Palo Alto Networks had a busy 2022, capped off by its annual Ignite event in Las Vegas earlier this month. That event showcased the vendor's zero trust, secure access service edge (SASE), and other networking, cloud, endpoint, application security services.

Here is a recap of SDxCentral's top Palo Alto Networks stories in 2022.

Palo Alto Networks Chairman and CEO Nikesh Arora during the vendor's most recent earnings call said the vendor faces one SASE competitor head-to-head for the largest enterprise deals. Arora didn’t name the other vendor, be he did add that “very rarely do we see a third. This doesn’t take a lot to guess who the second vendor is.”

“If you look at it historically, until about three years ago we didn’t have a SASE, we could actually go head-to-head with the industry leader,” he said during the call. “What has happened in the last one-and-a-half years or two? We’ve become a force to reckon with.”

Palo Alto Networks Chief Information Security Officer (CISO) Niall Browne discussed how Palo Alto Networks secures the company itself and its customers using its own zero-trust network access (ZTNA 2.0), SASE (Prisma Access), cloud security (Prisma Cloud), and autonomous security operation center (Cortex XSIAM) products. He also talked about the unique challenges the vendor faces in securing one of the largest security companies in the world, and what keeps him up at night.

“Palo Alto Networks has 13,000 employees, that’s 13,000 branches, with a branch employee of one per branch,” Browne said. “You can’t duplicate environments from headquarters across the board. So how do you get the same if not better security in Starbucks as you would in headquarters? That’s always been the conundrum cybersecurity has struggled with. So I firmly believe SASE is the answer to that.”

Palo Alto Networks called on the cybersecurity industry to shift toward next-generation ZTNA, which the vendor calls ZTNA 2.0. It claims traditional ZTNA products “have proven more dangerous than helpful” in today’s hybrid work and cloud migration world.

First-generation ZTNA products have “critical limitations” including providing too much access, “allow and ignore,” and little to no visibility or control over data, Palo Alto Networks founder and CTO Nir Zuk pointed out in a blog post.

Zuk expects more vendors will follow its lead in offering an autonomous security operation center (SOC) to replace legacy security information and event management (SIEM) and SOC tools.

For Palo Alto Networks’ SOC offerings, “all security operations are being run by machines and then we bring in the people,” Zuk said during his speech at this year's RSA Conference. “This is happening right now. We’ve isolated, we’re building it, we’re selling it.”

Zuk explained the industry has automated the SOC with the human in the center. “The human is still driving and we can’t do that in the SOC if we want to investigate every data point coming in” to figure out what’s under attack, he said.

Arora detailed the vendor's SASE-first sales strategy and the market’s competitive landscape.

“At least the last four-and-a-half years we’ve observed as a firewall business sometimes you end up in contention between the security team and the networking team. Sometimes security teams tell network teams which firewall to buy, all depending on the internal dynamics of the organization. The same thing happens for SASE: sometimes networking people tell the security guys, ‘I run SD-WAN, you go figure out the security.’ Sometimes security guys [say] ‘that’s SASE, what are you gonna be doing with SD-WAN?’ So that’s general contention,” Arora said. “But I think that’s a shortish-term issue. As people start relying on this at scale they realize that they want to run this as-a-service. And over time the more they understand the reason why you need to have an integration of SD-WAN and SASE you’ll see them converge."

As security teams struggle with burnout and talent shortages, some are pivoting to work with fewer vendors in order to avoid an overwhelming number of security alerts, tools, and management consoles. This is one of the major reasons why big security vendors are touting their platform approach.

For the last five years, vendor growth exploded in the security market, but now more customers consult with Palo Alto Networks to find out how they can consolidate services and use fewer vendors, Rick Caccia, SVP and CMO of Palo Alto Networks Cortex and Unit 42, told SDxCentral.

This trend “is good for a large company like us,” he said. “If you have multiple different vendors, it becomes harder to do integration.” He called this shift “groundbreaking insight.”

Arora predicts cloud security will account for between 2% and 5% of the $1 trillion in annual public cloud spending over the next decade, and the vendor is still in the early stages of capturing a portion of that potential $50 billion market.

The executive expects half of all computing will be done on the public cloud, and believes most companies that have less than $10 billion in revenue should not have their own data centers.

Palo Alto Networks Unit 42 leaders warned of a global threat landscape creating a perfect storm for attackers to go under the radar as ransomware, business email compromise, and phishing attacks continue to surge.

“I think the combination of events that are going on today is pretty favorable for the nation-state actors,” Wendi Whitmore, SVP of cyber consulting and threat intelligence at Palo Alto Networks Unit 42, said during a keynote at the Ignite 2022 event.

She listed the Shamoon attacks, the SolarWinds hack, and the conflict between Russia and Ukraine as recent examples of major attacks. As organizations remain busy dealing with data breaches, supply chain attacks, and other threats, this creates a perfect storm for attackers.

The “internet of medical things” is lowering costs and ushering in a new era of patient care. But with an anticipated 2.3 billion new devices coming into global health care facilities by 2025, the threat landscape is expanding “tremendously,” Palo Alto Networks SVP Anand Oswal said at the vendor’s Ignite event.

Most medical IoT devices are not designed with a security-first mindset, Oswal explained. According to Palo Alto Networks’ Unit 42 research arm, 83% of medical imaging devices like CT scanners and X-ray machines are running on outdated operating systems without the latest security patch.

Palo Alto Networks also found that distributing malware accounts for 40% of all attacks on medical IoT devices. With malware becoming increasingly advanced, the vendor’s latest zero-trust Medical IoT Security solution relies heavily on machine learning (ML) to detect and prevent what he calls “zero day, very advanced malware attacks.”

Palo Alto Networks announced a partnership with Amazon Web Services (AWS) to natively integrate its next-generation firewall into the public cloud for the first time.

The Palo Alto Networks Cloud NGFW for AWS brings together the security vendor’s firewall capabilities with the simplicity and scalability of the public cloud to secure AWS deployments. “You get the best of both worlds,” Oswal said.

Oswal pointed out that the common denominator across all of the recent cyberattacks – including those exploiting vulnerabilities like Log4Shell, cryptojacking, and ransomware – is a network. “That’s why best-in-class network security that can successfully prevent these sophisticated and evasive attacks is more critical than ever in the public cloud,” he told SDxCentral.