AINEWS
The undisclosed price deal is Palo Alto's fifth security acquisition in 2026, a $29 billion plus push to turn Cortex from a security analytics product into software that can act without a human in the loop.
Palo Alto Networks said Tuesday it has agreed to acquire Console, a startup whose AI agents investigate alerts and remediate issues on their own. The deal is the fifth security acquisition Palo Alto has closed in 2026 as it tries to convert its Cortex security-operations platform from a product that displays alerts into one that can act on them.
Console's technology connects to a customer's identity systems, SaaS applications, security tools, and other systems, then uses AI agents to understand a request, gather context, execute a workflow, and document what happened, according to Palo Alto's press release. In practice, a security analyst could type a plain-English instruction, and the system would triage alerts, pull context, run a response playbook, and write up the result.
Chairman and CEO Nikesh Arora framed the deal as the company's "shift to software-as-an-agent," a positioning line that appeared in both the corporate release and the investor relations filing. Cortex, the security-operations platform at the center of the bet, is what gets the new arms and legs. Console's CEO and co-founder Andrei Serban said the startup was built around a simpler premise: "people should be able to express an operational goal, and intelligent software should handle the complexity required to achieve it."
The deal is the fifth leg of a nine-month consolidation campaign. Palo Alto closed observability vendor Chronosphere for $3.35 billion in January, identity-security company CyberArk for $25 billion in February, security posture startup Koi for roughly $400 million in April, and AI-infrastructure startup Portkey in May, according to a NetworkWorld timeline of the year's deals and the Console investor release. Cumulatively, the four named deals represent about $28.75 billion in disclosed spend; the Console price was not disclosed, and the close is subject to customary conditions.
The five deals share a direction. Chronosphere, CyberArk, Koi, Portkey, and now Console each add a different layer to the Cortex platform, and all four named-price deals closed inside 2026. The strategic read: Palo Alto is buying its way into agent execution rather than building the agent runtime in-house. The pressure cuts two ways. Splunk and Microsoft Sentinel, the log-aggregation platforms that anchor most enterprise security operations, are stitching agent features into existing analytics products. Agent-native startups are building greenfield autonomous-SOC platforms from scratch. Palo Alto is trying to land between them, with Cortex as the substrate and the new deals as the executor.
The same velocity creates real risk. Five acquisitions in nine months means five integrations, four of them large enough to reshape the product line. The corporate release does not name an integration timeline, a product-overlap plan, or a customer-migration path for Console. Arora's "software-as-an-agent" framing is also vendor copy. The release provides no deployment metrics, no autonomous-SOC adoption numbers, and no third-party validation that an agent-driven Cortex outperforms the dashboard-driven version at enterprise scale. Serban's claim that the technology can "dramatically slash overhead" is a press-statement line, not a measured result.
The announcement landed on Palo Alto's earnings day. ABC Money, citing a Benzinga pickup, reported the company also disclosed a stock slide, though the release itself does not connect the two events. SEC filings for the deal are not yet visible on Palo Alto's EDGAR 8-K index; the Form 8-K covering material acquisitions is the next read.
The open question is whether the consolidation buys time or buys a different kind of problem. If Cortex can credibly act on the alerts it surfaces, the platform is a step ahead of the SIEM incumbents and the agent-native startups that have to build distribution. If the integrations slip or the autonomous workflows underperform, Palo Alto will have paid a $28.75-billion-plus disclosed-price premium to be a faster follower. The next data point is the Console close, and the first 8-K that names integration milestones.