What Comes Next for Palo Alto Networks After Its $28B Security Buying Spree

After acquiring identity security leader CyberArk for $25 billion and observability platform Chronosphere for $3.35 billion, Palo Alto Networks has made its ambition unmistakably clear: to become the industry’s most comprehensive, AI-native security platform. The question now is not why Palo Alto is buying—but what comes next.

The immediate priority will be deep platform integration. Identity, observability, cloud, network, and AI security cannot remain modular products if Palo Alto wants to win the “platformization” war. Expect accelerated convergence of CyberArk’s privileged identity controls with Palo Alto’s AI-driven threat detection and enforcement engines, enabling real-time identity-aware response across endpoints, cloud workloads, and AI agents.

Strategically, Palo Alto’s next move is likely to focus on data and AI interaction security. With enterprises rapidly adopting GenAI and agentic workflows, securing prompts, models, and AI-driven actions is becoming mission-critical. Acquiring or building deeper capabilities around AI governance, data lineage, and prompt-level threat detection would strengthen Palo Alto’s leadership as AI becomes the new attack surface.

Another probable direction is OT, IoT, and cyber-physical security, particularly for critical infrastructure, manufacturing, energy, and smart cities. As nation-state threats increasingly target physical-digital convergence points, Palo Alto may seek acquisitions that extend visibility and control beyond traditional IT environments.

Geographically, Palo Alto is also expected to double down on regulated markets—BFSI, government, telecom, and defense—by offering vertically optimized security stacks that combine identity, observability, AI protection, and compliance automation.

Ultimately, Palo Alto’s trajectory suggests a shift from being a best-of-breed cybersecurity vendor to becoming the default security operating system for the AI enterprise—where prevention, detection, identity, observability, and response are fused into one continuously learning platform.