Palo Alto Networks Acquires Console for Agentic Security

Palo Alto Networks completed its acquisition of Console on September 1, 2026, adding an AI-native service-management and workflow platform to Cortex. The companies did not disclose the purchase price, valuation, consideration structure, or other financial terms.

The strategic logic is more revealing than the missing number. Palo Alto Networks has spent years helping security teams see, investigate, and prioritize risk. Console adds a way for software agents to understand organizational context, follow permissions and approvals, and execute work across the systems where an alert becomes an actual response.

That changes the operating question around autonomous security. The market has become comfortable asking whether an agent can identify the right action. The harder enterprise question is whether the agent knows who is allowed to authorize it, which systems it may touch, what evidence it must preserve, and when a human still needs to take responsibility.

What Palo Alto Networks Acquired

Console was founded in 2024 by Andrei Serban, now Co-Founder and CEO, and Neal Chandra, Founder and CTO. The San Francisco company built an AI-native service-management platform that connects information about users, applications, devices, tickets, policies, and the systems used to run internal operations.

Teams describe processes in natural-language Playbooks. Console’s agents can gather missing context, resolve routine requests, investigate issues, execute explicitly configured actions, or route work to a person when the situation exceeds the agent’s authority. That mechanism is already useful in IT, where password resets, access requests, device troubleshooting, onboarding, and user-access reviews often cross several systems before anyone can close the work.

Console’s security architecture matters to the acquisition thesis. Connecting an integration does not give an agent write access by default, actions must be configured for the relevant context, and customers can use roles, approval gates, and audit records. Those controls turn the product from a conversational interface into a governed operating layer.

Why Cortex Needs an Action Layer

Cortex already sits near a large amount of enterprise security information. Palo Alto Networks can observe endpoint behavior, identity activity, cloud posture, network traffic, alerts, and threat intelligence across a customer environment. The acquisition brings that view closer to the systems where a remediation must be executed.

Palo Alto Networks Chairman and CEO Nikesh Arora described the goal as allowing customers to work directly with data and build agentic workflows in natural language. The company says Console will deepen Cortex by helping teams investigate signals, prioritize work, and take action across the environment. Palo Alto Networks’ fiscal fourth-quarter release goes further, positioning Console as a way to expand Cortex across enterprise agentic transformation.

The handoff between signal and action is where the product value will be tested. A model may correctly recommend disabling an account, revoking access, isolating a device, or escalating a suspicious event. The enterprise still needs to know which identity is involved, what policy applies, whether an approval is required, which connected system is authoritative, and what must appear in the audit record after the action.

Evidence Console Has Moved Beyond the Demo

Console has disclosed at least $29.2M in financing. TechCrunch reported a $6.2M Seed round from Thrive Capital in June 2025, and Console later announced a $23M Series A from DST Global Partners and Thrive Capital. The company did not disclose a Series A valuation in its official announcement.

Console also publishes evidence that its agents are operating inside real customer environments. The company says Databricks, Webflow, Scale AI, and Flock Safety use Console to automate more than 50% of support requests without human intervention. Its Scale AI case study reports auto-resolution increasing from 15% to 57%, while its Cursor case study says Console handles the majority of Tier 1 and Tier 2 requests for an IT team supporting more than 750 employees.

Those metrics are company-reported rather than independently audited, so they should be read as operational evidence, not a universal benchmark. They still help explain what Palo Alto Networks bought: a platform that has already connected agents to routine enterprise work, learned the context needed to complete that work, and exposed the controls required to keep automation inside organizational boundaries.

How the Console Deal Fits Palo Alto Networks’ Strategy

Palo Alto Networks is assembling adjacent pieces of an AI-era security platform through acquisition. Koi added capabilities for agentic endpoint security. Portkey added AI gateway governance. CyberArk expanded identity security, and Chronosphere expanded observability. Console adds the workflow and execution layer that can connect those signals and controls to action inside Cortex.

The acquirer has the financial and distribution scale to make that integration consequential. Palo Alto Networks reported $3.41B in fiscal fourth-quarter 2026 revenue, $9.10B in Next-Generation Security annual recurring revenue, and more than 70,000 customers. Its fiscal-year statement shows $11.48B in total revenue across product and subscription-and-support businesses.

That scale creates leverage and integration pressure at the same time. Console’s value comes from maintaining a useful model of the organization and making agent actions configurable, reviewable, and auditable. Folding the product into a broad security platform can extend its reach, but the result will depend on whether those context and control advantages survive the integration.

What Security and IT Leaders Should Watch

The acquisition leaves important commercial and product questions open. Palo Alto Networks did not say how Console will be packaged, whether it will remain available separately, how quickly its capabilities will appear inside Cortex, or whether pricing and contracts will change for existing customers. The companies also did not disclose employee-retention arrangements or a detailed integration timetable.

Security and IT leaders should watch the action boundary. The useful measure will be how much work Cortex can complete with the correct identity context, policy controls, approvals, and audit evidence while still escalating the right exceptions to people. A higher automation percentage means little if the organization cannot explain why an agent acted or reverse the action when the context was wrong.

Palo Alto Networks acquired a company built around the minute after software reaches a recommendation. As Console moves into Cortex, that minute will begin carrying more identities, more permissions, more systems, and more consequences than the ticket queue ever did.