As enterprises accelerate AI adoption, scale multicloud environments, and prepare for the quantum era, the complexity of securing dynamic infrastructures continues to grow. Threat actors are evolving at unprecedented speed, exploiting weaknesses in fragmented security architectures and inconsistent controls.
With PAN-OS® 12.1 Orion, Palo Alto Networks introduces a release engineered to deliver more innovative, more predictable, and more resilient network security. It’s built to address the challenges facing modern organizations by providing a robust foundation that enables IT leaders to confidently embrace the future of multicloud, AI, quantum, and beyond. The major features of the core components in PAN-OS cover new NGFW hardware, networking, SD-WAN, decryption and cryptography, clustering, User-ID, and more.
Breakthrough Innovations and Features in PAN-OS 12.1 Orion
Quantum-Safe Readiness Built into the OS
Quantum computers will eventually break classical encryption algorithms such as RSA and ECC, making the transition to post-quantum cryptography (PQC) a critical, multi-year initiative. PAN-OS® 11.1 and 11.2 began this journey with support for PQC in site-to-site VPNs (RFC 8784, RFC 9242, RFC 9370). Since NIST’s standardization of PQC algorithms in August 2024, adoption has accelerated across browsers, messaging apps, and libraries, including LibOQS, OpenSSL, wolfSSL, and BoringSSL. As PQC traffic grows, malicious actors are equally able to exploit these libraries, increasing the need for enterprise-grade inspection and control.
Figure 1: Click the demo to learn more.
PAN-OS 12.1 Orion advances this capability by embedding quantum-safe functions directly into the operating system:
These innovations establish a clear roadmap from assessment to adoption, allowing organizations to inventory their cryptographic environment, remediate risks, enable PQC inspection, and progressively transition toward quantum-safe operations.
The proliferation of applications across public and private clouds has created a fragmented security landscape, marked by inconsistent controls, misconfigurations, operational silos, and growing blind spots.
PAN-OS 12.1 Orion addresses these challenges with new software firewall capabilities that provides a unified multicloud security framework that simplifies protection for dynamic environments,accelerating both cloud and AI transformation. Our software firewall automatically discovers workloads and data flows across AWS, Azure, GCP, and private data centers, eliminating blind spots and reducing the need for manual inventories.
Figure 2: Automate Deployment of a Multicloud Security Fabric
Our new Multicloud Security Fabric (MSF) provides the foundation, establishing a unified network security overlay that automatically connects and protects workloads across disparate cloud environments with consistent policy. For private cloud workloads experiencing unpredictable traffic demands, the Hyperscale Fabric (HSF) ensures security can scale elastically without creating performance bottlenecks.
For microperimeter use cases, we’ve also delivered Traffic Redirector, which programmatically steers traffic from discovered workloads to the appropriate security services for inspection. This eliminates the manual, error-prone routing changes that typically slow down application deployment.
This integrated approach simplifies the entire security lifecycle around four key pillars:
Pan-OS 12.1 Orion delivers new software firewall capabilities that enable this 4-pillar approach to multicloud and AI security.
Figure 3: Four-pillar approach to multicloud and AI security.
Expanded Defense Capabilities Powered by Precision AI
Adversaries are increasingly using AI to accelerate reconnaissance, exploit development, and automate attacks. To counter this, PAN-OS 12.1 Orion integrates Precision AI, Palo Alto Networks’ proprietary engine that combines machine learning, deep learning, and generative AI to detect and prevent attacks in real time. Orion extends the reach of Precision AI across the enterprise with new capabilities that strengthen defenses against advanced threats.
The Advanced DNS Security Resolver introduces a resolver-based deployment option that inspects both DNS requests and responses, detecting more threats than competitors while integrating with Strata Cloud Manager for centralized visibility and control. Additionally, Device Security expands protection beyond IoT to cover every managed, unmanaged, and operational technology device, combining active and passive data collection with IT and OT integrations.
Applying risk-adaptive policies and guided virtual patching reduces alert fatigue and enables proactive mitigation. In addition, Orion introduces new AI-driven threat detections, including single-query DNS tunneling detection, in-memory API vector analysis, and encrypted Sliver C2 prevention. Together, these innovations reduce noise, improve detection precision, and deliver end-to-end protection across the entire attack lifecycle.
Precision AI capabilities deliver unmatched defense:
Managing distributed firewalls, SASE, and SD-WAN deployments has traditionally required multiple tools, creating silos and adding complexity for security operations teams. PAN-OS 12.1 Orion eliminates this fragmentation by consolidating management into a single AI-powered platform with Strata Cloud Manager (SCM).
SCM delivers end-to-end operational simplification through:
With SCM, enterprises gain a unified, intelligent control plane that strengthens Zero Trust architectures, ensures regulatory compliance, and reduces operational complexity across multicloud and hybrid environments.
PAN-OS 12.1 Orion introduces fourteen new fifth-generation Next-Generation Firewalls (NGFWs) engineered for quantum readiness, high-performance security, and resilience across enterprise, branch, and industrial environments.
PA-5500 Series (Data Center): Purpose-built for large-scale data centers, delivering up to 4x the performance of previous generations. Equipped with 400 Gbps interfaces and quantum-optimized hardware acceleration, it enables high-throughput inspection of post-quantum cryptography (PQC) traffic and secure connectivity for AI-driven workloads.
PA-500 Series (Branch): Designed for integrated branch deployments, combining best-in-class Layer 7 inspection with a compact, power-efficient form factor. Simplified Zero Touch Provisioning (ZTP) streamlines deployment and lifecycle management for distributed enterprises.
PA-455R-5G (Industrial/Edge): Hardened for rugged and outdoor environments, this model extends enterprise-grade protection to operational technology (OT) and edge networks. It features native 5G connectivity and a ruggedized chassis to deliver resilient performance in harsh conditions.
Figure 7: 5th-Generation NGFWs
These new NGFW platforms expand your ability to secure diverse environments, supporting everything from high-capacity data centers to remote branches and industrial sites, while ensuring organizations remain prepared for quantum-era threats.
In addition to quantum-safe innovation and next-generation firewall performance, PAN-OS 12.1 Orion introduces powerful capabilities to extend security, flexibility, and modernization across your network:
Decryption Enhancements – Streamline and scale encrypted traffic inspection with improved performance and coverage, ensuring visibility without compromising speed.
Passwordless for Enterprise Apps – Strengthen identity security with phishing-resistant, passwordless authentication that simplifies access for users across your critical enterprise applications.
PAN-OS Modernization – Modern, cloud-ready OS architecture designed for agility, scalability, and seamless integration across hybrid and multicloud environments.
PAN-OS NGFW integration with Prisma SD-WAN – Deliver simplified branch connectivity with integrated security and application-aware routing in a single converged platform.
FE-400 – A new firewall engine with a purpose-built ASIC for advanced threat prevention and high-performance data center deployments.
Advanced Routing Engine – Next-generation routing for large-scale, complex environments, optimized for throughput, reliability, and simplified management.
Web Proxy on the PA-5450 – Built-in web proxy functionality on our flagship PA-5450, reducing the need for point products and consolidating security operations.
PAN-OS 12.1 Orion is not just a new operating system; it's a paradigm shift in network security. It's our answer to the growing complexity you face every day, providing a unified, AI-driven, and future-ready platform that simplifies your operations and strengthens your defenses. We're also introducing 14 new 5th-generation Next-Generation Firewalls, which are designed to redefine performance and protection for data centers and distributed branches.
With features like the Multicloud Security Fabric and an easy path to quantum-safe security, PAN-OS 12.1 Orion allows you to move from a state of complexity to one of confidence, ready to secure what's next.
Start your journey with PAN-OS 12.1 and see firsthand how our technology helps secure your future.
Sign up now to get an in-depth look at PAN-OS 12.1.
