Panorama + Strata Cloud Manager: Your Network Security Management, Evolved

[shv]

Panorama + Strata Cloud Manager: Your Network Security Management, Evolved

The Reality for Panorama Customers

With over 25,000 customers and 70,000+ active deployments, Panorama is one of the most widely deployed network security management platforms in the world. It serves as the central control point for firewall policy, device configuration, logging, and reporting across on-premises and hybrid environments.

As Palo Alto Networks has evolved the Strata portfolio to include Strata Cloud Manager (SCM) — a cloud-delivered platform offering AI-powered insights, proactive posture management, and unified visibility — many Panorama customers face a familiar question:

"Can we get the benefits of SCM while continuing our core activities on Panorama?"

The answer is yes.

Why This Matters Now

Panorama was built for a different era of network security management — one where the primary challenge was configuring firewalls at scale. That problem is solved. Today's challenge is different:

• The misconfiguration surface is growing faster than teams can audit it. Research consistently shows that misconfigurations — not zero-days — are the primary enabler of breaches. Manual best-practice reviews happen quarterly at best; attacks don't.
• Reactive operations are a structural vulnerability. When a firewall runs out of session capacity, when an anomalous policy change goes undetected, when a rule accumulates exceptions over years until it's effectively permissive — these are problems that appear in incident retrospectives, not before incidents.
• The firewall estate has outpaced management tooling. Organizations with hundreds of managed NGFWs cannot manually track policy drift, redundant rules, and configuration exceptions across device groups. The gap between what's configured and what's intended widens silently.

Panorama solves the configuration and logging problem. But it has limited resources and access to solve the intelligence and posture problem at scale. That is exactly what SCM was built to do — and it can do it without asking you to replace anything.

Coexistence by Design

Panorama and Strata Cloud Manager are complementary platforms with distinct, non-overlapping roles that coexist within the same environment.

Panorama takes care of the core functionalities of:

• Device and configuration management
• Log collection via Dedicated Log Collectors (DLCs)
• Traffic-based reporting

Strata Cloud Manager, In addition to above functionalities, extends to the following core pillars:

• AI-powered security posture management — custom best practice checks, regulatory compliance, policy anomaly detection, and configuration cleanup (SCM Pro)
• Proactive operational health — anomaly forecasting, root cause analysis, upgrade recommendations, and capacity planning (SCM Pro)
• Unified traffic visibility across NGFW, SASE, and SD-WAN via Command Center, Activity Insights, Log Viewer, and IOC Search (requires Strata Logging Service)
• Autonomous Digital Experience Management (ADEM) for user-to-application monitoring (SCM Pro)
• AI Canvas — natural language data exploration and custom dashboards (SCM Pro)
• Strata Copilot for product-wide AI-powered operational assistance (all tiers)

The question is not whether to adopt SCM — it is how much of SCM's capability to activate, starting from where you are today.

Four Coexistence Models

Depending on your current Panorama deployment, there are four recognized integration models:

Model	Panorama Role	SCM Role	Best For
1	Config, Logging, Reporting	Hardware/software health, WildFire/DNS dashboards, Copilot (Essentials)	Starting point — zero changes to existing infrastructure
2	Config, Logging, Reporting	Full posture management, policy analysis, AI Canvas, ADEM (Pro)	SCM Pro value without changes to logging
3	Config, Reporting	Logging via SLS + Command Center, Log Viewer, Activity Insights (Essentials+SLS)	Cloud-based logging for full traffic visibility
4	Config, Reporting	Logging via SLS + full SCM Pro capability	Recommended destination — maximum combined value

Model 4 — Panorama managing configuration, SLS handling logging, SCM Pro delivering AI-powered intelligence — is the ideal end state for most organizations.

What SCM Delivers — By Tier

SCM Essentials (included with NGFW / Prisma Access) Out-of-the-box health monitoring: hardware and software incidents, deployment-wide status trends, WildFire and DNS security dashboards, IoT and CASB-X dashboards, cloud-based configuration management for NGFW/SASE/SD-WAN, and Strata Copilot. No log forwarding required.

SCM Essentials + Strata Logging Service Adds full traffic visibility: Command Center, Activity Insights, Log Viewer, IOC Search, Executive Summary, SASE Health, SD-WAN dashboards, Reports, and log forwarding. SLS provides 1-year log retention. Also unlocks rule hit count in the configuration view.

This is a significant capability step — and a natural point to pause and assess. But organizations that stop at Essentials+SLS are missing the layer that addresses the hardest problem: knowing what's wrong before it becomes an incident. Traffic visibility shows you what happened. SCM Pro tells you what's about to go wrong.

SCM Pro (paid — includes SLS) The complete intelligence layer on top of Essentials+SLS:

• Security Posture — custom best practice checks, regulatory compliance dashboards, Policy Analyzer (ML) to identify the rules most likely to be exploited, Policy Optimizer (ML) to remediate unused and overly permissive policies, configuration cleanup
• Predictive Operations — anomaly forecasting that flags degrading firewalls 30–90 days before failure, root cause analysis that reduces MTTR from hours to minutes, upgrade recommendations, Capacity Analyzer to prevent session-table exhaustion before it becomes a production incident
• ADEM — autonomous digital experience management for user-to-application monitoring and rapid troubleshooting
• AI Canvas — natural language data exploration, custom dashboards, multi-source correlation across NGFW, Prisma Access, ADEM, and SLS logs

For the full up-to-date feature matrix, see: SCM Licenses and Support — docs.paloaltonetworks.com

What Staying at Essentials+SLS Costs You

Essentials+SLS delivers real value. But it is a visibility tool, not a posture management system. The difference matters:

Without SCM Pro	With SCM Pro
You see traffic logs. You identify misconfigurations when something breaks or a compliance audit flags them.	Policy Analyzer surfaces shadow rules and over-permissive policies continuously — before they become an incident or finding.
Capacity issues surface as firewall performance degradation under load.	Capacity Analyzer forecasts session-table exhaustion and memory pressure 30–90 days out.
Software upgrade decisions are manual and reactive.	Upgrade Recommendations proactively identify NGFWs running versions with known vulnerabilities or reliability issues.
User-reported connectivity issues require manual correlation across multiple data sources.	ADEM pinpoints the exact segment where degradation occurs, reducing troubleshooting time from hours to minutes.
Policy cleanup happens on an annual audit cycle — if at all.	Configuration Cleanup identifies unused rules and objects continuously, reducing the attack surface that accumulates over years of policy changes.

The cost of a single misconfiguration-enabled breach or an unplanned firewall failure almost always exceeds the annual cost of SCM Pro by orders of magnitude. The question is not whether SCM Pro pays for itself — it is whether your team is willing to find out the hard way.

In Practice: Three Common Scenarios

Large enterprise, 300+ NGFWs, heavy Panorama investment An organization with a decade of Panorama policy hierarchy, complex device groups, and strict change control cannot afford a wholesale migration. They activate SCM Essentials (Model 1, zero change to existing infrastructure), enable telemetry, and immediately surface posture findings across the estate — including 40+ shadow rules that predated the current security team. SCM Pro activation follows, adding compliance dashboards required for their annual PCI audit and eliminating a manual review process that consumes two weeks of engineer time each year.

Mid-market financial institution, log sovereignty concerns A regulated institution cannot move logs to the cloud without compliance sign-off. They adopt Model 2: Panorama continues to handle all logging via DLCs, SCM Pro activates alongside it and delivers posture management, policy analysis, and ADEM entirely from telemetry. Log-based SCM features remain inactive until their compliance team approves SLS — but the posture and predictive operations value begins immediately.

MSSP managing multi-tenant Panorama estate A managed service provider with 50 customer tenants across a shared Panorama deployment activates SCM Pro to operationalize best-practice assessments across all tenants — replacing a labor-intensive manual review process with continuous, automated posture monitoring. Per-tenant compliance reporting (PCI, HIPAA, CIS) is generated on demand rather than assembled quarterly. The ADEM capability reduces time spent on user-reported connectivity issues by surfacing root causes without requiring full log analysis.

Getting Started

The path to SCM Pro requires no forklift migration. Organizations can begin with zero disruption to existing operations:

1. Activate SCM Essentials (no cost) and onboard your Panorama-managed devices
2. Enable telemetry on your firewalls and Panorama — Device Health, Product Usage, and Threat Prevention
3. Evaluate SCM's posture insights alongside your existing Panorama workflow
4. Activate SCM Pro to unlock the full intelligence and posture capability set and leverage Strata Logging Service (SLS) when ready to expand log retention and unlock full traffic visibility within SCM

Each step adds value independently. None require removing or reconfiguring Panorama.

Key Considerations

Telemetry is foundational. SCM's AI-powered features depend on telemetry from your firewalls. All three telemetry categories should be enabled for optimal results before activating SCM.

SLS unlocks log-based features in SCM. Customers who want traffic visibility inside SCM (Log Viewer, IoC Search, Command Center traffic data) require SLS as the log destination — included with SCM Pro, or purchased separately for SCM Essentials.

Panorama co-management is supported. If your environment uses Panorama to manage both Prisma Access and NGFW, note that separate Tenant Service Groups (TSGs) are currently required for each.

SCM Pro qualification. New SCM Pro SKUs are available to qualifying customers. Your account team can confirm eligibility and recommend the right licensing path for your environment.

The Competitive Context

Competitors offer single-pane-of-glass management platforms that bundle configuration and analytics. The Panorama + SCM architecture is different by design: Panorama provides proven, granular configuration authority that security teams have relied on for years, while SCM adds a cloud-delivered intelligence layer that no on-premises platform can replicate at scale. Organizations evaluating alternatives should ask whether a rip-and-replace of their configuration management infrastructure — with the migration risk, retraining cost, and operational disruption it entails — delivers more value than an intelligence layer built directly on top of what's already deployed.

The Bottom Line

Panorama customers do not need to choose between protecting their existing investment and gaining the AI-powered capabilities of Strata Cloud Manager. The two platforms are designed to work together, with a clear, low-risk path from where you are today to the full value of SCM Pro.

Your next step is activation.

For deployment guidance, contact your Palo Alto Networks account team.