.webp)
New platform unifies Extended Detection and Response (XDR) with Cortex Agentic Endpoint Security into a single sensor to protect enterprise hosts and autonomous AI agents
Mumbai, India, October 26, 2026 -- Palo Alto Networks, the global cybersecurity leader, today announced Cortex XDR One, a unified endpoint security platform designed to protect enterprises from threats targeting both traditional operating systems and autonomous AI agents. By bringing together Extended Detection and Response (XDR) and Cortex Agentic Endpoint Security into a single interface and lightweight sensor, Cortex XDR One addresses the critical security blind spots created by the rapid enterprise adoption of AI coding agents, co-pilots, Model Context Protocol (MCP) servers, and personal AI tools.
Over the past two years, enterprises have increasingly authorised AI agents to interact directly with internal databases, production code, financial ledgers, and customer management systems. Because these agents operate non-deterministically and inherit user permissions, they introduce complex attack vectors such as prompt injection, indirect data poisoning, and unauthorised API calls that traditional Endpoint Detection and Response (EDR) solutions and basic software containers were not built to stop.
"The expansion of agentic capabilities across enterprise endpoints demands a security posture that treats AI agents with the same rigour and control as traditional system processes," said Orcun Tezel, Vice President, Technical Solutions, Asia Pacific & Japan at Palo Alto Networks. "Just as we pioneered XDR to protect network, identity, and cloud environments, Cortex XDR One expands endpoint protection to govern AI agents at the source, enforce OS-level boundaries, and stop evasive threats in real time."
Key features and capabilities of Cortex XDR One:
- Real-Time AI Inventory and Shadow AI Visibility: Instantly detects, catalogs, and governs all AI artifacts, packages, extensions, and ungoverned "shadow AI" tools installed on enterprise endpoints.
- Dual-Layer Execution Enforcement: Combines runtime agent guardrails against prompt injection and destructive commands with real-time operating system monitoring to block zero-day exploits and living-off-the-land attacks.
- On-Sensor Small Language Models (SLMs): Deploys optimised, lightweight language models directly on the endpoint sensor to inspect and block fileless, evasive threats offline without transferring sensitive code to the cloud.
- Unified Sensor and Cross-Domain Telemetry: Consolidates telemetry onto a single sensor to stitch together end-to-end attack chains, reducing false positives by up to 95% and enabling rapid automated remediation.
- Flexible Deployment Options: Organisations can deploy Cortex Agentic Endpoint Security as a standalone module alongside third-party EDR solutions using a targeted sensor, or natively integrate it through the full Cortex XDR One platform.
- Managed Support via Unit 42: Customers can pair XDR One with Unit 42 Managed Detection and Response (MDR), which now includes Managed Agentic Endpoint Security for proactive threat hunting and AI risk governance.
The technology powering Cortex Agentic Endpoint Security stems from Palo Alto Networks' integration of Koi, an innovative agentic security startup whose capabilities were initially deployed internally by Palo Alto Networks' InfoSec team.
Availability
Cortex XDR One and Cortex Agentic Endpoint Security are available immediately. For more information, read the blog.
About Palo Alto Networks
Palo Alto Networks (NASDAQ: PANW), the global AI cybersecurity leader, protects our digital way of life with a comprehensive portfolio of cybersecurity solutions and platforms across Network, Cloud, Security Operations, AI and Identity. Trusted by 75,000+ customers and powered by Unit 42 threat intelligence, our AI-driven platforms eliminate complexity, empowering enterprises to modernise with confidence and securing the speed of innovation. Explore the future of security at www.paloaltonetworks.com.
Palo Alto Networks, Cortex, Cortex AgentiX, Chronosphere and the Palo Alto Networks logo are trademarks of Palo Alto Networks, Inc. in the United States and in jurisdictions throughout the world. All other trademarks, trade names, or service marks used or mentioned herein belong to their respective owners. Any unreleased services or features (and any services or features not generally available to customers) referenced in this or other press releases or public statements are not currently available (or are not yet generally available to customers) and may not be delivered when expected or at all. Customers who purchase Palo Alto Networks applications should make their purchase decisions based on services and features currently generally available.
Rate us on G2
