Palo Alto Networks: Claude for thousands of developers — feature development velocity up 20–30%

• Palo Alto Networks accelerates development with Claude (customer story) — Anthropic / Claude (кейс-стади)
• Palo Alto Networks: Accelerating software development and security with Anthropic's Claude and Google Cloud — Google Cloud (customer story)

Background

Palo Alto Networks is the largest cybersecurity company: a global provider of comprehensive network security products and services. An engineering organization of thousands of developers faced the question the whole industry was asking in 2024–2025: how do you raise developer productivity with generative AI without sacrificing the quality and security of shipped code? For a company that sells security, the second clause is not a caveat but the essence of the brand.

The program was led by Gunjan Patel, Director of Engineering in the Office of the CPO, with a cross-functional team of engineers. The methodology was systematic from the start: the team did not rush to deploy "some AI" but first mapped the developer lifecycle to identify which tasks are most error-prone and consume the most time. Tools were chosen against that map.

A formal evaluation of several LLMs and coding assistants followed. The winner was a combination: Sourcegraph Cody as the IDE interface with Anthropic's Claude models as the backend, deployed on Vertex AI in Google Cloud — the pairing that, per the team's assessment, best matched the company's focus on security and safety. The case is documented twice — by Anthropic and by Google Cloud — offering the rare chance to cross-check the numbers of two interested parties against each other.

The deployment scale in two snapshots: the Google Cloud story describes a 150-developer pilot and a subsequent rollout to 3,000; Anthropic's story cites 2,500 developers onboarded with 3,500 more ramping up. It is one of the largest publicly documented deployments of AI development assistants in the cybersecurity sector.

Problem

In cybersecurity the cost of a bug is higher than anywhere: "If a bug is found later, that's what costs money and reputation and customers are not happy," says Patel. A vulnerability in a product that itself protects customers' infrastructure hits trust harder than any failure in ordinary software. So development acceleration could not trade against quality: on the contrary, AI had to reinforce quality control.

Mapping the developer lifecycle showed exactly where time and quality were being lost. 30–35% of developer time went into the initial development phase — identified as the critical error-prevention point. Onboarding was another bottleneck: a new employee needed up to six months to become fully proficient in the company's extensive and complex codebases — and all that time senior developers spent hours manually guiding newcomers through the code structure.

The industry's specifics set a separate layer of requirements. Palo Alto Networks' source code is a sensitive asset: the solution had to keep code within the company's data boundaries rather than send it to uncontrolled external services. Plus the infrastructure demands of scale: thousands of developers need stable inference throughput without degradation at peak hours, and a predictable cost model that can be planned on an annual horizon. Finally, a vendor filter: a company selling security could not work with a model provider for whom safety is a secondary concern.

Solution

The solution's architecture is a model pairing split by latency and depth. Claude 3.5 Haiku handles real-time code completion: the fast, cheap model suggests the next lines as developers type. Claude 3.5 Sonnet works in pair-programming mode via IDE chat: a developer asks "help me improve the performance of this code" — the system gathers relevant files, sends them to Sonnet, and returns a ready snippet. The interface is the Sourcegraph Cody plugin in the IDE; the backend is Claude on Vertex AI. "The combination of Claude on Vertex AI with Sourcegraph enabled us to keep our source code within our data boundaries and performed well in coding tasks," Patel explains.

Usage scenarios diverged by experience level. Juniors lean on Claude's ability to explain code: the model understands the overall codebase, and new hires start contributing within weeks instead of months without burning senior developers' time. Experienced engineers use Claude as a partner in tricky debugging and architecture brainstorms — the case quotes the live phrasing: "Hey, check my logic on this" and "I'm stuck on this bug; can you help me brainstorm?"

The rollout followed the canon: a pilot with 150 developers from junior to senior, impact measurement, then scaling to thousands of engineers. Infrastructure-wise, scaling leaned on two Google Cloud capabilities: granular usage-based GSU (Generative AI Scale Units) pricing with flexible commitment periods — six months or a year — and provisioned throughput for consistent performance. Patel describes the switch from on-demand to provisioned throughput with enthusiasm rare in enterprise case studies: "We didn't think that switching from on-demand to provisioned throughput would work easily. But it really did work — flawlessly. All we had to do was change the endpoint, and everything ran smoothly. That was a huge win for us."

The next frontier is AI post-processing of code in CI/CD: a developer writes code with Claude in real time, and after the pull request is created, AI takes over offline — improving variable names, adding clarifying comments, automatically generating and running unit tests, then identifying security issues in the code and automatically suggesting patches. "These efforts will contribute to cleaner, more readable code while simultaneously addressing vulnerabilities and strengthening security," says Patel. His team is meanwhile mapping each development team's processes in search of the next AI leverage points — and questioning the process structure itself: "Software development lifecycle was designed before the AI era... we probably won't have all these stages."

Result

The headline numbers agree across both case studies: feature development and code implementation velocity rose 20–30%. Unit test writing speed increased 10–30% — and that is not just productivity: more tests mean fewer bugs and a higher-quality codebase. Junior developers complete tasks 70% faster, and their onboarding dropped from months (up to six) to weeks. Scale: a 150-developer pilot → 3,000 in rollout per Google Cloud's version; 2,500 onboarded and 3,500 ramping per Anthropic's. Patel sums up why this matters to cybersecurity: "Running Claude on Google Cloud's Vertex AI not only accelerates development projects, it enables us to hardwire security into code before it ships."

A separate result is the vendor selection criterion Patel states outright: "Anthropic prioritized safety and security a lot more than other LLMs. They discuss security and safety implications in every meeting. As the largest cybersecurity company, that's a big deal for us."

Framing. All figures are the company's self-report published by two interested vendors (Anthropic and Google Cloud); the methodology behind "feature development velocity" is not disclosed; the juniors' 70% is an estimate for a specific type of integration task; the 2,500/3,000 developer discrepancy between the stories reflects different snapshot moments — a reminder that numbers in vendor stories are point-in-time, not audited.

Editorial analysis. First: this is a rare case where an AI assistant's ROI is computed not "on average" but by segment — and the biggest win sits with juniors (70% vs 20–30% average). The practical takeaway inverts the "AI amplifies the strong" intuition: in large engineering organizations AI primarily levels the team and converts six-month onboarding into weeks, which is direct money in hiring and scaling. Second: the sequence "map the process → measure a pilot → scale" matters more than any single number here; the leverage point (the initial development phase, 30–35% of time) was chosen from data, not fashion. Third: the post-processing pipeline — generating and running tests, finding vulnerabilities, and auto-patching after every PR — sketches a deeper restructuring than an IDE assistant: AI becomes a pipeline stage with its own area of responsibility, and Patel's remark that "we probably won't have all these stages" reads like the announcement of the next case study. Finally, note what gets measured here: PANW is one of the few to publish not just "average productivity" but segmentation by seniority (juniors/seniors) and a separate testing metric. The more granularly a company slices its own numbers, the more reason there is to trust them — by that criterion, the PANW case is markedly more evidential than the average vendor report.

Lessons learned

1. A cheap fast model for completion + a strong model for IDE chat is the working pair for mass AI adoption in engineering: latency where speed matters, intelligence where depth matters.
2. Start with a process map, not a tool: Palo Alto first found where time and quality leak (30–35% — the initial phase) and only then chose the LLM.
3. Juniors gain the most (70% faster tasks): AI levels the team and cuts onboarding from months to weeks — price that effect in hiring dollars.
4. AI in CI/CD (tests, comments, vulnerability detection, auto-patches) pays off faster than flashy scenarios: a bug caught before release is direct savings in money and reputation.
5. For regulated and security-sensitive industries, the vendor's safety posture is a selection criterion on par with model quality.
6. Keep code within your data boundaries: an IDE plugin + a model inside your cloud perimeter (Vertex AI) removes the main legal blocker to adoption.
7. Flexible access infrastructure (GSU pricing, provisioned throughput, endpoint swap without code rewrites) removes the main technical barrier to scaling across thousands of engineers.

Frequently asked questions