First renewal quotes after a platformization bundle opened 15 to 30 percent up, so the consolidation discount and the renewal uplift turned out to be two halves of one motion
The bundle is a good deal in year one and an open question every year after. What decides which, is whether a written cap was agreed while alternatives were still deployed.
Prepared by Redress Compliance · August 18, 2026 · Security advisory. 15 to 20 Palo Alto renewals with Prisma components advised, 2024 to 2025.
Executive summary
First renewal quotes after a platformization bundle opened 15 to 30 percent up. Written caps negotiated at signing held those same renewals to single digits, which makes the cap worth more than the opening discount.
Deployed utilization of licensed modules and credits ran 60 to 80 percent. So 20 to 40 percent was paid for and not used, which is the first lever and it needs no vendor conversation to find.
Credits and bundled SKUs make per unit comparison hard by design. That is not an accident of packaging, it is what the packaging is for.
Estates holding a current competitor quote on at least one module settled materially better than estates negotiating on relationship alone. Displacement runs both ways, and only one side keeps proving it.
How is a Prisma deal actually priced?
As bundled subscriptions and credits across modules, with mobile users, bandwidth and workload credits as the underlying meters. Prisma Access prices by mobile users and remote network bandwidth tiers, while the cloud security portfolio now sits inside Cortex Cloud.
The credit layer is the part that matters commercially. Credits convert a set of different meters into one pool, and a pool is much harder to price against a competitor than a line is.
| Component | What it meters | Where comparison breaks |
|---|---|---|
| Prisma Access | Mobile users and bandwidth tiers | Tier boundaries differ by vendor |
| Cloud security credits | Workload credits across posture, runtime and code | One pool covering several products |
| Bundled SKUs | Several modules under one line | No standalone unit price to compare |
| Support tier | Premium support riding on top | Priced as a percentage of a moving base |
The bundling is the strategy
Making like for like comparison hard is a legitimate commercial choice by the vendor and a solvable problem for the buyer. Price each module standalone from the incumbent competitor before accepting a bundle rate, and the pool becomes legible again.
Is the platformization bundle a good deal?
In year one, usually yes. Every year after that it is an open question, because a consolidation discount trades directly for concentrated renewal leverage, a motion the vendor describes openly in its investor materials.
When one vendor runs the firewall, the SASE layer and cloud security, the renewal stops being a negotiation between alternatives. Nothing improper has happened. The buyer simply sold the option and was paid for it in year one.
Consolidation can still be the right answer. It is only ever the right answer with renewal protection negotiated while alternatives are still deployed, because that is the only period in which the protection is cheap.
The Prisma negotiation brief
The rate bands, the credit pool defense, the utilization audit, and the cap language that decides what the second term costs.
Get the brief →What 15 to 20 Palo Alto renewals showed
Across roughly 15 to 20 Palo Alto Networks renewals with Prisma components Fredrik Filipsson advised between 2024 and 2025, the bundle discount and the renewal uplift behaved as two halves of the same motion.
Deployed utilization of licensed modules and credits ran 60 to 80 percent. Between a fifth and two fifths of what was licensed sat unused, and that gap is visible from inside the estate without asking the vendor anything.
First renewal quotes after a platformization bundle opened 15 to 30 percent up. Where a written cap had been negotiated at signing, the same renewals landed in single digits.
That contrast is the finding. The cap costs nothing at signature, when the buyer still has competitors deployed and the vendor wants the consolidation. It is close to unbuyable two years later.
Estates that tabled a current competitor quote on at least one module settled materially better than estates negotiating on relationship. One live alternative is enough, and it does not have to be the biggest module.
- Percentile standing for your exact deal size and industry, from real closed transactions
- Credit pools and module utilization mapped against what the estate actually deploys
- Cap and uplift language flagged with the exact quote, the page, and the replacement text
Where is the first lever, before any negotiation?
In the utilization gap. Licensed modules and credits ran 60 to 80 percent deployed, so the first move is an internal audit rather than a vendor conversation.
- Map credits consumed against credits purchased per module, not across the pool, because the pool average hides the modules nobody turned on.
- Identify modules deployed in name only, which are the ones a renewal will quietly renew at full value.
- Price the estate you run before discussing the estate you bought.
The counter moves across the wider Palo Alto licensing estate run module by module, and a live alternative such as Wiz on the cloud security side is what keeps the comparison honest.
Support rides on the base
Premium support tiers price as a percentage on top, documented on the support services page. A base reduced by an honest utilization audit reduces the support line with it, which is the second saving nobody asks for.
Why does a written cap beat a bigger discount?
Because a discount is a one time event and a cap governs every year of the term. Across the renewals advised, caps agreed at signing held openings of 15 to 30 percent down to single digits.
An introductory discount does not survive the seller's next promotion cycle. A written cap does, because it is a term rather than a gesture.
Coterm with intent, or not at all
Aligning module end dates builds either one big renewal you control or one big hostage event you do not. Which one depends entirely on whether the cap was agreed before the alignment.
What the renewals measured, 2024 to 2025
Two cuts of the engagement file frame the trade being made at signature.
After a platformization bundle, against single digits where a written cap had been agreed at signing.
Across Prisma modules and credits, which is the lever available before any vendor conversation opens.
Both numbers point at the same moment: signature. That is when the cap is cheap and the alternatives are still real. Our brief on the wider Palo Alto licensing estate works the counter moves module by module.
Watch the briefing · 5:48Model Year Five Before You Admire Year OneWhy platform agreements front load the value and back load the cost, and what modelling the full term changes about the decision.
Your first five moves
- Audit deployed utilization before anything else, since licensed modules and credits ran 60 to 80 percent deployed across the renewals advised.
- Price every module standalone against the incumbent competitor before accepting a bundle rate, which is what makes the credit pool legible.
- Model the renewal at a 15 to 30 percent uplift and ask whether the bundle still wins on those terms.
- Make a written cap a condition of consolidating, because caps agreed at signing held the same renewals to single digits.
- Keep one credible alternative deployed. The negotiation practice runs the utilization audit before the platformization conversation opens.
Frequently asked questions
How much do Prisma renewals open up after a bundle?
Between 15 and 30 percent on the first renewal after a platformization bundle. Where a written cap had been agreed at signing, the same renewals landed in single digits.
How much of a Prisma estate is typically unused?
Between 20 and 40 percent. Deployed utilization of licensed modules and credits ran 60 to 80 percent across the renewals advised.
Why are Prisma deals hard to compare?
Because they price in credits and bundled SKUs rather than per unit lines. That converts several different meters into one pool, which is much harder to benchmark against a competitor.
Is consolidating onto one security vendor a mistake?
Not necessarily. It is a good deal in year one and an open question afterwards, and it is only defensible with renewal protection negotiated while alternatives are still deployed.
What is worth more, a bigger discount or a cap?
The cap. A discount is a one time event that does not survive the next promotion cycle, while a written cap governs every year of the term.
Does a competitor quote actually change the outcome?
Yes. Estates holding a current quote on at least one module settled materially better than estates negotiating on relationship alone. It does not have to be the largest module.
When should the cap be negotiated?
At signature, while competitors are still deployed and the vendor wants the consolidation. Two years later it is close to unbuyable.
Does support pricing follow the base?
Yes. Premium support rides on top as a percentage, so a base reduced by an honest utilization audit reduces the support line with it.
Should module end dates be aligned?
Only with intent. Coterming builds either one large renewal you control or one large hostage event you do not, and the cap decides which.
What is the first move that needs no vendor conversation?
The utilization audit. Mapping credits consumed against credits purchased per module, rather than across the pool, surfaces the modules nobody turned on.
