Palo Alto Networks, Inc.
Acquisitions
5
Major Deals Covered
$29.5B
Disclosed Deal Value
Palo Alto Networks's largest disclosed acquisition here is CyberArk for $25B in 2026. This page covers 5 major deals from 2021 to 2026, each with its price where disclosed and the reason behind it.
| Company | Year | Price | Purpose |
|---|---|---|---|
| CyberArk | 2026 | $25.0B | Add identity and privileged-access security, a category Palo Alto had not covered. |
| Chronosphere | 2026 | $3.4B | Add cloud-scale observability and telemetry data management to Cortex. |
| Talon Cyber Security | 2023 | $625.0M | Add an enterprise browser for secure access from managed and unmanaged devices. |
| Dig Security | 2023 | $400.0M | Add data security posture management (DSPM) for cloud data stores. |
| Bridgecrew | 2021 | $156.0M | Add infrastructure-as-code scanning and developer-focused cloud security. |
2026
$25.0B
Add identity and privileged-access security, a category Palo Alto had not covered.
CyberArk became the base of the Idira identity platform and contributed meaningfully to revenue and ARR from the second half of fiscal 2026.
Completed February 2026 in a cash-and-stock deal; Palo Alto's largest acquisition.
2026
$3.4B
Add cloud-scale observability and telemetry data management to Cortex.
Gives Cortex a data layer for security and AI operations.
Completed January 2026.
2023
$625M
Add an enterprise browser for secure access from managed and unmanaged devices.
Became Prisma Access Browser within Prisma SASE.
Integrated into Prisma SASE.
2023
$400M
Add data security posture management (DSPM) for cloud data stores.
Folded into Palo Alto's cloud security portfolio.
Price was reported in press, not disclosed by the company.
2021
$156M
Add infrastructure-as-code scanning and developer-focused cloud security.
Brought the open-source Checkov project into Prisma Cloud.
Integrated into Prisma Cloud, now part of Cortex Cloud.
Since early 2024, Palo Alto has pursued 'platformization'. It offers customers free or discounted periods so they can move off rival tools before their contracts expire, in exchange for long-term commitments to its platforms. In 2026 it extended that strategy through acquisitions: Chronosphere for observability data (closed January 2026), CyberArk for identity security (closed February 2026), and Console for agentic AI workflows in Cortex (announced with Q4 fiscal 2026 results). AI security products such as Prisma AIRS are the newest growth line.
Palo Alto Networks makes most of its money from recurring subscriptions and support, with the rest from firewall products. Customers buy hardware and virtual next-generation firewalls and then pay yearly for threat prevention, URL filtering, DNS security and SD-WAN services. The faster-growing part is Next-Generation Security: Prisma SASE and Prisma AIRS for cloud and AI security, Cortex XDR, XSIAM and Cloud for security operations, and, since the February 2026 CyberArk deal, the Idira identity and privileged-access platform. Sales run mainly through channel partners, distributors and cloud marketplaces, and large customers often sign multi-year platform contracts. That model gave the company $21.2 billion of remaining performance obligations at July 31, 2026.
CyberArk, completed in February 2026 for about $25 billion in cash and stock. In January 2026 Palo Alto also closed the $3.35 billion purchase of observability firm Chronosphere.
Palo Alto Networks built Cortex through strategic acquisitions, notably Demisto in 2019 for $560 million (Security Orchestration, Automation, and Response - SOAR) and Expanse in 2020 for $800 million (Attack Surface Management - ASM), which formed the foundation for Cortex XSIAM.
Prisma Cloud was established through transformative cloud security acquisitions, including RedLock in 2018 ($173M, cloud security posture management), Twistlock in 2019 ($410M, container and Kubernetes security), PureSec in 2019 (serverless security), Bridgecrew in 2021 ($156M, shift-left/Infrastructure-as-Code), and Cider Security in 2022 ($195M, CI/CD pipeline security).
In April 2020, Palo Alto Networks acquired CloudGenix for approximately $420 million, integrating its major cloud-delivered Software-Defined Wide Area Network (SD-WAN) technology into Prisma Access to create an end-to-end Prisma SASE solution.
In late 2023 Palo Alto bought Talon Cyber Security (about $625 million) for an enterprise browser, and Dig Security (reported at about $400 million) for cloud data security posture management.
In May 2024 Palo Alto agreed to acquire IBM's QRadar SaaS assets and migrate QRadar customers to Cortex XSIAM, while IBM Consulting became a major services partner for Palo Alto platforms.
In January 2014, Palo Alto Networks made its first acquisition by purchasing Morta Security, a stealth startup composed of former NSA cybersecurity engineers, bringing advanced threat intelligence and malware detection capabilities directly into WildFire.
In March 2019, Palo Alto Networks acquired security orchestration, automation, and response (SOAR) pioneer Demisto for $560 million. Demisto became the operational brain of Cortex XSOAR, automating incident response workflows and reducing mean time to resolve (MTTR) cyber incidents from hours to seconds.
Compare corporate acquisition records, deal values, and strategic targets
Explore Palo Alto Networks
Core profile pages, founders and related research hubs for this company.