Get your first audit free.
Create a free Falco Lite account, verify your email, and connect a firewall or Panorama. Falco runs your first audit after you connect and continues with free monthly audits. Use the report to review findings and plan remediation.
Create your free Lite accountFrom connection to first report
Create your free account
Sign up with your name, work email, and organization. Verify your email, then follow the device setup steps in Falco.
Choose your devices
List the firewalls and Panorama instances you want to audit. For Panorama-managed devices, a connection to Panorama lets Falco discover and audit its managed firewalls.
Prepare API access
Create a dedicated service account for configuration auditing. Confirm Falco’s source addresses and the required permissions with our team, restrict HTTPS access to those sources, and review the device certificate before connecting.
Review the first findings
Connecting your first device starts the initial audit. Once it finishes, open the report to review failed checks, affected devices, and remediation guidance. Lite audits run monthly after that.
API access, changes, and stored data
Review the permissions and information involved before connecting a device.
What access does Falco need?
Configuration audits can use a PAN-OS service account with read-only access. Falco connects to the device’s XML API over HTTPS, either directly or through Panorama. Your network rules control access to that API.
Will Falco change my configuration?
Audits inspect configurations. Enterprise tools run with the permissions you grant to the device account. Playbooks (beta) and EDL installation require write access and stage candidate changes for you to review, commit, or push in PAN-OS. Playbooks include a plan review before staging. Command Center runs the commands you submit.
What information does Falco keep?
Falco stores device inventory, configuration data, and audit results. Command Center also stores command responses. When configuration backups are enabled, Falco keeps the last 100 configuration versions per device by default.
Where is Falco hosted?
Falco and all customer data, backups, and disaster-recovery copies are hosted in the United States in our own colocation facility.
Which PAN-OS and Panorama versions are supported?
Falco supports all PAN-OS versions on firewalls and Panorama. Connect Panorama to discover and audit its managed firewalls.
Who can see our devices?
Account Admins can see devices across their customer account. Account Users have read-only access to devices assigned through their groups. Digital Scepter staff can access customer environments to provide support.
Can we require multifactor authentication?
Yes. Falco supports authenticator apps and passkeys. Account Admins can require a second factor or set a policy that requires passkey sign-in.
Need help connecting or acting on findings?
Tell us your device models, PAN-OS versions, and whether you use Panorama. We can discuss setup questions or a paid support engagement for configuration reviews, changes, and ongoing maintenance.