As workforces became more distributed across offices, homes, and branch locations worldwide, enterprise security requirements evolved with them. The security perimeter moved to the cloud. Enterprises now expect protection wherever users connect, without compromising the performance of the applications they depend on. For Palo Alto Networks, meeting that expectation at scale meant rethinking how Prisma Access, its cloud-delivered security service, was built. 

Prisma Access inspects enterprise traffic inline before it reaches its destination. Each customer runs on dedicated compute and network resources, completely isolated from other tenants. 

“Everything is dedicated—compute, network, resources,” says Pankaj Bhagra, Sr. Distinguished Engineer at Palo Alto Networks. “Think of it as an enterprise buying a product. We run it as a service for them.” A global enterprise doesn't share infrastructure with the customer alongside it. That isolation remained non-negotiable throughout the modernization. 

Delivering on that commitment, however, came at a cost. Palo Alto Networks runs hundreds of thousands of VMs on Google Cloud for Prisma Access alone. Enterprise traffic swings roughly 80% from weekend lows to weekday peaks. Under the previous VM-based architecture, meeting demand meant either maintaining excess capacity around the clock or waiting five to seven minutes for new VMs to boot. Neither approach was sustainable. 

Palo Alto Networks had operated Prisma Access on Google Cloud since 2018, building direct working relationships with Google Cloud networking and product teams. Premium Networking—with its global points of presence and deterministic routing—provides the geographic reach and latency consistency enterprise security demands. When required capabilities didn't yet exist, Palo Alto Networks worked directly with Google's engineering teams to build them. That depth of collaboration made Google Cloud the natural platform for what came next.