By Michael Novinson (MichaelNovinson)
Palo Alto Networks will embed intelligent agents across the platform security giant’s ecosystem to proactively investigate and remediate threats, said Chairman and CEO Nikesh Arora.
The Silicon Valley-based company will enable organizations to customize agents’ levels of autonomy and integrate them into every layer of cybersecurity operations, which Arora said will provide a streamlined and automated experience across environments and vendors. The firm intends to build a unified identity platform to enable agentic security systems and harmonize access visibility across all human and machine identities.
“Our customers will be able to customize those agents for their own environments,” Arora told reporters. “So, you can decide when you want the agent to act, when you want the agent to be supervised and when you want the agent to be autonomous. The beautiful part of that is because it is effectively an industry platform, it is connected to every security vendor out there. It is not Palo Alto-specific.”
During a media and analyst roundtable, Arora on Monday laid out a vision for the future of cybersecurity centered on artificial intelligence-driven agents, identity platform integration and industry collaboration. The company debuted new products to drive greater automation, cross-platform operability and AI security, he said.
How Much Autonomy Should Organizations Give AI Agents?
Cybersecurity tools historically either block threats when clearly malicious or issue alerts for human analysts to investigate, but Arora said this model doesn’t scale in the face of accelerating threats and increasing data complexity. Cortex AgentiX gives organizations the flexibility to assign these agents different levels of autonomy: from supervised actions to fully autonomous execution, Arora said.
“We are going to introduce predefined agents that will come as part of our AgentiX platform, which will be able to do investigations – whether around email, around identity, around threat intelligence – and do a lot of the pre-work for our customers,” Arora said.
By delegating high-volume, low-context tasks to agents, Arora said human analysts are freed to address advanced threat hunting, adversarial analysis and response orchestration. Arora said customers have reduced their SOC budget by more than 50 per cent through automation without diminishing security posture, and can realistically automate 75 per cent of SOC tasks today, with the rest requiring expert human oversight.
“SOC analysts are now going to spend their time looking at the complex problem, saying, ‘How do I solve the problem?'” he said. “The good news is that if you go back about two years ago, there’s this constant hum in the industry that we have a few million less cybersecurity professionals than we need. The solution is more automation and more AI. I’m hoping that that cybersecurity skills gap goes away now.”
Enterprises are now moving AI from experimentation into production, which Arora said makes them targets for exploitation via model leakage, data poisoning and credential misuse. The company now offers a unified AI security platform capable of handling AI model scanning, agent protection and red-teaming, and it can now integrate security into AI everywhere from sandbox testing to live deployment.
“Our customers are getting to the point where they believe as they get into production, as they want to launch AI, they have to secure it before they go,” Arora said. “You are able to do AI protection in production, for agents and for models. You are able to do red-teaming. You are able to do model scanning. All of these activities have been integrated and will be launched.”
Palo Alto’s Take on Cloud Security, Identity, Oracle Pact
Cloud security posture management tools have become largely API-based, passive systems that offer configuration visibility but limited value in production, Arora said. He envisions combining configuration management with runtime visibility and response – alongside application security posture management – to actively correlate misconfigurations with production events to detect real threats.
“We think that over the last few years, the CSPM industry has effectively commoditized,” Arora said. “We think the true way to get value from a cloud security platform is actually to marry what happens in production with what’s happening in your configuration. By marrying CSPM into CDR, you will be able to get an end-to-end view of your cloud landscape and be able to solve cloud security at scale.”
As more autonomous agents proliferate across infrastructure, Arora said organizations face critical questions on who the agents are, what credentials they hold and what they can access. Most companies have no consolidated view of who has access to what when it comes to non-human identities like agents, APIs and service accounts, which Arora said introduces risk, confusion and inefficiency (see: Nikesh Arora: Why Palo Alto Is Making a $25B Bet on Identity).
“The reason we decided to get in the identity space is because we felt that the arrival of agentic AI was going to create the inflection point needed to transform that industry,” Arora said. “I think identity is equally fragmented as most parts of the cybersecurity industry. With CyberArk, we are going to be able to expand their capabilities past just the privileged users across the entire enterprise.”
