This cloud-based subscription provides a complete and accurate inventory of an organization’s global internet-facing assets and misconfigurations to continuously discover, evaluate, and mitigate an external attack surface without the need for any installation/agents.  Cortex Xpanse consists of three products - Cortex Xpanse Expander, Cortex Xpanse Behavior, and Cortex Xpanse Link.

  • Cortex Xpanse Expander identifies and attributes an organization's internet-facing assets to identify sanctioned and unsanctioned assets to map the enterprise attack surface.
  • Cortex Xpanse Behavior uses global Internet flow data to surface communications between Internet-connected assets to detect and stop risky or out-of-policy communications that can be exploited for data breaches or ransomware attacks.
  • Cortex Xpanse Link continuously identifies Internet assets, risky services, or misconfigurations in third parties to help secure a supply chain or identify risk during M&A due diligence. Cortex Xpanse bolsters the broader PANW portfolio by integrating with Prisma Cloud to identify unmanaged cloud assets and integrates with Cortex XSOAR to automate remediation of discovered issues.



Featured Tiles

Understanding Issues in Cortex Xpanse Expander

Cortex Xpanse Issues classify risk on your attack surface for triage and investigation.

Cortex Xpanse Expander Dashboards

Cortex Xpanse Expander provides a suite of dashboards for monitoring your attack surface.


Cortex® Xpanse™ Release Notes

Cortex® Xpanse™ User Guide