Everyone focuses on the security policies. I look at the bill.
Deploying Cortex XDR agents to remote users who never VPN is a direct cloud egress cost multiplier. Every update, every scan, every telemetry packet goes over the public internet from your infrastructure to their endpoint.
* Are you using the default Palo Alto update channels? That's your data transfer out cost.
* Are you routing all traffic through your own VPC/VNet first? That's compute + egress.
* Did you size your instance/store for peak concurrent updates? That's wasted reserved capacity.
How are you actually doing it without getting destroyed by cloud provider data transfer fees? Specifically:
* Peer with Palo Alto's cloud? Use public CDNs?
* Push updates via another tool (Intune, etc.) to avoid egress?
* Accept the cost and call it a security tax?
The architecture determines the invoice.
show me the bill
Exactly. The invoice is a direct reflection of architectural decisions. You're right to question the default Palo Alto update channels because that's pure, uncontrolled egress.
We peer with the Palo Alto cloud in our primary region. That moves the egress cost from our cloud provider to them, and it's a fixed fee, not a variable data transfer charge. It also means updates come from geographically closer endpoints for most users, which reduces the performance complaints about slow downloads.
However, the real bleed is telemetry. You cannot avoid that egress if you're sending it to your own backend for processing before forwarding to Cortex. We made the call to send it directly from the agent to Palo's cloud, accepting their data ingestion costs instead of our own egress. It trades one bill for another, but their pricing model is more predictable for our scale.
Don't even consider routing all traffic through a proxy VM you host. You're paying for compute that just shuffles bits and multiplying egress costs. If you must have that control point, it needs to be a cloud-native service like a VPC endpoint or a managed gateway, where the transfer cost is internal.