China's Cyberspace Administration (CAC) has initiated a cybersecurity review of Palo Alto Networks products sold within the country, citing national security concerns. The announcement from the CAC, published in formal Chinese, referenced the National Security Law and the Cybersecurity Law of the People's Republic of China, as well as the Cybersecurity Review Measures, as the legal basis for the probe.
The regulatory body stated that the review aims to ensure the safe and stable operation of critical information infrastructure, prevent cybersecurity risks and vulnerabilities, and safeguard national security. However, the public justification provided by the CAC did not specify any particular vulnerability, reference any incident, or provide a timeline for the review's findings.
Palo Alto Networks has confirmed that it maintains high standards across its global operations. The company stated that, as of now, the review has no impact on its ability to serve customers or deliver products in the region.
This action by Chinese authorities mirrors a 2023 security review of Micron, which was also announced without prior warning. Weeks after that review, Beijing declared Micron's products a security risk for critical infrastructure, leading to effective sales restrictions and limited explanation. Micron subsequently withdrew its data center and server products from China, resulting in significant annual revenue losses, while domestic chipmakers gained market share.
The review of Palo Alto Networks products aligns with a broader strategy by China to promote technological self-reliance and reduce reliance on foreign technology. In January, Chinese authorities reportedly instructed domestic firms to cease using security software from a list of U.S. and Israeli vendors, including Palo Alto Networks, Fortinet, Check Point, and CrowdStrike, encouraging the adoption of domestic alternatives. Chinese vendors such as Huawei and H3C have been actively positioning their own firewalls and security platforms as replacements for foreign products.
The financial impact on Palo Alto Networks is difficult to quantify immediately, as the company does not separately report its revenue from China. However, potential restrictions could create opportunities for domestic competitors and introduce further uncertainty for Western technology companies operating in China.
This development also has a wider geopolitical context, reflecting a cycle of reciprocal distrust between Beijing and Washington. China has consistently framed foreign technology as a potential national security risk, while the United States and its allies have taken similar actions against Chinese and Russian vendors, including Huawei, ZTE, and Kaspersky. For instance, the U.S. banned Kaspersky's cybersecurity and antivirus products due to national security concerns, citing the software's ties to Russia. The Palo Alto Networks review therefore underscores a trend where cybersecurity products are increasingly viewed as strategic assets rather than solely commercial technologies.
