The platform for building and governing AI agents represents ‘the next step in security automation,’ Palo Alto Networks CEO Nikesh Arora says.
Palo Alto Networks on Tuesday debuted its new platform for building and governing AI agents, Cortex AgentiX, aimed at boosting automated investigation and remediation of cybersecurity threats.
For partners and customers of the cybersecurity giant, AgentiX represents “the next step in security automation,” Palo Alto Networks CEO Nikesh Arora said during a call with media and analysts.
[Related: Palo Alto Networks CPO: Why Cybersecurity Needs ‘Much More’ AI]
Meanwhile, two other product updates announced Tuesday by Palo Alto Networks are similarly focused around introducing native agents within the vendor’s platform, Arora (pictured) said. Palo Alto Networks unveiled the next version of its cloud security offering with the debut of Cortex Cloud 2.0, as well as a new update to its AI security platform with Prisma AIRS 2.0.
Ultimately, Palo Alto Networks is introducing a broad set of agents for partners and customers as a way of “effectively automating a significant part of their cybersecurity actions,” Arora said.
Currently, “the whole act of investigation [and] remediation is fundamentally extremely manual in the industry,” he said during the call with media and analysts.
While significant automation for those activities has been built into the vendor’s Cortex XSIAM offering, “we are now taking that one step further and trying to embed that across all of our products,” Arora said.
When it comes to Cortex AgentiX, the platform will serve as the next generation of Palo Alto Networks’ SOAR (security orchestration, automation and response) offering, known as XSOAR, the vendor said.
AgentiX is available now as part of Cortex Cloud, Cortex XSIAM and Cortex XDR, and will be offered as a standalone platform starting in early 2026, according to Palo Alto Networks.
What follows are five things to know about the launch of Palo Alto Networks’ AgentiX platform.
Countering Unknown Threats
One of the massive advantages of the Cortex AgentiX system is around automating a response to threats that have been previously unknown, said Gonen Fink, executive vice president of products for Cortex and Cloud at Palo Alto Networks.
While the existing XSOAR platform handles known threats very effectively, “if this is the first time you’ve seen this incident, then you don’t have a playbook for it,” Fink said in an interview with CRN.
At the same time, many adversaries are themselves using agentic capabilities to uncover exposures that can be exploited — meaning that increasingly, “you’re running into new things for which you don’t have a playbook,” he said. “Those things require more reasoning, more context, more planning.”
AgentiX can fill that gap by connecting into all of the data and context that Palo Alto Networks has within the Cortex platform, Fink said. This ultimately can provide SOC (Security Operations Center) analysts with the reasoning and planning that they need in cases where there are no predetermined responses in place, he said.
“That is what’s going to help you to further reduce having to deal with the unknown incidents, and make your SOC more and more autonomous,” Fink said.
Prebuilt Agents
To help partners and customers get started with AgentiX, Palo Alto Networks is introducing a number of prebuilt agents as part of the platform launch.
Those include agents for assisting with threat intelligence, email investigation, endpoint investigation and network security, the company said.
“Our customers will then be able to take those one step further and enhance them, and customize those agents for their own environments,” Arora said during the call with media and analysts.
Agent Builder
For organizations looking to build their own agents, AgentiX will offer a no-code option for doing so utilizing GenAI, according to Palo Alto Networks.
Crucially, the no-code agent builder in AgentiX will be able to tap into both Palo Alto Networks and third-party tools, with more than 1,000 integrations built into the system, the company said.
AgentiX is “effectively an industry platform. It is connected to every security platform out there or security vendor out there. It is not Palo Alto [Networks] specific,” Arora said. “It is actually a platform that allows you to automate agents across any product that is out there.”
Orchestration And Governance
AgentiX also provides functionality for orchestrating “complex workflows” for security across AI agents, Palo Alto Networks said in a news release.
This will enable launching “context-aware” agents from within Cortex products as well as providing orchestration of agents through AgentiX as a standalone tool, the company said.
Meanwhile, AgentiX provides capabilities for governing the autonomous actions of agents with strong guardrails, including role-based access controls and the option to require human approvals, according to Palo Alto Networks.
With AgentiX, “you can decide when you want the agent to act,” Arora said. “You can decide when you want the agent to be supervised. You can decide when you want the agent to be autonomous.”
Cortex Cloud, Prisma AIRS Updates
Along with the addition of AgentiX, other major updates in Cortex Cloud 2.0 announced Tuesday include a “reimagined” Command Center that provides a simplified view of insights, threats and workflows across the multi-cloud environment, Palo Alto Networks said in a news release.
Cortex Cloud 2.0 also introduces a “performance-optimized” mode for its cloud detection and response (CDR) agent, enabling a reduction of up to 50 percent in processing consumption for CDR, the company said.
As for Prisma AIRS 2.0, the new version of Palo Alto Networks’ AI security platform includes the full integration of capabilities from the acquisition of Protect AI.
Prisma AIRS can now offer in-line defense against a range of AI security threats — including prompt injection, malicious agents and tool misuse — in real time, according to Palo Alto Networks.
