SECURITY ATLAS / EVALUATION BRIEF
Prisma Access
Research reviewed: 2026-10-18
https://atlasofsecurity.com/landscape/vendors/palo-alto-prisma-access/

THE ATLAS TAKE
Prisma Access is a substantial candidate for teams moving internet and private-access policy toward a cloud-delivered service, especially where Palo Alto operations already exist. The licensing documentation deserves as much attention as the architecture diagram: the edition, mobile-user scope and management experience shape the actual deployment. Atlas would insist on a complete private application transaction and an internet-policy test before crediting a combined solution. Secure Agentless Access is a separate evaluation path with its own prerequisites, rather than a capability to assume from the broad Prisma Access name.

SCOPE
For a combined public/private evaluation select the Enterprise secure-all-apps edition and required mobile-user scope. Strata Cloud Manager and Panorama management differ; RBI and Secure Agentless Access add-ons must be identified separately.

WORTH A LOOK WHEN
Enterprises with defined mobile-user and site requirements and a clear Palo Alto management strategy.

THINK TWICE WHEN
The proposal lacks a selected edition, management plane or supported private-access design.

IMPLEMENTATION
1. Freeze the proposed bill of materials
Record edition, mobile-user scope, management plane and any agentless or isolation add-ons.

2. Map application dependencies
Include authentication redirects, helper services and name resolution in the private-access pilot.

3. Plan publish and rollback ownership
Document who changes policy, how the effective result is verified and how access is restored after an error.

OPERATING REALITY
Operators must manage identity, traffic onboarding, certificates and policy publication across the selected management model. Existing firewall familiarity can help, but cloud connectivity and user access still require dedicated diagnostics. Agentless and client-based access should have separate support runbooks because their prerequisites and failure modes differ.

COMMERCIAL CONSIDERATIONS
Compare the exact edition and capacity or user scope in the quote. Separate agentless access, browser isolation and other add-ons from the combined baseline, including required connectivity infrastructure.
- Selected edition and user/site scope
- Management and optional access entitlements
- Connectivity, migration and policy operations

EVALUATION PLAN / PROPOSED TESTS, NOT COMPLETED RESULTS
1. Complete a private application transaction
Acceptance evidence: Preserve identity, DNS, dependency and effective-policy evidence.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

2. Apply and reverse an internet restriction
Acceptance evidence: Record publication timing, matching rule and user outcome.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

3. Pilot a separately licensed agentless application
Acceptance evidence: Check the documented prerequisites and record unsupported workflows explicitly.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

QUESTIONS FOR THE VENDOR
- Which policy capabilities disappear if the edition does not support them?
- Which dataplane and service versions are required for agentless access?
- Are private-app connectivity and optional data controls in the proposed design?

EVIDENCE GAPS
- Atlas has not independently tested latency, availability or inspection efficacy.
- Confirm edition-specific capabilities and the exact management/deployment release.

SOURCES
Prisma Access licensing (Documentation)
https://docs.paloaltonetworks.com/prisma-access/activation-and-onboarding/your-prisma-access-license
Secure Agentless Access (Documentation)
https://docs.paloaltonetworks.com/prisma-access/administration/secure-agentless-access
Private web application prerequisites (Documentation)
https://docs.paloaltonetworks.com/prisma-access/administration/secure-agentless-access/private-web-application-access-for-secure-agentless-access

Use synthetic fixtures in an authorized environment. Agree rollback and acceptance criteria before enforcement.
Documentation research and Atlas analysis. Independent hands-on effectiveness, effort, and complete price remain unassessed.