China Launches Cybersecurity Review of Palo Alto Networks Products
China’s Cyberspace Administration (CAC) has initiated a formal cybersecurity review of products sold by US technology firm Palo Alto Networks in the Chinese market, the regulator announced on Thursday. The review, conducted under China’s National Security Law and Cybersecurity Law, follows the Cybersecurity Review Measures and targets the company’s products for potential risks to critical information infrastructure.
The announcement, published at 17:00 Beijing time on August 6, states the review aims to “ensure the secure and stable operation of critical information infrastructure, prevent cybersecurity risks and vulnerabilities, and safeguard national security.” The official CAC announcement offered no specifics on which products are under scrutiny, no timeline for a verdict, and no list of alleged vulnerabilities.
Escalation in the US-China Tech War
The review comes just one day after Beijing imposed sanctions on multiple US entities and tightened export controls on drones, as reported by SCMP. These measures were responses to recent US actions, including FCC bans on Chinese drones, power inverters, robots, and routers, and the addition of 43 Chinese companies to the Uyghur Forced Labour Prevention Act entity list.
The timing is significant. President Xi Jinping’s planned visit to Washington in September for a summit with President Donald Trump remains on track, but analysts describe the latest measures as a “speed bump” rather than a derailment. Dominic Chiu, senior analyst at Eurasia Group, told SCMP that Beijing’s measures were “calibrated to impose costs without breaking the truce.”
Peter Alexander, founder of Shanghai-based consultancy Z-Ben Advisors, told CNBC that both sides were attempting to create new leverage through sanctions and limitations before the expected summit. William Bratton of BNP Paribas described Beijing as starting to replicate Washington’s approach of invoking national security frameworks to restrict access to technology it considers strategically sensitive.
From Informal Freeze to Formal Proceeding
The August 6 review upgrades Beijing’s approach from informal procurement guidance to a formal legal proceeding. In January 2026, Chinese authorities directed domestic organizations to stop using cybersecurity software from more than a dozen US and Israeli companies — including Palo Alto Networks, Fortinet, Check Point, CrowdStrike, and others — with a transition deadline set for the first half of 2026, as Reuters reported.
The formal review now carries statutory authority under the Cybersecurity Review Measures, which direct reviewers to examine whether a product could be illegally controlled or manipulated, whether supply could be interrupted for diplomatic reasons, and whether sensitive data could be exfiltrated without authorization. A WilmerHale legal analysis of the Micron case detailed these criteria.
Why Palo Alto’s Products Are Significant
Palo Alto’s next-generation firewall products operate at OSI Layer 7 — the application layer — using deep packet inspection to see inside encrypted traffic, identify specific applications, and detect threats. The company’s WildFire service routes file samples and telemetry data to its regional cloud for Asia-Pacific operations, based in Singapore rather than mainland China.
This means Chinese organizations using Palo Alto products are, by default, sending potentially sensitive files and network telemetry outside China’s borders for cloud-based analysis. As TechTimes noted, a firewall at that level is not a passive gate — it is an active observation point.
There is also a dimension beyond product architecture. Palo Alto’s Unit 42 threat intelligence division maintains formal cooperation with the US Department of Homeland Security and the US intelligence community. In February 2026, Reuters reported that Palo Alto executives had ordered Unit 42 researchers to soften a threat report — removing a direct attribution of a global espionage campaign affecting 37 countries to Beijing — after the January ban, out of concern that naming China could trigger further retaliation.
The Micron Precedent
The most relevant guide to what comes next is what happened to Micron Technology. In March 2023, the CAC’s Cybersecurity Review Office announced an identical-sounding probe of Micron products sold in China, also citing critical information infrastructure supply chain security. Approximately seven weeks later, the review office announced that Micron’s products had failed and directed operators of critical information infrastructure to stop purchasing them.
Micron has since effectively exited China’s data center market, though it continues to sell into mobile and automotive segments. As Reuters reported via the Economic Times, the CAC’s latest action echoes its 2023 review of the US memory-chip maker.
Financial Impact and Strategic Implications
The direct financial impact on Palo Alto is expected to be modest. China represents approximately 1-2% of the company’s total sales, and Palo Alto reported $9.22 billion in fiscal year 2025 revenue. Shares fell as much as 4.2% in pre-market trading before paring some losses.
The strategic implications are considerably larger. China’s cybersecurity market is projected to reach $13.03 billion in 2026, and the Asia-Pacific region — $52 billion and growing — is forecast to achieve the highest regional compound annual growth rate globally. The review signals that the cybersecurity layer is now a front in the US-China tech war, alongside semiconductors, telecommunications equipment, drones, and AI.
Analysts at GeopolitEchs identified three possible outcomes: the best case is the review passes after Palo Alto agrees to a “China edition” of its products with telemetry disabled and full local deployment; the middle case allows ordinary commercial customers to continue using the products while government and critical infrastructure operators are barred from new procurement; the worst case mirrors Micron — full failure, full ban on critical information infrastructure procurement.
What’s Next
The review functions as a de facto pre-verdict restriction. Government agencies, central state-owned enterprises, and operators of critical information infrastructure in finance, energy, telecom, and transport will likely suspend new Palo Alto purchases immediately, pending the review’s outcome.
The January 2026 directive covered more than a dozen US and Israeli firms, suggesting this review may serve as a template for other companies. The global cybersecurity market is fracturing along geopolitical lines, with vendors increasingly sold to one bloc or the other.
Whether Palo Alto can satisfy the review through technical remediation — localizing WildFire infrastructure to mainland China, disabling cross-border telemetry, providing source-code access — remains unresolved. The answer may ultimately be determined in Washington at the Xi-Trump summit that both capitals say they are still planning.