>
    Strata Copilot
    AI Access Security Licenses
    Focus
    Download PDF
    Focus
    1. Home
    2. AI Access Security
    3. AI Access Security Licenses
    Download PDF
    AI Access Security

    AI Access Security Licenses

    Table of Contents

    AI Access Security Licenses

    Review the AI Access Security licenses to understand which license is right for you.
    Where Can I Use This?What Do I Need?
    • NGFW (Managed by Panorama or Strata Cloud Manager)
    • Prisma Access (Managed by Panorama or Strata Cloud Manager)
    • Prisma Browser
    • Strata Logging Service license
    One of the following:
    • AI Access Security license
    • CASB-PA license
    • CASB-X license
    • Prisma Browser standalone license
    Review the available AI Access Security licenses to begin safely adopting and controlling access to generative AI (GenAI) applications on your network.
    • AI Access Security License
      The AI Access Security license is a standalone license. It includes the following three types of license:
      • AI Access Security EVAL—Evaluation license for AI Access Security. If you have the EVAL license active, you must convert the evaluation license to a production license after the evaluation period has ended to continue safely controlling access to and safely adopting GenAI apps.
      • AI Access Security LAB—AI Access Security license specific for your lab environments. This license isn't intended for a production environment.
      • AI Access Security—Production license for AI Access Security.
    • CASB-PA and CASB-X
      AI Access Security is included by default with both the CASB-PA and CASB-X licenses. No additional action is needed to activate AI Access Security. You can begin using AI Access Security to safely adopt GenAI apps after activating either of these licenses.
      (FedRAMP Support) AI Access Security is supported in FedRAMP environments only when activated with a FedRAMP CASB-PA or CASB-X license.
    • Prisma Browser Standalone License
      AI Access Security is included by default with the Prisma Browser Standalone License. No additional action is needed to activate AI Access Security. You can begin using AI Access Security to safely adopt GenAI apps after activating this license.
      A Secure Enterprise Browser (Prisma Browser) license includes only the AI Access Security dashboard for Prisma Browser. For AI Access Security capabilities over the network, you must purchase the AI Access-X or CASB-X licenses separately.

    What Is Included with an AI Access Security License?

    What is included with AI Access Security depends on whether other licenses are active on the tenant.
    The included AI Access Security functionality is dependent on the PAN-OS or data plane version currently running on the NGFW or Prisma Access tenant. Refer to the Setup Prerequisites for more information on what functionality is included.
    Expand each license section to see the full capabilities available at each tier.
    • AI Access Security only
      Applies to NGFW or Prisma Access managed by Panorama or Strata Cloud Manager when only the AI Access Security license is active.
      Minimum PAN-OS or Data Plane Version
      Capabilities
      11.2.2-h1
      Prisma Access 5.1 Innovation
      • Visibility into over 2,250 GenAI apps delivered through dynamic content updates and App-ID Cloud Engine (ACE).
      • Define policy rules to control access to GenAI apps and non-GenAI apps.
      • Access the Strata Cloud Manager Command Center for GenAI visibility.
      • Access the AI Access Security Activity Insights dashboard to view detailed GenAI app usage data, users, and common GenAI use cases occurring on your network.
      • Enterprise DLP inspection and verdict rendering for supported GenAI apps only. Traffic containing sensitive data is not forwarded to Enterprise DLP for non-GenAI apps.
      • Tag GenAI apps on Strata Cloud Manager to reflect whether the application is approved within your organization and for tag-based policy enforcement.
        AI Access Security doesn't sync GenAI app tags to Panorama.
      • SaaS Security Inline: Generate reports for discovered GenAI apps only.
      • SaaS Security Inline: View GenAI apps in the Application Dictionary to learn more about specific GenAI apps, vendors, compliance, and risk characteristics.
      • Data Security: View GenAI apps installed as third-party connected apps/plugins in 9 SaaS marketplace apps.
      • Data Security: Visibility and control of data-at-rest residing in ChatGPT Enterprise app.
    • AI Access Security and Enterprise DLP Licenses
      Applies to NGFW or Prisma Access managed by Panorama or Strata Cloud Manager when both the AI Access Security and Enterprise DLP licenses are active. Includes all capabilities from the AI Access Security only tier, with the following change.
      Minimum PAN-OS or Data Plane Version
      Additional Capabilities
      11.2.2-h1
      Prisma Access 5.1 Innovation
      • Enterprise DLP inspection and verdict rendering extends to supported GenAI and non-GenAI apps (previously GenAI apps only).
    • CASB-PA and CASB-X Licenses
      Applies to NGFW or Prisma Access managed by Strata Cloud Manager when the CASB-PA or CASB-X licenses are active. Includes all AI Access Security only capabilities, plus the following.
      Minimum PAN-OS or Data Plane Version
      Additional Capabilities
      10.2
      11.1
      Prisma Access 5.0 Preferred and Innovation
      Prisma Access 5.1 Preferred
      11.2.2-h1
      Prisma Access 5.1 Innovation
      All capabilities from the previous version row, plus:
      • Tag GenAI apps on Strata Cloud Manager to reflect whether the application is approved within your organization and for tag-based policy enforcement.
        AI Access Security doesn't sync GenAI app tags to Panorama.
      • View GenAI apps installed as third-party connected apps/plugins in 9 SaaS marketplace apps.
    • FedRAMP CASB-PA and CASB-X Licenses
      Applies to NGFW or Prisma Access managed by Strata Cloud Manager when the FedRAMP CASB-PA or CASB-X licenses are active. Includes all AI Access Security only capabilities, plus the following.
      Minimum PAN-OS or Data Plane Version
      Additional Capabilities
      10.2
      11.1
      Prisma Access 5.0 Preferred and Innovation
      Prisma Access 5.1 Preferred
      11.2.2-h1
      Prisma Access 5.1 Innovation
      All capabilities from the previous version row, plus:
      • Tag GenAI apps on Strata Cloud Manager to reflect whether the application is approved within your organization and for tag-based policy enforcement.
        AI Access Security doesn't sync GenAI app tags to Panorama.
      • View GenAI apps installed as third-party connected apps/plugins in 9 SaaS marketplace apps.

    © 2026 Palo Alto Networks, Inc. All rights reserved.