Palo Alto Networks Acquires Koi: Securing the AI-Powered Endpoint

The $1.2 billion deal aims to expand protection for AI-led operations and bolster endpoint security against emerging agent-based threats.

Apr. 11, 2026 at 8:42pm

Got story updates? Submit your updates here. ›

A highly detailed, glowing 3D illustration depicting a complex network of interconnected AI agents, algorithms, and data flows, with recognizable cybersecurity elements like firewalls and encryption keys illuminated by neon cyan and magenta lights, conceptually representing the need for comprehensive protection of AI-powered endpoints.As AI-driven tools and agents become ubiquitous in the enterprise, a new generation of security solutions aims to provide the visibility and control needed to govern this emerging attack surface.Palo Alto Today

Palo Alto Networks has announced plans to acquire Koi, a pioneer in Agentic Endpoint Security, in a move to address the growing security risks posed by AI-enabled agents and tools that can actively read, write, and move data with broad access and fewer guardrails. The integration of Koi's technology into Palo Alto Networks' Prisma AI Security (AIRS) and Cortex XDR platforms is expected to deliver deeper visibility and practical control over agent-based tools, enabling customers to govern every agent, plugin, and script with confidence.

Why it matters

Traditional security models were designed to stop malicious files and obvious threats, but today's AI-enabled agents and tools can actively exploit authentication checks, use API-based remote code execution, or spoof agent identities to hijack trusted automation. This rapid, agent-driven shift accelerates risk to machine speed, leaving a notable blind spot in conventional security approaches. The Palo Alto Networks-Koi acquisition aims to close this visibility gap and set a new standard for endpoint security, enabling organizations to safely experiment with AI tools and adopt AI-enabled processes without opening new, unmanaged risk pathways.

The details

When the deal closes, Koi's Agentic Endpoint Security will integrate with Palo Alto Networks' Prisma AI Security (AIRS), expanding protection for AI-led operations. At the same time, the integration is expected to bolster Cortex XDR's endpoint security by delivering deeper visibility into the AI attack surface. The combined capabilities are intended to give customers clear visibility and practical control over agent-based tools, allowing safer deployment of AI-driven workflows.

  • Palo Alto Networks plans to share additional specifics during its Q2 FY2026 earnings call, scheduled for February 17, 2026, at 1:30 p.m. PT.

The players

Lee Klarich

Palo Alto Networks' Chief Product & Technology Officer, emphasizes that AI agents and tools act as insider threats and the Koi acquisition will close the visibility gap and set a new standard for endpoint security.

Amit Assaraf

CEO and Co-Founder of Koi, notes that their mission is to secure the 'next frontier' of risk and by joining Palo Alto Networks, Koi aims to scale its technology to large enterprises, delivering protection that makes modern AI-native endpoints secure by design.

Palo Alto Networks

A global AI cybersecurity leader, offering a broad portfolio across network, cloud, security operations, AI, and identity, serving thousands of customers worldwide and emphasizing AI-driven platforms designed to simplify security and accelerate safe innovation.

Koi

A pioneer in Agentic Endpoint Security, focused on securing the 'next frontier' of risk posed by AI-enabled agents and tools that can actively read, write, and move data with broad access and fewer guardrails.

Got photos? Submit your photos here. ›

What they’re saying

“AI agents and tools act as insider threats: they operate with extensive system access but remain largely invisible to traditional security controls.”

— Lee Klarich, Chief Product & Technology Officer, Palo Alto Networks

“Our mission is to secure the 'next frontier' of risk. In an environment dominated by agentic interactions, legacy solutions are often blind. By joining Palo Alto Networks, Koi aims to scale its technology to large enterprises, delivering protection that makes modern AI-native endpoints secure by design.”

— Amit Assaraf, CEO and Co-Founder, Koi

What’s next

The judge in the case will decide on Tuesday whether or not to allow Walker Reed Quinn out on bail.

The takeaway

This acquisition envisions a more comprehensive safeguard for AI-powered endpoints, spanning visibility, governance, and security policy enforcement. For organizations, this could translate into safer experimentation with AI tools and faster, more confident adoption of AI-enabled processes without opening new, unmanaged risk pathways. However, it also invites debate about whether centralizing control over agent-based tools is compatible with the speed and autonomy that AI agents promise, and whether deeper visibility into AI attack surfaces creates meaningful benefits for most organizations or is primarily valuable to large enterprises with complex ecosystems.