Cortex Xpanse by Palo Alto Networks is an attack surface management platform, born from DARPA in 2012, that provides continuous discovery and monitoring of internet-connected assets across an organization's infrastructure. The platform scans the entire IPv4 space multiple times daily, performing over 500 billion port scans across 4.3 billion IPv4 addresses to identify vulnerabilities, security flaws, and misconfigurations in internet-facing assets. Operating as an agentless solution, it builds and maintains a comprehensive inventory of known and unknown assets, helping organizations track changes and detect risks across their external attack surface, including those from cloud providers, supply chain vendors, and third-party partners. The platform is integrated into Prisma Cloud and specializes in discovering and attributing internet-exposed cloud assets deployed across AWS, Microsoft Azure, and Google Cloud Platform (GCP). Through supervised machine learning models, it maps attack surfaces and prioritizes remediation efforts, while providing threat intelligence data enrichment on IPs, domains, and certificates using information from discovered assets.
