Palo Alto Networks earlier this week announced that it had acquired Console, an AI company whose software executes enterprise operations work on instruction. The transaction is described as complete. The terms, and the price of the acquisition were undisclosed. The security giant nevertheless announced that Console will be integrated into Cortex, the security operations platform that Palo Alto Networks has spent the past year rebuilding through acquisition.
Earlier in January this year, the company closed its $3.35 billion purchase of the observability provider Chronosphere, then completed its $25 billion acquisition of the identity security vendor CyberArk in February this year, making identity a declared pillar of its platform strategy.
Console is by some distance the smallest of the three, and the only one announced without a figure attached to it. Chronosphere brings the visibility into what is happening across a customer’s infrastructure, CyberArk on the other hand provides control over which human, machine, and AI identities are permitted to do. Console now provides parts of it, and its software connects to a customer’s identity systems, SaaS applications and security tooling, interprets a request expressed in ordinary language, gathers the context needed to service it, runs the workflow and records what it did.
In a security operations centre, that is the difference between an analyst being told an alert requires attention and the alert being closed without one. Nikesh Arora, Chairman and CEO of Palo Alto Networks, described the purchase in terms that leave little room for interpretation. “Security operations can no longer be about managing dashboards and queuing tickets just to help humans work faster,” he said in a statement, calling the shift software-as-an-agent and saying it gives the platform the arms and legs to deliver autonomous security outcomes.
Enterprise security teams have spent a decade buying detection and correlation tooling that produces more findings than staff can work through, and the standard response has been to triage harder and hire more analysts to do it. Console proposes that the queue itself is the problem.
Andrei Serban, Co-Founder and CEO of Console, put it as a design principle rather than a product feature. “We built Console around a simple idea: people should be able to express an operational goal, and intelligent software should handle the complexity required to achieve it,” he said, adding that customers had already shown that agents can cut operational overhead substantially.
An agent that resolves an alert is one that changes something in a live environment, whether that is revoking access, isolating a host or altering a configuration. The questions a buyer needs answered concern error rates, rollback, the standing privileges the agent holds while it operates and the completeness of the audit record it leaves behind. None of that appears in the announcement, and the legal notice attached to it warns that features referenced may not be delivered when expected, or at all.
For enterprises across the GCC, the governance question arrives ahead of the productivity one. Banks, telecom operators and government entities in Saudi Arabia and the UAE run security operations under regimes built on the assumption that an accountable person authorised each consequential action.
Agentic remediation does not remove that requirement; it relocates it into the audit log, and regulators have not yet said in detail what an acceptable log looks like. Palo Alto Networks addressed neither regional availability nor hosting arrangements in the announcement. Those answers, rather than the acquisition itself, will determine how quickly any of this appears on a screen in Riyadh or Abu Dhabi.
