[](https://www.paloaltonetworks.com/?ts=markdown) * [](https://www.paloaltonetworks.com/?ts=markdown) * Products Products AI Security [![](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/prisma-AIRS-logo-nav.svg)](https://www.paloaltonetworks.com/ai-security/prisma-airs?ts=markdown) [AI Security Platform](https://www.paloaltonetworks.com/ai-security/prisma-airs?ts=markdown) * [AI Gateway](https://www.paloaltonetworks.com/ai-security/ai-gateway?ts=markdown) * [AI Supply Chain Security](https://www.paloaltonetworks.com/ai-security/ai-supply-chain-security?ts=markdown) * [AI Red Teaming](https://www.paloaltonetworks.com/ai-security/ai-red-teaming?ts=markdown) * [AI Runtime Security](https://www.paloaltonetworks.com/ai-security/ai-runtime-security?ts=markdown) * [Agent Identity Security](https://www.paloaltonetworks.com/ai-security/agent-identity-security?ts=markdown) * [AI Posture Management](https://www.paloaltonetworks.com/prisma/cloud/ai-spm?ts=markdown) * [Agentic Endpoint Security](https://www.paloaltonetworks.com/cortex/agentic-endpoint-security?ts=markdown) Secure GenAI Tools * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) Network Security [![](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/strata-logo-nav.svg)](https://www.paloaltonetworks.com/network-security?ts=markdown) [Secure the Network](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown) * [OT / Industrial Security](https://www.paloaltonetworks.com/network-security/ot-security-solution?ts=markdown) * [Device \& IoT Security](https://www.paloaltonetworks.com/network-security/device-security?ts=markdown) * [5G Security](https://www.paloaltonetworks.com/network-security/5g-security?ts=markdown) * [Managed Firewalls - Azure](https://www.paloaltonetworks.com/network-security/cloud-ngfw-for-azure?ts=markdown) * [Managed Firewalls - AWS](https://www.paloaltonetworks.com/network-security/cloud-ngfw?ts=markdown) [Cloud-Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Advanced IP Defense](https://www.paloaltonetworks.com/network-security/advanced-ip-defense?ts=markdown) * [Quantum Safe Security](https://www.paloaltonetworks.com/network-security/quantum-safe-security?ts=markdown) * [Next-Gen Trust Security](https://www.paloaltonetworks.com/network-security/next-gen-trust-security?ts=markdown) SASE [![](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/prisma-sase-logo-nav.svg)](https://www.paloaltonetworks.com/sase?ts=markdown) [Secure Access (SASE)](https://www.paloaltonetworks.com/sase?ts=markdown) * [Prisma Access (ZTNA)](https://www.paloaltonetworks.com/sase/access?ts=markdown) * [SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) Security Operations [![](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/cortex-logo-nav.svg)](https://www.paloaltonetworks.com/cortex?ts=markdown) [Security Operations](https://www.paloaltonetworks.com/cortex?ts=markdown) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown) * [Extended Detection \& Response](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) * [Security Orchestration \& Automation](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown) * [Attack Surface Management](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown) * [Exposure Management](https://www.paloaltonetworks.com/cortex/exposure-management?ts=markdown) * [Email Security](https://www.paloaltonetworks.com/cortex/advanced-email-security?ts=markdown) * [Threat Intelligence Management](https://www.paloaltonetworks.com/cortex/threat-intel-management?ts=markdown) * [Agentic-first Automation](https://www.paloaltonetworks.com/cortex/agentix?ts=markdown) * [Identity Threat Detection and Response](https://www.paloaltonetworks.com/cortex/itdr?ts=markdown) [Endpoint Security](https://www.paloaltonetworks.com/cortex/endpoint-protection?ts=markdown) * [Endpoint Protection](https://www.paloaltonetworks.com/cortex/endpoint-protection?ts=markdown) * [Agentic Endpoint Security](https://www.paloaltonetworks.com/cortex/agentic-endpoint-security?ts=markdown) * [Ransomware Protection](https://www.paloaltonetworks.com/cortex/ransomware-protection?ts=markdown) * [Digital Forensics](https://www.paloaltonetworks.com/cortex/digital-forensics?ts=markdown) [Data Security](https://www.paloaltonetworks.com/cortex/data-security?ts=markdown) Cloud Security [![](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/cortex-cloud-logo-nav.svg)](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) [Application Security Overview](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown) * [Application Security Posture Management](https://www.paloaltonetworks.com/cortex/cloud/application-security-posture-management?ts=markdown) * [Software Supply Chain Security](https://www.paloaltonetworks.com/cortex/cloud/software-supply-chain-security?ts=markdown) * [Infrastructure-as-Code (IaC) Security](https://www.paloaltonetworks.com/cortex/cloud/infrastructure-as-code-security?ts=markdown) * [Software Composition Analysis](https://www.paloaltonetworks.com/cortex/cloud/software-composition-analysis?ts=markdown) * [Secrets Security](https://www.paloaltonetworks.com/cortex/cloud/secrets-security?ts=markdown) * [Open Partner Ecosystem](https://www.paloaltonetworks.com/cortex/cloud/appsec-partner-ecosystem?ts=markdown) [Cloud Posture Security Overview](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Security Posture Management](https://www.paloaltonetworks.com/cortex/cloud/cloud-security-posture-management?ts=markdown) * [Cloud Infrastructure Entitlement Management](https://www.paloaltonetworks.com/cortex/cloud/cloud-infrastructure-entitlement-management?ts=markdown) * [Data Security Posture Management](https://www.paloaltonetworks.com/cortex/cloud/data-security-posture-management?ts=markdown) * [AI Security Posture Management](https://www.paloaltonetworks.com/cortex/cloud/ai-security-posture-management?ts=markdown) * [Vulnerability Management](https://www.paloaltonetworks.com/cortex/cloud/vulnerability-management?ts=markdown) * [Cloud Attack Surface Management](https://www.paloaltonetworks.com/cortex/cloud/attack-surface-management?ts=markdown) [Cloud Runtime Security Overview](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown) * [Cloud Detection and Response](https://www.paloaltonetworks.com/cortex/cloud-detection-and-response?ts=markdown) * [Container \& Kubernetes Security](https://www.paloaltonetworks.com/cortex/cloud/kubernetes-and-container-security?ts=markdown) * [Cloud Workload Protection](https://www.paloaltonetworks.com/cortex/cloud/cloud-workload-protection?ts=markdown) * [API Security](https://www.paloaltonetworks.com/cortex/cloud/api-security?ts=markdown) * [Serverless Security](https://www.paloaltonetworks.com/cortex/cloud/serverless-security?ts=markdown) Observability ^NEW^ [![](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/cortex/xcor/cortex-xcor-logo-nav-2.svg)](https://www.paloaltonetworks.com/cortex/xcor?ts=markdown) Observability \& Remediation * [AI-Driven Observability](https://www.paloaltonetworks.com/cortex/xcor/ai-driven-observability?ts=markdown) * [Distributed Tracing](https://www.paloaltonetworks.com/cortex/xcor/distributed-tracing?ts=markdown) * [Log Management](https://www.paloaltonetworks.com/cortex/xcor/log-management?ts=markdown) * [Metrics Monitoring](https://www.paloaltonetworks.com/cortex/xcor/metrics-monitoring?ts=markdown) Identity Security [![](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/idira-logo-nav.svg)](https://www.paloaltonetworks.com/idira?ts=markdown) [Human Identities](https://www.paloaltonetworks.com/idira/human?ts=markdown) * [Modern PAM](https://www.paloaltonetworks.com/idira/human/privileged-access-management?ts=markdown) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management?ts=markdown) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager?ts=markdown) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance?ts=markdown) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management?ts=markdown) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access?ts=markdown) [Machine Identities](https://www.paloaltonetworks.com/idira/machine?ts=markdown) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management?ts=markdown) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance?ts=markdown) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery?ts=markdown) [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic?ts=markdown) [See All Products](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown) * [![Overview icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/logo-default-orange.svg) Overview](#products-panel-0) * [![AI Security icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/icon-prisma-blue.svg) AI Security](#products-panel-1) * [![Network Security icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/icon-strata.svg) Network Security](#products-panel-2) * [![SASE icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/icon-prisma-blue.svg) SASE](#products-panel-3) * [![Security Operations icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/icon-cortex.svg) Security Operations](#products-panel-4) * [![Cloud Security icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/icon-cortex.svg) Cloud Security](#products-panel-5) * [Observability ^NEW^](#products-panel-6) * [![Identity Security icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/icon-idira.svg) Identity Security](#products-panel-7) [See All Products](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown) [![AI Security icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/prisma-AIRS-logo-nav.svg) AI Security Discover, assess and protect AI apps, agents and employee use of GenAI tools](https://www.paloaltonetworks.com/ai-security/prisma-airs?ts=markdown) [![Network Security icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/strata-logo-nav.svg) Network Security AI-powered NetSec with next-gen firewalls, inline defense and unified management](https://www.paloaltonetworks.com/network-security?ts=markdown) [![Security Operations icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/cortex-logo-nav.svg) Security Operations Stop cyberattackers with the industry's premier platform for autonomous security operations](https://www.paloaltonetworks.com/cortex?ts=markdown) [![Observability \& Remediation NEW icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/cortex/xcor/cortex-xcor-logo-nav-2.svg) Observability \& Remediation ^NEW^ Prevent downtime with the AI-driven platform that delivers autonomous remediation](https://www.paloaltonetworks.com/cortex/xcor?ts=markdown) [![SASE icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/prisma-sase-logo-nav.svg) SASE Protect with AI, secure AI use and operate with AI using agentic Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown) [![Identity Security icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/idira-logo-nav.svg) Identity Security Identity security platform to secure every identity: human, machine and agentic](https://www.paloaltonetworks.com/idira?ts=markdown) [![Cloud Security icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/cortex-cloud-logo-nav.svg) Cloud Security Prevent risks from code to cloud with the leading agentic cloud security platform](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) [![AI Security logo](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/prisma-AIRS-logo-nav.svg)](https://www.paloaltonetworks.com/ai-security/prisma-airs?ts=markdown) [AI Security Platform](https://www.paloaltonetworks.com/ai-security/prisma-airs?ts=markdown) * [AI Gateway](https://www.paloaltonetworks.com/ai-security/ai-gateway?ts=markdown) * [AI Supply Chain Security](https://www.paloaltonetworks.com/ai-security/ai-supply-chain-security?ts=markdown) * [AI Red Teaming](https://www.paloaltonetworks.com/ai-security/ai-red-teaming?ts=markdown) * [AI Runtime Security](https://www.paloaltonetworks.com/ai-security/ai-runtime-security?ts=markdown) * [Agent Identity Security](https://www.paloaltonetworks.com/ai-security/agent-identity-security?ts=markdown) * [AI Posture Management](https://www.paloaltonetworks.com/prisma/cloud/ai-spm?ts=markdown) * [Agentic Endpoint Security](https://www.paloaltonetworks.com/cortex/agentic-endpoint-security?ts=markdown) Secure GenAI Tools * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) [![Network Security logo](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/strata-logo-nav.svg)](https://www.paloaltonetworks.com/network-security?ts=markdown) [Secure the Network](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown) * [OT / Industrial Security](https://www.paloaltonetworks.com/network-security/ot-security-solution?ts=markdown) * [Device \& IoT Security](https://www.paloaltonetworks.com/network-security/device-security?ts=markdown) * [5G Security](https://www.paloaltonetworks.com/network-security/5g-security?ts=markdown) * [Managed Firewalls - Azure](https://www.paloaltonetworks.com/network-security/cloud-ngfw-for-azure?ts=markdown) * [Managed Firewalls - AWS](https://www.paloaltonetworks.com/network-security/cloud-ngfw?ts=markdown) [Cloud-Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Advanced IP Defense](https://www.paloaltonetworks.com/network-security/advanced-ip-defense?ts=markdown) * [Quantum Safe Security](https://www.paloaltonetworks.com/network-security/quantum-safe-security?ts=markdown) * [Next-Gen Trust Security](https://www.paloaltonetworks.com/network-security/next-gen-trust-security?ts=markdown) [![SASE logo](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/prisma-sase-logo-nav.svg)](https://www.paloaltonetworks.com/sase?ts=markdown) [Secure Access (SASE)](https://www.paloaltonetworks.com/sase?ts=markdown) * [Prisma Access (ZTNA)](https://www.paloaltonetworks.com/sase/access?ts=markdown) * [SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) [![Security Operations logo](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/cortex-logo-nav.svg)](https://www.paloaltonetworks.com/cortex?ts=markdown) [Security Operations](https://www.paloaltonetworks.com/cortex?ts=markdown) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown) * [Extended Detection \& Response](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) * [Security Orchestration \& Automation](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown) * [Attack Surface Management](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown) * [Exposure Management](https://www.paloaltonetworks.com/cortex/exposure-management?ts=markdown) * [Email Security](https://www.paloaltonetworks.com/cortex/advanced-email-security?ts=markdown) * [Threat Intelligence Management](https://www.paloaltonetworks.com/cortex/threat-intel-management?ts=markdown) * [Agentic-first Automation](https://www.paloaltonetworks.com/cortex/agentix?ts=markdown) * [Identity Threat Detection and Response](https://www.paloaltonetworks.com/cortex/itdr?ts=markdown) [Endpoint Security](https://www.paloaltonetworks.com/cortex/endpoint-protection?ts=markdown) * [Endpoint Protection](https://www.paloaltonetworks.com/cortex/endpoint-protection?ts=markdown) * [Agentic Endpoint Security](https://www.paloaltonetworks.com/cortex/agentic-endpoint-security?ts=markdown) * [Ransomware Protection](https://www.paloaltonetworks.com/cortex/ransomware-protection?ts=markdown) * [Digital Forensics](https://www.paloaltonetworks.com/cortex/digital-forensics?ts=markdown) [Data Security](https://www.paloaltonetworks.com/cortex/data-security?ts=markdown) [![Cloud Security logo](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/cortex-cloud-logo-nav.svg)](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) [Application Security Overview](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown) * [Application Security Posture Management](https://www.paloaltonetworks.com/cortex/cloud/application-security-posture-management?ts=markdown) * [Software Supply Chain Security](https://www.paloaltonetworks.com/cortex/cloud/software-supply-chain-security?ts=markdown) * [Infrastructure-as-Code (IaC) Security](https://www.paloaltonetworks.com/cortex/cloud/infrastructure-as-code-security?ts=markdown) * [Software Composition Analysis](https://www.paloaltonetworks.com/cortex/cloud/software-composition-analysis?ts=markdown) * [Secrets Security](https://www.paloaltonetworks.com/cortex/cloud/secrets-security?ts=markdown) * [Open Partner Ecosystem](https://www.paloaltonetworks.com/cortex/cloud/appsec-partner-ecosystem?ts=markdown) [Cloud Posture Security Overview](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Security Posture Management](https://www.paloaltonetworks.com/cortex/cloud/cloud-security-posture-management?ts=markdown) * [Cloud Infrastructure Entitlement Management](https://www.paloaltonetworks.com/cortex/cloud/cloud-infrastructure-entitlement-management?ts=markdown) * [Data Security Posture Management](https://www.paloaltonetworks.com/cortex/cloud/data-security-posture-management?ts=markdown) * [AI Security Posture Management](https://www.paloaltonetworks.com/cortex/cloud/ai-security-posture-management?ts=markdown) * [Vulnerability Management](https://www.paloaltonetworks.com/cortex/cloud/vulnerability-management?ts=markdown) * [Cloud Attack Surface Management](https://www.paloaltonetworks.com/cortex/cloud/attack-surface-management?ts=markdown) [Cloud Runtime Security Overview](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown) * [Cloud Detection and Response](https://www.paloaltonetworks.com/cortex/cloud-detection-and-response?ts=markdown) * [Container \& Kubernetes Security](https://www.paloaltonetworks.com/cortex/cloud/kubernetes-and-container-security?ts=markdown) * [Cloud Workload Protection](https://www.paloaltonetworks.com/cortex/cloud/cloud-workload-protection?ts=markdown) * [API Security](https://www.paloaltonetworks.com/cortex/cloud/api-security?ts=markdown) * [Serverless Security](https://www.paloaltonetworks.com/cortex/cloud/serverless-security?ts=markdown) [![Observability NEW logo](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/cortex/xcor/cortex-xcor-logo-nav-2.svg)](https://www.paloaltonetworks.com/cortex/xcor?ts=markdown) Observability \& Remediation * [AI-Driven Observability](https://www.paloaltonetworks.com/cortex/xcor/ai-driven-observability?ts=markdown) * [Distributed Tracing](https://www.paloaltonetworks.com/cortex/xcor/distributed-tracing?ts=markdown) * [Log Management](https://www.paloaltonetworks.com/cortex/xcor/log-management?ts=markdown) * [Metrics Monitoring](https://www.paloaltonetworks.com/cortex/xcor/metrics-monitoring?ts=markdown) [![Identity Security logo](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/idira-logo-nav.svg)](https://www.paloaltonetworks.com/idira?ts=markdown) [Human Identities](https://www.paloaltonetworks.com/idira/human?ts=markdown) * [Modern PAM](https://www.paloaltonetworks.com/idira/human/privileged-access-management?ts=markdown) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management?ts=markdown) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager?ts=markdown) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance?ts=markdown) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management?ts=markdown) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access?ts=markdown) [Machine Identities](https://www.paloaltonetworks.com/idira/machine?ts=markdown) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management?ts=markdown) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance?ts=markdown) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery?ts=markdown) [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic?ts=markdown) * Solutions Solutions By Use Case [![Drive AI Transformation icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/ai-page/teaser-block/teaser-icon-2.svg) Drive AI Transformation Scale enterprise AI adoption across employees, applications and agents with confidence and control](https://www.paloaltonetworks.com/ai-security?ts=markdown) [![Accelerate Cloud Transformation icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/icon-cortex.svg) Accelerate Cloud Transformation Build fast and innovate fearlessly with AI-driven protection from code to cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) [![Secure AI Coding icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/logo-default-orange.svg) Secure AI Coding Let AI coding do more, with you in control. Protect data, govern agents and control AI costs](https://www.paloaltonetworks.com/secure-ai-coding?ts=markdown) [![Secure Every Identity icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/icon-idira.svg) Secure Every Identity Stop identity-led breaches: Secure human, machine, and agentic identities with zero trust](https://www.paloaltonetworks.com/idira?ts=markdown) [![Enable Autonomous SOC icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/icon-cortex.svg) Enable Autonomous SOC Fight AI with AI to stop threats at machine speed with the power of analytics and automation](https://www.paloaltonetworks.com/cortex/fight-ai-with-ai?ts=markdown) [![Secure Critical Infrastructure icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/logo-default-orange.svg) Secure Critical Infrastructure Stop machine-speed threats across OT, 5G and IoT with AI-driven cyber defense](https://www.paloaltonetworks.com/securing-critical-infrastructure?ts=markdown) [![Secure the Hybrid Network icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/icon-strata.svg) Secure the Hybrid Network Stay ahead of AI-driven attacks with unified network security across hybrid environments](https://www.paloaltonetworks.com/network-security?ts=markdown) [![Automate Root-Cause Analysis icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/icon-cortex.svg) Automate Root-Cause Analysis Respond autonomously to incidents and accelerate remediation with agentic AI](https://www.paloaltonetworks.com/cortex/xcor?ts=markdown) [![Frontier AI Defense icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/icon-Unit42.svg) Frontier AI Defense Use defender-grade models to stop AI-speed attacks before they start](https://www.paloaltonetworks.com/unit42/ai-advantage?ts=markdown) * Services Services Security Services [![](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/unit-logo-dark.svg)](https://www.paloaltonetworks.com/unit42?ts=markdown) Prepare for Emerging Risks * [AI Security](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/ai-security-assessment?ts=markdown) * [Frontier AI](https://www.paloaltonetworks.com/unit42/prepare-for-emerging-risks/continuous-frontier-ai-defense?ts=markdown) * [Respond to Cyber Attacks](https://www.paloaltonetworks.com/unit42/respond?ts=markdown) * [Incident Response](https://www.paloaltonetworks.com/unit42/respond/incident-response?ts=markdown) * [Digital Forensics](https://www.paloaltonetworks.com/unit42/respond/digital-forensics?ts=markdown) * [Managed Detection \& Response](https://www.paloaltonetworks.com/unit42/respond/managed-detection-response?ts=markdown) * [Managed Threat Hunting](https://www.paloaltonetworks.com/cortex/managed-threat-hunting?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses?ts=markdown) * [Attack Surface Assessment](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/attack-surface-assessment?ts=markdown) * [Breach Readiness](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/breach-readiness-review?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/cloud-security-assessment?ts=markdown) * [Compromise Assessment](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/compromise-assessment?ts=markdown) * [Ransomware Readiness](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/ransomware-readiness-assessment?ts=markdown) * [Supply Chain](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/supply-chain-risk-assessment?ts=markdown) * [Tabletop Exercises](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/tabletop-exercises?ts=markdown) * [Unit 42 Retainer](https://www.paloaltonetworks.com/unit42/retainer?ts=markdown) [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy?ts=markdown) * [Cyber Risk](https://www.paloaltonetworks.com/unit42/build-your-security-strategy/cyber-risk-assessment?ts=markdown) * [IR Plan Development](https://www.paloaltonetworks.com/unit42/build-your-security-strategy/IR-plan-and-development-review?ts=markdown) * [Security Program Design](https://www.paloaltonetworks.com/unit42/build-your-security-strategy/security-program-design?ts=markdown) * [SOC Assessment](https://www.paloaltonetworks.com/unit42/build-your-security-strategy/soc-assessment?ts=markdown) * [Virtual CISO](https://www.paloaltonetworks.com/unit42/build-your-security-strategy/virtual-ciso?ts=markdown) * [Zero Trust](https://www.paloaltonetworks.com/unit42/build-your-security-strategy/zero-trust-advisory?ts=markdown) Understand the Adversary * [Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence?ts=markdown) * [Offensive Security](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/offensive-security-services?ts=markdown) Managed Firewalls Managed Firewalls * [Managed Firewalls - AWS](https://www.paloaltonetworks.com/network-security/cloud-ngfw?ts=markdown) * [Managed Firewalls - Azure](https://www.paloaltonetworks.com/network-security/cloud-ngfw-for-azure?ts=markdown) Customer Services [Global Customer Services](https://www.paloaltonetworks.com/services?ts=markdown) * [Education \& Training](https://www.paloaltonetworks.com/services/education?ts=markdown) * [Professional Services](https://www.paloaltonetworks.com/services/consulting?ts=markdown) * [Success Tools](https://www.paloaltonetworks.com/services/customer-success-tools?ts=markdown) * [Support Services](https://www.paloaltonetworks.com/services/solution-assurance?ts=markdown) * [Customer Success](https://www.paloaltonetworks.com/services/customer-success?ts=markdown) [Under Attack?](https://www.paloaltonetworks.com/unit42/contact-unit42?ts=markdown) * [Services Overview](#services-panel-0) * [Security Services](#services-panel-1) * [Managed Firewalls](#services-panel-2) * [Customer Services](#services-panel-3) [Under Attack?](https://www.paloaltonetworks.com/unit42/contact-unit42?ts=markdown) [![Security Services logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/unit-logo-dark.svg)](https://www.paloaltonetworks.com/unit42?ts=markdown) Prepare for Emerging Risks * [AI Security](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/ai-security-assessment?ts=markdown) * [Frontier AI](https://www.paloaltonetworks.com/unit42/prepare-for-emerging-risks/continuous-frontier-ai-defense?ts=markdown) * [Respond to Cyber Attacks](https://www.paloaltonetworks.com/unit42/respond?ts=markdown) * [Incident Response](https://www.paloaltonetworks.com/unit42/respond/incident-response?ts=markdown) * [Digital Forensics](https://www.paloaltonetworks.com/unit42/respond/digital-forensics?ts=markdown) * [Managed Detection \& Response](https://www.paloaltonetworks.com/unit42/respond/managed-detection-response?ts=markdown) * [Managed Threat Hunting](https://www.paloaltonetworks.com/cortex/managed-threat-hunting?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses?ts=markdown) * [Attack Surface Assessment](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/attack-surface-assessment?ts=markdown) * [Breach Readiness](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/breach-readiness-review?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/cloud-security-assessment?ts=markdown) * [Compromise Assessment](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/compromise-assessment?ts=markdown) * [Ransomware Readiness](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/ransomware-readiness-assessment?ts=markdown) * [Supply Chain](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/supply-chain-risk-assessment?ts=markdown) * [Tabletop Exercises](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/tabletop-exercises?ts=markdown) * [Unit 42 Retainer](https://www.paloaltonetworks.com/unit42/retainer?ts=markdown) [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy?ts=markdown) * [Cyber Risk](https://www.paloaltonetworks.com/unit42/build-your-security-strategy/cyber-risk-assessment?ts=markdown) * [IR Plan Development](https://www.paloaltonetworks.com/unit42/build-your-security-strategy/IR-plan-and-development-review?ts=markdown) * [Security Program Design](https://www.paloaltonetworks.com/unit42/build-your-security-strategy/security-program-design?ts=markdown) * [SOC Assessment](https://www.paloaltonetworks.com/unit42/build-your-security-strategy/soc-assessment?ts=markdown) * [Virtual CISO](https://www.paloaltonetworks.com/unit42/build-your-security-strategy/virtual-ciso?ts=markdown) * [Zero Trust](https://www.paloaltonetworks.com/unit42/build-your-security-strategy/zero-trust-advisory?ts=markdown) Understand the Adversary * [Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence?ts=markdown) * [Offensive Security](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/offensive-security-services?ts=markdown) Managed Firewalls * [Managed Firewalls - AWS](https://www.paloaltonetworks.com/network-security/cloud-ngfw?ts=markdown) * [Managed Firewalls - Azure](https://www.paloaltonetworks.com/network-security/cloud-ngfw-for-azure?ts=markdown) [Global Customer Services](https://www.paloaltonetworks.com/services?ts=markdown) * [Education \& Training](https://www.paloaltonetworks.com/services/education?ts=markdown) * [Professional Services](https://www.paloaltonetworks.com/services/consulting?ts=markdown) * [Success Tools](https://www.paloaltonetworks.com/services/customer-success-tools?ts=markdown) * [Support Services](https://www.paloaltonetworks.com/services/solution-assurance?ts=markdown) * [Customer Success](https://www.paloaltonetworks.com/services/customer-success?ts=markdown) * Industries Industries [![Financial Services icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/financial-icon-2.svg) Financial Services Secure with AI cybersecurity, fraud and ransomware prevention, compliance, and customer data protection](https://www.paloaltonetworks.com/industry/financial-services?ts=markdown) [![Manufacturing icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/manufacturing-icon-2.svg) Manufacturing Secure with OT security, ransomware defense, industrial cybersecurity, supply chain resilience, and continuity](https://www.paloaltonetworks.com/industry/manufacturing?ts=markdown) [![Retail and Hospitality icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/retail-icon-2.svg) Retail and Hospitality Secure with payment security, PCI compliance, ransomware and fraud prevention, and data protection](https://www.paloaltonetworks.com/industry/retail?ts=markdown) [![Healthcare and Life Sciences icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/healthcare-icon-2.svg) Healthcare and Life Sciences Secure patient and clinical data, medical device security, ransomware defense, and HIPAA compliance](https://www.paloaltonetworks.com/industry/healthcare?ts=markdown) [![Public Sector icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/public-sector-icon-2.svg) Public Sector Secure with Zero Trust, cyber defense, compliance, infrastructure protection, and citizen data security](https://www.paloaltonetworks.com/industry/public-sector?ts=markdown) [![Utilities icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/utilities-icon-2.svg) Utilities Secure with power grid protection, OT network security, ransomware defense, and critical infrastructure security](https://www.paloaltonetworks.com/industry/electric-utilities?ts=markdown) [![Transportation icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/transportation-icon-2.svg) Transportation Secure OT and connected infrastructure protection, ransomware defense, supply chain security, compliance](https://www.paloaltonetworks.com/industry/transportation-security?ts=markdown) [![Small and Medium Business icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/smb-icon-2.svg) Small and Medium Business Secure against cyber threats using AI-powered endpoint, network, browser, cloud, and MDR](https://www.paloaltonetworks.com/industry/small-medium-business-portfolio?ts=markdown) * Partners Partners NextWave * [Partner Program](https://www.paloaltonetworks.com/partners/nextwave-partner-portal-login?ts=markdown) * [Become a Partner](https://paloaltonetworks.my.site.com/NextWavePartnerProgram/s/partnerregistration?type=becomepartner) * [Request Partner Portal Access](https://paloaltonetworks.my.site.com/NextWavePartnerProgram/s/partnerregistration?type=requestaccess) * [Partner Portal Login](https://www.paloaltonetworks.com/partners/nextwave-partner-portal?ts=markdown) * [Find a Partner](https://paloaltonetworks.my.site.com/NextWavePartnerProgram/s/partnerlocator) Partner Ecosystem [Explore All Partners Find the right partner network tailored to your business needs, cloud environments, and security requirements](https://www.paloaltonetworks.com/partners?ts=markdown) [Cloud Service Partners Bring cloud native security and compliance to the entire development lifecycle](https://www.paloaltonetworks.com/partners/nextwave-for-csp?ts=markdown) [Frontier AI Alliance Outpace today's cyberattacks through a global ecosystem of leaders orchestrating unified defenses](https://www.paloaltonetworks.com/frontier?ts=markdown) [Global System Integrators Speed and secure digital transformation with the industry's best technology, people and intelligence](https://www.paloaltonetworks.com/partners/nextwave-for-gsi?ts=markdown) [Managed Security Service Providers Gain valuable resource oversight to help your businesses administer security strategies](https://www.paloaltonetworks.com/partners/managed-security-service-providers?ts=markdown) [Resellers Deliver the most comprehensive cybersecurity portfolio while expanding opportunities and profitability](https://www.paloaltonetworks.com/partners/resellers?ts=markdown) [Service Providers Protect mobile users, devices and applications with effective, flexible and easy to deploy cybersecurity](https://www.paloaltonetworks.com/partners/service-providers?ts=markdown) [Technology Partners Advance security and transformation with innovative technology partner integrations](https://www.paloaltonetworks.com/partners/technology-partners?ts=markdown) * Resources Resources ![Learn icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/resource-library-icon.svg) Learn * [Resource Library](https://www.paloaltonetworks.com/resources?ts=markdown) * [Analyst Reports](https://www.paloaltonetworks.com/resources/research?ts=markdown) * [Customer Stories](https://www.paloaltonetworks.com/customers?ts=markdown) * [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) * [Threat Vector Podcast](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown) * [Unit 42 Threat Research](https://unit42.paloaltonetworks.com/) * [Knowledgebase](https://knowledgebase.paloaltonetworks.com/) * [Technical Documentation](https://docs.paloaltonetworks.com/) ![Engage icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/engage-icon-2.svg) Engage * [Webinars](https://www.paloaltonetworks.com/resources/webinars?ts=markdown) * [Demos](https://www.paloaltonetworks.com/demos?ts=markdown) * [Test Drive](https://www.paloaltonetworks.com/resources/test-drives?ts=markdown) * [On-Demand](https://www.paloaltonetworks.com/ondemand?ts=markdown) ![Connect icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/connect-icon-2.svg) Connect * [Executive Briefings](https://www.paloaltonetworks.com/about-us/executive-briefing-program?ts=markdown) * [Events](https://events.paloaltonetworks.com/) * [Live Community](https://live.paloaltonetworks.com/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) ![Discover icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/discover-icon-2.svg) Discover * [Why Palo Alto Networks?](https://www.paloaltonetworks.com/why-paloaltonetworks?ts=markdown) * [Platform Approach](https://www.paloaltonetworks.com/why-paloaltonetworks/platformization?ts=markdown) * [Awards \& Recognition](https://www.paloaltonetworks.com/about-us/awards?ts=markdown) * [Global Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications?ts=markdown) * [Cloud Locations](https://www.paloaltonetworks.com/products/regional-cloud-locations?ts=markdown) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown) * [Trust 360 Program](https://www.paloaltonetworks.com/resources/whitepapers/trust-360?ts=markdown) ![Company icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/logo-default-orange.svg) Company * [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown) * [Management Team](https://www.paloaltonetworks.com/about-us/management?ts=markdown) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown) * [Careers](https://jobs.paloaltonetworks.com/en) * [Culture \& Benefits](https://jobs.paloaltonetworks.com/en/culture/) * [Ethics \& Compliance](https://www.paloaltonetworks.com/company/ethics-and-compliance?ts=markdown) * [Office Locations](https://www.paloaltonetworks.com/about-us/locations?ts=markdown) * ![search magnifying glass](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/search-black.svg) * us Language * USA (ENGLISH) * [AUSTRALIA (ENGLISH)](https://www.paloaltonetworks.com.au/cyberpedia/what-is-botnet) * [BRAZIL (PORTUGUÉS)](https://www.paloaltonetworks.com.br/cyberpedia/what-is-botnet) * [CANADA (ENGLISH)](https://www.paloaltonetworks.ca/cyberpedia/what-is-botnet) * [CHINA (简体中文)](https://www.paloaltonetworks.cn/cyberpedia/what-is-botnet) * [FRANCE (FRANÇAIS)](https://www.paloaltonetworks.fr/cyberpedia/what-is-botnet) * [GERMANY (DEUTSCH)](https://www.paloaltonetworks.de/cyberpedia/what-is-botnet) * [INDIA (ENGLISH)](https://www.paloaltonetworks.in/cyberpedia/what-is-botnet) * [ITALY (ITALIANO)](https://www.paloaltonetworks.it/cyberpedia/what-is-botnet) * [JAPAN (日本語)](https://www.paloaltonetworks.jp/cyberpedia/what-is-botnet) * [KOREA (한국어)](https://www.paloaltonetworks.co.kr/cyberpedia/what-is-botnet) * [LATIN AMERICA (ESPAÑOL)](https://www.paloaltonetworks.lat/cyberpedia/what-is-botnet) * [MEXICO (ESPAÑOL)](https://www.paloaltonetworks.com.mx/cyberpedia/what-is-botnet) * [SINGAPORE (ENGLISH)](https://www.paloaltonetworks.sg/cyberpedia/what-is-botnet) * [SPAIN (ESPAÑOL)](https://www.paloaltonetworks.es/cyberpedia/what-is-botnet) * [TAIWAN (繁體中文)](https://www.paloaltonetworks.tw/cyberpedia/what-is-botnet) * [UK (ENGLISH)](https://www.paloaltonetworks.co.uk/cyberpedia/what-is-botnet) * Accounts \& Support Accounts \& Support * Accounts * Customer * Partner * Employee * [Login to Download](https://www.paloaltonetworks.com/login?ts=markdown) * [Become a Member](https://www.paloaltonetworks.com/login?screenToRender=traditionalRegistration&ts=markdown) * Support * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) * [What's New](https://www.paloaltonetworks.com/resources?ts=markdown) * [Get Support](https://support.paloaltonetworks.com/SupportAccount/MyAccount) [Under Attack?](https://www.paloaltonetworks.com/unit42/contact-unit42?ts=markdown) * [Demos and Trials](https://www.paloaltonetworks.com/get-started?ts=markdown) [Introducing Cortex XCOR: Observability, reimagined. Discover now.](https://www.paloaltonetworks.com/cortex/xcor?ts=markdown) [](https://www.paloaltonetworks.com/?ts=markdown) Search All * [Tech Docs](https://docs.paloaltonetworks.com/search) Close search modal 1. [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) 2. [Threats](https://www.paloaltonetworks.com/cyberpedia/threat?ts=markdown) 3. [Malware and Ransomware](https://www.paloaltonetworks.com/cyberpedia/what-is-malware-vs-ransomware?ts=markdown) 4. [What is a Botnet?](https://www.paloaltonetworks.com/cyberpedia/what-is-botnet?ts=markdown) Table of Contents * [What is Malware vs. Ransomware?](https://www.paloaltonetworks.com/cyberpedia/what-is-malware-vs-ransomware?ts=markdown) * [What Is Malware?](https://www.paloaltonetworks.com/cyberpedia/what-is-malware-vs-ransomware#malware?ts=markdown) * [What Is Ransomware?](https://www.paloaltonetworks.com/cyberpedia/what-is-malware-vs-ransomware#ransomware?ts=markdown) * [Key Differences Between Malware and Ransomware](https://www.paloaltonetworks.com/cyberpedia/what-is-malware-vs-ransomware#differences?ts=markdown) * [Is Ransomware Worse Than Malware?](https://www.paloaltonetworks.com/cyberpedia/what-is-malware-vs-ransomware#worse?ts=markdown) * [Emerging Trends in Malware and Ransomware](https://www.paloaltonetworks.com/cyberpedia/what-is-malware-vs-ransomware#trends?ts=markdown) * [Malware vs. Ransomware FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-malware-vs-ransomware#faqs?ts=markdown) * [What is Ransomware as a Service (RaaS)?](https://www.paloaltonetworks.com/cyberpedia/what-is-ransomware-as-a-service?ts=markdown) * What is a Botnet? * [Botnets Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-botnet#explained?ts=markdown) * [The Mechanics of Botnet Architecture](https://www.paloaltonetworks.com/cyberpedia/what-is-botnet#architecture?ts=markdown) * [Common Types of Botnet-Driven Attacks](https://www.paloaltonetworks.com/cyberpedia/what-is-botnet#types?ts=markdown) * [Advanced Evasion and AI-Assisted Botnets](https://www.paloaltonetworks.com/cyberpedia/what-is-botnet#advanced?ts=markdown) * [The Rise of Agentic AI Attacks](https://www.paloaltonetworks.com/cyberpedia/what-is-botnet#rise?ts=markdown) * [Polymorphic Code and Domain Flux](https://www.paloaltonetworks.com/cyberpedia/what-is-botnet#polymorphic?ts=markdown) * [Identifying Botnet Infections on the Network](https://www.paloaltonetworks.com/cyberpedia/what-is-botnet#identifying?ts=markdown) * [Signs of a Botnet Infection](https://www.paloaltonetworks.com/cyberpedia/what-is-botnet#signs?ts=markdown) * [How to Protect Against Botnets](https://www.paloaltonetworks.com/cyberpedia/what-is-botnet#protect?ts=markdown) * [How To Disable a Botnet](https://www.paloaltonetworks.com/cyberpedia/what-is-botnet#disable?ts=markdown) * [Tools and Techniques for Botnet Defense](https://www.paloaltonetworks.com/cyberpedia/what-is-botnet#tools?ts=markdown) * [Real-World Examples of Botnets](https://www.paloaltonetworks.com/cyberpedia/what-is-botnet#examples?ts=markdown) * [Botnet FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-botnet#faqs?ts=markdown) * [What is Malware? Detecting, Preventing \& Managing Threats](https://www.paloaltonetworks.com/cyberpedia/what-is-malware?ts=markdown) * [What Is Malware? Definition, Types, and Examples](https://www.paloaltonetworks.com/cyberpedia/what-is-malware#what?ts=markdown) * [How Malware Works](https://www.paloaltonetworks.com/cyberpedia/what-is-malware#malware-works?ts=markdown) * [Types of Malware](https://www.paloaltonetworks.com/cyberpedia/what-is-malware#types?ts=markdown) * [How Malware Spreads: Common Attack Vectors](https://www.paloaltonetworks.com/cyberpedia/what-is-malware#cav?ts=markdown) * [Signs of a Malware Infection](https://www.paloaltonetworks.com/cyberpedia/what-is-malware#signs?ts=markdown) * [Comprehensive Malware Protection Strategies](https://www.paloaltonetworks.com/cyberpedia/what-is-malware#comprehensive?ts=markdown) * [Business Impact of Malware](https://www.paloaltonetworks.com/cyberpedia/what-is-malware#impact?ts=markdown) * [Malware FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-malware#faq?ts=markdown) * [What is Multi-Extortion Ransomware?](https://www.paloaltonetworks.com/cyberpedia/what-is-multi-extortion-ransomware?ts=markdown) * [What Is Ransomware?](https://www.paloaltonetworks.com/cyberpedia/what-is-multi-extortion-ransomware#what?ts=markdown) * [The Evolution of Modern Ransomware Attacks](https://www.paloaltonetworks.com/cyberpedia/what-is-multi-extortion-ransomware#evolution?ts=markdown) * [What Are the Phases of Ransomware Extortion?](https://www.paloaltonetworks.com/cyberpedia/what-is-multi-extortion-ransomware#phases?ts=markdown) * [Four New Multi-Extortion Methods](https://www.paloaltonetworks.com/cyberpedia/what-is-multi-extortion-ransomware#new?ts=markdown) * [How to Protect Your Organization from Ransomware Attacks](https://www.paloaltonetworks.com/cyberpedia/what-is-multi-extortion-ransomware#protect?ts=markdown) * [Multi Extortion Ransomware FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-multi-extortion-ransomware#faq?ts=markdown) * [Malware vs. Exploits](https://www.paloaltonetworks.com/cyberpedia/malware-vs-exploits?ts=markdown) * [What Is Malware Protection? Best Practices for Modern Businesses](https://www.paloaltonetworks.com/cyberpedia/what-is-malware-protection?ts=markdown) * [Malware Protection Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-malware-protection#explained?ts=markdown) * [How Malware Protection Works](https://www.paloaltonetworks.com/cyberpedia/what-is-malware-protection#how?ts=markdown) * [Key Components of an Enterprise Malware Protection Strategy](https://www.paloaltonetworks.com/cyberpedia/what-is-malware-protection#key?ts=markdown) * [Common Types of Malware Threats](https://www.paloaltonetworks.com/cyberpedia/what-is-malware-protection#common?ts=markdown) * [Implementing Effective Malware Protection](https://www.paloaltonetworks.com/cyberpedia/what-is-malware-protection#effective?ts=markdown) * [Malware Protection FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-malware-protection#faq?ts=markdown) * [Expanding Targets for New SunOrcal Malware Variant](https://www.paloaltonetworks.com/cyberpedia/expanding-targets-for-new-sunorcal-malware-variant?ts=markdown) * [What Are Fileless Malware Attacks and "Living Off the Land"? Unit 42 Explains](https://www.paloaltonetworks.com/cyberpedia/what-are-fileless-malware-attacks?ts=markdown) # What is a Botnet? 3 min. read Table of Contents * * [Botnets Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-botnet#explained?ts=markdown) * [The Mechanics of Botnet Architecture](https://www.paloaltonetworks.com/cyberpedia/what-is-botnet#architecture?ts=markdown) * [Common Types of Botnet-Driven Attacks](https://www.paloaltonetworks.com/cyberpedia/what-is-botnet#types?ts=markdown) * [Advanced Evasion and AI-Assisted Botnets](https://www.paloaltonetworks.com/cyberpedia/what-is-botnet#advanced?ts=markdown) * [The Rise of Agentic AI Attacks](https://www.paloaltonetworks.com/cyberpedia/what-is-botnet#rise?ts=markdown) * [Polymorphic Code and Domain Flux](https://www.paloaltonetworks.com/cyberpedia/what-is-botnet#polymorphic?ts=markdown) * [Identifying Botnet Infections on the Network](https://www.paloaltonetworks.com/cyberpedia/what-is-botnet#identifying?ts=markdown) * [Signs of a Botnet Infection](https://www.paloaltonetworks.com/cyberpedia/what-is-botnet#signs?ts=markdown) * [How to Protect Against Botnets](https://www.paloaltonetworks.com/cyberpedia/what-is-botnet#protect?ts=markdown) * [How To Disable a Botnet](https://www.paloaltonetworks.com/cyberpedia/what-is-botnet#disable?ts=markdown) * [Tools and Techniques for Botnet Defense](https://www.paloaltonetworks.com/cyberpedia/what-is-botnet#tools?ts=markdown) * [Real-World Examples of Botnets](https://www.paloaltonetworks.com/cyberpedia/what-is-botnet#examples?ts=markdown) * [Botnet FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-botnet#faqs?ts=markdown) 1. Botnets Explained * * [Botnets Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-botnet#explained?ts=markdown) * [The Mechanics of Botnet Architecture](https://www.paloaltonetworks.com/cyberpedia/what-is-botnet#architecture?ts=markdown) * [Common Types of Botnet-Driven Attacks](https://www.paloaltonetworks.com/cyberpedia/what-is-botnet#types?ts=markdown) * [Advanced Evasion and AI-Assisted Botnets](https://www.paloaltonetworks.com/cyberpedia/what-is-botnet#advanced?ts=markdown) * [The Rise of Agentic AI Attacks](https://www.paloaltonetworks.com/cyberpedia/what-is-botnet#rise?ts=markdown) * [Polymorphic Code and Domain Flux](https://www.paloaltonetworks.com/cyberpedia/what-is-botnet#polymorphic?ts=markdown) * [Identifying Botnet Infections on the Network](https://www.paloaltonetworks.com/cyberpedia/what-is-botnet#identifying?ts=markdown) * [Signs of a Botnet Infection](https://www.paloaltonetworks.com/cyberpedia/what-is-botnet#signs?ts=markdown) * [How to Protect Against Botnets](https://www.paloaltonetworks.com/cyberpedia/what-is-botnet#protect?ts=markdown) * [How To Disable a Botnet](https://www.paloaltonetworks.com/cyberpedia/what-is-botnet#disable?ts=markdown) * [Tools and Techniques for Botnet Defense](https://www.paloaltonetworks.com/cyberpedia/what-is-botnet#tools?ts=markdown) * [Real-World Examples of Botnets](https://www.paloaltonetworks.com/cyberpedia/what-is-botnet#examples?ts=markdown) * [Botnet FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-botnet#faqs?ts=markdown) A botnet is a coordinated network of internet-connected devices---including computers, mobile phones, and IoT hardware---infected with specialized [malware](https://www.paloaltonetworks.com/cyberpedia/what-is-malware?ts=markdown) that grants remote control to a single attacking party. These hijacked devices, often called zombies, act in unison under the command of a bot-herder to execute automated, large-scale cyberattacks that would be impossible for a single machine to perform. Key Points * **Distributed Power:** Botnets harness the collective computing resources of thousands of compromised systems to amplify the impact of cyberattacks. \* **Silent Operation:** Infected devices typically continue to function normally, leaving the owner unaware that their hardware is participating in malicious activity. \* **Automated Scalability:** A single bot-herder can manage millions of globally dispersed nodes simultaneously through a centralized or decentralized command structure. \* **Versatile Weaponry:** Threat actors utilize these networks for diverse objectives, ranging from crippling websites with traffic to harvesting sensitive corporate credentials. \* **Persistent Risk:** Modern botnets employ advanced evasion techniques, such as domain-generation algorithms, to maintain control even when parts of their infrastructure are dismantled. ![An infographic that shows how a botnet infects devices and controls them via a command-and-control server.](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/cyberpedia/what-is-botnet/how-botnets-work.jpg "A high-angle, close-up shot of a black mechanical gaming keyboard and an optical mouse on a dark surface. The keyboard keys are illuminated from beneath with a rainbow gradient of RGB lights, while the mouse features a glowing blue light along its edges and scroll wheel. The background is dark and out of focus, emphasizing the colorful glow of the hardware.") \*\*\*Figure 1:\**How Botnets Work* ## Botnets Explained The term botnet combines the words robot and network to describe an architecture in which automated software agents operate across a vast network of compromised [endpoints](https://www.paloaltonetworks.com/cyberpedia/what-is-an-endpoint?ts=markdown). While early iterations focused on simple tasks such as managing chatroom protocols, contemporary botnets serve as the primary infrastructure for global cybercrime. They provide adversaries with the scale to overwhelm enterprise defenses through sheer volume. For cybersecurity professionals, botnets represent a unique challenge because the source of an attack is not a single malicious actor, but rather thousands of legitimate, albeit compromised, user devices. This distribution masks the attacker's identity and complicates mitigation efforts. Understanding the botnet lifecycle is essential for defending against the automated threats that now dominate the digital landscape. The significance of botnets lies in their role as a force multiplier. By leveraging the processing power and bandwidth of others, attackers can launch [distributed denial-of-service (DDoS) attacks](https://www.paloaltonetworks.com/cyberpedia/what-is-a-ddos-attack?ts=markdown), distribute massive volumes of [ransomware](https://www.paloaltonetworks.com/cyberpedia/what-is-ransomware?ts=markdown), or conduct exhaustive brute-force attempts against encrypted targets. This infrastructure is often rented out in a subterranean economy known as botnet-as-a-service, lowering the barrier to entry for sophisticated digital assaults. ## The Mechanics of Botnet Architecture A botnet's effectiveness relies on its communication structure, which dictates how commands reach the infected nodes. The architecture determines the speed of instruction delivery and the network's overall resilience against law enforcement takedowns. **Botnet Architecture** | Architecture Type | Control Mechanism | Key Advantage | Primary Vulnerability | | Centralized (C2) | A single hub or server group issues all commands. | High efficiency and direct control over all nodes. | Single point of failure; if the server is seized, the botnet dies. | | Decentralized (P2P) | Nodes share instructions directly with each other. | Extreme resilience; nearly impossible to dismantle entirely. | Slower command propagation compared to centralized models. | | Hybrid | Combines P2P for survival with C2 for payload delivery. | Balances stealth, survival, and operational speed. | Increased complexity in the malware code. | |---------------------|---------------------------------------------------------|--------------------------------------------------------------|--------------------------------------------------------------------| ## The Three Stages of the Botnet Lifecycle Botnets do not appear instantly; they require a systematic recruitment and activation process. This lifecycle allows attackers to build a massive resource pool before revealing their presence through an active attack. | Stage | Action | Objective | | Stage 1: Recruitment | Infection via phishing, unpatched vulnerabilities, or weak IoT credentials. | Gain initial access to as many endpoints as possible. | | Stage 2: Connection | Malware "beacons" or call home to the C2 server to register. | Establish a persistent communication channel for future orders. | | Stage 3: Execution | The bot-herder issues commands for a specific malicious goal. | Launch attacks, steal data, or rent the network to third parties. | |----------------------|-----------------------------------------------------------------------------|-------------------------------------------------------------------| [Unit 42 research](https://www.paloaltonetworks.com/resources/research/unit-42-incident-response-report) indicates that phishing and vulnerability exploitation remain the primary access vectors for initial compromise. In many cases, these intrusions exploit known vulnerabilities that have gone unpatched in corporate or consumer environments. ## Common Types of Botnet-Driven Attacks Once a network reaches critical mass, it can be deployed for various disruptive purposes. The diversity of these attacks reflects the versatility of controlling thousands of distinct IP addresses. * **Distributed Denial-of-Service (DDoS):** Flooding targets with massive traffic to cause operational downtime. * **Credential Stuffing:** Using thousands of IP addresses to bypass rate-limiting during brute-force login attempts. * **[Cryptojacking](https://www.paloaltonetworks.com/cyberpedia/cryptojacking?ts=markdown):** Hijacking CPU power to mine cryptocurrency, leading to system degradation and high power costs. * **Data Exfiltration:** Quietly scraping host systems for [personally identifiable information (PII)](https://www.paloaltonetworks.com/cyberpedia/pii?ts=markdown) and financial records. Identity-based weaknesses now account for nearly 90% of security investigations. Botnets exacerbate this by providing the scale needed to test millions of leaked credentials across multiple platforms simultaneously. ## Advanced Evasion and AI-Assisted Botnets The next generation of botnets utilizes automation and [machine learning](https://www.paloaltonetworks.com/cyberpedia/machine-learning-ml?ts=markdown) to bypass traditional security perimeters. These advancements represent a shift from static scripts to dynamic, intelligent attack chains. ## The Rise of Agentic AI Attacks Agentic AI allows botnets to exhibit autonomous decision-making capabilities. Instead of following a rigid set of pre-programmed instructions, AI-driven bots can adjust their tactics in real-time based on the defensive responses they encounter within a network. [Unit 42 simulations](https://www.paloaltonetworks.com/blog/2025/05/unit-42-develops-agentic-ai-attack-framework/?ts=markdown) have demonstrated that AI-powered attack chains can compress the time from initial compromise to data exfiltration to under 25 minutes. This speed makes traditional manual response times obsolete and necessitates AI-driven defensive measures. [Explore how Unit 42 tracks global botnet activity](https://www.paloaltonetworks.com/unit42?ts=markdown) to stay ahead of emerging threats. ## Polymorphic Code and Domain Flux To evade detection, modern botnets often use polymorphic code that alters its signature with every new infection. This prevents legacy antivirus software from identifying the malware based on known file patterns. Additionally, botnets use Domain Generation Algorithms (DGAs) to generate and contact thousands of random domains daily, making it impossible for defenders to block the command source by blacklisting a few static IP addresses. ## Identifying Botnet Infections on the Network Early detection is critical to preventing an endpoint from becoming a launchpad for larger attacks. Monitoring for specific network and endpoint anomalies can reveal the presence of hidden bot software. | Indicator Type | Symptom | Possible Botnet Activity | | Network | Spikes in outbound traffic. | Data exfiltration or participation in a DDoS attack. | | Network | Frequent DNS failures or odd domain requests. | Malware attempting to contact its DGA-based C2 server. | | Endpoint | High CPU/Memory usage while idle. | Unauthorized cryptocurrency mining (Cryptojacking). | | Endpoint | Unexpected system restarts or slow internet. | Bot software consuming local resources and bandwidth. | |----------------|-----------------------------------------------|--------------------------------------------------------| ## Signs of a Botnet Infection Recognizing the early warning signs of a botnet infection is critical for maintaining the integrity of your network and protecting corporate data. Because botnets are designed for silent persistence, these indicators often appear as subtle performance issues rather than overt system failures. The following table summarizes the common technical and behavioral symptoms associated with a compromised device. **Signs Your Device May Be in a Botnet** | Indicator | Symptom | Technical Explanation | | Performance Degradation | Slower-than-normal response times or sluggish applications. | The bot malware consumes CPU and RAM cycles to execute background tasks like DDoS flooding. | | System Instability | Frequent crashes, "blue screens," or unexplained application errors. | Malicious code conflicts with legitimate system processes or exhausts kernel resources. | | Network Spikes | Unusual or high data usage, even when the device is idle. | The bot is communicating with a Command and Control (C2) server or exfiltrating harvested data. | | Thermal Anomalies | Device running hot, or the fan is spinning loudly while not in use. | High-intensity tasks like cryptojacking (unauthorized mining) strain the hardware and battery. | | Process Red Flags | Suspicious background activity or unknown tasks in the Task Manager. | Botnets often deploy secondary tools or "droppers" to maintain a persistent foothold on the system. | | Network Blips | Constant router activity or high volumes of outgoing traffic. | Infected nodes frequently "beacon" to the bot-herder to receive new instructions or attack parameters. | | Security Failure | Antivirus software is disabled, malfunctioning, or unable to update. | Sophisticated malware often attempts to blind the system's defenses to prevent its own removal. | |-------------------------|----------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------| ![How to Protect Against Botnets](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/cyberpedia/what-is-botnet/how-to-protect-against-botnets.jpg "How to Protect Against Botnets") ***Figure 2:** How to Protect Against Botnets* ## How to Protect Against Botnets Preventing botnet infections requires a combination of good cybersecurity hygiene, updated technology, and user awareness. Here are essential steps to safeguard your devices and networks: **Keep Software and Devices Updated:** Regularly update operating systems, applications, and firmware to patch known security vulnerabilities that botnets exploit. Enable automatic updates whenever possible for desktop and mobile devices, as well as IoT equipment. **Use Antivirus and Anti-Malware Tools:** Use reputable antivirus and anti-malware tools to detect, quarantine, and remove threats. Modern solutions often include real-time protection, behavioral monitoring, and threat intelligence to identify botnet activity early. **Be Cautious with Emails and Links:** Most botnets begin with a phishing email or a malicious download. Avoid clicking on suspicious links or attachments, especially if the sender is unknown. Watch for emails that urge immediate action or contain strange formatting and grammar. **Secure Your Internet of Things (IoT) Devices:** IoT devices are a favorite target for botnets like Mirai because of their weak default security settings. To protect them: * Change default usernames and passwords immediately after setup. * Disable remote access features you don't need. * Regularly update device firmware. * Place IoT devices on a separate network from critical systems, if possible. **Use a Firewall:** Firewalls act as a barrier between your network and potential threats. Configure your firewall to monitor outbound traffic to help detect unusual activity, such as a device contacting a known C2 server. **Educate Yourself and Others:** Human error remains a major factor in successful botnet infections. Educate employees or family members on the signs of phishing, safe browsing habits, and how to recognize malicious files or websites. **Enable Multi-Factor Authentication (MFA):** Add an extra layer of protection to your accounts. Even if a botnet captures your password, it won't be able to log in without the second authentication factor. **Perform Regular Security Audits:** Conduct periodic security checks on your devices and network. Look for outdated software, weak passwords, or unusual access logs. Proactive audits can help you spot signs of compromise before severe damage occurs. ## How To Disable a Botnet Once a botnet is discovered, the two widely used approaches for disabling it are to take down the control centers and remove the malware that controls the botnet. The best approach will depend on the botnet's architecture, scale, and the resources available to the organization. 1. **Take Down Botnets Control Centers:** If a botnet employs a client-server architecture, it can be disabled by shutting down the central server or servers that control it. Taking down a botnet control center usually requires the support of law enforcement. 2. **Eliminate Botnet Malware on Infected Devices:** The easiest way to remove botnet malware from an individual system is to use anti-virus tools. If this does not work, the system needs to be wiped and reimaged. Malware can be removed from IoT devices by performing a factory reset, reformatting the device, or flashing the firmware. ## Tools and Techniques for Botnet Defense Several tools and techniques are available to defend against botnet threats. Some are specific to botnets, and others are part of an organization's overall security program. The following are several tools and techniques that can be employed. * [Access controls](https://www.paloaltonetworks.com/cyberpedia/access-control?ts=markdown) * Advanced anomaly detection * Anti-virus software * Behavioral analysis and machine learning * Command-and-control (C2) server detection * Device authentication * Honeypots and decoys * Installing updates and security patches * Masking IP addresses * [Network segmentation](https://www.paloaltonetworks.com/cyberpedia/what-is-network-segmentation?ts=markdown) * Rate limiting * Real-time monitoring * Signature-based tools * Strong password policies * Threat intelligence * [User and entity behavior monitoring](https://www.paloaltonetworks.com/cyberpedia/what-is-user-entity-behavior-analytics-ueba?ts=markdown) * Using [proxy servers](https://www.paloaltonetworks.com/cyberpedia/what-is-a-proxy-server?ts=markdown) ## Real-World Examples of Botnets Many botnet attacks are zero-day varieties. The following is a review of several real-world botnet attacks. While most of these have been disabled, a few are still active. ### EarthLink Spammer (Disabled) One of the first botnets to gain public attention was the EarthLink botnet, also known as the EarthLink Spammer. Launched in 2000, the botnet was used by its creator and other cyber criminals to send more than 1.25 million phishing emails over the EarthLink network. This botnet software used Trojan horse malware to infect systems and remotely access users' information. Over a year, the EarthLink botnet affected approximately 12% of EarthLink's email traffic and resulted in an estimated $4.1 million in lost profits for the organization. ### Cutwail (Disabled) Discovered in 2007, the Curtwail botnet was sending more than 51 million emails per minute by 2009, accounting for over 45% of the world's spam. It is estimated that, at its peak, the Curwail botnet comprised 1.5 to 2 million infected computer systems sending 74 billion spam emails a day. Cutwall targeted Windows systems with Trojan horse malware, which used infected computers as spambots. Cutwail was also used to spread well-known malware families and was used as a DDoS botnet for SSL attacks. ### ZeuS (Disabled) The ZeuS botnet, also known as Zbot, was believed to be the most widely used malware, infecting more than 13 million computers in 196 countries. ZeuS used Trojan horse malware for several nefarious purposes, including spreading CryptoLocker ransomware and stealing credentials for users' accounts, such as social media, banking, FTP, and email accounts. Over 90% of all online bank fraud incidents were attributed to the ZeuS botnet. ### Storm (Disabled) Storm, also known as the Storm Worm Botnet, Dorf Botnet, and E-card Malware, was one of the first peer-to-peer botnets. This Trojan horse malware was available for rent on the dark web. Believed to have infected up to 2 million computers, Storm was used for various criminal activities, including identity theft, bank fraud, and distributed denial-of-service (DDoS) attacks. This was one of the most virulent botnets, as it had defensive capabilities that thwarted attempts to track and deactivate it. ### Kraken (Disabled) The Kraken botnet was a massive spyware botnet. It was estimated to have infected 10% of all Fortune 500 companies, but each of the almost 500,000 bots in the network could send about 600,000 emails a day. In addition to its size, the Kraken botnet is believed to have been one of the first to employ evasion techniques to evade detection by anti-malware tools. ### Grum (Disabled) Specializing in targeting the pharmaceutical industry with spam, the Grum botnet could send nearly 40 billion emails daily, accounting for around 20% of the world's spam. At its peak, the Grum botnet included more than 100,000 computers. A notable feature of the Grum botnet was that it used two types of control servers, one for infecting systems and one for sending commands. Additionally, the control servers were located in Panama, Russia, and Ukraine, which provided resiliency and allowed the system to stay operational even when one control server was disabled. ### Mariposa (Disabled) The Mariposa botnet, comprising more than 12 million computers, used worm malware that propagated itself through malicious digital ads, also known as malvertising. This botnet was used to steal sensitive data from over 800,000 users, including credentials for financial services sites and credit card numbers. It was also used to launch online scams and DDoS attacks. ### GameOver Zeus (Disabled) After the client-server ZeuS botnet was disabled, GameOver Zeus (GOZ) emerged with a peer-to-peer architecture, making it harder to disrupt. Before it was disrupted, GameOver Zeus had infected over 250,000 computers and caused an estimated $100 million in monetary losses. ### Dridex (Active as of May 2024) Dridex, also known as Bugat and Cridex, is a Trojan horse malware that mainly spreads through phishing campaigns. It is delivered as a Word or Excel document attachment with a malicious macro that downloads and executes malware. Distributed through a malware-as-a-service model, this infostealer botnet is used to perform various malicious actions, including stealing users' information by capturing screenshots, keylogging, and launching ransomware attacks. ### ZeroAccess (Disabled) Built to target Microsoft Windows operating systems, ZeroAccess is a peer-to-peer botnet that uses Trojan horse malware. The ZeroAccess botnet was particularly difficult to disable because it evaded detection by using a trick to disable anti-virus software running on infected systems. Growing to more than 9 million computers, the ZeroAccess botnet was used for cryptocurrency mining and spamming malware. ### 3ve (Disabled) 3ve was the head of three interconnected sub-botnets used for ad fraud. The botnet was used to create more than 5,000 fake websites, spoofing the domains of high-ranking and prestigious publishers and selling their "premium" traffic to advertisers. 3ve was believed to have generated 3-12 billion ad bid requests daily using the more than 1.7 million computers under its control. By using an anti-forensics evasion tactic, 3ve is estimated to have collected around $30 million before it was disabled. ### Emotet (Active as of August 2024) Emotet, also known as Heodo and Geodo, is considered one of the most dangerous botnets because it is polymorphic, changing its code each time it is called up. It uses Trojan horse malware to spread and distribute other malware and ransomware. Threat actors use Emotet to commit financial fraud, espionage, and political sabotage with malicious spam. ### Mirai (Active as of August 2024) The Mirai botnet is known for targeting and weaponizing IoT devices. It is believed to have infected over 600,000 devices, which it uses to launch DDoS attacks. In 2016, it ran a 1TB/second DDoS. The Mirai source code is publicly available and has been used to create hundreds more botnets. Mirai is considered to be the largest IoT botnet. ## Botnet FAQs ### What Are Common Botnet Actions? The simple answer as to what botnets can do is anything. Botnets are used to automate and scale many malicious cyber activities. The following examples demonstrate the variety of actions that botnets can be directed to execute on behalf of cybercriminals. These functions are made possible because once botnet malware is installed, it enables the botmaster to send commands such as: * [Exfiltrating files and other data](https://www.paloaltonetworks.com/cyberpedia/data-exfiltration?ts=markdown) * Gathering data from the device * Installing and running applications on the device (e.g., spyware) * Monitoring the user's activities * Reading and writing system data * Searching for vulnerabilities in other devices ### Is it difficult to remove a botnet? Like all malware, the difficulty of removing a botnet depends on several variables, including the number of affected devices, the type of architecture used, and the complexity of the malware. Often, anti-virus software can detect and remove botnet malware. ### What is a zombie computer? A device that's been compromised and is under the control of a botnet operator. ### How do botnets spread? Through malware delivered via phishing, malicious downloads, and unpatched software. ### Can mobile phones be part of a botnet? Yes. Android devices, in particular, have been targeted by botnets. ### What is botnet-as-a-service (BaaS)? A black market service where cybercriminals rent access to a botnet. ### How can organizations detect and mitigate botnet activity? Cybercriminals commonly use botnets to launch distributed denial-of-service (DDoS) attacks, send spam emails, conduct click fraud, spread malware, and steal sensitive information such as login credentials. Organizations can detect and mitigate botnet activity by monitoring network traffic for unusual patterns. The use of intrusion detection and prevention systems (IDS/IPS), robust endpoint protection, and regularly updating and patching systems can help to prevent infections. ### What are the signs that a device may be part of a botnet? Signs that a device may be part of a botnet include slow performance, unusual network activity, frequent crashes, unexpected pop-ups or ads, and high CPU or memory usage without an obvious cause. ### What legal measures are in place to combat botnets? Legal measures to combat botnets include laws and regulations that criminalize their creation and use. International cooperation between law enforcement agencies and initiatives to take down command-and-control servers also play a crucial role in disrupting botnet operations. ### How do IoT devices become a botnet? IoT devices are targets for botnets because they are internet-connected devices that offer access to networks and often have poor security controls. Like other devices, threat actors use known vulnerabilities in IoT devices that can be easily exploited to make them part of a botnet. These infected devices serve as a launch pad to gather other vulnerable devices into the botnet. Related Content [Unit 42 Threat Brief: Botnets Explore an in-depth analysis and insights into botnet activities, their evolution, and impact on cybersecurity.](https://unit42.paloaltonetworks.com/) [DDoS Attacks Explained Become knowledgable on Distributed Denial of Service (DDoS) attacks, their methods, and the damage they can cause.](https://www.paloaltonetworks.com/cyberpedia/what-is-a-ddos-attack?ts=markdown) [IoT Under Siege: The Mirai Campaign Learn about the Mirai botnet and its impact on IoT devices, how it exploits vulnerabilities and spreads, and security measures to protect IoT devices from such threats.](https://docs.paloaltonetworks.com/best-practices/security-policy-best-practices/security-policy-best-practices) [Controlling Botnets with the Next-Generation Firewall See how Palo Alto Networks' Next-Generation Firewall can be used to detect and control botnet activities.](https://media.paloaltonetworks.com/documents/Controlling-Botnets.pdf) ![Share page on facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/resources/facebook-circular-icon.svg) ![Share page on linkedin](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/resources/linkedin-circular-icon.svg) [![Share page by an email](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/resources/email-circular-icon.svg)](mailto:?subject=What%20is%20a%20Botnet%3F&body=Uncover%20what%20a%20botnet%20is%2C%20how%20it%20operates%2C%20and%20its%20role%20in%20cyber%20threats.%20Ideal%20for%20cybersecurity%20experts%20keen%20on%20fortifying%20defenses.%20at%20https%3A//www.paloaltonetworks.com/cyberpedia/what-is-botnet) Back to Top [Previous](https://www.paloaltonetworks.com/cyberpedia/what-is-ransomware-as-a-service?ts=markdown) What is Ransomware as a Service (RaaS)? [Next](https://www.paloaltonetworks.com/cyberpedia/what-is-malware?ts=markdown) What is Malware? Detecting, Preventing \& Managing Threats {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security?ts=markdown) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs?ts=markdown) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown) * [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/unit42/respond/managed-detection-response?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) * Observability * [Cortex XCOR](https://www.paloaltonetworks.com/cortex/xcor?ts=markdown) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira?ts=markdown) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management?ts=markdown) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management?ts=markdown) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager?ts=markdown) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance?ts=markdown) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management?ts=markdown) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic?ts=markdown) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management?ts=markdown) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance?ts=markdown) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery?ts=markdown) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access?ts=markdown) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/prepare-for-emerging-risks/continuous-frontier-ai-defense?ts=markdown) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses?ts=markdown) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy?ts=markdown) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence?ts=markdown) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond?ts=markdown) Company * [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown) * [Customers](https://www.paloaltonetworks.com/customers?ts=markdown) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown) * [Communities](https://www.paloaltonetworks.com/communities?ts=markdown) * [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center-subscribe.html) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications?ts=markdown) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown) * [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) * [Documents](https://www.paloaltonetworks.com/legal?ts=markdown) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language