Palo Alto Networks Application Security

Name: Palo Alto Networks Application Security
Brand: Palo Alto Networks
Rating: 4.3 (654 reviews)

Leader

The industry's most comprehensive AI security platform.

Est 2005|Valuation $306.8B|Raised $261.3M

LinkedIn 2.0M|Website|Web traffic 3.9M|FTEs 21,921|HQ Santa Clara, CA

MarketsApplication Security Testing (AST)Cloud-Native Application Protection Platform (CNAPP)Code Security

Palo Alto Networks Application Security screenshot

Published May 16, 2026

01Common complaints

1) For organizations prioritizing a lightweight, fast-to-deploy CNAPP with minimal operational overhead - Agentless-first alternatives are often chosen when time-to-value and low operational overhead are top priorities. 2) When pricing predictability is a primary procurement requirement - Community feedback and procurement examples suggest pricing and packaging can be complex; buyers should require clear contractual protections. 3) When only a single specialized AppSec capability is required - If the requirement is for a single focused capability (for example, only SAST or only WAF), a specialist point solution may have a simpler integration path. 4) For organizations without Palo Alto platform expertise and unwilling to invest in partners or training - The platform’s operational model and multi-module architecture require some level of vendor-specific expertise or partner support.

Deal disqualifiers (poor fit)

Small teams without bandwidth for tuning and administration.
Buyers requiring transparent, self-serve list pricing and predictable cost structures.
Organizations that only require a narrow, single capability where a specialized tool may provide lower friction.

Frequently mentioned limitations (from reviews/community)

UI/UX complexity: asset discovery and explorer workflows can be difficult to use at scale.
Documentation gaps: reviewers reported limited step-by-step guides for advanced modules and manual search tasks.
Trial and onboarding friction: customers report difficulty trying all modules independently without guided onboarding.
Licensing and packaging confusion: multiple sources indicate naming and entitlement shifts have caused procurement friction.

Vendor-acknowledged architecture trade-offs

Inline WAAS can impact performance; the vendor offers out-of-band WAAS as an option to address this trade-off.

Security/compliance disclosure gaps

While ISO and SOC frameworks are referenced on Trust Center pages, a consolidated public control list for specific product modules (SSO/SCIM/audit logs/data retention) was not located in the reviewed materials. Buyers should request detailed compliance documentation through Trust Center or the vendor’s security questionnaires.

02Why they buy

Differentiators supported by evidence

Coverage across SDLC and runtime: Prisma Cloud describes capabilities that span from code analysis to runtime protections.
WAAS deployment options: The vendor provides both inline and out-of-band WAAS modes to address performance considerations.
ASPM and third-party scanner ingestion: Cortex Cloud ASPM supports ingesting findings from third-party scanners for centralized correlation and prioritization.

Where competitors have clear advantages

Agentless deployment models and simplified dashboards are frequently cited as advantages for certain competitors.
Alternatives may present lower adoption friction for organizations seeking a rapid trial and proof-of-value.

03Field reports

Review platform availability note

Gartner Peer Insights pages for Prisma Cloud and related products may be restricted. Available reviews for related Palo Alto cloud offerings provide insight into recurring themes (support, complexity, cost) but may not be limited to Prisma Cloud AppSec.

TrustRadius (Prisma Cloud) — examples of positives and negatives

TrustRadius lists Prisma Cloud with a generally favorable composite score in the snapshot used for this report. Review excerpts include: Positive example: - A reviewer noted consolidated multi-cloud coverage in a single console, referencing CSPM, workload protection, IAM, and other components. Critical examples: - Reviewers reported that the console could be more user-friendly and that portfolio licensing and packaging can create friction. - Some reviewers requested greater flexibility and interoperability for diverse infrastructures and reported performance concerns in large-scale deployments. - Usability and documentation gaps were cited for certain features such as the asset explorer and manual search workflows.

AWS Marketplace reviews (G2-syndicated) — examples

Positive example:

A reviewer described Cortex Cloud’s unified dashboard as providing consolidated threat detection and compliance reporting, and reported shorter times to act on alerts in their environment.

Negative example:

Other reviewers reported time-intensive initial onboarding, policy fine-tuning requirements, a cluttered UI, and concerns about usage-based pricing increases if data ingestion is not managed.

Community feedback (Reddit) — themes (positive and negative)

Community discussions mix experiences across Prisma, Cortex, and other Palo Alto products. Common themes observed: Positive community themes: - Platform consolidation can provide centralized policy management and unified visibility for some deployments; several users reported stable operational experiences when deployed with appropriate governance. Negative community themes: - Pricing and licensing changes have been a frequent concern in some threads, including reports of substantial quoted increases in adjacent Prisma services. - Complexity and a steep UI learning curve were reported in multiple discussions. - Support quality experiences are variable based on threads; some users reported dissatisfaction while others reported rapid resolution when escalation paths or premium support were used.

Reasons cited for selection

Centralized visibility and multi-cloud coverage across posture, workload, and AppSec shift-left capabilities.
Integration benefits if customers already use other Palo Alto products (network firewalls, SecOps tooling).
Compliance reporting and centralized audit-capable visibility.

Reasons cited for replacement or evaluation of alternatives

Cost concerns and perceived high pricing.
Complexity and administrative overhead.
Preference for agentless competitors that emphasize faster deployment and simpler adoption.

Vendor/analyst-style ROI claims (Forrester TEI)

Palo Alto publishes a Forrester Total Economic Impact (TEI) summary for Prisma Cloud with modeled costs and benefits. These studies are vendor-commissioned and contain assumptions that may not reflect all deployment scenarios; buyers should review methodology and adjust assumptions to their environment.

Analyst placements and recognition

Palo Alto has been included in analyst evaluations such as The Forrester Wave and GigaOm Radar for related cloud workload and posture categories. These placements provide a directional view of capabilities across broad categories rather than a detailed assessment of specific AppSec workflows. Buyers should use analyst placements as one input among technical evaluations, proof-of-concept testing, and procurement checks.

04Best fit

Company sizes

Most appropriate for mid-market to large enterprise organizations or those with substantial cloud footprints. Reviewers originate from a range of company sizes, including mid-market and enterprise segments.

Industries

Common industries that align with the product’s value proposition include:

Technology / SaaS
Financial services
Retail / e-commerce (WAAS/WAF-like needs)
Regulated industries requiring reporting for HIPAA/PCI/GDPR

Roles and personas

CISO / Head of Cloud Security
AppSec leader / DevSecOps manager
Security engineering (policy-as-code / CI/CD)
Cloud platform engineering

Fit criteria

Organizations seeking consolidation of cloud and application security functions.
Organizations operating in multi-cloud environments that require centralized posture and app/API protection.
Organizations prepared to invest in tuning and process maturity (DevSecOps workflows, ownership mapping, remediation processes).

05The pitch

What the product does (core value proposition)

Palo Alto Networks Application Security is delivered across Prisma Cloud / Cortex Cloud (CNAPP) for code-to-cloud application security and Web Application & API Security (WAAS) for runtime protection. The offering aggregates application security signals (code, CI/CD, infrastructure-as-code, dependencies, secrets, runtime) into a unified risk-prioritization and policy engine. Key capability buckets included under the Application Security umbrella: - ASPM (Application Security Posture Management): centralizes findings from multiple AppSec tools and correlates them with runtime context to prioritize and help prevent exploitable risk. - Shift-left AppSec within Prisma Cloud: IaC scanning, SCA (open-source dependency scanning), secrets scanning, CI/CD guardrails, and policy-as-code. - Runtime AppSec / WAAS: WAF-like protections, API discovery and policy enforcement, bot defense, DoS protections, virtual patches, and application/API traffic visibility across environments. (Primary product materials: official product overview and feature pages for Prisma Cloud Application Security; WAAS collateral; press/announcements for Cortex Cloud ASPM.)

Target market and market positioning

- Target users: security engineering/DevSecOps teams, cloud security teams, platform engineering, and (for WAAS) application owners responsible for runtime protection of web applications and APIs. - Typical customer profile: mid-market to large enterprises operating in multi-cloud or hybrid environments and seeking consolidation across cloud security, AppSec, and runtime controls. - Market positioning: positioned as an offering that combines CNAPP capabilities with AppSec and runtime controls. The vendor emphasizes prevention-oriented controls and prioritized risk scoring based on contextual signals. The vendor also supports ingestion of third-party scanner findings through its partner ecosystem.

Get a comprehensive analysis of Palo Alto Networks Application Security including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →

Published May 16, 2026

01Common complaints

For organizations prioritizing a lightweight, fast-to-deploy CNAPP with minimal operational overhead

Agentless-first alternatives are often chosen when time-to-value and low operational overhead are top priorities.

When pricing predictability is a primary procurement requirement

Community feedback and procurement examples suggest pricing and packaging can be complex; buyers should require clear contractual protections.

When only a single specialized AppSec capability is required

If the requirement is for a single focused capability (for example, only SAST or only WAF), a specialist point solution may have a simpler integration path.

For organizations without Palo Alto platform expertise and unwilling to invest in partners or training

The platform’s operational model and multi-module architecture require some level of vendor-specific expertise or partner support.

Deal disqualifiers (poor fit)

Small teams without bandwidth for tuning and administration.
Buyers requiring transparent, self-serve list pricing and predictable cost structures.
Organizations that only require a narrow, single capability where a specialized tool may provide lower friction.

Frequently mentioned limitations (from reviews/community)

UI/UX complexity: asset discovery and explorer workflows can be difficult to use at scale.
Documentation gaps: reviewers reported limited step-by-step guides for advanced modules and manual search tasks.
Trial and onboarding friction: customers report difficulty trying all modules independently without guided onboarding.
Licensing and packaging confusion: multiple sources indicate naming and entitlement shifts have caused procurement friction.

Vendor-acknowledged architecture trade-offs

Inline WAAS can impact performance; the vendor offers out-of-band WAAS as an option to address this trade-off.

Security/compliance disclosure gaps

While ISO and SOC frameworks are referenced on Trust Center pages, a consolidated public control list for specific product modules (SSO/SCIM/audit logs/data retention) was not located in the reviewed materials. Buyers should request detailed compliance documentation through Trust Center or the vendor’s security questionnaires.

02Why they buy

Differentiators supported by evidence

Coverage across SDLC and runtime: Prisma Cloud describes capabilities that span from code analysis to runtime protections.
WAAS deployment options: The vendor provides both inline and out-of-band WAAS modes to address performance considerations.
ASPM and third-party scanner ingestion: Cortex Cloud ASPM supports ingesting findings from third-party scanners for centralized correlation and prioritization.

Where competitors have clear advantages

Agentless deployment models and simplified dashboards are frequently cited as advantages for certain competitors.
Alternatives may present lower adoption friction for organizations seeking a rapid trial and proof-of-value.

03Field reports

Review platform availability note

TrustRadius (Prisma Cloud) — examples of positives and negatives

TrustRadius lists Prisma Cloud with a generally favorable composite score in the snapshot used for this report. Review excerpts include:

Positive example:

A reviewer noted consolidated multi-cloud coverage in a single console, referencing CSPM, workload protection, IAM, and other components.

Critical examples:

Reviewers reported that the console could be more user-friendly and that portfolio licensing and packaging can create friction.
Some reviewers requested greater flexibility and interoperability for diverse infrastructures and reported performance concerns in large-scale deployments.
Usability and documentation gaps were cited for certain features such as the asset explorer and manual search workflows.

AWS Marketplace reviews (G2-syndicated) — examples

Positive example:

A reviewer described Cortex Cloud’s unified dashboard as providing consolidated threat detection and compliance reporting, and reported shorter times to act on alerts in their environment.

Negative example:

Other reviewers reported time-intensive initial onboarding, policy fine-tuning requirements, a cluttered UI, and concerns about usage-based pricing increases if data ingestion is not managed.

Community feedback (Reddit) — themes (positive and negative)

Community discussions mix experiences across Prisma, Cortex, and other Palo Alto products. Common themes observed:

Positive community themes:

Platform consolidation can provide centralized policy management and unified visibility for some deployments; several users reported stable operational experiences when deployed with appropriate governance.

Negative community themes:

Pricing and licensing changes have been a frequent concern in some threads, including reports of substantial quoted increases in adjacent Prisma services.
Complexity and a steep UI learning curve were reported in multiple discussions.
Support quality experiences are variable based on threads; some users reported dissatisfaction while others reported rapid resolution when escalation paths or premium support were used.

Reasons cited for selection

Centralized visibility and multi-cloud coverage across posture, workload, and AppSec shift-left capabilities.
Integration benefits if customers already use other Palo Alto products (network firewalls, SecOps tooling).
Compliance reporting and centralized audit-capable visibility.

Reasons cited for replacement or evaluation of alternatives

Cost concerns and perceived high pricing.
Complexity and administrative overhead.
Preference for agentless competitors that emphasize faster deployment and simpler adoption.

Vendor/analyst-style ROI claims (Forrester TEI)

Analyst placements and recognition

04Best fit

Company sizes

Most appropriate for mid-market to large enterprise organizations or those with substantial cloud footprints. Reviewers originate from a range of company sizes, including mid-market and enterprise segments.

Industries

Common industries that align with the product’s value proposition include:

Technology / SaaS
Financial services
Retail / e-commerce (WAAS/WAF-like needs)
Regulated industries requiring reporting for HIPAA/PCI/GDPR

Roles and personas

CISO / Head of Cloud Security
AppSec leader / DevSecOps manager
Security engineering (policy-as-code / CI/CD)
Cloud platform engineering

Fit criteria

Organizations seeking consolidation of cloud and application security functions.
Organizations operating in multi-cloud environments that require centralized posture and app/API protection.
Organizations prepared to invest in tuning and process maturity (DevSecOps workflows, ownership mapping, remediation processes).

05The pitch

What the product does (core value proposition)

Key capability buckets included under the Application Security umbrella:

ASPM (Application Security Posture Management): centralizes findings from multiple AppSec tools and correlates them with runtime context to prioritize and help prevent exploitable risk.
Shift-left AppSec within Prisma Cloud: IaC scanning, SCA (open-source dependency scanning), secrets scanning, CI/CD guardrails, and policy-as-code.
Runtime AppSec / WAAS: WAF-like protections, API discovery and policy enforcement, bot defense, DoS protections, virtual patches, and application/API traffic visibility across environments.

(Primary product materials: official product overview and feature pages for Prisma Cloud Application Security; WAAS collateral; press/announcements for Cortex Cloud ASPM.)

Target market and market positioning

Target users: security engineering/DevSecOps teams, cloud security teams, platform engineering, and (for WAAS) application owners responsible for runtime protection of web applications and APIs.
Typical customer profile: mid-market to large enterprises operating in multi-cloud or hybrid environments and seeking consolidation across cloud security, AppSec, and runtime controls.
Market positioning: positioned as an offering that combines CNAPP capabilities with AppSec and runtime controls. The vendor emphasizes prevention-oriented controls and prioritized risk scoring based on contextual signals. The vendor also supports ingestion of third-party scanner findings through its partner ecosystem.

Get a comprehensive analysis of Palo Alto Networks Application Security including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →