* [Blog](https://www.paloaltonetworks.com/blog) * [Security Operations](https://www.paloaltonetworks.com/blog/security-operations/) * [Agent Security](https://www.paloaltonetworks.com/blog/ai-security/category/agent-security/) * How a Developer Endpoint ... # How a Developer Endpoint Became the Path to Binance's $6.3B Heist [](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.paloaltonetworks.com%2Fblog%2Fsecurity-operations%2Fhow-a-developer-endpoint-became-the-path-to-binances-6-3b-heist%2F) [](https://twitter.com/share?text=How+a+Developer+Endpoint+Became+the+Path+to+Binance%E2%80%99s+%246.3B+Heist&url=https%3A%2F%2Fwww.paloaltonetworks.com%2Fblog%2Fsecurity-operations%2Fhow-a-developer-endpoint-became-the-path-to-binances-6-3b-heist%2F) [](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.paloaltonetworks.com%2Fblog%2Fsecurity-operations%2Fhow-a-developer-endpoint-became-the-path-to-binances-6-3b-heist%2F&title=How+a+Developer+Endpoint+Became+the+Path+to+Binance%E2%80%99s+%246.3B+Heist&summary=&source=) [](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https://www.paloaltonetworks.com/blog/security-operations/how-a-developer-endpoint-became-the-path-to-binances-6-3b-heist/&ts=markdown) \[\](mailto:?subject=How a Developer Endpoint Became the Path to Binance’s $6.3B Heist) Link copied By [Emran Mazumder](https://www.paloaltonetworks.com/blog/author/emran-mazumder/?ts=markdown "Posts by Emran Mazumder"), [Gal Hachamov](https://www.paloaltonetworks.com/blog/author/gal-hachamov/?ts=markdown "Posts by Gal Hachamov"), [Yuval Ronen](https://www.paloaltonetworks.com/blog/author/yuval-ronen/?ts=markdown "Posts by Yuval Ronen") and [Idan Dardikman](https://www.paloaltonetworks.com/blog/author/idan-dardikman/?ts=markdown "Posts by Idan Dardikman") Nov 09, 2026 8 minutes [Agent Security](https://www.paloaltonetworks.com/blog/ai-security/category/agent-security/?ts=markdown) [AI and Cybersecurity](https://www.paloaltonetworks.com/blog/security-operations/category/ai-and-cybersecurity/?ts=markdown) [AI Governance](https://www.paloaltonetworks.com/blog/ai-security/category/ai-governance/?ts=markdown) [AI Security](https://www.paloaltonetworks.com/blog/category/ai-security/?ts=markdown) [Assess AI Risks](https://www.paloaltonetworks.com/blog/ai-security/category/assess-ai-risks/?ts=markdown) [Cybersecurity](https://www.paloaltonetworks.com/blog/category/cybersecurity/?ts=markdown) [Develop AI Safely](https://www.paloaltonetworks.com/blog/ai-security/category/develop-ai-safely/?ts=markdown) [Must-Read Articles](https://www.paloaltonetworks.com/blog/security-operations/category/must-read-articles/?ts=markdown) [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown) [Threat Intelligence](https://www.paloaltonetworks.com/blog/category/threat-intelligence-1/?ts=markdown) [Agentic Security](https://www.paloaltonetworks.com/blog/tag/agentic-security/?ts=markdown) [AI agent security](https://www.paloaltonetworks.com/blog/tag/ai-agent-security/?ts=markdown) [Binance Hack](https://www.paloaltonetworks.com/blog/tag/binance-hack/?ts=markdown) [Cortex AES](https://www.paloaltonetworks.com/blog/tag/cortex-aes/?ts=markdown) [Cortex XDR](https://www.paloaltonetworks.com/blog/tag/cortex-xdr/?ts=markdown) [Credential Theft](https://www.paloaltonetworks.com/blog/tag/credential-theft/?ts=markdown) [Cybersecurity](https://www.paloaltonetworks.com/blog/tag/cybersecurity/?ts=markdown) [DevSecOps](https://www.paloaltonetworks.com/blog/tag/devsecops/?ts=markdown) [Endpoint Security](https://www.paloaltonetworks.com/blog/tag/endpoint-security/?ts=markdown) [lateral movement](https://www.paloaltonetworks.com/blog/tag/lateral-movement/?ts=markdown) [Lazarus Group](https://www.paloaltonetworks.com/blog/tag/lazarus-group/?ts=markdown) [Palo Alto Networks](https://www.paloaltonetworks.com/blog/tag/palo-alto-networks/?ts=markdown) [Supply Chain Security](https://www.paloaltonetworks.com/blog/tag/supply-chain-security/?ts=markdown) [Threat Intelligence](https://www.paloaltonetworks.com/blog/tag/threat-intelligence/?ts=markdown) [TraderTraitor](https://www.paloaltonetworks.com/blog/tag/tradertraitor/?ts=markdown) Could the largest crypto heist in history have been prevented? **If the endpoints had Cortex, the answer is an unequivocal yes.** On October 29, 2026, threat actors drained approximately $6.34 billion from Binance's hot wallets in roughly 20 minutes \[1\]. The cryptography didn't fail. The core infrastructure never flinched. A single engineer's laptop was all it took for North Korea's TraderTraitor \[2\] to walk away with billions. They should never have made it past the first machine. When we put the incident telemetry and attack techniques to the test, the conclusion was immediate: **[Palo Alto Networks Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) and [Cortex AES](https://www.paloaltonetworks.com/cortex/agentic-endpoint-security?ts=markdown) (Agentic Endpoint Security) could have shut down this entire attack down on the endpoint.** Cortex XDR kills the initial infostealer and credential harvesting cold at the OS level, while Cortex AES neutralizes the backdoored dependencies and governs the internal AI agents the attackers hijacked to move laterally. Here is how Cortex breaks the attack chain at every stage, long before an adversary reaches the vault. ### **The Anatomy of the Breach: Four Critical Links** While Binance's disclosure offers an initial snapshot of the threat actors' tactics, techniques, and procedures (TTPs), the attack chain unfolded across four distinct phases: 1. **Initial Access via Malvertising (June 2026):** An engineer attempting to install the Homebrew package manager clicked a poisoned search ad, landing on a spoofed site that delivered **MacSync Stealer** . 2. **Secondary Entry via Supply-Chain Lure (September 2026):** A second engineer was targeted by a fictitious recruiter with a take-home coding assignment that silently replaced a legitimate *pyenv* package with a malicious variant. 3. **Lateral Movement via Internal AI Tools (October 20, 2026):** The attackers hijacked an internal, permissioned AI tool running on developer workstations to pivot across machines without triggering standard security alerts. 4. **Credential Harvesting \& Container Execution:** On a compromised host, the threat actors extracted a container deployment token, deployed a rogue container running an execution script, and completed their path to the transaction-signing infrastructure. ### **Phase 1: Breaking the First Link with Cortex XDR** The intrusion began five months prior to the drain. A Binance engineer fell victim to a malvertising campaign delivering **MacSync Stealer** \[3\], a macOS infostealer sold as a service. The decoy Homebrew page instructed the user to paste a single *zsh* command into their terminal. Once executed, the script prompted for local administrative credentials, harvested the macOS Keychain, browser sessions, SSH private keys, and local wallet data, compressed the loot into a single ZIP archive, and exfiltrated it to the attacker's command-and-control (C2) server. Although Binance detected and remediated the infection after the fact and rotated the engineer's credentials, the attackers had already extracted the internal reconnaissance data required to plan their lateral assault. ![Image 1: SANS Internet Storm Center overview of MacSync Stealer delivery chain4](https://www.paloaltonetworks.com/blog/wp-content/uploads/2026/11/2026-04-30-image-MacSync-Stealer-image-01.png "Image 1: SANS Internet Storm Center overview of MacSync Stealer delivery chain4") Image 1: SANS Internet Storm Center overview of MacSync Stealer delivery chain \[4\] #### **How Cortex XDR Stops It** Cortex XDR prevents MacSync Stealer out of the box before credential harvesting can take place: * **Dynamic Analysis \& Anti-Malware Engines:** MacSync Stealer binaries and staging scripts are identified and blocked at download and execution. * **Behavioral Threat Protection (BTP):** MacSync Stealer relies on living-off-the-land techniques, utilizing native terminal commands and system utilities. Cortex XDR continuously maps execution causality chains. When a terminal session spawns anomalous credential-access APIs, reads unmapped browser SQLite databases, or attempts mass archiving in hidden system directories, BTP severs the process tree immediately. When tested against identical execution scripts, Cortex XDR blocks the malicious payload at the first terminal invocation, neutralizing the campaign before initial reconnaissance ever leaves the machine. ![](https://www.paloaltonetworks.com/blog/wp-content/uploads/2026/11/image3-1.png) Image 2: Cortex XDR alert showing dynamic interception of MacSync Stealer ### **Phase 2: Intercepting the Trojanized Dependency with Cortex AES** In September 2026, TraderTraitor launched a targeted spear-phishing campaign against a second Binance engineer. The adversary created a legitimate-looking recruitment shell company, complete with authentic-looking social media profiles, and invited the engineer to complete a take-home technical assessment. Embedded within the project repository was a mechanism that silently swapped the developer's local *pyenv* installation for a backdoored version. This tactic is a hallmark of DPRK cyber operations: * In 2023, GitHub \[5\] warned that TraderTraitor was posing as recruiters to trick Web3 developers into executing projects laden with malicious npm packages. * In June 2026, Sonatype \[6\] revealed that Lazarus actors had published dozens of compromised open-source packages specifically engineered to abuse implicit trust in developer dependencies. #### **Where AES Steps In** Standard EDR solutions often struggle with developer tools; compilers, package managers, and interpreter wrappers routinely modify local binaries and establish outbound connections as part of ordinary development workflows. Cortex AES is purpose-built to close this blind spot: * **Pre-Execution Dependency Scanning:** Cortex AES inspects code repositories and candidate packages before they are built or executed locally, identifying anomalous hooks, obfuscated payloads, and tampered package definitions. * **Developer Environment Inventory:** If a tampered tool like *pyenv* is identified, security teams need to determine the scope of compromise immediately. Cortex AES provides unified visibility across the entire engineering fleet, mapping every installed runtime, package version, and CLI utility across all workstations in real time. ![](https://www.paloaltonetworks.com/blog/wp-content/uploads/2026/11/image5-1.png) Image 3: Cortex AES maps installed runtime, package version, and CLI utility ### **Phase 3: Stopping Lateral Movement via Rogue AI Agents** On October 20, 2026, the attackers advanced their intrusion by hijacking an internal AI developer tool, using it to hop to two additional machines, including the workstation compromised in June. This reflects a shift across the enterprise threat landscape: AI tools are rapidly becoming an unmonitored attack highway. In June 2026, Anthropic \[7\] reported that **6.5% of over 800 banned adversarial accounts used AI tooling specifically to execute lateral network movement** , rather than merely drafting phishing lures or scanning code. When an autonomous AI assistant runs with broad system permissions, an attacker who gains control of that agent inherits its privileges. #### **How Cortex AES Governs Agentic Workflows** Cortex AES introduces runtime guardrails for developer-facing AI: * **Agentic Posture \& Policy Enforcement:** Cortex AES discovers every AI assistant, Model Context Protocol (MCP) server, and custom skill running across developer endpoints. It enforces strict boundary policies: agents are restricted to approved toolsets, preventing local AI helpers from executing arbitrary shell commands or touching unauthorized directories. * **AI Detection and Response (AIDR):** An AI agent commandeered by a threat actor exhibits distinct operational telemetry compared to one assisting an engineer. Instead of generating application code, an adversarial session performs local discovery, searches for cloud credentials, and attempts outbound network traversal. * **Session-Level Behavioral Baselines:** Cortex AES AIDR continuously evaluates active agent sessions. When a session deviates from standard developer interaction patterns, AIDR flags the anomaly in real time, terminates the session, and isolates the host. ![](https://www.paloaltonetworks.com/blog/wp-content/uploads/2026/11/image1-1.png) Image 4: Visibility across AI agent, Model Context Protocol (MCP) server, and custom skill ![](https://www.paloaltonetworks.com/blog/wp-content/uploads/2026/11/image6.png) Image 5: AIDR continuously evaluates active agent sessions ### **Phase 4: Neutralizing Token Theft with Cortex Credential Protection** On one of the laterally compromised endpoints, the threat actors uncovered an active container deployment token. Using this token, they spun up an unauthorized container to execute arbitrary scripts, the final operational bridge needed to reach the hot-wallet signing environment. Workstation-resident secrets remain a favored target for high-tier adversaries. Cortex XDR's **Credential Gathering Protection** monitors protected system memory, local config files, and credential stores to block unauthorized process access to tokens, SSH keys, and cloud secrets. Even if an adversary achieves user-level code execution, Cortex denies the privilege escalation and token extraction required to access production pipelines. ![](https://www.paloaltonetworks.com/blog/wp-content/uploads/2026/11/image4-1.png) Image 6: Cortex Credential Gathering Protection ![](https://www.paloaltonetworks.com/blog/wp-content/uploads/2026/11/image2-1.png) Image 7: Cortex Financial Malware Threat Protection ### **The New Perimeter: The Developer Workstation** The October 29 drain took just 20 minutes to execute. But the intrusion that made it possible was a calculated, five-month campaign that moved exclusively through developer laptops. Crypto networks and modern enterprises do not typically fail because their core cryptography is broken. They fail because the endpoints used to write, build, and deploy that infrastructure are treated like standard office laptops instead of the keys to the vault. By deploying [**Cortex XDR**](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) to eliminate OS-level malware and credential theft alongside [**Cortex AES**](https://www.paloaltonetworks.com/cortex/agentic-endpoint-security?ts=markdown) to govern developer packages, runtimes, and AI agents, security organizations can break modern attack chains at the first machine, long before an adversary reaches the balance sheet. **SOURCE** : \[1\] [https://www.binance.com/en/blog/community/3229153443759566763](https://www.binance.com/en/blog/community/3229153443759566763) \[2\] [https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack](https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack) \[3\] [https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-05-20-IOCs-for-MacSync-Stealer-activity.txt?utm\_campaign=tti\_homebrew-macsync](https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-05-20-IOCs-for-MacSync-Stealer-activity.txt?utm_campaign=tti_homebrew-macsync) \[4\] [https://isc.sans.edu/diary/32942](https://isc.sans.edu/diary/32942) \[5\] [https://github.blog/security/vulnerability-research/security-alert-social-engineering-campaign-targets-technology-industry-employees/](https://github.blog/security/vulnerability-research/security-alert-social-engineering-campaign-targets-technology-industry-employees/) \[6\] [https://www.sonatype.com/blog/lazarus-groups-latest-brandjacking-campaign-on-npm](https://www.sonatype.com/blog/lazarus-groups-latest-brandjacking-campaign-on-npm) \[7\] [https://www.anthropic.com/news/AI-enabled-cyber-threats-mitre-attack](https://www.anthropic.com/news/AI-enabled-cyber-threats-mitre-attack) *** ** * ** *** ## Related Blogs ### [AI and Cybersecurity](https://www.paloaltonetworks.com/blog/security-operations/category/ai-and-cybersecurity/?ts=markdown), [AI Security](https://www.paloaltonetworks.com/blog/category/ai-security/?ts=markdown), [Announcement](https://www.paloaltonetworks.com/blog/category/announcement/?ts=markdown), [Cybersecurity](https://www.paloaltonetworks.com/blog/category/cybersecurity/?ts=markdown), [Must-Read Articles](https://www.paloaltonetworks.com/blog/security-operations/category/must-read-articles/?ts=markdown), [News and Events](https://www.paloaltonetworks.com/blog/security-operations/category/news-and-events/?ts=markdown), [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown) [#### Cortex XDR is the only Certified Leader in AV-Comparatives EPR 7 years in a row](https://www.paloaltonetworks.com/blog/security-operations/cortex-xdr-is-the-only-endpoint-security-market-leader-to-be-certified-by-av-comparatives-7-years-in-a-row/) ### [AI and Cybersecurity](https://www.paloaltonetworks.com/blog/security-operations/category/ai-and-cybersecurity/?ts=markdown), [Announcement](https://www.paloaltonetworks.com/blog/category/announcement/?ts=markdown), [Cybersecurity](https://www.paloaltonetworks.com/blog/category/cybersecurity/?ts=markdown), [Must-Read Articles](https://www.paloaltonetworks.com/blog/security-operations/category/must-read-articles/?ts=markdown), [Product Features](https://www.paloaltonetworks.com/blog/security-operations/category/product-features/?ts=markdown), [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown), [Use-Cases](https://www.paloaltonetworks.com/blog/security-operations/category/use-cases/?ts=markdown) [#### Cortex XDR Scores Perfect 100% in SE Labs 2026 Ransomware Test](https://www.paloaltonetworks.com/blog/security-operations/cortex-xdr-scores-perfect-100-in-se-labs-2026-ransomware-test/) ### [AI and Cybersecurity](https://www.paloaltonetworks.com/blog/security-operations/category/ai-and-cybersecurity/?ts=markdown), [AI Security](https://www.paloaltonetworks.com/blog/category/ai-security/?ts=markdown), [Announcement](https://www.paloaltonetworks.com/blog/category/announcement/?ts=markdown), [Cybersecurity](https://www.paloaltonetworks.com/blog/category/cybersecurity/?ts=markdown), [Must-Read Articles](https://www.paloaltonetworks.com/blog/security-operations/category/must-read-articles/?ts=markdown), [News and Events](https://www.paloaltonetworks.com/blog/security-operations/category/news-and-events/?ts=markdown), [Product Features](https://www.paloaltonetworks.com/blog/security-operations/category/product-features/?ts=markdown), [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown), [Use-Cases](https://www.paloaltonetworks.com/blog/security-operations/category/use-cases/?ts=markdown) [#### Identity Meets the SOC: Redefining the Last Perimeter](https://www.paloaltonetworks.com/blog/security-operations/identity-meets-the-soc-redefining-the-last-perimeter/) ### [AI and Cybersecurity](https://www.paloaltonetworks.com/blog/security-operations/category/ai-and-cybersecurity/?ts=markdown), [Must-Read Articles](https://www.paloaltonetworks.com/blog/security-operations/category/must-read-articles/?ts=markdown), [Points of View](https://www.paloaltonetworks.com/blog/category/points-of-view/?ts=markdown), [Product Features](https://www.paloaltonetworks.com/blog/security-operations/category/product-features/?ts=markdown), [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown) [#### Ransomware Attacks: Why Your Endpoint Protection Can't Keep Up](https://www.paloaltonetworks.com/blog/security-operations/ransomware-attacks-why-your-endpoint-protection-cant-keep-up/) ### [AI and Cybersecurity](https://www.paloaltonetworks.com/blog/security-operations/category/ai-and-cybersecurity/?ts=markdown), [Must-Read Articles](https://www.paloaltonetworks.com/blog/security-operations/category/must-read-articles/?ts=markdown), [News and Events](https://www.paloaltonetworks.com/blog/security-operations/category/news-and-events/?ts=markdown), [Product Features](https://www.paloaltonetworks.com/blog/security-operations/category/product-features/?ts=markdown), [Use-Cases](https://www.paloaltonetworks.com/blog/security-operations/category/use-cases/?ts=markdown) [#### From Silos to Synergy: How Cortex XDL Transforms XDR to Elevate Threat Detection](https://www.paloaltonetworks.com/blog/security-operations/from-silos-to-synergy-how-cortex-xdl-transforms-xdr-to-elevate-threat-detection/) ### [AI and Cybersecurity](https://www.paloaltonetworks.com/blog/security-operations/category/ai-and-cybersecurity/?ts=markdown), [Must-Read Articles](https://www.paloaltonetworks.com/blog/security-operations/category/must-read-articles/?ts=markdown), [News and Events](https://www.paloaltonetworks.com/blog/security-operations/category/news-and-events/?ts=markdown) [#### Cortex XDR is the Only Endpoint Security Market Leader to Achieve 99% in Both Threat Prevention and Response in AVC EPR](https://www.paloaltonetworks.com/blog/security-operations/cortex-xdr-is-the-only-endpoint-security-market-leader-to-achieve-99-in-both-threat-prevention-and-response-in-avc-epr/) ### Subscribe to Security Operations Blogs! Sign up to receive must-read articles, Playbooks of the Week, new feature announcements, and more. ![spinner](https://www.paloaltonetworks.com/blog/wp-content/themes/panwblog2023/dist/images/ajax-loader.gif) Sign up Please enter a valid email. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) and acknowledge our [Privacy Statement](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown). Please look for a confirmation email from us. If you don't receive it in the next 10 minutes, please check your spam folder. This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. {#footer} {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security?ts=markdown) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs?ts=markdown) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown) * [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/unit42/respond/managed-detection-response?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) * Observability * [Cortex XCOR](https://www.paloaltonetworks.com/cortex/xcor?ts=markdown) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira?ts=markdown) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management?ts=markdown) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management?ts=markdown) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager?ts=markdown) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance?ts=markdown) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management?ts=markdown) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic?ts=markdown) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management?ts=markdown) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance?ts=markdown) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery?ts=markdown) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access?ts=markdown) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/prepare-for-emerging-risks/continuous-frontier-ai-defense?ts=markdown) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses?ts=markdown) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy?ts=markdown) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence?ts=markdown) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond?ts=markdown) Company * [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown) * [Customers](https://www.paloaltonetworks.com/customers?ts=markdown) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown) * [Communities](https://www.paloaltonetworks.com/communities?ts=markdown) * [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications?ts=markdown) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown) * [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) * [Documents](https://www.paloaltonetworks.com/legal?ts=markdown) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language