Prisma AIRS Pricing: Demo-Led Scope and Quote Questions

Prisma AIRS pricing starts with a Palo Alto Networks demo and a scoped proposal. The public platform and runtime pages reviewed on 18 October 2026 describe AI posture and model and supply-chain controls. They also describe runtime protection. The pages name an AI gateway and agentic endpoint security. They publish no numeric amount for a complete deployment. A budget therefore needs module boundaries and traffic assumptions before it needs arithmetic.

TL;DR

• Prisma AIRS uses a demo-led buying path, and the reviewed public pages display no numeric amount for the full platform.
• The portfolio covers posture and runtime, AI gateway and supply-chain security, plus agentic endpoint security.
• Ask the quote to separate modules; protected applications and agents; environments and deployment components; traffic capacity and retention; support and services.
• Keep runtime threat filtering and endpoint agent governance separate from cloud posture and authenticated HTTP authorization.

Prisma AIRS pricing is quote-led

The Prisma AIRS platform page presents a portfolio and routes prospective buyers to sales. Its portfolio includes runtime and posture management alongside supply-chain controls and red teaming. Palo Alto Networks also names an AI Gateway and Agentic Endpoint Security. The reviewed page provides no complete public dollar schedule for that portfolio.

It leaves package names and licensed units to the proposal and order form. Included capacity and overage treatment belong there too, along with term and discounts. Avoid translating the absence of a public rate into "custom pricing" unless Palo Alto Networks uses that wording in the commercial response.

I would reject a purchase request with one line called "Prisma AIRS." The label covers too many technical owners, and a renewal reviewer would have no way to connect the total to the deployed controls.

Save the proposal beside the architecture. Add the review date and sales entity, then list every Palo Alto Networks SKU or entitlement exactly as written.

Portfolio modules create separate cost drivers

AI Security Posture Management scans for assets and configuration risk. Supply-chain controls address model and component risk before production. Red-team work tests applications and agents, while runtime controls inspect production activity. The gateway and agentic endpoint products occupy additional enforcement surfaces.

Each module has a different plausible unit. Posture may depend on cloud accounts and discovered assets. Testing may depend on applications and environments, or on campaigns. Runtime can depend on protected applications, traffic, throughput, or deployment points. Endpoint scope can follow users and devices, or agent installations. Those examples help procurement ask questions; only the written quote establishes what Palo Alto Networks bills.

Create a page with five boxes for the proposed modules. Draw arrows from the buyer-operated cloud accounts, CI pipeline, model endpoints, AI applications, and employee devices into the relevant box. Put the proposed SKU under each one. An unconnected box is either missing architecture or unnecessary commercial scope.

The AI security platform comparison can help separate posture and governance products from live request controls.

AI Runtime Security needs traffic assumptions

Palo Alto Networks describes AI Runtime Security as protection for AI applications and agents that detects and blocks AI-specific threats. The page names prompt injections and data leaks, and it offers a managed runtime route alongside platform information.

A runtime proposal should identify where inspection occurs. Ask which application, agent, gateway, or container paths receive the control. Record supported model providers and protocols. Specify peak requests and payload sizes. Then record expected latency and availability target, plus regions and failure behavior. If the design adds a managed firewall, document who operates it and how traffic reaches it.

Test a blocked synthetic prompt injection and a permitted benign request. Then submit a restricted data pattern and retrieve all three events by transaction identifier. The evidence should show which runtime component acted and under which policy or profile. Record the resulting action and time.

A polished dashboard proves very little by itself. My preference is a small test packet that an engineer can replay after every material policy or routing change. The AI runtime security controls guide provides that acceptance shape.

Gateway and endpoint controls cover different paths

Prisma AIRS presents AI Gateway as an enterprise control plane for AI activity. It also presents Agentic Endpoint Security for autonomous agents operating at the endpoint. Those surfaces can meet inside one portfolio while observing different events.

A backend application may send an authenticated HTTP request directly to an LLM. An endpoint agent may reason locally or call a local MCP server. It can also interact with desktop applications before any model-bound HTTP request appears. Gateway policy can evaluate traffic it receives. Endpoint controls can observe local activity that never crosses that gateway.

Require Palo Alto Networks to map each proposed control to the route it sees. Demonstrate one backend API call and one local-agent action. Disable or bypass the expected control path in a test environment and document the result. This proves the design's coverage limits before procurement treats the suite name as universal reach.

The AI firewall, gateway, and proxy guide explains why placement changes visibility. Use the route map in the security review and the quote review.

Quote normalization needs deployment and service detail

Ask the proposal to itemize modules and licensed units. Require included capacity and overage treatment for every usage-based line. Record protected applications and agents, cloud accounts, endpoints, environments, and data regions. Add hosted and buyer-operated components. Note required Palo Alto Networks products and network changes.

Then capture retention and evidence export. Specify integrations with SIEM, case management, identity providers, and cloud platforms. Name onboarding and policy-tuning work. Record support hours and response targets. Add the escalation routes. Separate training and professional services. List red-team campaigns and managed runtime operations separately.

Preserve contract length and renewal basis. Add price protection and minimum commitments. Record the treatment of new modules. Ask how a module removal affects the remaining package. Record model-provider and cloud costs as separate lines unless the order explicitly includes them.

Finally, request a worked example using the buyer's actual topology. A proposal covering three environments should show which modules and units apply in each. The example is evidence of quote logic, not a reusable public rate.

Evidence ownership belongs in the purchase test

Posture findings, red-team reports, runtime threat events, endpoint events, and gateway decisions answer different review questions. The contract should state export formats and retention for each. It should also state whether the buyer can retrieve evidence after a module or contract ends.

For request-layer policy, the acceptance record should name the authenticated caller and application relay. Include data classification and destination. Add policy version and outcome, plus the timestamp. An endpoint event needs the device and local agent action. A posture record instead names the asset and configuration finding. Combining these into one generic "AI security event" weakens the audit trail.

Put printed examples side by side during the design review. One page can show a cloud asset finding. Another can show a blocked runtime request, while a third shows an endpoint agent event. The different fields make the control boundaries visible to procurement and incident response.

Authenticated HTTP authorization remains a precise boundary

DeepInspect governs authenticated HTTP traffic deliberately routed between users or agents and LLM endpoints. The application supplies identity and role context. DeepInspect evaluates that context with prompt classification and destination under versioned policy, then records the decision independently before allowed traffic reaches the model.

Prisma AIRS can address broader posture, testing, runtime, gateway, and endpoint requirements. Buyers should compare the proposed AIRS gateway or runtime path against the identity-bound acceptance record they need. If it supplies every required field and enforces on the intended route, capture that proof. If another component owns the decision, keep both scopes explicit.

Local execution and browser-only interactions remain outside DeepInspect's HTTP boundary. STDIO calls remain outside it too. Agentic Endpoint Security or another endpoint control owns those paths. Cloud discovery and model supply-chain review also remain separate jobs.

DeepInspect

DeepInspect supplies identity-aware policy and independent decision evidence for authenticated HTTP requests deliberately routed to LLM endpoints. It can sit beside posture, red-team, runtime, and endpoint controls when those products own other stages or paths.

Test the actual routes and attach each result to the corresponding quote line. Book a technical deep dive at deepinspect.ai.