Palo Alto Networks has acquired Console, an AI-native platform designed to enable agentic workflows across enterprise operations. This acquisition expands the autonomous capabilities of Palo Alto Networks’ Cortex security operations platform.
Announced on September 1, 2026, the deal aims to help security teams investigate signals, prioritize tasks, and respond to operational issues at machine speed.
Palo Alto Networks stated that Console will enhance Cortex’s agentic AI capabilities, allowing organizations to utilize natural-language prompts to create workflows that analyze information and take action across their environments.
Palo Alto Acquires Console
This acquisition highlights a growing industry trend towards AI systems that do more than just summarize alerts or assist analysts. Agentic systems are designed to achieve defined goals by gathering context, making decisions within configured parameters, and executing multi-step tasks.
In a security operations center, this could involve collecting telemetry from various tools, enriching alerts with threat intelligence, identifying affected assets, updating cases, and initiating remediation actions.
Nikesh Arora, Chairman and CEO of Palo Alto Networks, emphasized that security operations can no longer rely solely on dashboards and ticket queues aimed at making human analysts more efficient.
He described the acquisition as a step towards “software-as-an-agent,” where customers can interact directly with data and use natural language to create automated workflows for alert resolution and remediation.
Console’s platform enables users to express operational objectives while the AI-driven software manages the underlying complexities.
Palo Alto Networks plans to integrate this capability into Cortex, its security operations platform, where analysts frequently grapple with alert overload, fragmented data sources, manual case management, and repetitive investigation workflows.
The company believes that Console will empower enterprise teams by applying AI-driven analysis and action to alerts, issues, and requests. The goal is to reduce operational overhead while improving the speed and consistency of security decisions.
For instance, an analyst might define a workflow such as: investigate high-severity identity alerts involving privileged accounts, correlate authentication events with endpoint activity and known indicators, assess whether the behavior is suspicious, and isolate affected devices if certain risk thresholds are met.
Instead of requiring separate manual actions across different security tools, an agentic workflow could coordinate these tasks under predefined governance controls.
This acquisition comes at a time when enterprises are facing a threat landscape increasingly influenced by AI-enabled attacks, including faster phishing operations, automated reconnaissance, synthetic identity abuse, and more adaptive malware campaigns. In response, defensive platforms are integrating AI into their detection, investigation, and response processes.
However, the pursuit of autonomous remediation also poses risks. Organizations must establish approval gates, limit agent permissions, maintain audit logs, validate AI-generated recommendations, and prevent workflow abuse through prompt injection or compromised data sources.
Palo Alto Networks has acknowledged that some referenced services or capabilities may not be generally available yet, and future delivery remains subject to integration and development risks.
Andrei Serban, co-founder and CEO of Console, stated that the company was founded on the principle that intelligent software should handle the complexity behind a user’s operational goals. He believes that joining Palo Alto Networks will provide Console with essential security expertise, platform infrastructure, and global enterprise reach.
Palo Alto Networks, which claims to serve over 70,000 customers, stated that this acquisition aligns with its broader strategy of delivering AI-driven security across network, cloud, security operations, AI, and identity environments.
Keep your SOCÂ up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.
