Palo Alto Networks

History

Palo Alto Networks was founded in 2005 by Nir Zuk, a former engineer from Check Point and NetScreen Technologies. Zuk, an Israeli native, began working with computers during his mandatory military service in the Israel Defense Forces in the early 1990s and served as head of software development in Unit 8200, a branch of the Israeli Intelligence Corps.

The company debuted on the NYSE on July 20, 2012, raising $260 million with its initial public offering, which was the 4th-largest tech IPO of 2012. It remained on the NYSE until October 2021 when the company transferred its listing to Nasdaq.

In 2014, Palo Alto Networks founded the Cyber Threat Alliance with Fortinet, McAfee, and NortonLifeLock, a not-for-profit organization with the goal of improving cybersecurity "for the greater good" by encouraging cybersecurity organizations to collaborate by sharing cyber threat intelligence among members. By 2018, the organization had 20 members including Cisco, Check Point, Juniper Networks, and Sophos.

In 2018, the company began opening cybersecurity training facilities around the world as part of the Global Cyber Range Initiative.

In May 2018, the company announced Application Framework, an open cloud-delivered ecosystem where developers can publish security services as SaaS applications that can be instantly delivered to customers.

In 2019, the company announced the K2-Series, a 5G-ready next-generation firewall developed for service providers with 5G and IoT requirements. In February 2019, the company announced Cortex, an AI-based continuous security platform.

Acquisitions

• January 2014: Morta Security
• April 2014: Cyvera for approximately $200 million
• May 2015: CirroSecure
• March 2017: LightCyber for approximately $100 million
• March 2018: Cloud Security company Evident.io for $300 million. This acquisition created the Prisma Cloud division.
• April 2018: Secdo
• October 2018: RedLock for $173 million
• February 2019: Demisto for $560 million
• May 2019: Twistlock for $410 million
• June 2019: PureSec for $47 million
• September 2019: Zingbox for $75 million
• November 2019: Aporeto, Inc. for $150 million
• April 2020: CloudGenix, Inc. for $420 million
• August 2020: Crypsis Group for $265 million
• December 2020: Expanse for $1.25 billion.
• February 2021: Bridgecrew for $156 million
• November 2022: Cider Security for $300 million.
• October 2023: Announced its intent to acquire Dig Security for $400 million
• November 2023: Talon Cyber Security for $625 million
• December 2023: Dig Security for $400 million
• July 2025 : Protect AI for $500 million
• July 2025: CyberArk for $25 billion
• November 2025: Chronosphere for $3.35 billion (expected to close fiscal 2H 2026)

Threat research

Unit 42 is the Palo Alto Networks threat intelligence and security consulting team. They are a group of cybersecurity researchers and industry experts who use data collected by the company's security platform to discover new cyber threats, such as new forms of malware and malicious actors operating across the world. The group runs a popular blog where they post technical reports analyzing active threats and adversaries. Multiple Unit 42 researchers have been named in the MSRC Top 100, Microsoft's annual ranking of top 100 security researchers. In April 2020, the business unit consisting of Crypsis Group which provided digital forensics, incident response, risk assessment, and other consulting services merged with the Unit 42 threat intelligence team.

According to the FBI, Palo Alto Networks Unit 42 has helped solve multiple cybercrime cases, such as the Mirai Botnet and Clickfraud Botnet cases, the LuminosityLink RAT case, and assisted with "Operation Wire-Wire".

In 2018, Unit 42 discovered Gorgon, a hacking group believed to be operating out of Pakistan and targeting government organizations in the United Kingdom, Spain, Russia, and the United States. The group was detected sending spear-phishing emails attached to infected Microsoft Word documents using an exploit commonly used by cybercriminals and cyber-espionage campaigns.

In September 2018, Unit 42 discovered Xbash, a ransomware that also performs cryptomining, believed to be tied to the Chinese threat actor "Iron". Xbash is able to propagate like a worm and deletes databases stored on victim hosts. In October, Unit 42 warned of a new crypto mining malware, XMRig, that comes bundled with infected Adobe Flash updates. The malware uses the victim's computer's resources to mine Monero cryptocurrency.

In November 2018, Palo Alto Networks announced the discovery of "Cannon", a trojan being used to target United States and European government entities. The hackers behind the malware are believed to be Fancy Bear, the Russian hacking group believed to be responsible for hacking the Democratic National Committee in 2016. The malware communicates with its command and control server with email and uses encryption to evade detection.

References

References

1. "Firewalls & Appliances".
2. "Prisma SASE".
3. PCmag. (2018-01-26). "Millions of PCs targeted by cryptocurrency-mining malware".
4. (2018). "Application Framework - Palo Alto Networks".
5. (2025-08-29). "Palo Alto Networks Inc. FY 2025 Annual Report (Form 10-K)". [[U.S. Securities and Exchange Commission]].
6. (2018). "About Us - Palo Alto Networks".
7. (2018). "Unit 42 Twitter".
8. (2018). "Ignite Conference Twitter".
9. "Palo Alto Networks".
10. (2018-06-02). "What to Expect of Google and Softbank Star Nikesh Arora, Palo Alto Network's New CEO".
11. Blacharski, Dan. (2010-04-05). "How I Got Here: Nir Zuk, CTO, Palo Alto Networks".
12. Leyden, John. (22 October 2010). "US and UK gov cyber defences = big boys' trough-slurp".
13. "Nir Zuk".
14. (2025-03-04). "Nir Zuk fears mass exodus of talent from Israel".
15. Savitz, Eric. (20 July 2012). "Kayak, Palo Alto Networks IPOs Off To Strong Debuts". [[Forbes]].
16. Owens, Jeremy. (20 July 2012). "Palo Alto Networks stunning IPO a good sign for some tech niches". [[Mercury News]].
17. (31 December 2012). "The 10 largest tech IPOs of 2012". [[VentureBeat]].
18. "EDGAR Filing Documents for 0001193125-21-296438".
19. (October 12, 2021). "Palo Alto Networks to Transfer Stock Exchange Listing to Nasdaq".
20. Albanesius, Chloe. (February 13, 2015). "Obama Wants Tech Firms to Alert Feds to Cyber Threats". PC Magazine.
21. "Who We Are - Cyber Threat Alliance".
22. "Membership - Cyber Threat Alliance".
23. Aasha Bodhani, ITP Net. "[http://www.itp.net/616303-palo-alto-networks-introduces-global-cyber-range-initiative Palo Alto Networks introduces global Cyber Range initiative]." Jan 16, 2018. Retrieved Feb 6, 2018.
24. (2019-02-12). "Palo Alto Networks Introduces Fastest-Ever Next-Generation Firewall and Integrated Cloud-Based DNS Security Service to Stop Attacks".
25. (26 February 2019). "Edited Transcript of PANW earnings conference call or presentation 26-Feb-19 9:30pm GMT".
26. Rao, Leena. (6 January 2014). "Palo Alto Networks Buys Cyber Security Startup Founded By Former NSA Engineers, Morta". [[TechCrunch]].
27. (6 January 2014). "Palo Alto Networks® Acquires Morta Security". Palo Alto Networks.
28. Rao, Leena. (24 March 2014). "Palo Alto Networks Buys Cyber Security Company Cyvera For $200M". [[TechCrunch]].
29. (10 April 2014). "Palo Alto Networks® Completes Acquisition of Cyvera". Palo Alto Networks.
30. King, Rachel. (27 May 2015). "Palo Alto Networks acquires cybersecurity company CirroSecure". [[Zdnet]].
31. (28 February 2017). "Palo Alto Networks acquires LightCyber". Palo Alto Networks.
32. (Mar 26, 2018). "Palo Alto Networks Closes Acquisition of Evident.io". Palo Alto Networks.
33. (Apr 24, 2018). "Palo Alto Networks Closes Acquisition of Secdo". Palo Alto Networks.
34. (October 3, 2018). "Palo Alto Networks to acquire RedLock for $173 M to beef up cloud security". TechCrunch.
35. (February 19, 2019). "Palo Alto Networks to acquire Demisto for $560M". TechCrunch.
36. (29 May 2019). "Palo Alto Networks to acquire container security startup Twistlock for $410M".
37. "Palo Alto Networks to acquire Twistlock, PureSec".
38. (2019-05-30). "SEC Form 10-Q, Fiscal Third Quarter 2019, period ended April 30, 2019". Palo Alto Networks.
39. (2019-09-04). "Palo Alto Networks intends to acquire Zingbox for $75M". TechCrunch.
40. Condon, Stephanie. (November 25, 2019). "Palo Alto Networks acquires Aporeto for cloud security".
41. (2020-04-22). "Palo Alto Networks completes $420m acquisition of CloudGenix in three weeks".
42. (24 August 2020). "Palo Alto Networks to buy digital forensics consulting firm for $265M".
43. "Palo Alto Networks Strategic Acquisitions".
44. (2021-02-16). "Prisma Cloud Shifts Left With Proposed Acquisition of Bridgecrew". Palo Alto Networks Blog.
45. Lunden, Ingrid. (2022-11-17). "Sources: Palo Alto Networks is buying Cider Security for up to $300M".
46. Ingrid Lunden. (October 31, 2023). "Confirmed: Palo Alto Networks buys Dig Security, sources say for $400M".
47. Maria Deutscher. (October 31, 2023). "Palo Alto Networks acquires Dig Security for reported $400M".
48. Gately, Edward. (6 November 2023). "Palo Alto Networks Acquiring Talon Cyber Security in Reported $625 Million Deal".
49. (2023-12-05). "Palo Alto Networks completes acquisition of Dig Security".
50. (2025-07-22). "Palo Alto Networks Completes Acquisition of Protect AI".
51. (2025-07-30). "Palo Alto to scoop up CyberArk for $25 billion to tackle AI-era threats". Reuters.
52. (2018). "Unit 42 FAQs".
53. (2018). "Unit 42 Archives".
54. (16 August 2018). "Four Unit 42 Vulnerability Researchers Make MSRC Top 100 for 2018".
55. (2021-04-20). "Unit 42 and Crypsis Combine to Offer Threat Intel, Incident Response".
56. (18 September 2018). "Hackers' Cooperation with FBI Leads to Substantial Assistance in Other Complex Cybercrime Investigations". U.S. Department of Justice.
57. (17 October 2018). "Creator of remote access tool LuminosityLink sent behind bars".
58. (15 October 2018). "Stanford Man Sentenced to 30 Months for Computer Intrusion Crimes". U.S. Department of Justice.
59. (11 June 2018). "Business E-Mail Compromise (BEC) Task Force in Los Angeles Announces Local Arrests as the Department of Justice Announces the Results of "Operation Wire-Wire" Including 74 Charged in Bec Schemes Internationally".
60. (2 August 2018). "Hacking group combines spear-phishing with mass malware campaign".
61. (18 September 2018). "Chinese-speaking cybercrime group launches destructive malware family".
62. (12 October 2018). "Hack Brief: Fake Adobe Flash Installers Come With A Little Malware Bonus".
63. (20 October 2018). "Russian hacking tool gets extra stealthy to target US, European computers".
64. (20 October 2018). "Russia's Elite Hackers May Have New Phishing Tricks".
65. (20 October 2018). "Sofacy Continues Global Attacks and Wheels Out New 'Cannon' Trojan".