feedback. Public review snippets emphasize scalability, integration with Palo Alto management and policy models, and operational complexity.

Representative positive feedback (paraphrased)

A reviewer on a mainstream review site described GlobalProtect/Prisma Access positively, noting the ability to apply a single set of policies across remote users.
Reviewers on G2 and TrustRadius note benefits related to integration with Palo Alto security services and the ability to centralize policy management.

Representative negative feedback (paraphrased)

- Practitioner comments on Reddit and other forums describe Prisma Access deployments as more complex to set up compared with some SSE-first competitors such as Zscaler ZIA or Cloudflare Zero Trust. - Community posts report operational friction (for example, when Prisma Access expands egress IP ranges, some organizations experienced additional work for IP-based allowlisting). - Forum posts have described intermittent connectivity or configuration commit issues in certain deployments.

Balance and access constraints

Public positive examples were often accessible on mainstream review platforms; lower-rating or detailed negative examples were more commonly found in practitioner forums. Full review platform content may require authentication, and reviewers should treat platform excerpts as indicative rather than comprehensive.

Common criticisms and complaints (support issues, bugs, missing features)

Reported themes include implementation complexity relative to some SSE-first tools, operational friction with dynamic egress IP ranges, occasional performance or reliability issues noted in community posts, and variable experiences with vendor support channels.

Specific outcomes customers achieved (with caveats)

Vendor and partner collateral report outcomes such as reduced tool sprawl and consolidated policy management; these metrics are frequently vendor-published and should be validated independently where possible.

Customer pain points and frustrations mentioned in reviews

Noted pain points include routing and design complexity, commit/propagation issues, and connectivity or application behavior problems after migrations (examples cited on community forums).

Deal-breakers and reasons customers didn't purchase

Likely deal-breakers inferred from practitioner discussions include deployment complexity, opaque pricing/packaging, heavy reliance on static IP allowlisting, and a preference for simpler admin UX.

04Best fit

Company sizes

Common fit:
- Mid-market: mid-sized organizations
- Enterprise: large enterprises
- Often includes global/hybrid workforces and multiple branch locations

Industries and verticals where adoption is strongest

Financial services, technology, professional services, healthcare, and other regulated industries — inferred from the vendor’s enterprise positioning and compliance materials.

Roles and personas: decision makers AND end users

Decision makers:
- CISO / VP Security
- Head of Network Security / IT Infrastructure
- Procurement / Vendor risk management
End users:
- Network security engineers (Panorama / Prisma Access / Strata Cloud Manager)
- SOC analysts consuming logs and alerts
- Helpdesk staff supporting client connectivity

Pain points and challenges the product addresses

Consolidating multiple security point products under a single vendor
Adding cloud-updated prevention and detection features without frequent on-prem updates
Applying consistent security policy for remote users and branch locations

Qualification criteria: what makes a GOOD fit

An existing Palo Alto NGFW footprint and a desire to standardize security profiles across enforcement points
Willingness to invest in design, architecture, and potentially professional services
Need for advanced inspection services such as WildFire analysis and advanced URL/DNS protections

Real customer examples with company names when available

Vendor collateral references organizations (for example, Jefferies cited in Prisma SASE materials); procurement should verify the scope of each case study and whether CDSS components were included.

05The pitch

What the product does (core value proposition in objective terms)

- Palo Alto Networks’ Cloud-Delivered Security Services (CDSS) are subscription security capabilities delivered from Palo Alto’s cloud and integrated with Palo Alto network-security form factors (hardware NGFW, VM, cloud NGFW, and Prisma Access). These services provide protections such as Advanced WildFire, Advanced URL Filtering, Advanced DNS Security, and other cloud-updated detection/prevention features. Vendor materials position CDSS as an alternative to combining multiple point products by consolidating security services under a single vendor platform. - In practice, CDSS functions as a bundle category of additional security subscriptions that extend traffic inspection and policy enforcement across Palo Alto’s network security stack and are commonly paired with Prisma Access or Prisma SASE deployments.

Target market and market positioning

- Target customers are primarily mid-market to enterprise organizations that already use, or are willing to standardize on, Palo Alto Networks’ network security stack and seek cloud-delivered updates, threat intelligence, and inspection capabilities without integrating multiple third-party point products. - Positioning elements include: - Platform consolidation - Marketing references to AI (including mentions of "Precision AI") - Consistent policy enforcement across hybrid work, branch, data center, and cloud environments

Get a comprehensive analysis of Palo Alto Networks Cloud Delivered Security Services including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →