PAPA case studies

PAPA · Put your knowledge to work in context.

The Palo Alto Networks Certified Professional Accreditation (PAPA) is listed under Palo Alto Networks Education & Training as a professional-level accreditation, and this page is an independent study resource for candidates preparing for it. Our profile covers four domains: AI Security, Network Security, Security Operations, and Cloud Security, each weighted at 25 percent. The PAPA case studies are 5 cases and about 5,264 words.

Atlas RAG assistant: indirect injection turned data-exfiltration channel

Northwind Health's internal assistant "Atlas" answers policy questions for 4,200 staff, retrieving from SharePoint and Confluence and citing sources. Retrieval returns the top 8 chunks to a third-party LLM API; the web renderer displays markdown, including remote images.

1,053 words, about 5 min 2

Branch SD-WAN decryption rollout versus pinned POS terminals

Vantage Retail operates 180 stores behind an MPLS network it is replacing with SD-WAN and a next-gen firewall at each branch, with local internet breakout. The security team enabled outbound TLS decryption on branch firewalls for all URL categories except finance and health, as a pilot at 40% of sites.

948 words, about 5 min 3

Six analysts, 2,300 alerts a day, and one beacon that waited 52 hours

Meridian Logistics' SOC has six analysts across two shifts plus a manager, a SIEM ingesting 4,100 sources, and roughly 2,300 alerts per day. Only 38% are triaged; the rest auto-close after 24 hours.

1,038 words, about 5 min 4

74 AWS accounts, 11,400 findings, and one leaked access key

Cloudpost is a B2B SaaS company on AWS with 74 accounts under Control Tower, plus 12 GCP projects used by data science. It runs 41 EKS clusters and deploys roughly 220 times a week through CI/CD.

1,096 words, about 5 min 5

Malicious pickle in the model registry and an unannounced model swap

Halcyon Analytics fine-tunes open-weight models for insurance claims triage. Its ML platform team pulls base models and LoRA adapters from a public hub into an internal registry, then serves them on GPU nodes that mount S3 buckets with write access to the claims lake.

1,129 words, about 6 min