# Provenance stamped 2026-10-07 (roadmap#943): written by an API Evangelist sweep (dated 2026-05-04 by the file itself), not
# harvested from the provider. `method: generated` so the economics campaign may replace it with a
# dated, verbatim transcription; every figure below is unverified until it does.
method: generated
generated: '2026-05-04'
specification: FinOps Framework
specificationVersion: '1.0'
schema: https://www.finops.org/framework/
provider: Palo Alto Networks
providerId: palo-alto-networks
created: '2026-05-04'
modified: '2026-05-05'
reconciled: false
notes: No public pricing. Structural FinOps placeholder for Palo Alto Networks; meters and
  charge categories reflect the platform's enterprise-subscription shape.
tags:
  - FinOps
  - FOCUS
  - Cybersecurity
  - Network Security
  - Cloud Security
description: Palo Alto Networks is sold as an enterprise platform across firewall, cloud
  security, and SecOps product lines. FinOps mapping captures product-level subscription
  meters; per-unit pricing is negotiated under contract.
sources:
  - https://pan.dev/
  - https://focus.finops.org/focus-specification/v1-3/
alignedWith:
  framework: FinOps Foundation Framework
  frameworkUrl: https://www.finops.org/framework/
  dataSpec: FOCUS
  dataSpecVersion: '1.3'
  dataSpecUrl: https://focus.finops.org/focus-specification/v1-3/
publisherName: Palo Alto Networks, Inc.
serviceCategory: Cybersecurity
billingModel:
  pricingCategory: Subscription (Enterprise)
  billingFrequency: Annual
  billingCurrency: USD
  chargeCategories:
    - Purchase
    - Usage
    - Tax
focusColumns:
  ServiceName: Palo Alto Networks Platform
  ServiceCategory: Cybersecurity
  ProviderName: Palo Alto Networks
  PublisherName: Palo Alto Networks, Inc.
  InvoiceIssuerName: Palo Alto Networks, Inc.
  BillingCurrency: USD
  ChargeCategory: Purchase
meters:
  - name: firewall_subscription
    description: PAN-OS firewall subscription (per appliance / VM-Series instance)
    unit: appliance-year
    aggregation: count
    dimensions:
      - product
      - region
  - name: prisma_cloud_workloads
    description: Prisma Cloud protected workloads
    unit: workload-month
    aggregation: max
    dimensions:
      - account
      - cloud
  - name: prisma_sase_seats
    description: Prisma SASE protected seats
    unit: seat-month
    aggregation: max
    dimensions:
      - tenant
  - name: cortex_data_ingest
    description: Cortex XDR/XSIAM data ingestion volume
    unit: GB
    aggregation: sum
    dimensions:
      - tenant
      - source
principles:
  - name: Visibility
    description: Use Strata Cloud Manager, Prisma Cloud, and Cortex tenant dashboards plus
      the FOCUS-shaped invoice from Palo Alto Networks to track product-level spend.
  - name: Allocation
    description: Allocate by product family (PAN-OS, Prisma Cloud, Prisma SASE, Cortex) and
      by tenant/account; tag firewalls and cloud accounts with cost-center metadata.
  - name: Optimization
    description: Right-size firewall models, retire unused VM-Series instances, tune Cortex
      data sources to control ingest GB, and review Prisma Cloud workload coverage at renewal.
  - name: Accountability
    description: Assign a Palo Alto product owner per family with renewal forecasting responsibility
      and quarterly utilization review against the contract.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com