Palo Alto Networks has released PAN-OS 12.2 Ceres, marking the next major evolution in enterprise cyber prevention engineered to drastically reduce attack surfaces, disrupt threats, and stop advanced attacks. As cyber adversaries rapidly adopt AI automation, modern organizations face an overwhelming volume of direct-to-IP attacks, polymorphic malware, and complex infrastructure sprawl.
Announced at Black Hat 2026, PAN-OS 12.2 Ceres addresses these challenges head-on by combining frontier AI intelligence with deeply integrated platform protections. With over 55+ innovations and 15 new quantum-optimized Gen 5 PA-Series Next-Generation Firewall (NGFW) platforms, this release advances security posture through autonomous operations, next-generation hardware performance, and industry-first defenses.
Cutting Edge AI Threat Defenses and Deep Visibility
At the heart of Ceres are game-changing threat prevention capabilities powered by Precision AI™. Leading the charge is Frontier Virtual Patching, which leverages frontier AI models to discover emerging vulnerabilities and deploy vaulted virtual patches before exploits can be weaponized. To combat evasive command-and-control (C2) channels, Advanced IP Defense provides real-time, zero-trust validation using global threat telemetry and fine-grained IP attributes to block attacker-controlled infrastructure.
Key Threat Prevention & Visibility Features:
- Advanced Threat Prevention+: Introduces AI-driven Frontier Virtual Patching for emerging vulnerabilities in open-source software (OSS).
- Advanced IP Defense: Delivers Precision AI directly to the network layer for zero-trust IP validation.
- Advanced URL Filtering: Adds HTTP Header Logging and Denial-of-Service (DoS) protection for AURL services.
- Advanced WildFire: Expands deployment flexibility with the On-Premise WildFire appliance (WF500B).
- Data Loss Prevention (DLP):
- Adds protocol inspection for WebSockets - enabling inspection of applications such as Microsoft Copilot
- Support for 100+ concurrent uploads of 500MB files - deeper inspection of large files at scale
- Layer 7 & Content Inspection:
- Native Prisma Browser support for NGFW - secure all activity, end-to-end
- Enhanced Content Cloud Analysis Transport Support - optimize traffic patterns inspected in the cloud
- CTD memory/buffer optimization - increase signature capacity of on-premise threat detection
- Local Deep Learning models - extend Precision AI™ deep in the platform
- User-ID & Cloud Identity:
- Multi-domain Credential Phishing prevention - detect and prevent phishing attacks across multi-domain Active Directory (AD) environments
- Cloud Identity Services for User-ID/IP-TAG/HIP/User-TAG/Quarantine lists - scale user context to over 10M objects across all form-factors
- TLS 1.3 support for authentication portals - Support all TLS versions across the authentication portal
Autonomous Operations and Modernized Architecture
Operational complexity is drastically reduced through Network Security Agents in Strata Cloud Manager. Functioning as autonomous teammates, these AI agents analyze security workflows, support natural language interactions, and execute operational tasks under granular control frameworks. Architecturally, Ceres consolidates security, switching, routing, and 5G into a single branch-in-a-box solution while bringing scalable AI runtime security and load balancing to cloud-native environments.
Key Operations, Cloud, & Networking Features:
- Strata Cloud Manager & Management:
- Autonomous Network Security Agents - Scale security expertise beyond human limits
- REST API commit support
- Simplified Zero Touch Provisioning (ZTP) - Onboard new NGFWs in minutes
- AAA accounting on log collectors - Improve log collector audits
- Networking & Branch-in-a-Box:
- Integrated L2 switching - extend the NGFW to provide a full branch in a box, with managed L2 capabilities
- DNSv6 Proxy - Support for IPv6 across the DNS proxy
- IPv6 Multicast Routing - Expand multicast routing to support IPv6
- VR/ARP/MAC/IPv6 scale increases - Increase platform scale
- Elephant flow support - Higher throughput tunnels to Prisma Access
- Auto-clearing for DISCARDed sessions - Reset DISCARDed sessions after expiry
- SD-WAN:
- Bandwidth path selection - Determine best path based on available bandwidth per application
- Auto-generated static IPsec tunnels to Panorama - to improve reachability of each SD-WAN node
- Enhanced debuggability - Improved troubleshooting
- SD-WAN VIF member expansion up to 16 - Extending the number of site connections
- Software Firewalls:
- Prisma AIRS support across VM-Series via a unified image
- Panorama HA across hypervisors
- Cloud SDK and VM OSS upgrades
- DPDK 24.11 upgrade
- SR-IOV support for OCI VM-Series.
- Mobile Edge Security: Multiple APNs/DNNs support, DHCP relay over cellular, cellular monitoring via MIBs, and Subscriber-ID/Equipment-ID enhancements.
Quantum Resilience, Industrial Security, and Product Integrity
Recognizing the looming threat of quantum computing, PAN-OS 12.2 Ceres prepares organizations for the cryptographic transition by integrating Post-Quantum Cryptography (PQC) to prevent "Harvest Now, Decrypt Later" attacks. Industrial environments are fortified through OT Security 4.0, which delivers granular microsegmentation, attack path analysis, and secure remote access.
These features complement the cryptographic visibility provided by the Quantum-Safe Security app, which uses the NGFWs (PAN-OS 10.2 or higher) as sensors to provide cipher visibility across your applications, end-user and IoT devices, and infrastructure.
Key Quantum, OT, & System Integrity Features
- Quantum & Decryption:
- Post-Quantum Cryptography (PQC) and IKEv2 support for GlobalProtect
- Quantum Safe Security capabilities, native QUIC and HTTP/3 decryption/inspection
- Enhanced decryption visibility - improve decryption troubleshooting
- IoT & OT Security:
- Device-ID VSYS support - support Device-ID across VSYSs
- OT Infrastructure VLAN microsegmentation - Segment E/W OT traffic with full inspection
- IoT Security metadata collection - Detect new IoT devices with collectors
- Certificate Lifecycle: Implementation of Next Generation Trust Security (NGTS) to manage certificate usage across PAN-OS
- Product Security:
- Enhancements to IMA and SELinux (permissive mode)
- Self-service Enhanced Factory Reset (EFR)
- PAN-OS Shield Vulnerability Protection for GlobalProtect
- Enforcement of non-default master key
- Comprehensive system integrity checks
Hardware Platform Innovations (15 New SKUs)
- PA-5500 Series (3 New SKUs): designed for high-density data center and campus deployments.
- PA-3500 Series (4 New SKUs): built for scalable enterprise perimeter protection.
- PA-1500 Series (3 New SKUs): delivering high-performance security for large branch offices.
- PA-50R Series (4 New SKUs): tailored for demanding industrial and OT environments.
- PA-520-5G: Integrated 5G appliance enabling secure high-speed mobile edge connectivity.
Secure Your Future in the Frontier AI Era
As cyber threats evolve at unprecedented velocity, PAN-OS 12.2 Ceres provides the definitive blueprint for defending modern enterprise environments against tomorrow's risks. By uniting autonomous Precision AI™ threat prevention, quantum resilience, and streamlined management across cloud, branch, and OT infrastructures, Ceres empowers your team to stop attacks at machine speed without sacrificing operational efficiency. The future of network security has arrived.
Upgrade your existing NGFW deployments to PAN-OS 12.2 Ceres today, explore the new Gen 5 hardware platforms, or reach out to your Palo Alto Networks representative to schedule a personalized demonstration.
For more information, please visit Anand Oswal’s blog and our PAN-OS 12.2 Release Notes. Register here to join our virtual event and learn more about the innovations in PAN-OS 12.2 Ceres.
