Palo Alto Networks has acquired Console, an AI-native startup that lets security teams build autonomous agents using natural language, in a deal valued at $500 million.
The acquisition, Palo Alto’s seventh of 2026, brings a two-year-old company with just $29 million in total funding into one of the largest cybersecurity platforms in the world. The deal was split between cash and stock, according to two sources familiar with the terms. Neither company disclosed full financial details in the official announcement, though the valuation was confirmed by the two sources.
Console, founded in 2024 by Andrei Serban, raised $6.2 million in seed funding and $23 million in a Series A round before the acquisition. The startup built what it describes as “software-as-an-agent” technology: AI systems that perform operational tasks with the context, permissions, and automation needed to execute security actions without constant human oversight.
Beyond Dashboards
Traditional security operations centers rely on analysts manually reviewing alerts, creating tickets, and triaging threats across dozens of tools. Console’s approach flips that model. Users define an operational objective, and AI handles the technical steps: examining an alert, gathering context from endpoint, cloud, identity, and network systems, assessing severity, and initiating a response workflow.
Nikesh Arora, Palo Alto’s chairman and CEO, said security operations must shift from helping analysts work faster to enabling autonomous security outcomes. He described the acquisition as a way for customers to interact directly with enterprise data and create agentic workflows in natural language.
Console will be integrated into Cortex, Palo Alto’s security operations portfolio. The combined platform aims to move analysts beyond dashboard-driven operations where teams manually review alerts and create tickets before taking action. Palo Alto explicitly distinguished Console from copilot-style tools that surface recommendations and leave execution to humans, describing Console’s agents as systems that complete defined tasks end-to-end.
For enterprises, the shift from copilot to autonomous agent raises a key governance question. Agents that can isolate endpoints, trigger remediation processes, or close security cases without human approval for every decision need controlled access to sensitive systems, detailed logging, and safeguards against inaccurate reasoning or unauthorized activity. Palo Alto said Console will support stronger governance of agentic operations, but acknowledged that benefits depend on successful integration into its existing portfolio.
Safety and Scale
Serban said Console’s existing customers have already used agents to reduce operational overhead and improve business processes. Joining Palo Alto gives the startup access to a broader cybersecurity platform, threat intelligence resources, and a global customer base of more than 70,000 organizations.
Palo Alto’s Unit 42 threat intelligence organization will likely provide context for future AI-driven workflows. The company operates across network security, cloud security, security operations, AI, and identity, giving it a wide surface area for Console’s technology to embed. Palo Alto cautioned that referenced future services or features may not yet be generally available to customers.
The cybersecurity market faces a structural problem that Console’s approach is designed to solve. Security teams handle rising alert volumes, increasingly automated attacks, and pressure to reduce the time between detection and containment. The industry’s workforce shortage compounds the pressure: ISC2 estimates a global gap of 4.8 million cybersecurity professionals, meaning the tools themselves need to do more of the work that humans cannot scale.
Autonomous security agents are not without risk. A poorly configured agent with write access to production systems could trigger a false-positive incident response, isolating critical servers or wiping data that turns out to be benign. Palo Alto’s emphasis on governance suggests the company plans to build guardrails into the Cortex integration, including approval workflows for high-impact actions and detailed audit trails. How strictly those guardrails are enforced will determine whether enterprises trust the technology with real operational authority.
A Year of Deals
The Console acquisition fits a pattern of aggressive dealmaking by Palo Alto. The company bought monitoring platform Chronosphere for $3.35 billion and cybersecurity startup Koi for $400 million earlier in 2026. Console at $500 million is a smaller bet, but it targets a specific gap: the infrastructure layer where AI agents run rather than the agents themselves.
The acquisition spree has drawn scrutiny from investors tracking Palo Alto balance sheet. The company spent more than $4.25 billion on acquisitions in 2026 alone, funded largely through operating cash flow and a $1 billion term loan closed in June. Console relatively small price tag makes it one of the more digestible deals in the portfolio, though integration risk remains: Palo Alto must merge Console two-year-old codebase into a platform serving 70,000 enterprises without disrupting existing Cortex deployments.
Palo Alto’s approach contrasts with competitors like CrowdStrike and SentinelOne, which are building agent-based platforms end-to-end. Microsoft, meanwhile, is embedding AI agents directly into its Defender suite for enterprise customers already in the Azure ecosystem. Palo Alto’s bet is that enterprises want infrastructure that works across vendors rather than locking into a single AI stack.
The deal reflects growing enterprise appetite for AI agents that do more than suggest next steps. As the technology matures, the distinction between copilot and autonomous agent will shape both the efficiency gains and the governance risks that security teams face. For Palo Alto, the Console deal is less about a single product and more about positioning for a market where AI does the work that human analysts cannot scale. The question is whether that market matures fast enough to justify the premium the company paid.
discussion