Outpost fundamentals and planning - An outpost enables you to have security scans performed on infrastructure in a cloud account owned by you. Learn about outpost fundamentals and what to consider when planning your outpost. - Administrator Guide - Cortex XDR - Cortex - Security Operations

Configure a managed outpost when there is sufficient trust between you and Cortex Cloud. Cortex accesses your environment more extensively and with less mediation.

Choose to deploy and manage your own outpost if:

In these cases, you might prefer to keep your data within your own network boundary.

Most of the cloud resources involved are charged to Palo Alto Networks instead of to you, so scan costs are reduced.

This mode requires additional cloud provider permissions and may incur additional cloud costs.

Cortex-managed outposts require zero management from you.

Outposts incur some additional maintenance overhead. This includes securing the outpost, managing the necessary IAM roles and permissions, upgrading versions, and adjusting cloud provider quotas to meet workload demands. Actively manage your capacity and quotas to meet the workload requirements.

For DSPM, your actual data is accessible to Palo Alto Networks—not just metadata. Rest assured, your data are deleted after scanners have completed. Zero trust security is used to secure your data in Palo Alto Networks-owned accounts.

For DSPM, only metadata is accessible to Palo Alto Networks—not your actual data.

DSPM on SaaS (such as for Snowflake and Office 365) is currently supported only for cloud scan.

DSPM on SaaS (such as for Snowflake and Office 365) is not supported for outpost scan.

Trust model

Cortex XDR interacts with your environment via dedicated IAM roles within the outpost. This establishes a secure trust relationship that adheres to the principle of least privilege.

Data security and residency

Outposts utilize a regionally symmetric architecture, processing data locally within the same cloud region and provider where it resides. Only metadata is ever sent back to Cortex XDR.

Scan operations

Scanning is performed by task-specific, ephemeral VMs built from hardened and continuously patched images. These instances are automatically terminated and all temporary resources are purged immediately after a scan completes.

Secure orchestration storage (such as buckets)

Scanner VMs operate in isolated private subnets without direct internet or Cortex XDR access. They communicate exclusively through encrypted, cloud-native storage used for operational data and scan results—never raw customer data.

Temporary processing storage (such as artifact buckets)

For specific scans where direct data sharing is restricted, data is temporarily placed in encrypted regional storage for analysis. Cortex XDR has no read permissions on this storage, and all data is deleted immediately after the job finishes.

Scanner isolation

Each scanner VM is purpose-built with a strictly defined set of permissions and network access tailored to its specific job. This ensures complete compartmentalization between different scan types.

Data encryption

Security is enforced through universal encryption at rest and in transit. Advanced egress filtering locks down external traffic to verified destinations, and secrets are managed via your own cloud-native secret management service.