About Advanced Threat Prevention Plus
Learn about the Advanced Threat Prevention Plus subscription and how it extends
Advanced Threat Prevention with preemptive protections.
| Where Can I Use
This? | What Do I Need? |
|---|
Advanced Threat Prevention Plus is a subscription tier that extends Advanced Threat Prevention with preemptive network protections for vulnerabilities that
have not been publicly disclosed or patched by software vendors. Where standard Advanced Threat Prevention detects and prevents exploits for known vulnerabilities and
unknown threats using inline ML and deep learning, Advanced Threat Prevention Plus adds
the ability to protect against vulnerabilities before they are publicly known — closing
the critical exposure window between vulnerability discovery and patch
availability.
What Is Included
Advanced Threat Prevention Plus is a superset of Advanced Threat Prevention. It
includes all existing capabilities plus the new Frontier Virtual Patching
module:
Capabilities included from Advanced Threat Prevention:
- Standard vulnerability protection content (delivered through scheduled content
updates).
- Command-and-control (C2) protection content (delivered through scheduled content
updates).
- Precision AI® inline protection from unknown C2 traffic — patented deep learning
models that prevent evasive C2 from tools such as Cobalt Strike, Sliver, and
Empire.
- Precision AI inline protection from never-before-seen exploits — cloud-based ML
models that prevent unknown command injection, SQL injection, and cross-site
scripting (XSS) attacks.
- Custom signature compatibility (Snort and Suricata rules).
New capabilities with Advanced Threat Prevention Plus:
- Proactive vulnerability discovery—Uses multimodel frontier AI to
uncover previously unknown and unpatched vulnerabilities. Sources include NOVA
(an agentic AI system that scans critical open-source software repositories),
the Critical Defense Program (a private consortium of enterprise, OT, IoT,
medical, and industrial partners including IBM Lightwell and Chainguard), and
vulnerability clearinghouses.
- Preemptive protection—Reduces the window of exposure to unpatched or
unpatchable vulnerabilities by delivering protections within hours of
vulnerability discovery, rather than waiting for scheduled content updates or
vendor patches.
- Vaulted protection—Delivers proactive defense without disclosing
sensitive vulnerability details. Signature details and traffic inspection logic
are held in the cloud, preventing adversaries from reverse-engineering the
underlying vulnerability.
Licensing and Activation
Firewalls with a standard Threat Prevention or Advanced Threat Prevention license
(without Advanced Threat Prevention Plus) do not see the Frontier Virtual Patching
tab in the Vulnerability Protection profile.
Management
You can manage Advanced Threat Prevention Plus through Strata Cloud Manager,
the PAN-OS web interface, and Panorama.
Strata Cloud Manager displays Advanced Threat Prevention Plus detection data in Activity Insights,
where you can drill down through predisclosure exploit categories and view
individual signature details in Threat Search.
