Palo Alto Networks SaaS Deal Referral Program Is Causing Partner Angst: Sources

Palo Alto Networks is launching a new Saas Deal Referral channel program that some partners see as a major shift in channel strategy that has them up in arms, CRN has learned.

Under the new program, Palo Alto Networks plans to pay partners with a 10 percent referral reward for uncovering sales opportunities for its RedLock cloud threat defense offering for Amazon Web Services, Microsoft Azure and Google Cloud.

The launch of the new agent model is creating a divide for the first time ever between the longtime channel stalwart and its partners, according to multiple sources. Several solution providers told CRN they are reassessing their partnerships with Palo Alto Networks and looking at moving business to other security vendors as a result of what they see as the start of a shift to a referral model for a broader array of products.

[Related: Palo Alto Networks Boosts Incentives For Partners Selling Full Portfolio]

"We're going to hit the pause button [on Palo Alto Networks] really hard," said one solution provider executive who asked not to be identified. "This is bizarrely outside their past channel strategy, and I think it's a massive threat to their channel credibility as well as their program."

Partners told CRN that the RedLock program for the first time relegates partners to a referral fee model that they say limits the margin they can make on the RedLock product sale. What's more, partner said, they expect the SaaS Deal Referral program to move to other products besides RedLock, which the company acquired in October for $173 million as part of its stepped-up cloud security offensive.

The company Monday modified its partner program in a move that makes partners selling its full security portfolio up to five times more profitable than those partners reselling a traditional firewall.

Palo Alto Networks first approached partners in the fall and told them that, going forward, six of the company's cloud and software products would be available through a marketplace, with partners receiving a referral fee for each transaction, sources told CRN. At the time, the company had planned to launch the initiative at the end of the year.

That proposal was sharply criticized by solution providers, causing Palo Alto Networks to push back the launch of the program to incorporate channel feedback and tweak its plan, sources said.

Palo Alto Networks is scheduled to disclose details of the new program to channel partners on Tuesday.

In an interview with CRN last week, Palo Alto Networks Senior Vice President of Worldwide Channels Karl Soderlund didn't directly answer questions about whether Palo Alto Networks was planning to shift pieces of its operation around cloud and SaaS to more of a direct sales model. He insisted, though, that the channel-centric DNA of Palo Alto Networks dating all the way back to its 2005 founding is not changing.

"We're always listening to our customers, [and] we're evolving our market approach based on their needs," Soderlund said. "Independent of what our go-to-market strategy is, our partners will always have an important role to play, and we are committed to them moving forward."

In a statement provided to CRN, Palo Alto Networks insisted the SaaS Deal Referral program is not a shift away from partners.

"At Palo Alto Networks, our success has been driven by our channel model, which will continue to be a major part of how we do business," the company said. "The enhancements we are announcing have been developed with close input from partner advisory councils and customer advisory boards, who have shown tremendous support for the initiative and have provided feedback throughout the process."

The company called the new SaaS Deal Referral program a response to changing customer needs. "Customers are telling us they want the speed and flexibility of SaaS offerings for cybersecurity," the company said. "The 10 percent referral rewards partners for bringing RedLock opportunities to Palo Alto Networks. In addition to the referral program, we believe there is a massive services opportunity for our partners and we intend to help them capitalize on it."

Sources said some of the other products Palo Alto Networks is looking at putting through a referral program include: the Evident public cloud security and compliance offering; the cloud-delivered Logging Service for log management; the Traps advanced endpoint protection portfolio; and the Aperture SaaS application visibility tool.

A Palo Alto Networks spokesperson said the referral program only applies to RedLock, and that all of the company's other SaaS products will continue to be sold through a two-tier distribution model.

Nonetheless, partners still see the new SaaS Deal Referral model as a sudden channel shift that is going to result in channel conflict as well as confusion for customers and partners.

Solution providers said a traditional resale agreement with support from distributors allows them to own the paper and the customer relationship from beginning to end. They see the embrace of a referral model as a threat to that longstanding cadence.

"It's going to be World War III for partners," said a frustrated top executive for a longtime Palo Alto Networks partner. "I view it as Palo Alto becoming a quasi-competitor for our business."

One top executive for a solution provider, who did not want to be identified, said his up until now his company has resisted taking on any competing security offerings, but over the past several weeks has spoken with a competing firewall vendor.

Another top sales executive for a solution provider, who did not want to be identified, said he expects solution providers serving SMB and midmarket customers to shift business to Check Point, Fortinet and Zscaler.

The partner, who did not want to be identified, called the new model a "subtle" shift away from channel.

"They're basically creating channel conflict with their own sales organization," said the partner. "It's horrible."

One channel source close to Palo Alto Networks, who did not want to be identified, said the shift represents a move toward a model where customers can buy Palo Alto cloud offerings via a credit card directly from the vendor.

"This is a big change in economics for the channel," said the source of the move to a referral model. "Palo Alto Networks was built on the back of the channel. This is the first major change in channel strategy since the founding of the company. Palo Alto Networks now wants to be a cloud company. The management team is now Google cloud guys. Palo Alto has spent a long time agonizing about this, but let's call this what it is: this is the legacy Palo Alto Networks channel getting cut out. Palo Alto wants to be a security version of Salesforce.com."

One partner executive, though, felt like Palo Alto Networks has done a good job of properly setting itself up for where the market is heading while still showing the importance of the partner community. The days of being a "widget seller" are nearing their end, the partner said, and vendors are going to follow the Salesforce model of going direct with certain pieces of their business where it makes sense.

Partners can retain their value, continue to make money, and stay relevant to Palo Alto Networks customers by wrapping a comprehensive services offering around the products that are being sold through the referral program, the source said.

Multiple sources indicated that the channel culture at Palo Alto Networks began to shift over the summer after new Chairman and CEO Nikesh Arora joined the company. Arora previously served as president and COO of SoftBank Group, and prior to that spent 10 years at Google, which isn't known for its deep solution provider roots.

Several partners said they see new CEO as the driving force behind the introduction of the new referral model. "I believe good channel programs start from the CEO down," the source said.

Soderlund of Palo Alto Networks said that both Arora and new president Amit Singh, who previously served as president of Google Cloud for six of his nine years at the company, have been meeting with the company's channel partners at the most senior level to understand what they're seeing in the market. Neither Arora nor Singh came in with any preconceived notions of how to do things best, Soderlund said, and aren't trying to force a Google culture onto Palo Alto Networks.

"One of the things that both Amit and Nikesh realize is the power of the channel and the alignment of the channel we have, and how vital they are to our go-to-market," Soderlund said.

However, several sources told CRN that the channel is no longer seen as the revenue multiplier it was under former CEO Mark McLaughlin. They say since the arrival of Arora in June and Singh in October – who also spent many years at Google –the channel is not as big a strategic priority as it was under McLaughlin.

One major channel partner, who did not want to identified, said he expects the fallout from the channel shift to have a big impact on Palo Alto Networks' sales in the future. "I think the new guys are going to learn a lesson in just how much the channel can really affect a business," the source said.

Additional reporting by Steven Burke