Advanced Threat Prevention Powered by Precision AI®

Focus

Advanced Threat Prevention Powered by Precision AI defends your network against both commodity threats—which are pervasive but not sophisticated—and targeted, advanced threats perpetuated by organized cyber adversaries. Advanced Threat Prevention includes comprehensive exploit, malware, and command-and-control protection, and Palo Alto Networks frequently publishes updates that equip the firewall with the very latest threat intelligence. You can use the Threat Vault to research the latest threats that Palo Alto Networks next-generation firewalls can detect and prevent.

What's New

October 2026	You can now protect your network against zero-day exploits and predisclosure vulnerabilities using Frontier Virtual Patching, a cloud-based detection module available with an Advanced Threat Prevention Plus license. Frontier Virtual Patching uses vaulted signatures to deliver preemptive protections before vendors release patches, closing the critical exposure window between vulnerability discovery and patch deployment. You enable Frontier Virtual Patching in your Vulnerability Protection profile, where you can set actions by severity and create exceptions using individual Threat IDs.
August 2026	The Advanced Threat Prevention Operator Dashboard in Strata Cloud Manager provides a subscription-specific central view of security metrics with actionable insights, surfacing critical efficacy metrics such as top malicious verdicts and blocked exploits. The dashboard covers exploitation and efficacy validation, C2 attribution and geo-location, known versus unknown threat differentiation, and source attribution for policy refinement.
July 2026	Palo Alto Networks introduces PAN-OS Shield, a built-in feature that uses Advanced Threat Prevention to deliver vulnerability protection signatures that protect the firewall against critical exploits without requiring PAN-OS upgrades or restarts. These signatures are delivered automatically via content updates, independent of PAN-OS release cycles, and do not require an active Advanced Threat Prevention license for PAN-OS specific vulnerability protections.
July 2026	Advanced Threat Prevention extends Local Deep Learning to detect command injection exploits directly on the NGFW, delivering verdicts up to 100 times faster than cloud-only analysis. The feature runs the same proven cloud model optimized for on-device execution, and is enabled by default when you enable Inline Cloud Analysis on a new Vulnerability Protection profile.
July 2026	Palo Alto Networks introduces a redesigned transport architecture for cloud-delivered security services that eliminates performance bottlenecks in the inline cloud analysis data forwarding channel. The new Advanced Forwarding architecture enables all data plane cores to natively handle payload forwarding through a scalable connection pool, reducing latency with a direct binary protocol and improving reliability through dynamic service address discovery and automatic failover.
July 2026	The Activity Insights: Threats dashboard in Strata Cloud Manager now visualizes the precise impact of your Advanced Security subscriptions with platform effects metrics, demonstrating how shared intelligence and cross-service correlations automatically block patient-zero attacks in your environment. The dashboard also introduces a Threat \| CVE toggle for visibility into CVE exploits detected by Advanced Threat Prevention, and Threat Search now supports both Threat ID and CVE search.
June 2026	Palo Alto Networks Advanced Threat Prevention Inline Cloud Analysis now supports detection of unknown C2 threats developed using the open source Sliver C2 framework and transmitted over the TLSv1.3 protocol. By leveraging a specialized pre-filtering used to identify suspicious TLS handshake characteristics associated with Sliver C2, suspected Sliver traffic is forwarded to the Advanced Threat Prevention cloud for in-depth analysis using a sequence-based neural network detection model. This deep learning model examines patterns across multiple TLS records within a session, enabling high-confidence detection of characteristic Sliver C2 communication patterns even when content is encrypted.
November 20 2025	Advanced Threat Prevention and various CDSS subscriptions operating on NGFWs and Prisma Access now support access to FedRAMP Moderate and High environments. To access the secure cloud environments, you must meet the program requirements and configure your cloud content server with the appropriate FQDN. Contact Palo Alto Networks customer representative for more information..
August 1 2025	Palo Alto Networks threat intelligence and research platform, Threat Vault, now provides support for CVE coverage searches for existing as well as upcoming Vulnerability Protection signatures. Previously, this was exclusively available as a Threat Vault API request.
July 30 2025	Palo Alto Networks Advanced Threat Prevention Inline Cloud Analysis now supports detection of unknown C2 threats developed using the open source Sliver C2 framework and transmitted over the TLSv1.3 protocol. By leveraging a specialized pre-filtering used to identify suspicious TLS handshake characteristics associated with Sliver C2, suspected Sliver traffic is forwarded to the Advanced Threat Prevention cloud for in-depth analysis using a sequence-based neural network detection model. This deep learning model examines patterns across multiple TLS records within a session, enabling high-confidence detection of characteristic Sliver C2 communication patterns even when content is encrypted.
April 30 2025	Palo Alto Networks now provides access to a new service region for the Advanced Threat Prevention service, located in Tel Aviv, Israel (FQDN: il.hawkeye.services-edge.paloaltonetworks.com). Typically, the default global service domain automatically connects you to the nearest service provider. However, if you want to override the automatically selected server due to your organization's data residency and performance requirements., you can manually specify the cloud content FQDN.
February 25 2025	Palo Alto Networks now offers access to Exfiltration Shield, which provides protection against DNS relaying attacks, also known as Data Exfiltration via HTTP request headers, by applying machine learning through the Inline Cloud Analysis mechanism of Advanced Threat Prevention. DNS relaying attacks exploit legitimate web services by placing DNS tunneling domains in SNI or HTTP headers like Host and X-Forwarded-For. When vulnerable web services receive these requests, they extract the tunneling domains and send them to attacker-operated DNS resolvers, effectively relaying tunneling traffic to attackers' command and control servers.
	Advanced Threat Prevention Reports now provide added vulnerability context by associating detected exploits and mapping them to a CVE if one is available.
	Advanced Threat Prevention now supports LDL (Local Deep Learning) for supported firewalls operating PAN-OS 11.2 and later. Local Deep Learning complements the cloud-based Inline Cloud Analysis component of Advanced Threat Prevention by providing a mechanism to perform fast, local deep learning-based analysis of zero-day and other evasive threats.
	Inline Cloud Analysis now supports detection of command injection and SQL injection vulnerabilities in real-time to protect users against zero-day threats.
	Palo Alto Networks now offers Advanced Threat Prevention, a new security service that applies predictive analytics to disrupt attacks that use DNS for command-and-control (C2) or data theft.
	Firewalls equipped with Threat Prevention can now detect domain fronting, a TLS evasion technique that can circumvent URL filtering database solutions and facilitate data exfiltration.
	Is your organization mission-critical, security-first, or a mix of both? Our best practices will guide you on how to best deploy threat updates, depending on your risk tolerance and application availability needs.

Advanced Threat Prevention

What's New

Get Started

Important Resources

Translated Documents

Activation & Onboarding

Next-Generation Firewalls

SASE

Cloud-Delivered Security Services

Network Security

Endpoints

Visibility & Monitoring

Best Practices