Palo Alto Networks Acquires Koi to Bolster AI Agent Endpoint Security

Security operations teams are grappling with faster attacks and a growing volume of alerts as enterprises adopt generative AI. Palo Alto Networks has been expanding Cortex, its AI-driven security operations platform, to move beyond dashboards and ticket queues toward autonomous response. Console, founded in 2024 by Andrei Serban, lets users converse with enterprise data and build agentic workflows in natural language, automating tasks such as signal investigation, prioritization and remediation.

Palo Alto Networks said on Sept. 1, 2026, that it had acquired Console and would integrate its technology into Cortex. The company did not disclose terms, but TechCrunch reported on Sept. 2, citing two people familiar with the deal, that the purchase price was $500 million in cash and stock. Console had raised $29 million, including a $6.2 million seed round led by Thrive Capital and a $23 million Series A co-led by Thrive and DST Global, and was valued at $157 million before the sale, according to PitchBook.

As enterprises shift from chatbots to AI agents capable of carrying out tasks autonomously, risks such as unauthorized actions, data leaks and runaway costs are rising in tandem. U.S. cybersecurity company Palo Alto Networks therefore targeted AI gateway provider Portkey, aiming to integrate model routing, access governance, token usage monitoring and runtime protection into Prisma AIRS to strengthen security controls after LLM deployment.

Palo Alto Networks signed a definitive acquisition agreement on April 30, 2026, and completed the transaction on May 29. The total consideration reported to the U.S. Securities and Exchange Commission was $140 million, payable in cash and replacement awards and subject to adjustment. Portkey will become the core AI Gateway for Prisma AIRS, providing centralized monitoring, orchestration and governance of enterprise AI agents and their interactions with models.