What is the key difference between prevention policies and extension policies?

In Palo Alto Cortex XDR, security policies are structured into distinct profiles based on their function. Prevention policies (or profiles) are fundamental to the agent's security posture, configuring the core threat prevention engines. These include modules for malware protection (local analysis, WildFire integration), exploit protection, and behavioral threat protection. In contrast, extension policies (or profiles) are used to manage and configure add-on modules that extend the agent's capabilities beyond core threat defense. A prime example is the Device Control module, which manages the use of USB and other peripheral devices.