Palo Alto Networks vs FireEye Battlecard - March 2015 (1)

Palo Alto Networks vs FireEye FireEye Weaknesses 1.

2.

3.

4.

5.

FireEye Marketing & Positioning Positioning

FireEye requires an appliance for each protocol and only scans web browsing and email (SMTP only). Appliances are required at each Internet gateway  Palo Alto Networks scans ALL applications, ports and protocols (including SSL traffic) to inspect network traffic in and out of customer networks for malware activity. FireEye signature blocking is limited to filename and URL  Palo Alto Networks signatures are payload based and can block polymorphic malware attacks based on one WildFire or AV signature. FireEye requires large-scale deployment of appliances throughout the network with no option for public cloud. FireEye’s niche A PT/Malware product requires an appliance at every Internet, data center, user, VPN and remote site connection. This solution is extremely costly to support full enterprise wide APT/Malware coverage Palo Alto Networks utilizes both public and private cloud solutions. The cloud solution  allows customers to scale the Wildfire solution in large environments. FireEye can only fail open or closed and does not have the ability to perform high availability availability or failover configurations Palo Alto Networks has a proven track record of high availability and failover  configurations utilizing PAN-OS failover and WildFire cloud based solutions. FireEye’s HX end point software performs validation of known IoCs and containment ONLY. If customers do not have an automated analysis analysis tool feeding the HX solution information it is of limited value at this time Palo Alto Networks TRAPS provides detection, protection and blocking of zero day  APT/Malware attacks.

1. 2. 3. 4.

FireEye is able to block repeated malware downloads and C2 connections within 2-5 minutes after first seeing a sample via local signatures creation. FireEye’s multi-staged detection includes web exploit, malware dropping, and C2 channels with the ability to correlate IOCs from connected endpoints. FireEye’s malware focused user interface is actionable. FireEye will position their malware/APT product as best in the industry coupled with the Mandiant research and services team.

------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Core products competing against Palo Alto Networks

FireEye Strengths 1.

2.

3.

4. 5.

6.

Onsite signature creation for file types within minutes. FireEye has the ability to create signatures on the local appliance without  communication with the FireEye cloud. Ability to block repeated malware downloads and command and control channels within 2-5 minutes after first seeing an outbound connection connection FireEye has the ability to block command and control channels without communication  with the FireEye sharing cloud. Multi-staged detection includes web exploit, malware dropping, and C2 channels with the ability to correlate IOCs from connected endpoints  FireEye’s detection engine shows the full malware lifecycle, which includes exploit, binary dropper/downloader and C2 channel connections in an easy to use and actionable interface. Simple, actionable malware focused user interface Email (EX Series) has the ability to act as an MTA and hold and quarantine emails before delivery.  In MTA mode, FireEye’s email appliance has the ability to hold emails for analysis to stop zero day spearphishing attacks. FireEye and Mandiant has a dedicated research team which includes incident response services and adds to the research portfolio

rd

2015  – Confidential – Competitive data is generated from public and 3  party sources (March 2015)

Palo Alto Networks competes with items marked with

Palo Alto Networks vs FireEye Objection Handling 1.

Key Sales Strategies

“Wildfire is a bolt on product and Palo Alto Networks is not focused on Advanced Persistent Threats and Malware ” Not true, WlidFire is an integral part o f the Threat Prevention product suite and feeds t he entire security platform by sharing URL, DNS, C&C information to all customers within 15 minutes. “WildFire adds performance overhead that will crash the firewall ” Wildfire adds little performance overhead and has never crashed a production firewall in any of our customer’s  deployments. “Palo Alto Networks is not serious about Malware and Advanced Persistent Threat attacks ” WildFire has more twice as many customers than FireEye and WildFire is an integral part of the security appliance  solution. Additionally attacks have changed and WildFire assists with not only detecting malware and APT attacks but blocking them. “Palo Alto Networks doesn’t have a research group of engineers to match Mandiant’s”  Palo Alto Networks Unit 42 is a dedicated research group that has discovered over 20 zero day attacks (2014) and is tracking more than 60 APT campaigns.  Unit 42 has also discovered multiple attacks never seen before in the wild.  Unit 42 is tracking ~2,600 Indicators of Compromise to detect attacks in the wild.



FireEye product and subscriptions are too expensive. Account teams should be proactively asking when FireEye’s subscriptions are up for renewal and request a WildFire discussion.



Customers want to consolidate security appliances and subscriptions



Leverage current Palo Alto Networks installed base  – Make sure to position and sell Wildfire into all current customers



Demonstrate the benefit of Palo Alto Networks Threat Prevention security platform rather than a malware point product.



Discuss Palo Alto Networks detect and prevent strategy versus competitors detect and inform.



Discuss with customers Zero Trust Networking and full malware/APT coverage at every remote site and VPN (Global Protect).



2.

3.

4.

Palo Alto Networks Covering the Entire Enterprise utilizing Threat Prevention

rd

2015 – Confidential – Competitive data is generated from public and 3  party sources (March 2015)