China opens security review of Palo Alto Networks

China has launched a cybersecurity review of products made by Palo Alto Networks, widening its scrutiny of US technology suppliers as trade and security tensions with Washington intensify.

The Cyberspace Administration of China said the review was intended to identify risks that could affect the country’s critical information infrastructure, network security and national security. The regulator did not specify which products were being examined, how long the process would take or whether restrictions could follow.

The investigation places one of the world’s largest cybersecurity companies under regulatory pressure in a market where Beijing is steadily reducing reliance on foreign technology. California-based Palo Alto Networks supplies firewalls, cloud-security services, threat-detection tools and other products to companies and public-sector organisations.

The review was announced a day after Beijing imposed measures against several US entities and tightened controls on exports of drones, components and related technologies to the United States. China presented those steps as a response to Washington’s restrictions on Chinese technology products and companies.

Under the new drone controls, exports to the US of specified equipment, components and dual-use technologies will face closer examination on a case-by-case basis. Chinese organisations and individuals were also barred from conducting business with targeted US entities accused by Beijing of supporting sanctions or policies that harmed China’s commercial interests.

The measures followed tighter US controls on Chinese drones, telecommunications equipment and other network-connected products. Washington has also expanded restrictions linked to allegations of forced labour in Xinjiang, adding dozens of Chinese companies to a list that can prevent their goods from entering the US market.

Beijing has rejected those allegations and accused Washington of using national security and human rights concerns to limit Chinese competition. US officials have maintained that tighter controls are needed to protect communications networks, sensitive data and critical infrastructure from potential foreign interference.

Palo Alto Networks had already faced signs of a more difficult operating environment in China. Earlier this year, Chinese companies were told to stop using cybersecurity software produced by several US and Israeli suppliers, including Palo Alto Networks, VMware, Fortinet and Check Point Software Technologies.

Security concerns surrounding foreign software have become more prominent as China promotes domestic alternatives across government departments, state-owned companies and strategically important industries. Cybersecurity products attract particular attention because they can monitor network traffic, detect threats and obtain access to sensitive corporate information.

Palo Alto Networks operates in China and has maintained offices in major commercial centres. The company does not separately disclose its revenue from the country, reporting China within its wider Asia-Pacific and Japan business. Any restriction on sales to operators of critical infrastructure could therefore be commercially significant, even if the direct financial impact remains difficult to calculate.

China’s action recalls its 2023 cybersecurity review of Micron Technology. That investigation resulted in restrictions preventing operators of critical information infrastructure from purchasing certain Micron products after regulators said the products posed security risks. Micron rejected the findings but later expanded investment in its China operations while managing the effects of the ban.

The latest review may test whether Beijing intends to apply a similar process to foreign cybersecurity suppliers. Possible outcomes range from demands for technical changes and additional compliance measures to limits on procurement by state-controlled organisations and infrastructure operators.

The investigation also strengthens opportunities for Chinese cybersecurity companies, which have expanded their offerings in cloud protection, network monitoring and threat intelligence. Beijing’s technology policies have encouraged organisations to replace foreign hardware and software with locally developed products, particularly in finance, telecommunications, energy and public administration.

That shift is part of a wider effort to build greater technological self-reliance. China has invested heavily in domestic semiconductors, operating systems, databases and enterprise software as US export controls restrict its access to advanced chips and manufacturing equipment.

Washington, meanwhile, has continued to tighten oversight of Chinese technology entering the US. Drones have become a major focus because Chinese manufacturers hold a dominant share of the global commercial market and supply equipment used by emergency services, infrastructure companies, farmers and public agencies.