Introducing Cortex XCOR: AI-Driven Observability that Delivers Autonomous Response with AI SRE
I’ve been tackling the observability problem for more than a decade, since before it was coined observability. From building internal monitoring for EC2 at AWS to building the observability platform for Uber, the holy grail was always to create a solution that would automatically tell you what the issues were and help remediate them, instead of just being a tool that showed you dashboards. But standing in the way were the foundational scale and cost challenges of cloud-native architectures, which is what my co-founder Rob Skillington and I solved by creating Chronosphere.
With the ability to effectively manage observability data at scale and as we undergo another major industry shift with AI, we’re finally at a point in time where the technology available puts the holy grail within grasp. Six months after joining Palo Alto Networks, we’re taking a major step forward with the launch of Cortex XCOR - an AI-native observability platform that delivers on that long promise of automatically root causing the issue.
Reimagining Observability for the Modern SDLC
Getting to this point required a fundamental leap in model intelligence. When generative AI was broadly released in late 2022, LLMs were intriguing, but the reasoning capabilities were rudimentary. Although we saw limited applications for chatbots and assistants within observability, those early models could only help the end user, they couldn’t ultimately solve the issue. They assisted investigations by summarizing logs or translating queries, but weren’t transformative. That changed in late 2025 with frontier models like OpenAI’s GPT-5 and Anthropic’s Claude Sonnet and Opus.
My own AI moment in observability came a couple of months ago when our chat functionality evolved from acting like an assistant to functioning as an autonomous expert that gave me the answer and showed me how it got there. As I pushed our agents with increasingly complex scenarios, they began reasoning through problems far beyond their initial capabilities. Much like how LLMs have replaced my need for web search, our chat is now my primary interface in our product, completely overhauling how I interact with it.
This shift for observability is needed now more than ever as operations teams struggle to keep up with the surge in AI-driven software development, caused by the same step up in reasoning capabilities from late 2025. Research shows that 42% of developers now report that AI writes at least half their code, up from 12% last year. Rapid code releases continuously expand the surface area for production failures and drive up the burden on developers and SREs to manually identify root causes. To match this velocity, observability needs to modernize now to avoid becoming the bottleneck for product innovation.
Introducing Cortex XCOR, the Next-Generation AI-Native Observability Platform
That is precisely why we are launching XCOR. We designed it to transform observability from static dashboards and manual remediation to an AI-first experience that automates both routine and complex investigations.
Cortex XCOR is an AI-driven platform that delivers autonomous response.
At the heart is our XCOR Operator, an AI assistant embedded throughout the platform that helps operations teams match AI-coding velocity. What makes the XCOR Operator especially powerful is that it understands the user intent and serves as the conversational interface for our specialized agents that execute behind the scenes. The user of an observability platform plays many roles depending on the situation: investigating incidents, tuning alerts and dashboards, optimizing data volumes, and so on. Each of these roles are mirrored by specialized AI agents that have been optimized to complete those task-specific workflows from end to end.
The most challenging role is the AI SRE - investigating an incident to get to the root cause and identify remediation. Triggered automatically when an alert fires, the AI SRE agent autonomously reasons through underlying issues and recommends actions and mitigations in under three minutes on average, with a 75% success rate of root cause analysis in complex production environments and a further 19% of incidents where the analysis was deemed useful. By comparison, manual responses can take 20 minutes just to locate the relevant issues, gather initial context and find the right on-call engineer.
None of this automated reasoning is possible without complete end-to-end visibility and context. With the recent acquisition of Embrace, we now bring together front-end Real User Monitoring (XCOR RUM) and proactive XCOR Synthetics with our backend and infrastructure observability to deliver a true, full-stack platform. RUM captures every web and mobile session in full fidelity without sampling, tying crashes and slow loads directly to session timelines, while synthetics simulates global user traffic to proactively catch regressions before they hit production.
Underpinning this full-stack visibility is the XCOR Fabric, which we engineeredto provide our agents with rich, real-time institutional, application and infrastructure context and draws from:
Knowledge Graph: A real-time, detailed model incorporating your infrastructure, applications and business logic. Unlike many other solutions, it normalizes and incorporates custom telemetry to provide the most complete context.
Operational Memory: Institutional learnings and historical context captured from past incident investigations.
User Behavior: Patterns revealing which specific queries and dashboards senior engineers rely on during active resolutions.
Human Knowledge: Context pulled directly from runbooks, documentation, and operational files.
By delivering total visibility and grounding our AI agents in this deep operational context, XCOR delivers rapid root-cause analysis and recommends steps toward remediation.
Automated Optimization Continues to Deliver the Most Cost-Effective Platform on the Market
Yet observability without cost control is like an untrained puppy, adorable until it chews through your furniture, shoes and budget. Managing observability costs remains a persistent challenge because modern cloud and AI-native architectures produce massive volumes of telemetry data. We designed Chronosphere to solve this exact problem, and it remains a major pillar of XCOR.
We help customers optimize data by an average of 89% without sacrificing visibility, earning top industry rankings for cost efficiency and the trust of industry leaders like OpenAI, DoorDash and Compass. Now with expanded consumption-based pricing models across the XCOR platform and granular consumption budgets that automatically adjust to usage patterns over time, we eliminate the tradeoff between critical visibility and rising costs.
The quest for observability’s holy grail is finally within reach. As engineering teams race to keep pace with the speed and scale of AI-driven development, XCOR moves operations beyond static dashboards and manual troubleshooting toward true autonomous remediation. This is observability's AI moment.
Most cloud and security teams struggle with two fundamental questions: What is actually running across our clouds, and what is exposed? As workloads sprawl and AI models deploy faster than ever, critical posture data gets locked inside specialized consoles. Gaps go unseen until they are exploited, and shadow AI leaves teams flying blind.
To solve this visibility challenge, Palo Alto Networks is introducing CLARA Agent.
By connecting Palo Alto Networks Strata Cloud Manager (SCM) directly to Google Cloud Gemini Enterprise, CLARA Agent turns complex cloud security data into clear, conversational insights. SCM powers this integration by consolidating security across environments, automating AI-driven operations to prevent misconfigurations, and continuously enforcing zero-trust policies with real-time threat prevention. Instead of digging through endless dashboards or running manual queries, teams can simply ask plain-language questions directly inside Gemini Enterprise to get immediate, evidence-backed answers.
CLARA Agent, which will be available on Google Cloud Marketplace, provides instant infrastructure discovery, automatically surfaces production AI/ML models alongside unsanctioned shadow AI, and ranks critical vulnerabilities so teams know exactly what is exposed. By bringing security intelligence directly into everyday workplace tools, it democratizes visibility for cloud, platform, and AI teams alike.
Bringing Palo Alto Networks CLARA Agent to Google Cloud Marketplace will help customers quickly deploy, manage, and grow the AI agent on Google Cloud’s trusted, global infrastructure. Palo Alto Networks can now securely scale and support organizations using its CLARA Agent to enable their security teams to turn cloud security data into conversational insights.
Vineet Bhan, Director, Security and Identity Partnerships, Google Cloud
Built for Immediate Value and Enterprise Security
CLARA Agent supercharges your existing investment in Strata Cloud Manager by bringing its rich security telemetry directly into everyday workflows. Greenfield deployments will benefit from additional visibility into their AI and non-AI workloads.
Designed to complement SCM’s robust security architecture, CLARA Agent leverages the open Agent-to-Agent (A2A) protocol and Model Context Protocol (MCP) servers to deliver fast, secure, and context-aware responses without requiring additional infrastructure setup. This integration creates a more seamless experience for security teams, empowering them to audit cloud posture, prioritize zero-day vulnerabilities, and secure rapid AI adoption faster and more intuitively than ever before.
See CLARA Agent Live at the Security Innovations Forum 2026
Palo Alto Networks is proud to be a sponsor of the Security Innovations Forum 2026 on September 29 at the Google Event Center MP7 in Sunnyvale, CA. Join Rich Campagna, Senior VP of Products at Palo Alto Networks, and Joshua Haslett, Strategic Technology Partner Manager at Google, on the executive panel, "Co-Innovating the Future of Cybersecurity: A C-Suite Perspective" (10:50 AM – 11:35 AM). They will discuss how agentic platforms are revolutionizing threat response and how organizations can deploy advanced AI agents at scale.
You can also visit the Palo Alto Networks kiosk during the forum to see a live demonstration of CLARA Agent, connect with our experts, and discover how we are co-innovating with Google Cloud to help safeguard agentic AI environments.
Get Started
Visit our booth at Google Cloud’s Security Innovations Forum 2026, or contact your Palo Alto Networks representative to schedule a demo.
This blog contains forward-looking statements that involve risks, uncertainties and assumptions, including, without limitation, statements regarding the benefits, impact, or performance or potential benefits, impact or performance of our products and technologies or future products and technologies. Any unreleased services or features (and any services or features not generally available to customers) referenced in this or other press releases or public statements are not currently available (or are not yet generally available to customers) and may not be delivered when expected or at all. Customers who purchase Palo Alto Networks applications should make their purchase decisions based on services and features currently generally available.
Login
