Cortex Cloud

Overview

Cortex Cloud (formerly Prisma Cloud) is Palo Alto Networks' cloud-native application protection platform (CNAPP), with cloud infrastructure entitlement management (CIEM) as one module beside posture management, runtime security, and application security. On 13 February 2025 Palo Alto announced Cortex Cloud as "the next version of Prisma Cloud," merging the CNAPP with Cortex cloud detection and response and moving it onto the Cortex platform, with existing customers upgraded. The CIEM page now carries the Cortex Cloud name, though a Prisma Cloud page is still live. Ownership is unchanged (Palo Alto Networks, NASDAQ: PANW), but the portfolio around it has grown: Palo Alto closed its acquisition of CyberArk, now Idira, in February 2026, putting privileged access and cloud entitlements under one vendor. The consolidation report covers what that means for buyers.

What it is good at

Breadth and correlation. The CIEM module computes net-effective permissions (who can take which action on which resource, after every policy layer is evaluated), flags excessive and unused privileges, and recommends rightsized roles. Its legacy Prisma Cloud CIEM page documents ingesting single sign-on data from Okta, Microsoft Entra ID, and AWS IAM Identity Center, so a federated user's real cloud access traces back to the human behind it, which is where many CIEM tools stop short. Remediation can run through Cortex XSOAR playbooks, and alerts route to 14 built-in third-party integrations. The Cortex Cloud page adds attack path analysis showing how identities can escalate privileges or move laterally, and governance of non-human identities such as service accounts and tokens, across AWS, Azure, Google Cloud, and Oracle Cloud.

For an organization already running Palo Alto firewalls, Prisma Access, or Cortex XSIAM, the draw is one vendor, one SOC console, and entitlement findings correlated with misconfigurations, vulnerabilities, and runtime alerts.

Where it falls short

CIEM is a small part of a very large platform, and it shows. Palo Alto's CIEM documentation describes no native just-in-time access or access-request workflow comparable to Britive or Tenable One Cloud Exposure (formerly Tenable Cloud Security), and least-privilege work ends in recommendations, tickets, or playbooks. The Cortex Cloud transition adds real uncertainty: module names, consoles, and licensing are changing, and buyers should get in writing which CIEM features are included in the edition they are buying. The platform is also an enterprise commitment; small teams will pay for and operate far more than they need.

Pricing

Quote-based enterprise subscription with no public list price. Confirm how Cortex Cloud meters CIEM (per workload, per resource or by credits) before signing, and model a multi-year cost with the TCO calculator. The pricing transparency index shows how this compares with peers.

Best for, and who should look elsewhere

Choose it when consolidation is the goal: a Palo Alto shop that wants cloud entitlements, posture, runtime, and SOC workflows on one contract. Deployment is light per cloud account, but getting value means tuning a large platform; treat it as a program, not a tool install. Look elsewhere for focused entitlement governance with JIT, for predictable pricing, or if you want to avoid deeper single-vendor dependence. See the best CIEM for multi-cloud ranking for alternatives.

Bottom line

A capable CIEM inside one of the broadest cloud security platforms, best for enterprises consolidating on Palo Alto Networks; a poor fit for buyers who mainly need to govern cloud privilege.