Palo Alto Networks Launches Cortex XDR One Platform

The new security solution provides visibility and protection for autonomous AI agents across enterprise endpoints.

Updated on Oct. 22, 2026 in Artificial Intelligence

Palo Alto Networks Launches Cortex XDR One Platform

Live Poll

Do you trust that businesses can securely manage the AI agents they use for internal operations?

Palo Alto Networks has introduced the Cortex XDR One platform to secure autonomous AI agents within corporate environments. The system uses small language models to inspect and block threats directly on endpoints.

Why it matters

Businesses increasingly allow AI agents to access critical databases and financial ledgers, creating risks like prompt injection and data poisoning. Cortex XDR One helps secure these systems by monitoring interactions at both the AI runtime and operating system layers.

Cortex XDR One utilizes small language models on sensors to process data locally without cloud movement. The platform reports a 95% reduction in false positives by inspecting and blocking threats at the runtime and operating system layers.

The players

Palo Alto Networks

This is a global cybersecurity company that provides enterprise-level security solutions for networks, clouds, and endpoints.

Koi

This is a startup company specializing in security technology that was integrated into the Cortex Agentic Endpoint Security module.

Unit 42

This is the threat intelligence and incident response division of Palo Alto Networks that now manages agentic endpoint security services.

The details

The platform integrates technology from the startup Koi to provide specialized endpoint security for autonomous software. It functions by using a single sensor to gather telemetry and connect potential attack chains across diverse digital domains.

October 22, 2026: Palo Alto Networks launched the Cortex XDR One platform.

The Tech Race

This release marks an evolution of the traditional endpoint detection and response (EDR) model by expanding security coverage to include autonomous AI agents. It positions Palo Alto Networks to compete in the growing market for AI-native infrastructure defense.

Organizations deploying AI agents can now implement local threat monitoring to reduce security vulnerabilities without relying on cloud-based processing. Security teams gain centralized visibility into AI software running on enterprise endpoints to better detect unauthorized API calls.

The takeaway

Organizations should audit the permissions granted to their autonomous AI agents to prevent non-deterministic actions. Implementing runtime security controls is essential as AI systems increasingly interact with sensitive financial and customer management platforms.