Palo Alto Networks at internet scale: 20,383 services, and 613 GlobalProtect portals

A security vendor that sells its own edge appliances to thousands of customers is also, unavoidably, part of the internet's measured surface. Recent ZoomEye queries put numbers on that surface for Palo Alto Networks, and the pattern is smaller and more concentrated than the brand's market share might suggest.

Context and method

The figures were collected on 26 September 2026 through the ZoomEye Python SDK. Each query is listed with its sub_type, where all covers every matching service and web restricts the result to identified web components.

Query	sub_type	Total
app="Palo Alto Networks"	all	20,383
app="Palo Alto Networks"	web	0
app="GlobalProtect"	all	613
app="GlobalProtect"	web	0
app="PAN-OS"	all	3
port=9440	all	1

The uniform zeros deserve a comment before the analysis. An empty web result does not mean there are no web interfaces. It means ZoomEye's web identification layer did not attribute a component to the result set for that pattern. Edge appliances are usually identified by the patterns the vendor bakes into their login pages, and those patterns may not map to a web component classification.

Analysis

The ratio between the vendor pattern and the product names is the interesting finding here. app="Palo Alto Networks" returns 20,383 services, app="GlobalProtect" returns 613, and app="PAN-OS" returns 3. If those three numbers described a single deployment, the conclusion would be that 97 percent of the estate uses no recognized naming. That is almost certainly wrong. What it actually shows is that internet-wide identification of this vendor's appliances depends on a small set of page signatures, and most deployments answer with something the scanner does not map to a vendor string.

The GlobalProtect number is the one with operational meaning. A GlobalProtect portal is a remote access entry point: it authenticates users, it brokers VPN sessions, and it sits in front of the network that everything else protects. 613 reachable portals is a small number in absolute terms, and each one is a door into a specific organization's internal network.

A second practical point concerns the appliance management plane. Port 9440 is a commonly documented management interface for this product family, and the single result for that pattern is a reminder that exposing a management interface to the internet is rare in this vendor's fleet, whatever the state of the data plane.

Implications

The value of a small number is that it can be reviewed exhaustively. An organization that watches GlobalProtect exposure can treat its own count as a precise figure rather than an estimate, because the identification method is narrow and the population is small. That is the opposite of the situation with, for example, generic web server fingerprints, where counts run into the hundreds of millions and the practical question is only about scale.

For defenders running this product, two actions follow. First, confirm whether the organization's own portal appears in a ZoomEye result for the GlobalProtect pattern, which answers the external reachability question directly. Second, treat any portal that does appear as an authentication system first and a network device second: the patching, account review and logging discipline that applies to identity infrastructure applies here, because that is what the portal is.

References

[1] ZoomEye cyberspace search engine.

[2] Palo Alto Networks security advisories.