Palo Alto Networks and Zero Networks Integration: How Microsegmentation and Next-Gen Firewalls Work Together

Summary

Palo Alto Networks and Zero Networks integrated automated microsegmentation with Palo Alto’s Layer 7 firewall inspection. Ransomware gets contained at the host, critical assets get deep inspection, and nobody hand-builds the policies. At Black Hat, ISMG’s Tom Field talks with Rich Campagna, SVP of Products at Palo Alto Networks, and Chris Boehm, Field CTO at Zero Networks, about ransomware containment, IoT and OT assets, zero trust, and keeping policy consistent across hybrid environments.

Key takeaways

• Zero Networks feeds asset context into Palo Alto Networks. Zero Networks learns every asset, from identity to workstation to server, automates its policy, and tags it into the Palo Alto ecosystem. That enriches firewall enforcement at a global scale.
• Ransomware is isolated at the host, not just at the perimeter. When Palo Alto Networks detects an infected asset, the bidirectional integration tells Zero Networks to cut it off from all communication, even inside its local segment.
• It completes the zero trust model. Zero Networks identifies every asset, including IoT and OT devices, and applies least privilege. Palo Alto Networks adds continuous verification with Layer 7 threat prevention on the traffic that matters.
• Layer 7 inspection goes where it counts. Inspecting all east-west traffic at Layer 7 isn’t practical in cost or operations. Zero Networks identifies critical assets, like ERP systems, so their traffic is steered to full inspection, while Layer 3 and 4 segmentation covers the rest.
• Policies stay current automatically. As devices move and IP addresses change, Zero Networks continuously updates Palo Alto firewalls, unifying policy across both systems with no manual changes. It also adds an audit trail for compliance.

Speakers: Tom Field, SVP of Editorial, ISMG · Rich Campagna, SVP of Products, Palo Alto Networks · Chris Boehm, Field CTO, Zero Networks

What problem does the Palo Alto Networks and Zero Networks partnership solve?

Tom Field: Hi there, I’m Tom Field. I’m senior vice president of editorial with Information Security Media Group. Here at Black Hat 2025 in ISMG studio to talk about a new partnership and a new integration. Joining me to discuss it are Rich Campagna, SVP products with Palo Alto Networks, joined by Chris Boehm, field CTO with Zero Networks. Gentlemen, thanks so much for taking time to speak with me tonight.

Rich Campagna: Of course.

Tom Field: All right. What are the primary security challenges, first of all, that your partnership, your integration aims to solve for your joint customers?

Chris Boehm: You want to start?

Rich Campagna: Sure. Yeah, I’ll, I’ll take that one and hand it over to you. So, you know, for our joint customers, it’s all about eliminating lateral threat movement, right? If you, if you look at the big incidents out there, um, you know, the difference between a, a, a small security incident and a very big one is the ability for an attacker to move laterally within an organization’s network once they made their way in. So if you talk to a CISO, they will tell you that the ability to contain lateral threat movement is absolutely paramount. The challenge is that it’s always been really complex to achieve, and that’s really what we’re after with this partnership.

Chris Boehm: Yeah, I, I second that. I mean, the main goal is, for when you think about your network security strategy, if you’re looking at Palo Alto and Zero Networks, we’re solving it from end to end. So it allows you to have the big picture, your company secure, and then when it gets inside the company, which never should happen, right? We’re there across the journey to say, “Hey, we can reassure anyone to send it back to Palo Alto,” and it’s a joint partnership. 

How does the integration secure east-west traffic?

Tom Field: Can I put myself in the CISO’s position here, because I want to hear about the integration. How is it going to help secure my east-west traffic to achieve secure microsegmentation, which, you know, I need?

Chris Boehm: Yeah, I can, I can go with that one. So from a microsegmentation perspective, it’s not new technology. When it comes down to it, we’re looking at it from each asset. So identity level to a workstation to server. And how we provide that is we learn on each asset and then automatically policy-management it and then tag it into the Palo Alto ecosystem. So that’s where the partnership comes in. So they have the enrichment of what we’re seeing on each asset level, and then you can enforce it on a global scale and visibility.

Tom Field: Okay.

Rich Campagna: Yeah. No, I think one of the, the key things, the reasons we were so interested in, in, uh, in partnering with Zero Networks, uh, Zero Networks on this is that, um, you know, for us, as a leader in the space for, for network security, the, the key strength that we bring to the table is primarily around Layer 7 threat prevention, right? The, the challenge, though, with, with implementing microsegmentation has always been this, this complexity, as around, you know, identifying assets, uh, ensuring that you have the right, uh, uh, Layer 7 threat prevention applied to the right traffic flows into the right, right assets. And so that’s really where, um, this, this partnership adds tremendous value. We have many customers that are using us for Layer 7 perimeter protection, either in a campus, data center, cloud, etc. It’s that combination of being able to, to implement those host-level controls around assets, identifying those assets, and tie the two things together that really makes this powerful.

How does the integration contain ransomware?

Tom Field: I’m going to click on that a little bit. Give me some use cases where the combined capabilities of Palo Alto and Zero Networks are stronger than the solutions separate.

Rich Campagna: Uh, well, we can start with something like, uh, like ransomware containment, right? Ransomware for years now has been a big thorn in the sides of, of those CISOs you were just, uh, putting yourself in the shoes of earlier, Tom. Um, you know, here the big challenge, you know, certainly customers will use something like a Palo Alto Networks firewall on their perimeter to stop ransomware from, from getting in, um, uh, and, uh, and, you know, from, from getting across various different kind of macro segments of, of their network. But still, the, the thing that has made ransomware attacks really successful in the past, some of the big ones going back years to things like NotPetya as an example, has been the ability to move, you know, one by one across the network. And so really to isolate that, to stop it, you need to contain things at the, at the host level, at the individual device level. It’s not sufficient to have this Layer 7 ransomware prevention, uh, you know, just at kind of boundaries of various different segments of your network or at your perimeter. You know, if something gets in, you need to be able to stop it and isolate it at the host level. So the power here in ransomware containment is in our ability to identify, uh, this threat, you know, perhaps as it comes into the, into the network, or, you know, kind of moves across some of these macro segments, but this, this, this kind of bidirectional communication into the Zero Networks, uh, product as well at the same time to basically identify, hey, this particular asset has been infected by ransomware. We’re going to isolate it to zero communications, not even within a local segment inside of the network. So we see the threat, you know, we stop it where we can, push that into Zero Networks, and stop that thing from communicating to anything. So you, you really have it at the source, and that’s really powerful in terms of ransomware containment.

Tom Field: Excellent example. Anyone want to add to that, Chris?

Chris Boehm: Yeah, I mean, the, think of the biggest attacks that’s happened in the past 2 years. Most of those scenarios, unfortunately, at me as a hacker would has been authorized, and that’s the challenge they are facing is how do they verify that user is not being malicious, and that’s where I would say that we are trying, we are making a big impact when it comes to multiple different industries, and then provide that insights back to Palo Alto, just as you mentioned. So when it comes to visibility, we can verify again and again and again through the whole entire process. So the blast radius is just, just shrink massively. Even if you did get to, say, as a developer I had source code access and then I had access to some other things, I can’t continue spreading across the whole company, thus blocking ransomware and lateral movement. I mean, that’s the real true goal, and it’s a, a ongoing effort that everyone’s facing today, is a, a common scenario.

How does the integration support a zero trust architecture?

Tom Field: Now, how’s the integration contribute to a comprehensive zero trust architecture strategy, which lots of organizations are talking about?

Chris Boehm: Well, heck, I think it’s very on par with what they’re looking for. Uh —

Rich Campagna: Yeah, I think that the fundamental of, of zero trust is, is, you know, the kind of fundamental concept is never trust and, and always verify, right? That’s the kind of the fundamental, um, construct that so many organizations have built kind of a core of their cybersecurity strategy, uh, around. And, and if you look at, you know, the elements that we bring to the table here jointly, right, we’re, we’re starting by, you know, at that individual host level with Zero Networks, identifying the asset. It may be, you know, endpoint device like the iPad or whatever it is you have in front of you, maybe some IoT or, or OT asset that needs to be identified, perhaps something like a camera or wireless access point or whatever the case may be. Regardless, you start with identifying, uh, what is trying to access and communicate on the network, and you have to apply this, this principle of, of least privilege, right? You’re going to give that thing only the access it needs based on its identity, whether it’s a user identity or machine identity or what have you. You give it only the access it needs on the network, and you’re going to stop it from there. So, no, no additional sort of network access. That’s the kind of the core starting point with, with zero trust. So, you’re identifying, authenticating, and authorizing, applying least privilege, but then, you know, from there, on top of that, you need to continuously verify. You need to ensure that, um, you know, whatever that is, that thing that’s, that’s communicating, uh, is not, uh, spreading threats like that ransomware we just talked about across your, across your network. It’s, it’s, it’s not been somehow compromised and, um, you know, trying to infiltrate or move laterally across and, and, um, um, spread some sort of incident across, across the organization. So that’s where the Palo Alto piece comes in. You start with least privileged on, on Zero Networks, and you apply this Layer 7 threat prevention and security controls on top of those critical traffic flows, or potent, you know, potentially malicious or suspicious traffic flows, and you have a very powerful combination that, that really gets to the, the end goal or the promise of zero trust, uh, that has been, uh, quite frankly elusive for a lot of organizations. They get, you know, part of the way there, but not 100% of the way there. With this they can.

How does the joint solution protect critical assets?

Tom Field: Okay. Now, you’ve done a good job talking about how your solution can stop ransomware and other threats from spreading laterally. If you were to sum up here, how does the joint solution protect my most critical assets and my servers?

Chris Boehm: Um, I mean, that’s the, it’s kind of going back to the zero trust story in the end. It’s reverifying and continually making it harder for attackers to even have even possibility to find your crown jewels. So, it, I think of it as any kind of company scenario. Hopefully, you may not have access to everything, but even if you did, if I was god mode of my whole company, I would have to reverify through the whole process. So, it would make it harder through the whole entire journey, from north, west, east, south traffic within my network, to make even lateral movement even possible, or even, uh, potential stealing of credentials or other information in my network. So, really the whole entire premise is for us to continuously do that. The challenge today, that’s not impossible. The challenge is for our networking teams to continuously do that and learn, and that’s what microsegmentation is — not new. It’s been around for quite some time. There’s macro segmentation, microsegmentation. There’s multiple different layers that’s out there. What really put us in the cutting edge, where it’s helping out Palo Alto, is we’re learning and automatically providing that insights on a contextual, on regular basis. So it’s, you may change, I may change on a regular basis, we need to adapt on, versus having a team catch it later that you should have blocked it or segment it. So that’s where we’re really making the drive easier for companies like Palo.

Tom Field: Good. Anyone add to that, Rich?

Rich Campagna: Yeah. No, I think, you know, that, um, maybe just add to that a little bit, that the customer view on this is that in an ideal world, they would put all traffic, even their east-west traffic inside of their organization, through full Layer 7 inspection for absolutely everything. That’s not practical from a cost standpoint. It’s not practical from a management operations standpoint. Um, so, you know, in terms of, in terms of critical assets, you know, part of the core value here is we will take, you know, the traffic from those critical asset, assets that you absolutely want to inspect. You want to be absolutely certain that nothing is, uh, you know, nothing that’s making its way into your, I don’t know, your ERP systems or some other, you know, critical data store, has not been somehow compromised, or, you know, some, some bad actor that’s compromised machine is not getting in there. You want to prov— provide that full Layer 7 protection for all of those critical assets and, and applications. And that’s, I think, really, um, it meets the need for, for the customer. They’re fine with your iPad, no offense to your iPad, uh, you know, but, you know, talking to maybe a print server, you know, printer somewhere locally on the, on the network, with Layer 3, Layer 4 segmentation, but it’s when a real critical asset, that’s where they want to apply that Layer 7 protection. So they identify with Zero Networks that this is a critical asset and use that to steer traffic into a full Layer 7 security capability.

How does the integration simplify policy management across hybrid environments?

Tom Field: So, back in the CISO’s position, we’re going to accept the premise that my security, security policies are a mess. I don’t think I’m alone there. Okay. How is your integration going to simplify security policy management and ensure consistency across the hybrid environments I work with?

Rich Campagna: It’s actually, it’s a, it’s a pretty beautiful integration, in that, um, you know, at the core — I described this before — what the Zero Networks technology is doing first and foremost is identifying assets, right, and applying that least privilege to it. And when it identifies that asset, identifies your iPad, it identifies that, you know, IoT device, and identifies my, you know, my PC on, on the network, it takes that identification, and it may change as I move around, you know, maybe our, our campus, uh, location as an example. My, you know, my IP address is going to change. The correlation between what’s happening on the network and the device attached to it will change. Takes all that information and in a continuous basis feeds that into the Palo Alto Networks firewalls, so that you have this consistent set of, uh, always up-to-date understanding of what’s on your network and what is communicating everywhere, both in the firewalls and at the local network level itself. Uh, and that really simplifies policies, allows you to unify that policy across both of these systems. And, and not only are they unified, but they’re, everything is always up to date. So when, when an asset moves, uh, you know, round, around an organization’s network, uh, there’s no need to, you know, kind of, kind of re-update policies or make changes. Everything is already update, up to date and automated.

Tom Field: Good.

Chris Boehm: Yeah, I mean, that’s well said. Visibility, obviously, uh, is a huge key when it comes to compliance and regulation and knowing what you’re doing and how you’re handling it from an audit trail perspective. We provide that audit trail visibility as well, and it scopes into tagging, and it enriches it from a policy manager perspective. I mean, all well said. So this guy knows our product pretty well.

Tom Field: Sounds like you know each other pretty well. So, Rich, Chris, thank you so much for taking time to talk about this partnership and this integration.

Rich Campagna: Of course. Thank you, Tom. Always a pleasure.

Tom Field: You’ve just heard from Rich Campagna with Palo Alto Networks and Chris Boehm with Zero Networks. For Information Security Media Group at ISMG studio, I’m Tom Field. Thank you so much for your time and attention today.