Architecture comparison

Palo Alto Networks vs Wiz

No shared foundational model — different bets.

Palo Alto Networks

Cybersecurity

Proximity

Off the LLM map (in-house non-LLM ML)

Models

—

Cloud · datastore

Multi-CloudBigQueryCloud SpannerCloud SQLElasticsearch/OpenSearchProprietary PAN-OS data stores

Compliance

SOC 2ISO 27001FedRAMPHIPAAPCI-DSS

Architecture

Core security products (Strata NGFW, VM-Series, CN-Series) and services (WildFire, Prisma Access, GlobalProtect) run a proprietary PAN-OS/SP3 single-pass parallel processing architecture that is deployed across on-prem appliances and major public clouds, with cloud-delivered security services and management layers operating on GCP and other hyperscalers.[3][4][7] Data and telemetry are stored in a mix of cloud-native databases and proprietary stores to support threat intelligence, logging, and analytics.

Wiz

Cybersecurity

Proximity

Off the LLM map (in-house non-LLM ML)

Models

—

Cloud · datastore

Multi-Cloudgraph database (Wiz Security Graph)PostgreSQL or equivalent relational datastore (inferred)object storage on cloud providers (e.g., S3/Blob/GCS) for scan metadata (inferred)

Compliance

SOC 2 (inferred from enterprise CNAPP positioning and customer requirements)ISO 27001 (inferred)GDPR alignment (inferred from data protection documentation)[4]encryption in transit and at rest for customer data[4]

Architecture

Wiz operates a proprietary, agentless CNAPP delivered as a SaaS platform that connects into customer AWS, Azure, and GCP environments via cloud APIs, ingests configuration, workload, identity, and data signals into a centralized Wiz Security Graph, and exposes findings through a single multi-tenant console.[6][8][10] The core analytics, correlation, and visualization engine is built around this internal graph store and scanning pipeline, backed by cloud-native storage and compute services in multiple public clouds.[3][6]

← Full orbit map · Score your own stack →