VENDOR NOTES · PALO ALTO NETWORKS
Cortex Xpanse: ASM and exposure management facts (2026)
SHORT ANSWER
Cortex Xpanse is Palo Alto Networks' ASM product, scanning the whole IPv4 space several times a day by the vendor's account and acting on exposures through Active Response playbooks, with native ties to Cortex XSOAR and Prisma Cloud. It fits teams already on Palo Alto Networks. Exploit validation and subsidiary attribution are not described on the pages we read, and no price is published.
By The Exposure Desk · Exposure Management Finder · Published 2026-10-11
Desk research from public vendor pages read in September 2026, updated 2026-10-11. Profiles follow our published method; we did not run the products.
Which tool types does Cortex Xpanse describe?
- Outer point: described on the vendor's pages we read
- Inner point: not in our sources (it may exist; we did not find it)
| Type | Status | What the pages say | Source |
|---|---|---|---|
| EASM discovery | Described | Palo Alto Networks says Xpanse scans all 4.3 billion IPv4 addresses multiple times a day and more than 500 billion ports daily. | Source: Cortex Xpanse · Read 27 Sep 2026 |
| Exposure validation | Not in our sources | Not described on the pages we read. | None |
| Exposure management platforms | Described | Sits in Cortex exposure management alongside Cortex XSOAR and Prisma Cloud. | Source: Cortex exposure management · Read 27 Sep 2026 |
| CTEM programme support | Described | Discovery and automated response are described; exploit validation is not. | Source: Cortex Xpanse · Read 27 Sep 2026 |
| WAF posture | Not in our sources | Not described on the pages we read. | None |
How does Cortex Xpanse prove an exposure is real?
| Exploitability checked | Not in our sources |
|---|---|
| Attack-style testing | Not in our sources |
| Retests after a fix | Not in our sources |
What does Cortex Xpanse do with a finding?
| Subsidiary and owner attribution | Partly Identifies the stakeholders for third-party exposures; subsidiary attribution is not described. Source: Cortex Xpanse attack surface management · Read 27 Sep 2026 |
|---|---|
| Routes findings to owners and tickets | Matches Routing and remediation through Cortex XSOAR playbooks. Source: Cortex Xpanse attack surface management · Read 27 Sep 2026 |
| Applies a compensating control | Matches Active Response runs built-in automated playbooks. Source: Cortex Xpanse · Read 27 Sep 2026 |
| Works through your WAF or edge | Not in our sources |
| WAF coverage across several vendors | Not in our sources |
| Integrations | Cortex XSOAR and Prisma Cloud inside the Palo Alto Networks portfolio. Source: Cortex Xpanse attack surface management · Read 27 Sep 2026 |
Where does Cortex Xpanse run, and what does it connect to?
| Deployment | Part of the Palo Alto Networks Cortex portfolio, with Cortex XSOAR playbooks and Prisma Cloud alongside. Source: Cortex Xpanse attack surface management · Read 27 Sep 2026 |
|---|---|
| Internal as well as external assets | Not in our sources |
| Cloud connections named | Matches Xpanse works with Prisma Cloud. Source: Cortex Xpanse attack surface management · Read 27 Sep 2026 |
| Platform it extends | Native ties to Cortex XSOAR playbooks and Prisma Cloud. Source: Cortex Xpanse attack surface management · Read 27 Sep 2026 |
| Platforms it connects to | None in our sources |
What does Cortex Xpanse cost?
Not published by Palo Alto Networks. Reseller listing (UK G-Cloud 14, KHIPU Networks): £70,850.84 an instance a year, no free trial, public-facing attack surfaces only.
Source: UK G-Cloud 14 listing: Cortex Xpanse (reseller KHIPU Networks) · Read 11 Oct 2026
Trial or self-serve start: Not in our sources
Where is Cortex Xpanse strong, and where are its limits?
Strengths and limits come from the vendor's own pages and our sources; a limit can be something we did not find.
Strengths
- Internet-wide scanning: all IPv4 addresses several times a day, by Palo Alto Networks' account.
- Active Response playbooks that act on exposures automatically.
- Native ties to Cortex XSOAR and Prisma Cloud for teams already on Palo Alto Networks.
Limits
- Exploit validation is not described on the product pages we read.
- No price from Palo Alto Networks (only a UK reseller listing), and subsidiary attribution is not described.
What does Cortex Xpanse say about itself?
What do peer reviews say?
Context only. Ratings come from Gartner Peer Insights' External Attack Surface Management market page read on 11 October 2026. They are not used in the finder and we have not verified them.
4.5 from 66 ratings.
Source: Gartner Peer Insights: External Attack Surface Management market · Read 11 Oct 2026
What has Cortex Xpanse announced recently?
No dated announcements in our sources.
Who should shortlist Cortex Xpanse?
Consider Cortex Xpanse if you already run Cortex XSOAR or Prisma Cloud, or if you want automated response playbooks on newly found exposures.
In our example finder profiles, Cortex Xpanse is in the first group for: Subsidiaries on Palo Alto Networks.
Run the finder with your answersHow does Cortex Xpanse compare with each other vendor?
Questions readers ask
Does Cortex Xpanse prove exploitability?
Not in our sources. Not in our sources. Attack-style testing: Not in our sources.
Does Cortex Xpanse work with WAFs?
Not in our sources. Not described on the pages we read.
Does Cortex Xpanse publish its prices?
Not published by Palo Alto Networks. Reseller listing (UK G-Cloud 14, KHIPU Networks): £70,850.84 an instance a year, no free trial, public-facing attack surfaces only.