Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Palo Alto Networks CEO Nikesh Arora said the IBM QRadar deal would “hopefully cement” the company’s place in the security information and event management (SIEM) and security operations center (SOC) market. The deal did improve Palo Alto’s access to established SIEM customers—but it was not a purchase of all QRadar, nor proof that Palo Alto became the market leader. Palo Alto acquired selected QRadar SaaS assets and related customer relationships; IBM retained QRadar on-premises. The strategic prize was converting customers to Palo Alto’s Cortex XSIAM platform.
What Arora meant by “cements our place”
Arora made the remark in May 2024 as Palo Alto discussed its planned acquisition of IBM QRadar’s SaaS assets. He was describing a strategic goal, not announcing an independently verified market ranking. Palo Alto already sold Cortex XSIAM, a security-operations platform with SIEM capabilities alongside functions such as extended detection and response (XDR), security orchestration, automation and response (SOAR), and attack-surface management. QRadar offered a recognized enterprise SIEM brand and an installed customer base that could help Palo Alto enter accounts where it was not the incumbent.
Arora also pointed to Palo Alto’s previous absence from Gartner’s influential SIEM Magic Quadrant, contrasting its position with IBM’s history in the category. Access to QRadar customer relationships and contracts could give Palo Alto an earlier opportunity to discuss XSIAM migration than waiting for each customer’s agreement to expire. That is a route to stronger positioning; it does not by itself establish leadership by market share or product performance. CRN’s May 21, 2024 coverage reported Arora’s comments.
What Palo Alto acquired—and what IBM kept
The companies announced their partnership and planned transaction on May 15, 2024. Palo Alto completed the acquisition on August 31, 2024. Its purchase covered selected QRadar SaaS assets, certain intellectual-property rights, customer relationships and SaaS contracts, together with related transition arrangements. It did not encompass the entire QRadar product family.
#1 Best Overall
- Transferred to Palo Alto: selected QRadar SaaS assets and related rights, customer relationships, and SaaS customer contracts.
- Retained by IBM: the QRadar on-premises business, along with IBM’s broader security portfolio.
IBM’s annual report describes the transaction as involving selected SaaS assets, not the on-premises business. Palo Alto’s acquisition explainer and closing announcement identify the completed deal’s scope. The distinction matters: headlines saying Palo Alto “bought QRadar” can wrongly suggest that IBM’s on-premises customers automatically became Palo Alto customers or that their product was included in the sale.
The commercial logic: SaaS assets, on-premises migration potential
Palo Alto disclosed $500 million in upfront consideration plus contingent earn-out consideration. The earn-out was tied to qualifying QRadar on-premises customers migrating to Cortex XSIAM; a Palo Alto filing identifies qualifying transactions through June 30, 2028. The arrangement therefore linked some of the deal’s future economics to customer conversion, not simply to the SaaS assets acquired at closing.
On Palo Alto’s corrected Q3 FY2024 earnings-call transcript, the company said QRadar SaaS generated approximately $100 million in calendar 2023 revenue. That is Palo Alto’s disclosure about SaaS revenue for that calendar year, not a measure of all QRadar revenue or a promise of equivalent revenue after the acquisition. Palo Alto also cautioned that recognized fiscal-2025 revenue could be substantially lower because of contract and deferred-revenue considerations. The same transcript described access to the on-premises QRadar customer list and the migration-linked earn-out. Read the corrected transcript.
IBM Consulting was positioned to support eligible customer migrations to XSIAM. The 2024 announcement described no-cost migration services for qualified customers, but that wording should not be read as a guarantee that the entire replacement project would cost nothing. Buyers should establish the current offer’s eligibility, scope, geography and exclusions, and separately budget for any new platform licenses, architecture work, integrations, training, internal labor and transition operations. The partnership announcement also described continued IBM support, fixes, connector updates and expanded consumption options for on-premises customers choosing to remain on QRadar at that time.
Free tools Windows power users keep installed
One-click scans. No signup required.
Why XSIAM is not simply a QRadar replacement
Palo Alto’s strategic case is platform consolidation: bring security operations functions together rather than replace one SIEM with an identical one. XSIAM is positioned as a broader platform, and a customer may value combining analytics, detection and response capabilities. Fewer disconnected tools can simplify operations, but a wider platform migration can also change how data is collected, detections are authored, analysts investigate alerts and services are licensed.
Organizations should compare operating models and total cost, not just feature lists. A QRadar deployment with extensive custom rules, reports, playbooks or integrations may require substantial mapping and testing. A broader commitment to one vendor can reduce tool sprawl while increasing dependence on that vendor’s ecosystem. Telemetry ingestion, retention, add-ons, support and parallel-running costs can affect the economics even when migration services are offered at no cost. Public pricing is not a reliable basis for a universal comparison: enterprise quotes depend on workloads, data volumes, terms and scope.
What happened to QRadar SaaS after closing
The SaaS transaction did not become a long-term plan to maintain an independent Palo Alto-owned QRadar SaaS line. In 2025, Palo Alto announced end-of-sale and end-of-life treatment for acquired QRadar SaaS products. The lifecycle summary lists April 14, 2026 as the end-of-life date for several named QRadar cloud products. Existing subscriptions and support obligations were to be honored through the earlier of the applicable subscription end or relevant product end-of-life date. IBM support documentation addressed QRadar SaaS customers during the transition.
Those notices apply to the acquired QRadar SaaS products, not IBM’s QRadar on-premises products or SKUs. Product branding can span multiple components, so customers should verify the exact product, entitlement and lifecycle entry rather than assume every QRadar-branded offering has the same deadline. Consult Palo Alto’s end-of-sale notice, end-of-life summary, and IBM’s QRadar SaaS divestiture notice for the applicable product and support details.
Recommended Free Tools
What QRadar customers should evaluate
Start with the deployment and contract
- QRadar SaaS or cloud: Identify the precise product and entitlement, applicable subscription end, lifecycle date and migration eligibility. Coordinate with the relevant support contacts and obtain written confirmation of transition responsibilities.
- QRadar on-premises: The SaaS acquisition did not itself require a move to Palo Alto. Check IBM’s current support and lifecycle commitments for the deployed version, appliance and contract; do not rely on the SaaS notice to determine on-premises status.
- QRadar Suite or mixed deployments: Confirm the status of each component. A shared brand does not mean every SKU follows the same lifecycle.
Inventory what a migration must preserve
- Custom correlation rules, offense logic and suppression rules.
- Saved searches, dashboards, reports and compliance evidence.
- Log sources, collection agents and identity, endpoint, network, cloud and application integrations.
- SOAR playbooks and threat-intelligence feeds.
- Retention periods, legal holds, data residency and investigation history.
- Analyst workflows, training needs, service contracts and operational ownership.
Before committing, ask for a written mapping of sources, detections and playbooks; test representative content; agree how historical data will be retained or transferred; and define detection-parity acceptance criteria. Also document search and performance requirements, rollback or coexistence plans, professional-services responsibilities, and a complete commercial quote covering ingestion, retention, add-ons, support and services. Preserve records and investigation evidence before cutover.
Rank #4
Compare alternatives against the organization’s operating model
XSIAM is one option, not the only destination for an on-premises QRadar customer. Depending on existing skills, infrastructure and requirements, buyers may assess Microsoft Sentinel, Splunk Enterprise Security, Google Security Operations, or remaining with IBM while support and roadmap meet their needs. Their pricing models and procurement paths differ, and workload-specific quotes are often necessary; compare data volume, retention, integration effort, support, migration services and the cost of running systems in parallel.
A staged coexistence project can reduce cutover risk, particularly for a highly customized deployment. It also extends the period in which an organization must operate and potentially pay for two platforms. The right choice depends on validated migration effort, required controls, total cost and the value of consolidation—not the acquisition announcement alone.
What the deal proves—and what it does not
The transaction gave Palo Alto a faster route to SIEM customers and a substantial opportunity to position Cortex XSIAM as a broader security-operations platform. Its earn-out structure and later QRadar SaaS lifecycle decisions reinforce that migration and customer conversion were central to the strategy. But Palo Alto bought selected QRadar SaaS assets, not IBM’s on-premises business; customers still faced contractual and technical decisions; and Arora’s “cements our place” line was an executive view of strategic positioning, not independent evidence that Palo Alto became the SIEM market leader.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
