The NHS has set an ambitious goal of achieving cyber resilience across healthcare organisations by 2030. Delivering on that vision requires technology, expertise and close collaboration across the public and private sectors.

This is clearly a highly complex task, but one we're delighted to help deliver in partnership with IBM. Through this partnership, Palo Alto Networks will provide advanced cloud-based perimeter technology, alongside IBM Consulting’s specialist guidance, implementation support and tailored onboarding for NHS organisations.

As health and care services continue to modernise, maintaining resilient, secure digital infrastructure has never been more important. Healthcare organisations are operating in an increasingly complex environment, with growing digital dependencies, expanding supply chains, evolving cyber threats and new technologies such as AI reshaping the landscape.

According to IBM's Cost of a Data Breach Report, healthcare continues to be one of the most impacted sectors globally when it comes to the financial consequences of cyber incidents. This highlights the importance of taking a proactive, long-term approach to cyber resilience across critical public services.

Palo Alto Networks' continued work with the NHS demonstrates the scale and complexity of securing modern healthcare environments. As organisations balance innovation, operational demands and evolving security requirements, there is a growing need for solutions that provide both strong protection and the flexibility to meet local needs.

Introducing the Next Generation of the NHS Secure Boundary Programme

Palo Alto Networks will deliver next-generation, cloud-based security solutions through the next iteration of the NHS Secure Boundary programme. The service has been designed to help strengthen cyber resilience across UK health and social care organisations while supporting the safe and reliable delivery of services.

Secure Boundary provides the capability to support a network spanning more than 1.5 million NHS staff, over 200 NHS trusts, more than 55,000 organisations handling health data and approximately 2 million devices under national cyber monitoring. The nationally integrated and centrally funded service embodies a "Defend as One" approach, helping organisations benefit from shared protection while retaining local control.

Secure Boundary supports NHS organisations through:

• An AI-enabled cybersecurity capability designed to strengthen resilience and support the safe, reliable delivery of healthcare services.
• Enhanced visibility and protection for internet traffic across the Health and Social Care Network.
• Improved security for infrastructure and clinical applications operating across multiple service providers.
• Increased protection for information shared across NHS organisations and trusted third parties.
• Greater privacy and security for staff accessing web-based services, whether on-site or remotely.
• A "Defend as One" approach that complements existing local security measures while allowing organisations to tailor policies to their specific requirements.
• Reduced complexity through the consolidation of security tools and management processes.
• Improved efficiency through a centrally funded model that helps reduce duplication of technology and investment.

The new Secure Boundary service represents a significant step forward in strengthening the NHS's digital resilience. By providing a more secure foundation for NHS services, it helps support operational continuity, safeguard sensitive information and enable healthcare teams to continue delivering high-quality care in communities across the UK for years to come.

If you would like to find out more about Secure Boundary and how it can help your organisation, please contact ukpubsec@paloaltonetworks.com. 

---

 

Forward-Looking Statements

This blog contains forward-looking statements that involve risks, uncertainties and assumptions, including, without limitation, statements regarding the benefits, impact, or performance or potential benefits, impact or performance of our products and technologies or future products and technologies. These forward-looking statements are not guarantees of future performance, and there are a significant number of factors that could cause actual results to differ materially from statements made in this blog. We identify certain important risks and uncertainties that could affect our results and performance in our most recent Annual Report on Form 10-K, our most recent Quarterly Report on Form 10-Q, and our other filings with the U.S. Securities and Exchange Commission from time-to-time, each of which are available on our website at investors.paloaltonetworks.com and on the SEC's website at www.sec.gov.  All forward-looking statements in this blog are based on information available to us as of the date hereof, and we do not assume any obligation to update the forward-looking statements provided to reflect events that occur or circumstances that exist after the date on which they were made.  

 

The post NHS England evolves its cybersecurity strategy with Palo Alto Networks and IBM appeared first on Palo Alto Networks Blog.

Hope is not a strategy. Neither is nostalgia.

Mark Carney, Prime Minister of Canada

 

Business leaders cannot respond to AI-era cyber risk by longing for a simpler technology stack, slower decision-making or a security model built around a trusted internal network. AI is changing how organisations operate—and how adversaries identify and exploit weaknesses—faster than many leadership teams can anticipate.

Cybersecurity has therefore evolved from a “coconut strategy”, built around a hardened perimeter and trusted interior, to what I call a “mango strategy”. The modern enterprise and its digitally connected ecosystem have a porous, continuously changing edge, but it must place its strongest protection around the core: its data, identities, code repositories, applications, digital essentials and critical operations.

What is the CEO’s role in AI governance and cybersecurity?

This shift makes cybersecurity a CEO-level business priority. CEOs do not need to oversee every AI deployment, but they must define how the organisation adopts, governs and secures AI while maintaining resilience, accountability and trust. That means setting risk thresholds, assigning accountability, protecting critical data and identities, and ensuring that security can operate at the same machine-speed as autonomous systems.

Why autonomous AI agents require workforce-level oversight

Given this dual nature, business leaders cannot afford to ignore AI. Like water, AI adoption will find its way and follow the path of least resistance as a senior cybersecurity leader from a large European bank put it. Without clear governance, it can expose weak controls, while AI-enabled attackers can exploit those weaknesses at unprecedented speed and scale.

Some have suggested that CEOs should double as Chief AI Officers. However, as executive responsibilities expand, expecting a CEO to oversee day-to-day AI implementations while setting broader corporate vision is unrealistic. While the CEO may not manage specific AI initiatives, they must actively shape the overarching strategy, the “AI surround and framework”.

This leadership starts with developing and hiring highly capable talent to execute the vision. The CEO’s true value lies in ensuring that AI is embraced across every business unit, integrated into risk models, and governed by robust safeguards. Proper administration and oversight are no longer secondary concerns—they are core executive functions.

A critical dimension of this responsibility is governing the use of agentic AI. Autonomous agents function effectively as "authorized insiders." Custom-built for specific workflows, they leverage elevated privileges to access critical applications, databases, and proprietary tools around the clock.

In practice, these agents represent a new class of virtual employees. Though non-human, their operational impact is comparable to their human counterparts, yet they operate 24/7. CEOs must ensure that autonomous agents are deployed, monitored, and evaluated with the same rigors applied to the rest of the workforce.

How can leaders build resilience against AI-driven instability?

Translating this new operational reality into steady organizational resilience requires recognizing AI's broader societal impact. While the technology holds vast potential for good, it can also accelerate systemic and geopolitical instability when misused. For instance, recent developments in frontier AI models demonstrating advanced exploit-generation capabilities highlight the immediate necessity of defense-in-depth.

Palo Alto Networks CEO Nikesh Arora highlighted this shift in this article - Weaponised Intelligence -  “These are not incremental improvements. Imagine a horde of agents methodically cataloging every weakness in your technology infrastructure, constantly. Over the next six months, the barrier to entry for sophisticated attacks will continue to diminish. A hacker’s dream weapon will be available to anyone with a credit card and computer.”

To counter these emerging risks, leading AI developers and security organizations are actively collaborating. Through initiatives like Project Glasswing, partners across technology and financial services are stress-testing defender-grade models to harden critical software and establish proactive defenses before threats reach the wild.

These collaborative initiatives address the exact questions executive boards are asking today: Where are our exposure points, how severe are they, and how quickly can we contain them?

Answering these questions requires a strong security culture. Defining how an organization adopts and governs AI is now a core mandate for executive leadership. Even with specialized AI leadership in place, the CEO must drive the culture to align AI implementation with business values and strategic priorities.

Ultimately, executive leadership must set clear parameters: defining operational boundaries, establishing accountability, tracking key progress metrics, and encouraging responsible innovation within controlled risk thresholds.

Four cybersecurity priorities for the agentic AI era

The cybersecurity landscape has reached an inescapable inflection point: we have entered the "Agentic Era," where autonomous AI agents drive attacks at machine speed. In this environment, manual, reactive patching is no longer just slow—it is a mathematical dead end that can leave enterprises effectively unprotected.

Navigating this shift requires a deliberate transition from reactive measures to proactive architecture built on four strategic pillars:

1. Fight Machine with real-time machine speed: Because automated adversaries can scan millions of endpoints and chain multiple low-severity vulnerabilities into catastrophic exploit paths, human-led response is a guaranteed failure. Organizations must move to a prevention-first posture, using AI-driven systems that natively integrate across network, cloud, and endpoint telemetry to block threats in real-time.
2. The "Customer Zero" Mandate: The time between a model's release and its weaponization is shrinking to zero. Palo Alto Networks acts as "Customer Zero" by stress-testing frontier models during their development phase, hardening the security stack against specific autonomous logic capabilities well before they are public.
3. Move Beyond "Find-and-Fix": Finding vulnerabilities is only half the battle. The new imperative is to prioritize remediation based on exploitability and reachability—identifying which vulnerabilities can be chained together by an attacker—rather than just severity. This requires shifting operations to machine-speed defense via unified platforms and services like Unit 42 Frontier AI Defense or virtual patching, allowing you to safely patch your digital essentials when real-time agentic attacks are happening.
4. Prioritize Platformization: Fragmented security architectures—where point solutions cannot communicate—are an open invitation to automated lateral movement. A unified, data-driven architecture is a prerequisite for security, enabling a threat blocked at the endpoint to harden an organization’s perimeter.

How CEOs can create the defender’s advantage

For the C-suite, the takeaway is clear: Digital transformation and cybersecurity transformation are now inextricably linked. The organizations that adapt by rebuilding their architecture around unified data and autonomous prevention will hold the "defender's advantage," while those relying on legacy, manual workflows remain exposed to a rapidly accelerating threat landscape.

Nostalgia offers no protection against the speed and complexity of the modern threat landscape. Operating under the assumption that perimeters remain secure is a legacy mindset. 

As executive leaders refine their strategy for the AI era, two core principles should guide their approach:

• Cybersecurity is a data issue, not a technology issue. The goal is to protect data, not just to harden infrastructure.
• Many of our core best practices in cybersecurity, such as Zero Trust and modular platformization, are more appropriate than ever in the era of AI and automated agents. 

Helmut Reisinger is CEO for Europe, Middle East and Africa at Palo Alto Networks.

The post The Mango Strategy: A CEO’s Guide to AI Cybersecurity appeared first on Palo Alto Networks Blog.

Anyone who has seen the impressive frame of Stonehenge against the morning’s sunrise cannot help but be struck by its resilience, how it has withstood time and the unpredictable impact of nature and humans. And partly because of this, a recent conversation I had with the CIO of a large healthcare technology company made me realize that it was a fitting metaphor for cybersecurity.

As our conversation wove through familiar topics — the challenges and breakthroughs in enterprise IT architecture — we recognised and discussed a recurring pattern throughout most EMEA and multinational enterprises. Those organisations have gradually but surely evolved into a mosaic of vendor fragmentation, ‘micro-platforms’ across vendor-specific technologies, and rapidly developing data silos that no single IT architecture can solve on its own. 

The increased heterogeneity of hardware, operating systems, and cloud architectures now comes with a dizzying mix of cybersecurity tools and services, often optimised for Vendor X’s platform. This has led to the situation that a large organisation typically has more than 30 cybersecurity point solutions in place to protect their digital assets. And now that we have thrown AI into that mix, designing the right cybersecurity solution is as confusing as it is imperative.

That’s when I was reminded of Stonehenge. Its lintel-and-joinery design is strikingly simple and elegant, and it stands as a brilliant monument to long-term resilience. Just as Stonehenge has endured against natural and human threats, so organisations must build a cybersecurity architecture that endures a revolutionary rate of change and threat diversity, including geopolitical turbulence and AI entering the value chain. 

For CISOs, CIOs, board members, C-suite executives and line-of-business leaders concerned with operational resilience, cybersecurity architecture matters—deeply. 

And we should not forget that cybersecurity is a data problem. The more telemetry data you have, the more effectively you can execute security algorithms and protect your digital essentials across all your enterprise IT pillars, i.e., IT, OT, Clouds, Networks, Workplace, Endpoints, etc. We at Palo Alto Networks are able to combine relevant telemetry data from networks, firewalls, clouds, browsers, endpoints and the internet. 

Stonehenge was built from massive, self-reinforcing pillars and platforms of stone. The lintels and joinery help hold together the overall structure as a cohesive unit, and they have striking similarities to how IT architects are now thinking about cybersecurity. In today’s technology architecture, Stonehenge’s vertical pillars are an IT organisation’s specialised, vendor-specific IT domains—sometimes with its own security tools and capabilities rather than as a strategically integrated zero-trust cybersecurity framework across your enterprise IT pillars.

Now, Stonehenge’s with its unique resilience, can also serve in its own construction as a model for modern cybersecurity architecture. Like our evolution towards modular platformisation evolved deliberately and assuredly over time and it spans all key domains of cybersecurity, ie network, cloud, AI,  identity security and all key building blocks for an AI-driven SOC, the last line of defense that has to be real-time. In other words, it is the linchpin of our strategy for enterprise security built upon such key areas as Identity, the Autonomous SOC, and Network Security. 

Stonehenge’s lintel is analogous to cybersecurity platformization, a growing trend rapidly replacing the now-outdated best-of-breed point solution mindset. This employs a modular approach that gives flexibility and control to the security architect looking to add security domain capabilities as needs evolve. The mortise-and-tenon joinery of Stonehenge works because the parts fit together rather than being stacked as an afterthought, in much the same way modern cybersecurity frameworks are built upon the concept of embedded functionality rather than being bolted on. 

An important example here is Palo Alto Networks’ decision to power the cybersecurity platform core with Precision AI, rather than its technology being added as a separate tool. This approach enables Precision AI to power data, analytics, and workflows, making it an omnipresent resource for smarter and faster prevention, detection and response.

Another important element of any enduring architecture is its ability to provide stability to the overall framework. In cybersecurity architecture, this is the all-important cyber data layer across an integrated zero trust framework. As organisations continue to struggle with data silos across networks, cloud environments, security operations centres, and edge systems, the cybersecurity data lake takes on a heightened role of importance for the resilience of the entire cyber framework. Again, let’s not forget, cybersecurity is a data problem, a domain in its own right across all vertical IT pillars.

Now, Stonehenge with its unique resilience, can also serve in its own construction as a model for modern cybersecurity architecture. Like our evolution towards modular platformization evolved deliberately and assuredly over time and it spans all key domains of cybersecurity, i.e.  network, cloud, AI, endpoints, identity security and all key building blocks for an AI-driven SOC, the last line of defense that has to be real-time. In other words, it is the linchpin of our strategy for enterprise security built upon such key areas as Identity, the Autonomous SOC, and Network Security/SASE. 

Another critical element of the cyber platform is something even Stonehenge hasn't had to face: securing AI itself, especially the opportunity and threat represented by agentic AI. AI security must become part of the platform design and implementation, as we have done with our Prisma AIRS (AI Runtime Security) platform for enabling an organisation's growing AI portfolio to remain a vital asset and not an inviting attack vector. Agents now are not just another non-human identity; they are an entirely new class of identity, with a striking mismatch in speed between agent decision-making and human governance. The inside-out attack paths taken by hackers' ill-intentioned agents represent a major threat to under-protected AI supply chains. The same pressure now also comes from geopolitics and from AI moving into the value chain itself, such as in the case of the Factory of the Future.

Similarly, our recent acquisition of CyberArk gives us what we believe is the industry’s strongest identity security platform, Idira, positioning it as yet another vertical pillar connected to the overall cybersecurity platform lintel. Cortex XSIAM and its security data lake are deliberately open — ingesting and correlating third-party telemetry alongside our own, over 17 petabytes of telemetry data each day — to form a secure data layer that is accessible to users based on policy management and credentials validation. Palo Alto Networks leverages this mountain of data, along with around-the-clock scanning of more than 5 billion daily security events, to feed Precision AI in order to detect and block potentially devastating attacks. Currently, we detect about 9,6m new attacks per day that have not been there the day before. The use of automated AI in attack vectors has been accelerating the time of exfiltration of data from the compromise of an organization. This delay was 9 days about 3 years ago, now data is exfiltrated in most cases in less than a day, sometimes already within less than one hour!

In this context, it's also important to highlight the importance of an Autonomous SOC pillar, particularly since compliance reporting windows are continuously contracting from days to mere hours calling for real-time, highly automated defence. Today, mean-time-to-detect and mean-time-to-respond are board-level imperatives commanding more conversation and attention at an organisation’s highest levels. The Autonomous SOC pillar is a vital element in helping enterprises achieve even faster detection and remediation, ideally down into single minutes. If it also integrates the historic enterprise SIEM you can further simplify your SOC operations and gain solid financial benefits by platformization of your security relevant data.

Finally, keep in mind the use of supply chains to build the actual platform. For Stonehenge, that was an impressive physical supply chain: The bluestones used in the structure were hauled about 250 kilometers from Wales without the benefit of air, rail, or truck transport. For Palo Alto Networks’ cybersecurity platform, the supply chain was no less impressive, but more virtual than physical, often faced with attacks on third-party interdependencies such as SaaS applications, APIs and in times of Frontier AI models, the Open Source components. 

Like the pyramids, the Great Wall of China, and the Roman road system, the most remarkable aspect to Stonehenge isn’t just its engineering elegance, but its ability to withstand changing conditions and threats over time. Whether you’re a CEO, board member, CIO, CISO or security engineer, the decisions you make about cybersecurity carry significant impact and implications. In order to achieve Stonehenge-like resiliency, technical and business leaders should commit to an architectural model designed not only for today’s needs, but for what those needs are likely to be over the long term. 

Therefore, cybersecurity should be architected as a horizontal, dedicated platform across all your IT domains and businesses. With this you are able to provide real-time and platformized cybersecurity for tomorrow. And tomorrow is going to be a more and more AI-driven business world. 

 

Helmut Reisinger is CEO for Europe, Middle East, and Africa at Palo Alto Networks.

The post Built to Last: What Stonehenge Teaches us About IT Architecture & Cyber Resilience appeared first on Palo Alto Networks Blog.

Sovereignty has become the driving principle of Europe's technology conversation. Every policy discussion, every emerging legislative development, every procurement process, every boardroom debate comes back to which platforms and partners to trust.

Trust goes beyond compliance. It demands integrity, accountability, and transparency about the limits of what any provider can guarantee – rather than making commitments that sound reassuring but cannot be verified.

We have spent considerable time listening to public sector organizations, critical national infrastructure operators, and regulators across Europe. This is not a new concern. Over the years,  what organizations are asking for has become increasingly specific. They want their data to remain in Europe. They want to know precisely who can access it and who holds the encryption keys. And they want every access event logged and visible. They want operations managed locally, under local jurisdictions and subject to local laws.

These are governance requirements as much as technical ones. And what they add up to is a demand for verifiable control, not more contractual promises. The distinction matters enormously. Telling an organization you will protect their data is one thing; giving them the architecture and the visibility to verify that protection themselves is another.

It is worth being clear about who is driving this conversation. These requirements are not universal. A large enterprise running productivity tools has different needs from a government ministry managing sensitive national data or a critical infrastructure operator running systems that society depends on for clear drinking water. What we are describing here is what we hear from the most demanding end of the spectrum: public sector and critical national infrastructure. And that is where we focus, because getting it right there matters most.

What We Have Built

The announcement of the Sovereign Cortex with T Security, together with Deutsche Telekom and Google Cloud, is our direct response to these demands and the next step in our long-standing commitment to Europe. It is not a marketing position – it is a framework that provides customers actual controls. It is built on the five elements that reflect how we fundamentally think about sovereignty. One that will set the standard across every solution we build for the region.

1. Customer data and systems data (telemetry) are stored and processed in Europe and accessed only by personnel in-region.
2. The encryption keys are held externally under control by the customer. 
3. Data access events are independently reviewed, logged, visible, and auditable. 
4. Site reliability engineers and support personnel based in Europe manage and support the service. 
5. Contracts are signed by a European legal entity, governed by European law.

Each element of this framework was designed from the outside in, with the input of every European organization we collaborated with. 

Why Trust Has to Be Earned, Not Claimed

Here is what I believe, having spent years in this conversation across Europe. Trust is not something a provider can simply assert. It is something that has to be earned, over time, through consistent and verifiable action.

For technology companies operating in Europe, that means placing meaningful control with a trusted local European partner, being transparent about what we can and cannot guarantee, and treating sovereignty not as a compliance exercise but as a design principle.

It also means being honest about the journey. We have done significant work, yet we have further to go. The organizations we serve deserve partners who acknowledge that openly rather than presenting a finished picture.

What drives this work is straightforward: we believe in Europe’s digital future. We believe in the missions of the organizations we work with every day, whether they are protecting critical public services, securing national infrastructure, or safeguarding the data that citizens and institutions depend on. Being a committed partner to those organizations is not a product decision. It is a values decision.

And that is precisely why trust is the measure we hold ourselves to. The direction is clear, the commitment is real. But commitment means nothing without trust – and trust, like everything worth having, has to be earned every day.

---

Forward-Looking Statements

This blog contains forward-looking statements that involve risks, uncertainties and assumptions, including, without limitation, statements regarding the benefits, impact, or performance or potential benefits, impact or performance of our products and technologies or future products and technologies. These forward-looking statements are not guarantees of future performance, and there are a significant number of factors that could cause actual results to differ materially from statements made in this blog. We identify certain important risks and uncertainties that could affect our results and performance in our most recent Annual Report on Form 10-K, our most recent Quarterly Report on Form 10-Q, and our other filings with the U.S. Securities and Exchange Commission from time-to-time, each of which are available on our website at investors.paloaltonetworks.com and on the SEC's website at www.sec.gov.  All forward-looking statements in this blog are based on information available to us as of the date hereof, and we do not assume any obligation to update the forward-looking statements provided to reflect events that occur or circumstances that exist after the date on which they were made.

The post Trust is the Foundation of Sovereignty appeared first on Palo Alto Networks Blog.