PAN says its firewalls let administrators create fine-grained policies to deal with these applications, such as allowing Yahoo IM but no others. It also can detect attacks in these traffic streams. By contrast, stateful inspection firewalls are more blunt. If a stateful inspection firewall allows HTTP via port 80, any application that tunnels inside the protocol and uses that port will get into or out of the enterprise, whether security admins like it or not.
PAN's approach is both valid and useful, but here's where the chutzpah comes in. Co-founder Nir Zuk was a principle engineer for Check Point Software and a pioneer of stateful inspection technology. Check Point spent a great deal of effort badmouthing a competing firewall technology, the application proxy. Application proxy firewalls essentially do the same thing that PAN does???identify a variety of applications, inspect them and enforce granular policies on them.
However, back in the 1990s Check Point and its stateful inspection brethren (such as Cisco PIX) did such a great job of denigrating application proxy firewalls that today their share of the firewall market looks like a rounding error.
There are major technological differences between PAN and application proxies (and I'll get to those in a subsequent post), but I find it ironic that Zuk's newest venture is based on concepts Check Point tried to marginalize so many years ago.