CaixaBank has extended its alliance with US company Palo Alto Networks through 2030 to strengthen its protection against threats linked to advanced artificial intelligence (AI), the bank announced on November 5, 2026. The two companies will launch joint innovation projects and share teams specializing in AI applied to cybersecurity.
Key points of the CaixaBank–Palo Alto Networks alliance in 30 seconds
- CaixaBank and Palo Alto Networks are extending a collaboration that already existed, pushing it through 2030.
- The deal includes joint innovation projects and shared teams dedicated to AI applied to cybersecurity, using both attack and defense methodologies.
- The bank does not disclose the amount involved, the products in play, or how long the two companies have been working together.
- It falls under the 2025-2027 Strategic Plan, which earmarks €5 billion for technology.
- It arrives with DORA already in force, a rule that requires banks to monitor the risk posed by their technology providers.
The announcement talks about strengthening a relationship, not starting one, though it doesn’t clarify when it began or under what terms the previous phase was signed. There are no statements from executives at either company either: the bank’s release includes no quotes, and pieces covered by other outlets, such as El Demócrata or Financial IT, add no further details to the announcement. A search conducted for this article turned up no separate release from Palo Alto Networks about the deal.
What the deal covers, and what it leaves unspecified
According to CaixaBank, the extension brings new lines of work against risks the bank describes as growing. The most concrete piece is the creation of dedicated teams to develop AI-based attack and defense methodologies, aimed at what the bank calls active defense. On top of that come joint innovation projects and closer technical collaboration between specialists from both companies.
The bank justifies the move by pointing out that AI models are changing both how organizations defend themselves and how they get attacked. That’s why, it explains, it wants to rely on a platform that continuously incorporates the most advanced technologies, and it presents the agreement as part of a flexible, adaptable security model. These are the bank’s own assessments, not measured results.
The announcement leaves several points unspecified. For one, it doesn’t name a single Palo Alto Networks product. The company sells families such as Cortex (which includes Cortex XSIAM, its platform for security operations centers, or SOCs), Prisma for cloud and remote access built on SASE (Secure Access Service Edge) architecture, Strata for network security, and Prisma AIRS to protect applications and AI agents — but the announcement doesn’t say which of these CaixaBank uses or will use. It also doesn’t detail the contract’s value, how many professionals will staff those joint teams, or whether Palo Alto personnel will work from the bank’s own facilities.
The only financial figure mentioned is €5 billion, and it’s worth reading carefully. That’s the total technology investment planned under CaixaBank’s 2025-2027 Strategic Plan, which the bank channels through the Cosmos plan, unveiled in February 2025. It is not the value of this particular alliance, but the broader umbrella the bank places it under.
A bank with 21 million customers, now under DORA’s rules
Scale helps explain why cybersecurity takes up so much space in the bank’s strategy. CaixaBank serves 21.1 million customers in Spain and Portugal, according to its results report for the first nine months of 2026, published on October 30, 2026. In that period it earned €4.962 billion, up 12.9% from a year earlier. When it unveiled the Cosmos plan, the bank already set reinforcing its technology platform with the highest standards of resilience and security as one of its goals.
The deal also lands under a regulatory framework very different from the one in place two years ago. Regulation (EU) 2022/2554, known as DORA (Digital Operational Resilience Act), has applied since January 17, 2025, and requires banks, insurers, and other financial entities to maintain a risk-management framework for information and communication technologies (ICT), to report major incidents, to subject their systems to resilience testing, and to control the risk introduced by their technology providers.
That last point hits agreements like this one directly. DORA requires that contracts with ICT providers include minimum clauses on service levels, audits, access to information, and exit strategies, and that entities keep a register of all such agreements. It also creates a European oversight regime for providers deemed critical to the sector. CaixaBank doesn’t explicitly tie the alliance to DORA in its announcement, but any extension of a security contract of this scale falls within that scope. Adapting to the rule hasn’t been easy for the sector: a 2025 survey put the share of EMEA financial institutions admitting they still didn’t comply with the rule at 96%.
This isn’t the bank’s first move in this area. CaixaBank has reported, through its press office, taking part in a European research consortium on new ways to fight AI-driven cyberattacks, as well as in two European cybersecurity projects focused on critical infrastructure.
Palo Alto Networks, a provider in full expansion mode
CaixaBank describes its partner as a multinational headquartered in California, listed on the Nasdaq, with more than 20,000 employees. In recent months the company has expanded its portfolio through a string of acquisitions. The biggest was CyberArk, an identity security specialist, for roughly $25 billion, announced in July 2025 and closed in February 2026. Before that, it had completed the purchase of Chronosphere, focused on observability.
Much of that effort points to the same idea the bank’s announcement captures: using AI to defend systems while also protecting companies’ own AI systems. The company has laid out plans to move AI-based defense toward a continuous model built on third-party language models, and has kept adding pieces such as Prisma AIRS for agent security. Whether CaixaBank will end up using any of these specific tools is, for now, something neither the bank nor the vendor has confirmed.
Frequently asked questions
What have CaixaBank and Palo Alto Networks agreed to?
They have extended their cybersecurity collaboration through 2030 to address threats tied to advanced AI. The deal includes joint innovation projects and shared teams that will work on AI-based attack and defense methodologies.
How much money does the alliance involve?
Neither company has disclosed the amount. The €5 billion CaixaBank cites corresponds to the technology investment in its 2025-2027 Strategic Plan, not to this specific contract.
Which Palo Alto Networks products will CaixaBank use?
The announcement doesn’t specify. It refers to an AI-integrated security platform without naming solutions such as Cortex XSIAM, Prisma, Strata, or Prisma AIRS.
How does the deal relate to DORA?
The European DORA regulation, in force since January 17, 2025, requires banks to manage the risk posed by their technology providers and to reflect it in their contracts. CaixaBank doesn’t explicitly tie the alliance to this rule.
Sources:
- CaixaBank: CaixaBank strengthens its alliance with Palo Alto Networks (November 5, 2026)
- CaixaBank: January-September 2026 results (October 30, 2026)
- CaixaBank: Cosmos plan (February 14, 2025)
- CaixaBank: European AI cybersecurity projects
- EUR-Lex: Regulation (EU) 2022/2554 (DORA)
- El Demócrata
- Financial IT
- ITPro: CyberArk acquisition closes (February 12, 2026)
This article is also available in Spanish: «CaixaBank amplía hasta 2030 su alianza con Palo Alto Networks frente a la IA», on revistacloud.com.
