Palo Alto Networks licensing covers a broad security portfolio sold under one set of terms: hardware and software next-generation firewalls (NGFWs), cloud-delivered security services attached to those firewalls, the Prisma Access secure access service edge (SASE) service, the Cortex security operations products (Cortex XDR, Cortex XSIAM and Cortex Cloud) and Prisma Cloud. Every product, however it was bought, is governed by the End User License Agreement (EULA), whose August 2026 version defines Products as Hardware, Software and Subscriptions and incorporates the End User Support Agreement and the Enterprise Agreement terms by reference.[1] The metrics differ sharply by product line. A hardware firewall carries subscriptions bound to that device. Software firewalls draw on term-based credit pools. Prisma Access counts users, sites or megabits per second, and the Cortex and Prisma Cloud platforms meter endpoints, ingested gigabytes, workloads or credits. This article summarises the whole estate; the deeper articles in the See also list cover each construct.
Editions
Palo Alto Networks does not use a single edition ladder. Each product family has its own packaging:
| Product family | Commercial units the vendor names | Detail article |
|---|---|---|
| Hardware NGFW (PA-Series) | Device plus attached subscriptions and support | Enterprise Program |
| Software NGFW (VM-Series, CN-Series) | Software NGFW credits (flexible vCPUs) or fixed VM-Series models | Software NGFW credits |
| Prisma Access | Secure Web Gateway, ZTNA and Enterprise editions, per user, site or Mbps | Prisma Access licensing |
| Cortex XDR, XSIAM, Cortex Cloud | Pro per Endpoint, Cloud per Host, GB/day, protected workloads | Cortex and Prisma Cloud licensing |
| Prisma Cloud | Prisma Cloud Credits | Cortex and Prisma Cloud licensing |
For firewalls, the subscriptions include Threat Prevention and Advanced Threat Prevention, DNS Security and Advanced DNS Security, Advanced URL Filtering, WildFire and Advanced WildFire, GlobalProtect Gateway, SD-WAN, IoT Security, Strata Logging Service and Strata Cloud Manager. URL Filtering is no longer sold as a standalone subscription; its features are included in Advanced URL Filtering.[4] Strata Cloud Manager has two tiers: Essentials, which is free with the purchase of NGFW and Prisma Access, and Pro, which is an upgrade.[17]
Metrics
The vendor metrics recorded in the catalog are:
- Attached subscription (per firewall) for hardware firewall services. The EULA prohibits using Software licensed for a specific device, physical or virtual, on another device without written authorization.[1]
- Software NGFW Credit, vCPU, VM-Series Model capacity license and VM-Series ELA token for software firewalls.[2]
- Prisma Access Mobile User, Remote Network bandwidth (Mbps) and Remote Network site.[5]
- Cortex XDR Pro per Endpoint, Cortex XDR Cloud per Host, GB/day and Cortex Cloud protected workload.[7][8][9]
- Prisma Cloud Credit and Prisma Cloud developer.[10]
The EULA itself lists the consumption bases it expects: accounts, credits, endpoints, devices, points, seats, gigabytes or terabytes of data, tokens, users and workloads.[1]
Counting / floors
Use rights and restrictions
Section 2 of the EULA grants Software and Subscription rights only in accordance with the Published Specifications, for the term and within the scope of the ordering document, and solely for internal use unless a separate written contract says otherwise.[1] The restrictions most relevant to an effective license position are:
- no use in excess of the quantity in the ordering document (rule);
- no production use of Lab or NFR (not for resale) SKUs (rule);
- no transfer, sublicensing, rental or lease except to Affiliates and permitted assignees, with products bought from unauthorized resellers subject to the Secondary Market Policy (rule);
- no use as a managed services provider without written authorization (rule);
- no publication of benchmark or comparison tests (rule).
A customer that buys for an Affiliate is liable for the Affiliate’s breaches, and a change of control is deemed an assignment that requires consent unless it falls under the notice-only exceptions.[1]
Overuse and true-up
Section 4 of the EULA obliges the customer to monitor actual usage of consumption, volume or capacity-licensed products during the term. At the end of each month, quarter or year, Palo Alto Networks may perform a true-up reconciliation and charge, directly or through a reseller or cloud marketplace, for usage above the purchased capacity, including go-forward licences.[1] Product documentation adds enforcement mechanics. Prisma Access tracks unique mobile users over the last 30 days.[5] Cortex XDR falls back to Prevent policy for agents above the licensed count after 14 days,[20] and Cortex Cloud measures workloads on a 90-day average.[9] For the general pattern see True-up.
Start dates and expiry
The Grace Periods policy, incorporated into the EULA, sets when terms begin. Support contracts start at registration or 30 days (North America) or 90 days (elsewhere) after shipment, whichever is earlier. Attached subscriptions start at activation or 90 days after the authorization code is delivered. Term-based offerings such as Prisma Access, Software NGFW Credits and Enterprise Agreements have no grace period.[13] Support renewals always start at the end of the previous contract, regardless of any gap.[13] NGFW licences expire at 12:00 AM GMT on the day after the end date, and some subscriptions keep partial function after expiry while others stop.[19]
Virtualization & partitioning
Palo Alto Networks does not license its software firewalls by host processor. The VM-Series is licensed per firewall instance, either as a fixed VM-Series model or, with Software NGFW credits, by the number of vCPUs assigned to the firewall and the security services enabled.[2] A flexible deployment profile allows a maximum of 64 vCPUs.[3] The hypervisor or cloud instance therefore matters only through the vCPUs licensed to the firewall. Cortex XDR separates on-premises hosts (Pro EP) from cloud instances and containers (EP Cloud), regardless of where a container runs.[7] For the general concepts see Virtualization and partitioning.
Cloud / BYOL
The EULA applies to products acquired through cloud marketplaces as well as directly or through resellers.[1] The VM-Series is available as bring-your-own-licence (BYOL), using credits or model licences, or as PayGo from AWS, Azure or GCP marketplaces or a Cloud Security Service Provider.[2] Prisma Access runs on AWS, Google Cloud and Oracle Cloud Infrastructure as a service, so customers license the service rather than bringing licences to it.[6] Prisma Cloud Credits can be bought from Palo Alto Networks, channel partners or marketplaces such as AWS Marketplace.[10]
Programs
- Enterprise Program (for Attached Subscriptions) (ELA and ELA8): a volume arrangement that gives access to a defined set of firewall subscriptions across the hardware estate, capped at the current estate plus 20% above a net positive forecast for terms over one year.[11]
- Enterprise Program (for Hardware Support) (ESA): support and maintenance for the entire hardware firewall estate at one support level.[12]
- Software NGFW Credits and the VM-Series Multi-Model ELA for software firewalls.[2]
- Lab units: discounted equipment and licences for non-production use only; the vendor treats firewall protection of developer and DevOps environments as production.[18]
- Secondary Market Policy and End-of-Life Policy: licences on used devices are treated as expired and need re-certification, and support cannot lapse and be reinstated during the End-of-Life cycle.[14][15]
Support
Support and Success Plans (Standard, Premium, Platinum and variants) are governed by the End User Support Agreement. A plan expires at the end of its term unless renewed, and Palo Alto Networks reserves the right not to support products that were not bought through an authorized distributor or reseller (rule).[16] For the general concepts see Software maintenance and support.
Compliance verification
Section 2(f) of the EULA grants Palo Alto Networks and its independent advisors the right, on written request, to verify the customer’s compliance with Section 2, and allows Palo Alto Networks to pursue all available remedies if the review shows non-compliance.[1] The clause states no notice period, frequency limit or cost-shifting rule; those points are left to negotiated contracts. The catalog records it as a verification rule. For audit practice in general see Software license audit.
Out of scope
This article does not cover hardware specifications, list prices or discounts (Palo Alto Networks publishes no public price list, and the documents cited here give no part-number prices), professional services and Unit 42 services (which the EULA places under separate service terms), Idira-branded products sold under their own agreements on the vendor’s legal page, FedRAMP and public-sector variants, or vulnerability information.