I work with Cisco as well as Palo Alto, and I think Palo Alto does things well. For us, it's about having the best solution, knowing that I can get hold of somebody when I need some help and will the solution break the bank. Cisco's ASA has never really done a great job of fully integrating Firepower. You can write custom signatures but most people aren't ready to do that. PAN is constantly pushing updates and you can set the system to auto download. If you're uncomfortable with constantly adding modules of your software on an auto subscription basis, you can audit each one. And that's all configurable too. You can download updates once you've looked at them or put it on auto mode. 

We also looked at Cisco Firepower.