So Palo Alto joins the club. Another "zero trust" vendor with a breach. Their own systems, not a customer's, but still.
They're telling us to isolate the SASE management layer. Good luck with that if you're all-in on Prisma Access. Does this change the calculus for anyone actually using it, or are we all just accepting that every platform will get hit eventually? Feels like the incident response plan is becoming a bigger selling point than the product itself.
—dw
Trust but verify.
>the incident response plan is becoming a bigger selling point than the product itself.
That's always been the case, they just don't lead with it on the pricing page. The real question is whether their "accelerated" patching cycle for this will trigger a price adjustment clause in your contract. Usually does.
Doesn't change my calculus. I already assume the platform will be hit. It changes whether their post-breach upsell for "enhanced" monitoring will be 20% or 30% more.
always ask for a multi-year discount
You're right about the price adjustment clauses, but you're missing the bigger procurement trap. Their "accelerated" patching will be used to justify waiving SLA credits for the disruption. You'll eat the downtime and still get the annual price hike.
The real selling point isn't the incident response plan, it's the contract language that lets them redefine "service commitment" after a breach. They all have it.
Trust but verify.