As interest in new AI tools accelerates, cybercriminals are finding ways to exploit the trust surrounding them. Check Point Research (CPR) has uncovered Yoba, a malware campaign using fake GitHub projects impersonating supposed ChatGPT and Claude desktop applications, while abusing legitimate, signed OpenAI and Anthropic executables to help load malware. The campaign shows how the rush to access new AI tools is creating opportunities for social engineering, even when the AI platforms themselves have not been compromised. Key Findings Attackers used fake GitHub projects impersonating supposed ChatGPT and Claude desktop applications to distribute Yoba malware. Legitimate, signed OpenAI and Anthropic […]
In a short period, Check Point has appeared across three new Gartner research publications examining autonomous remediation, exposure assessment, and the future of preemptive cybersecurity. These three reports ask very different questions. But how do they connect? One examines how organizations can trust autonomous remediation. Another looks at the growing exposure management market and the increasing importance of exploitability. The third looks further ahead at the technologies Gartner believes will shape preemptive cybersecurity. Taken together, the reports capture a broader change already underway across the industry. Exposure management is expanding from identifying risk toward understanding exploitability and enabling action. Exploitability […]
AI assistants have quickly become part of everyday work, particularly for developers. Tools such as ChatGPT, Claude, Cursor and GitHub Copilot increasingly sit alongside source code, cloud environments and other sensitive business resources, making the credentials and sessions connected to these tools increasingly important to protect. New research from Check Point Research (CPR) into the Aokigahara infostealer shows how attackers are adapting to this shift. The malware specifically collects authentication files, session data and configuration files associated with popular AI applications and development tools. The significance goes beyond gaining access to an AI account. If stolen credentials or session tokens […]
When the PHP2Shell vulnerabilities became public, my thoughts went back to Log4Shell. Five years ago, Log4Shell showed how difficult it can be to respond to a critical vulnerability in software used across countless applications and services. PHP2Shell presents a similar challenge. The technical details are different, but the need to quickly understand where you’re exposed and take action is very familiar. I believe we should expect more incidents like this. AI is making it possible to discover vulnerabilities in widely used software at a speed and scale we haven’t seen before. As these capabilities become more accessible, we are likely […]
Two critical vulnerabilities in PHP, the programming language behind a large share of the world’s websites, online stores and internet services, are being actively targeted. Since details of CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell, leaked ahead of planned disclosure, 10% of organisations worldwide have been impacted (“impacted” means exploitation attempts, we have no way of knowing if the attack has been successful), according to Check Point Research. Hourly activity peaks at midnight, when fewer security teams are watching. Government institutions in the Netherlands and Finland have taken some of their websites offline as a precaution. What PHP2Shell is and why […]
Key takeaways Only 14 percent of organizations say they have formal GenAI policies that are actively enforced and audited, according to Check Point’s 2026 Cloud Security Report. →The costliest AI mistakes break rules no vendor ships. Air Canada was held liable for a refund its chatbot promised and the airline never offered →The usual fixes fall short. Models can be argued out of system prompts, keyword lists miss meaning, and US-centric DLP lists miss the data your regulators protect →Custom guardrails turn a sentence into an enforced rule. Describe it, test it in under five minutes, and run it on […]
AI is moving from answering questions to taking action. Agents can use tools, access enterprise data, and carry out work across systems on our behalf or autonomously. This creates opportunities for businesses to move faster, but it also changes what security must protect. An agent’s identity, the authority it carries, and the actions it takes all become security decisions.
As enterprises put agents into production, they need controls that keep pace without hindering the work those agents are designed to do. Palo Alto Networks is working with NVIDIA to advance this goal across five connected areas in support of the NVIDIA OpenShell Reference Architecture for safe AI agents: an AI gateway on NVIDIA Vera CPU systems; runtime protection on NVIDIA BlueField DPUs; agent identity governance on NVIDIA Sentry; AI factory visibility through an AI-driven, agentic security operations center (SOC); and partner services that help customers implement a secure architecture.
Palo Alto Networks AI Runtime Security Extends Protection Across the AI Factory and Edge
Until now, the AI factory conversation has centered primarily on compute capacity and token generation. But as autonomous agents execute higher-stakes workloads, runtime security has become just as essential. Agents can be steered past their guardrails, and a compromised host cannot be trusted to accurately report what occurred. To be effective, security teams require visibility and enforcement that operate independently of the host environment.
Palo Alto Networks AI Runtime Security on NVIDIA BlueField DPUs isolates security processing in a dedicated infrastructure domain. Because BlueField sits in the path between agents and the models, data, and services they access, security policies are enforced in silicon — beyond the reach of a compromised host. This capability safeguards both GPU-accelerated AI workloads and CPU-based agent runtimes and is now generally available across AI factory and industrial edge deployments. Offloading security from the host node delivers two critical benefits: increased token throughput and stronger runtime protection across the entire AI factory.
Deployment at scale must be manageable. Our work with Spectro Cloud manages the deployment and operation of AI Runtime Security on BlueField DPUs, enabling consistent management across the AI factory infrastructure — from the data center to distributed edge environments.
Idira Governs the Identity Behind Every Agent Action
Runtime protection answers what an agent is doing. Identity governance helps determine whether it is authorized to do it.
An agent may act for a person, a team, or an autonomous business process, often requiring access to multiple tools and data sources across the organization. Granting an agent broad, persistent access creates risk, while making access too restrictive limits its usefulness. To achieve the optimal balance of control and agent access, Palo Alto Networks is advancing an integration between agentic identity security and NVIDIA Sentry on BlueField — bringing identity and delegated authority closer to where agent interactions are governed.
The goal is to give each agent a verifiable identity, grant access appropriate to its task, and make its actions attributable. Once available, this solution will deliver zero-trust protection and tamper-resistant auditing for agents by moving the security controls — including identity — to the NVIDIA Bluefield DPU, separate from the host operating system. This addresses an immediate business need — enabling enterprises to scale agent deployments while retaining control over whose authority agents use and which resources they can reach.
Bringing AI Factory Signals into Cortex
Security teams need visibility into activity across the infrastructure that runs AI agents. Palo Alto Networks hasannounced an integration of Cortex XSIAM with NVIDIA DOCA Argus, which monitors host activity from BlueField’s independent trust domain. This provides security operations teams with runtime signals that do not rely on an agent installed on the host being monitored.
By bringing those signals together with network, cloud, and identity data in an AI-driven SOC, security teams can investigate AI infrastructure in the context of the broader enterprise. Palo Alto Networks is continuing to develop this foundation to support broader fleet visibility and more comprehensive response workflows — enabling security teams to identify unusual activity and act with greater confidence as AI deployments grow.
AI agents run within the NVIDIA OpenShell secure runtime, operated directly on the NVIDIA Vera CPU within the NVIDIA OpenShell Platform. Security observability is completely offloaded to the NVIDIA BlueField DPU. Operating out-of-band, NVIDIA Sentry, built on DOCA Argus, provides real-time memory and network inspection to detect threats without slowing AI inference. When malicious events or policy violations occur, DOCA Argus streams high-fidelity alerts directly to Palo Alto Networks Cortex XSIAM, where they can be automatically correlated and surfaced for rapid threat response.
Turning Secure AI Factory Designs into Deployments
Customers need more than an architecture diagram to bring an AI factory into production. They need a practical path to design, validate, and operate security across compute, networking, applications, and the SOC.
Palo Alto Networks is working with strategic vendors , including Deloitte and World Wide Technology (WWT), to help customers plan and deploy secure NVIDIA AI factories. Deloitte’s Silicon-to-Service (S2S) offering, combined with its Secure AI Foundations, helps organizations implement AI use cases on NVIDIA AI infrastructure through validated architectures and managed services. By building security into the full AI factory stack, Deloitte helps clients balance performance, safety, and cost as they scale from pilot to production.
WWT’s AI Proving Ground allows customers to evaluate and test an integrated stack before committing to production deployment.These engagements can help enterprises move from individual security components to a repeatable approach tailored to their environments and requirements.
Building Confidence into the Next Phase of Agentic AI
The value of agentic AI depends on an enterprise’s ability to give agents useful access while maintaining control over their actions. This requires runtime protection, governed identities, independent visibility, and a unified way to manage controls across the enterprise.
Palo Alto Networks delivers comprehensive security across every layer of the AI factory through a unified platform. In collaboration with NVIDIA, we support the NVIDIA OpenShell Reference Architecture for enterprise governance, isolation, and security. Together, we deliver the continuous protection needed to move safely from AI agent pilots to full-scale enterprise production.
AI agents and AI-enabled tools are fundamentally changing how work gets done. From coding assistants to Model Context Protocol (MCP) servers, autonomous tools now access sensitive data, execute commands, and modify local workflows directly from the endpoint. Traditional endpoint security models fail to offer the visibility or governance required to manage these autonomous actions.
The security gap is already significant. Only6% of organizations have an advanced AI security strategy. And the fastest attacks can move from initial access to data exfiltration in just 72 minutes, according to the2026 Unit 42 Global Incident Response Report. As AI adoption grows, teams need context to prioritize risk and experts ready to respond so the business can continue adopting AI with confidence.
Today, we are announcing Unit 42 Managed Agentic Endpoint Security (Managed AES). We built the service on Cortex AES, our AI-native endpoint security platform that provides visibility, contextual risk intelligence and protection for AI agents and artifacts. Managed AES adds 24/7 Unit 42 expertise to help organizations put those capabilities into action. Backed by Unit 42 threat intelligence, our experts provide AI governance, threat hunting, investigation and response, and AI-related cyber hygiene. They apply human judgment to turn contextual intelligence into policy recommendations and prioritized actions as the environment evolves.
Continuous Expert Defense for the AI Environment
Managed AES brings continuous Unit 42 expertise to four areas of AI endpoint security.
Govern AI Adoption with Greater Confidence
AI adoption often moves faster than security teams can assess it. Our experts help identify AI tools and associated risks, evaluate exposure and recommend improvements to policies and controls. Security leaders gain a clearer view of AI use across their environment.
Hunt for Emerging and Zero-Day Threats
AI-related threats can emerge before they trigger a known alert. Our threat hunters use frontline threat intelligence and Cortex AES signals to proactively hunt across the customer’s AI environment. They evaluate findings, recommend action and refine policies and correlation rules to strengthen protection over time.
Investigate and Respond 24/7
Our analysts continuously monitor activity, investigate suspicious behavior and take permitted actions on the customer’s behalf to contain AI-related threats. Security teams gain specialized support to understand what happened, determine the potential impact and prioritize next steps.
Continuously Strengthen AI-Related Cyber Hygiene
Unit 42 assesses the customer’s AI security posture as adoption evolves. AI Security Posture Reports identify policy and control improvements, while Threat Impact Reports detail threats, potential impact, response actions taken and recommended next steps. These insights help teams prioritize improvements.
Expert Protection Across Your AES Environment
Organizations can choose the Cortex AES deployment model that best fits their environment while receiving the same 24/7 Unit 42 expertise.
Managed AES with Standalone Cortex AES
Organizations can deploy Cortex AES alongside their existing endpoint security solution for AI-native visibility, contextual risk intelligence, governance and protection for AI agents and AI-enabled tools. Managed AES adds Unit 42 experts who help customers act on that visibility and risk intelligence.
Managed AES with Cortex XDR One
Cortex XDR One brings together Cortex AES and Cortex XDR into a single sensor and console experience. It combines endpoint detection and response with AI-native security for AI agents and artifacts. Unit 42 experts provide 24/7 governance, threat hunting, investigation and response across the entire endpoint attack surface.
Securely Scale AI Adoption
Unit 42 Managed AES helps security teams understand how AI is being used, address risk before it escalates and respond quickly when threats emerge. By combining Cortex AES context with frontline threat intelligence and expert analysis, Managed AES helps businesses adopt AI with confidence.
Register for our upcoming webinar, The Next Era of Endpoint Security, to learn how Cortex AES and Unit 42 experts help your team govern AI risks, strengthen visibility and protect the agentic endpoint.
For decades, industrial cybersecurity rested on a comfortable assumption: operational technology (OT) was protected by physical isolation. The "air gap" guaranteed that power grids, manufacturing lines, and water systems remained safely disconnected from the chaos of the public internet.
That assumption is no longer just outdated - it is a strategic liability.
Driven by the imperative for real-time efficiency, predictive maintenance, and AI-led automation, industrial operations are integrating with enterprise IT and cloud environments at an unprecedented scale. Telemetry from Palo Alto Networks reveals a 332% surge in unique internet-exposed OT devices and services, bringing nearly 20 million OT-related assets onto the public internet.
Digital transformation has fundamentally redrawn the perimeter. What was once an engineering challenge managed on the plant floor has transformed into an existential risk that demands board-level oversight.
Every Industrial Asset Is Now a Digital Asset
Modernizing critical infrastructure is rarely framed as a security initiative; it is an operational mandate. Heavy machinery engineered to last thirty years is now instrumented with IoT sensors, managed through cloud-native platforms, and remotely monitored.
This connectivity creates tight dependencies between core business IT and physical operations. Modern industrial facilities rely on enterprise identity management, cloud telemetry, and continuous software updating to function day to day.
Consequently, a threat actor does not need to breach the factory floor to stop production.
When an enterprise IT network suffers an incident, executive leadership often initiates a manual shutdown of operational lines out of caution or because shared authentication mechanisms become unavailable. The business processes linking enterprise IT and OT have become functionally inseparable.
The Anatomy of Modern Industrial Threats
Attackers no longer require sophisticated, state-sponsored zero-day exploits to disrupt physical infrastructure. As seen in recent cyber incidents targeting municipal water systems in the US and the breach of a Polish power plant, threat actors continuously exploit basic internet exposure, unpatched vulnerabilities, weak default credentials, and unsegmented remote connections.
Threat dynamics across critical infrastructure have shifted toward two major vectors:
Low-Friction Initial Access: Basic internet discovery tools allow threat actors to identify exposed control systems and programmable logic controllers (PLCs) in minutes. Weak factory default passwords or unsegmented cellular modems provide direct entry points into physical operations.
Operational Blindness: Modern attacks deliberately target the reporting layer - such as HMI and SCADA interfaces - to suppress alarms and present "normal" operational telemetry to engineers, even while underlying physical processes operate dangerously out of specification.
Operational Realities and the Zero Trust Imperative
The integration of artificial intelligence and automated workflows into industrial environments accelerates this challenge. Beyond human engineers logging into control networks, automated software pipelines, third-party monitoring platforms, and autonomous AI agents are executing commands within OT environments.
Data from recent identity landscape research reveals that machine identities outnumber human identities by 109 to 1 across EMEA organizations.
In an environment populated by millions of interconnected human, machine and AI actors, implicit trust based on network location is dangerous. Applying Zero Trust to OT requires moving away from traditional perimeter defense toward continuous, explicit verification:
Verify Explicitly: Authenticate and authorize every access request - human or machine - regardless of where the request originates.
Enforce Least-Privilege Access: Limit access strictly to the assets and commands necessary for a specific operational role or process.
Assume Breach: Design networks under the assumption that enterprise systems are compromised, preventing lateral movement into physical control layers.
The Industrial "Red Button": Engineering for Containment
While IT security prioritizes data confidentiality, OT security prioritizes human safety, system availability, and operational continuity. Halting a processing facility or energy grid carries immediate financial, environmental, and regulatory consequences. Security controls designed for corporate office networks cannot simply be retrofitted onto plant floors.
Cyber resilience is measured not merely by prevention, but by limiting the blast radius when a breach occurs.
Leading industrial organizations are establishing a programmable "Red Button" capability - a combination of architectural micro-segmentation and automated playbooks. This architecture allows security teams to rapidly isolate critical physical operations from compromised IT networks or cloud dependencies without bringing production to a complete halt.
Five Strategic Actions for Executive Boards
With regulatory frameworks like NIS2 increasing direct accountability for senior leadership, OT cybersecurity requires strategic governance centered on comprehensive visibility, robust micro-segmentation, operational risk scoring, and virtual patching:
Establish Complete Asset Visibility: Eliminate dark corners across physical environments. Organizations must maintain a continuous, real-time inventory of every connected industrial asset, controller, and external dependency.
Embed Security by Design and Virtual Patching: Integrate cybersecurity requirements directly into industrial modernization programs from initiation. Deploy virtual patching mechanisms - such as Frontier Virtual Patching - to shield unpatchable legacy systems against rapidly evolving AI-driven threats.
Architect for Degraded Mode: Design critical infrastructure to maintain safe, baseline operations even if cloud access, enterprise IT, or external network connections are severed.
Practice Operational Recovery: Develop and stress-test incident response playbooks specifically designed for physical environments, including offline configuration backups and manual operational overrides.
Unify Risk Governance: Align executive leadership, security operations, and plant engineering around operational-based risk scoring and shared business metrics: physical safety, system uptime, and operational continuity.
Accelerating digital transformation should not mean compromising physical safety or operational stability. Palo Alto Networks provides an integrated platform built to address the unique constraints of operational environments. By combining AI-driven asset discovery, granular micro-segmentation, continuous risk assessment, and virtual patching across both enterprise IT and physical control networks, Palo Alto Networks empowers industrial organizations to modernize with confidence - securing operations, protecting revenue, and safeguarding national infrastructure.
In this article An agent’s goal rarely says how the agent may reach it, and capable agents are good at finding routes nobody planned for. →NVIDIA Open Agent Safety Platform puts the boundary in the infrastructure, outside the agent’s reach →Check Point semantic monitoring judges whether each step still fits the task →the two already work together in a beta integration with NVIDIA OpenShell →the monitor’s verdict can arrive before the action runs, in under 100 milliseconds What the Goal Leaves Out When an organization hands an autonomous agent a job, such as processing supplier invoices, it states the goal […]
A new kind of AI model returns decisions instead of text. We spent a day trying to change its mind. It cost about 50 cents. In this article Jev is a new kind of AI model that returns typed decisions instead of text, built for software to call rather than for people to read. We put it inside a realistic application and tried to change its verdict from the outside. →every configuration we tested was broken: risk downgraded to low and investment advised, on a document that flags every warning sign →about 50 cents per successful break, with our strongest […]
AI agents are moving into the enterprise much faster than most security programs were designed to handle. They are no longer just answering questions or generating content. Agents can read email, access SaaS applications, query databases, invoke APIs, use MCP tools, modify records and execute business workflows. In other words, AI is moving from generating answers to taking actions. For CISOs and C-level leaders, that changes the security conversation. The question isn’t simply whether an organization is using AI safely. A more important question is: Can we confidently identify, govern, monitor, and control every AI agent before it becomes our […]
In this article The new Workforce AI MCP is Check Point’s own Model Context Protocol server for Workforce AI Security. Connect a compatible AI client and you can query, analyze, and manage your employee AI usage policy in natural language instead of working through filters, screens, and individual rule checks. →ask plain questions such as which rule applies to a given user and application, or whether a rule is shadowed by a higher-priority one →work across users, managed assets, GenAI application usage, DLP data types, and agent and MCP activity in a single conversation →create and update rules by request […]
Cybersecurity is in the middle of a generational shift. AI has disrupted a 30-year balance of power between defenders and adversaries.
Armed with agentic AI tools and open-weight models stripped of safety guardrails, threat actors are discovering, validating, and chaining exposures at machine speed. In a recent Unit 42 investigation, the attacker used more than 50 MITRE ATT&CK techniques to reduce weeks of methodical intrusion tradecraft into less than 10 hours—97% faster than a skilled red team could have done. Time-to-exfiltration has compressed to under an hour in real-world attacks. And when new CVEs are publicly disclosed, automated adversary scanners are weaponizing them within 15 minutes.
Defending at human speed is no longer viable. Organizations must close years of accumulated exposure while securing the AI they are rapidly adopting. That demands action on five fronts: continuously find and fix vulnerabilities, reduce exposure, secure AI infrastructure, unify attack prevention, and automate detection and response at machine speed.
Today, we are announcing Unit 42 Continuous Frontier AI Defense to put the first two priorities into practice. Powered by Anthropic's Mythos models and OpenAI's latest GPT cyber models, this always-on, agentic service combines our offensive security experts with proprietary multi-model harnesses to discover vulnerabilities, validate real-world exploitability, and accelerate remediation across applications, identities, cloud infrastructure, and network assets.
Led by our offensive security experts, this service discovers, validates and remediates exposures before they can be exploited. We use proprietary AI harnesses and gated capability models—powerful models restricted from public use—to discover vulnerabilities, prove real-world exploitability, and accelerate remediation across applications, identities, cloud infrastructure, and network assets as an organization’s environment changes.
Continuous Frontier AI Defense builds on Unit 42’s Frontier AI Defense, which launched in April and introduced Frontier AI Exposure Analysis, a point-in-time exposure analysis, and a security blueprint that benchmarks current capabilities to help organizations modernize their cybersecurity systems. In August, Unit 42 expanded the list of frontier AI models to include OpenAI’s GPT-5.6-Cyber and Anthropic's Claude Mythos 5, giving organizations access to additional AI capabilities.
A Single AI Model Is Not a Security Strategy
Frontier models are powerful, but no single AI model is a cybersecurity silver bullet and the models require equally powerful AI scanning harnesses.
Unit 42 research evaluation of model performance across enterprise codebases and live environments revealed two stark operational realities:
Coverage caps: No single AI model catches more than 40% of vulnerabilities in a complex environment.
Visibility: Leading cyber models such as Anthropic Claude Mythos 5 and OpenAI GPT-5.6-Cyber have less than 10% overlap in the exposures they identify.
To solve the single model gaps, Continuous Frontier AI Defense runs on proprietary multi-model harnesses. These harnesses act as an intelligent orchestration layer, routing specific offensive testing tasks to the model best suited for the job. This approach aligns model strengths, eliminates individual gaps, and keeps compute spend economical.
We combine these frontier models with Unit 42 threat intelligence, and frontline security expertise to turn raw vulnerability data into verified, actionable protection. Zero Data Retention (ZDR) architectures protect enterprise source code and telemetry, so customer data is never retained or used to train public models.
What Happens When AI Meets Real Enterprise Architecture
We did not build this service on theoretical assumptions. We built and validated it internally across Palo Alto Networks and across more than 100 customer engagements.
During our internal deployment, continuous Mythos-based scanning achieved over a year’s worth of traditional penetration testing results in just three weeks. The harness identified 3.2 times more high and critical vulnerabilities per product than legacy testing methods, and helped engineering teams cut mean time to remediate by 51%.
When we executed the service across customer environments, the frontline data delivered a clear warning:
Hidden exposures: In third-party applications, two out of three validated exposures had no known CVE. Vulnerability-only scanners will never see them.
High severity: 37% of identified exposures rated high or critical in severity.
Chained attack paths: Flaws rarely existed in isolation. In one financial sector engagement, our harness identified a sequence of individually minor flaws: an application payment link that failed to re-verify identity, a skipped one-time password check, and a session routing flaw. Chained together, an attacker could achieve complete account takeover and payment fraud without any victim action.
Moving from Discovery to Validated Protection
Finding weaknesses without fixing them only creates noise. And, security teams do not lack findings; they already have more alerts than they can act on. The bigger challenge is knowing which weaknesses an attacker can actually exploit and chain into a viable path to compromise, and then remediating them.
Unit 42 Continuous Frontier AI Defense translates findings directly into risk reduction:
Continuous Testing Engine: Provides a full-estate baseline scan followed by always-on testing as an organization’s environment changes.
Multi-Model AI Harness: Unit 42 deploys proprietary multi-model harnesses, the software architecture to route work to the model best suited for the task, improving efficacy and coverage while managing the cost of frontier AI at scale.
Leading Cyber Models: The harnesses are built around gated capability models, including Anthropic Claude Mythos 5 and OpenAI GPT-5.6-Cyber, as well as open weight models.
Advanced Adversary Simulation: Proves real-world exploitability by validating end-to-end attack paths across first- and third-party web apps, APIs, cloud infrastructure, source code repositories, and network assets.
Accelerated Remediation: Delivers actionable and prioritized fixes, code-level guidance, and virtual patch recommendations. To implement virtual patches before vulnerabilities are publicly disclosed or official patches exist, organizations can pair this with Frontier Virtual Patching.
Unit 42 Continuous Frontier AI Defense is available worldwide today on an annual subscription basis. Register for our upcoming virtual Threat Briefing to see how we apply Frontier AI, our proprietary multi-model harness, and offensive security expertise to protect Palo Alto Networks and our customers.
In this article Nineteen Check Point AI Security R&D teams spent two days on one prompt: build the demo customers would ask to see twice. Three of the results tell a single story about securing AI agents, and none of it starts with an attacker. →an autonomous agent took dangerous actions with no attacker involved, it simply hit a wall and improvised →a single poisoned file in a code repository turned a popular coding agent into a data exfiltration channel →questioning an off-track agent prevented as many attacks as blocking it, and completed more legitimate work →the lesson for anyone […]
Palo Alto Networks Named a Market Shaper in 2026 September Gartner® Emerging Market Quadrant for AI Application Security — Established Vendors.
When we set out to solve AI security, we knew it was an audacious challenge to take on. Securing AI Coding, which I wrote about last week, is one example of how we are tackling this multidimensional problem.
To us, this recognition reflects our core commitment to help organizations address all emerging AI use cases: securing AI coding, enterprise AI applications and governing autonomous agents, through a unified approach.
What Modern Enterprise AI Security Requires
Artificial intelligence is fundamentally changing how enterprise software is built, how digital experiences are delivered, and how work gets done.
In the report, Gartner defines ‘Market Shapers' as those that are building comprehensive platforms by acquiring innovative companies and introducing centralized management tools for AI workflows. They are also expanding traditional security capabilities into broader agent-based controls, using advanced access control and runtime monitoring to secure agentic actions.
We believe our position as a ‘Market Shaper’ reflects four core capabilities we provide through our AI Security Platform, Prisma AIRS for effective enterprise AI security today:
Secure AI Coding: Gain visibility into coding agents, extensions, skills, models and MCP servers, assess the artifacts they rely on, and establish controls over data, identity and agent actions.
Secure Enterprise AI Applications: Reduce risk across the AI application lifecycle, from models and components to testing and runtime interactions. This helps organizations build and deploy AI faster while safeguarding sensitive data and business-critical applications.
Govern Agent Actions: Maintain control and accountability as autonomous agents interact with enterprise data, tools and systems. Clear identities and permissions help reduce unauthorized activity and contain unintended behavior.
Accelerate AI Adoption Without Losing Control: Scale AI with consistent governance across coding, enterprise applications and autonomous agents. Maintain centralized control over access, usage and spend, through an AI Gateway.
Defending the AI Frontier Requires a Platform
AI coding agents, enterprise AI applications and autonomous agents may look like separate security problems. In practice, they increasingly depend on the same models, data, identities, tools and infrastructure. Attempting to secure each one with its own isolated point product only creates fragmentation at the exact point when enterprises need greater visibility and control
This is why we built Prisma AIRS, as the comprehensive AI security platform. It gives security teams a unified approach to discover AI, assess risk, protect runtime interactions, control agent identity and access, and govern connections to enterprise data and systems.
The goal is not to slow AI adoption. It is to give developers and business teams the freedom to use AI while giving security teams the visibility and control they need.
Read the research report to learn more: Gartner® Emerging Market Quadrant for AI Application Security – Established Vendors, September 2026.
Source: Gartner, Emerging Market Quadrant for AI Application Security – Established Vendors, September 2026.
Gartner is a trademark of Gartner, Inc., and/or its affiliates.
Gartner does not endorse any company, vendor, product or service depicted in its publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner publications consist of the opinions of Gartner’s business and technology insights organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this publication, including any warranties of merchantability or fitness for a particular purpose.
Securing Every Environment at the Speed of Frontier AI
Recognized as a Leader for the second consecutive time and positioned furthest for Completeness of Vision. Palo Alto Networks is advancing hybrid mesh firewall with one integrated platform for preemptive protection, agentic operations, AI runtime security and quantum-safe security across the enterprise.
We are proud to share that Palo Alto Networks has been named a Leader in the 2026 Gartner® Magic Quadrant for Hybrid Mesh Firewall for the second consecutive time, and positioned furthest for Completeness of Vision.
We believe this recognition reflects the strength of our approach to network security: one natively integrated platform that delivers consistent protection, policy and operations across every environment.
It also comes at a pivotal moment for cybersecurity. Frontier AI is collapsing the time between vulnerability discovery and exploitation. AI applications and agents are creating new infrastructure and data risks. At the same time, the cryptographic reset is forcing enterprises to rethink how they establish and maintain digital trust.
Fragmented firewall architectures and manual security operations were never designed for this speed, scale or complexity, and can no longer keep pace.
One Platform Across Every Environment
Hybrid environments have traditionally required organizations to deploy and manage different security products across data centers, clouds, branches, campuses and remote users. The result is often fragmented policy, inconsistent protection and operational complexity.
Palo Alto Networks transforms hybrid mesh firewall from a collection of enforcement products into a unified, intelligent security platform, powered by Precision AI.
The Strata Network Security Platform is our Hybrid Mesh Firewall, spanning hardware (PA-Series), virtual (VM-Series), cloud-native (Cloud NGFW) and firewall-as-a-service (SASE) deployments with consistent policy, shared intelligence and threat prevention across environments.
Strata Cloud Manager provides unified policy, visibility and AI-driven operations across these enforcement points. Beyond traditional firewall environments, the platform extends protection to the browser with Prisma Browser and to AI applications, models and agents with Prisma AIRS®.
Cloud-delivered security services, including Advanced Threat Prevention, Advanced WildFire, Advanced URL Filtering, and Advanced DNS Security deliver consistent, inline prevention across environments. Intelligence discovered in one part of the platform can strengthen protection everywhere, turning every enforcement point into a real-time prevention layer.
Gartner’s 2026 Hybrid Mesh Firewall research describes a market moving toward more automated, intelligence-driven security platforms as organizations manage increasingly complex hybrid environments.
The report identifies several trends shaping the evolution of hybrid mesh firewall, including the growing adoption of cloud-based management, AI-driven threat prevention, automation through LLM-based assistants, post-quantum cryptography and security capabilities for AI applications and workloads.
As these requirements evolve, organizations need a network security architecture that can deliver consistent protection and operations across hybrid environments while preparing for emerging AI and quantum-era risks.
Advancing Hybrid Mesh Firewall for the Frontier AI Era
Against this backdrop, Palo Alto Networks continues to advance the Strata Network Security Platform for the Frontier AI era.
Preempt attacks earlier: Advanced Threat Prevention Plus uses Frontier AI-powered vulnerability discovery and Frontier Virtual Patching to deliver preemptive protections, including before vulnerabilities are publicly disclosed or official patches are available.
Disrupt attacker infrastructure: Advanced IP Defense continuously identifies, validates and blocks attacker-controlled infrastructure in real time - even when adversaries use direct-to-IP communications, proprietary encryption, residential proxies or trusted cloud infrastructure to evade traditional security signals.
Operate at machine speed: Six purpose-built Network Security Agents in Strata Cloud Manager assist teams with deployment, troubleshooting, configuration management, posture optimization, threat investigation and data protection, with built-in guardrails and human oversight.
Secure AI and modernize digital trust: Prisma AIRS helps secure AI applications, models and agents across the AI lifecycle, while Quantum-Safe Security and Next-Generation Trust Security help organizations identify cryptographic risk and modernize digital trust. Read more about Palo Alto Networks’ approach to securing AI.
Together, these capabilities help organizations reduce exposure before attacks succeed, operate at machine speed, secure AI infrastructure and modernize digital trust for the post-quantum era.
Proven Security, Performance and Scale
A unified platform must deliver not only breadth, but also effective protection and reliable performance under demanding conditions.
Independent SecureIQLab testing demonstrated 99% security efficacy, with Palo Alto Networks scoring approximately 20 points higher than the next-best tested vendor. Miercom validation demonstrated up to 2–8 times higher AI traffic throughput, along with strong TLS inspection and stable performance under sustained load.
More than 75,000 organizations around the world rely on Palo Alto Networks to consolidate security, improve visibility and reduce risk across their hybrid environments.
This global scale provides intelligence that continuously strengthens the platform. Every attempted attack expands what the platform can learn, and every new detection can become protection for all customers.
Defining the Future of Hybrid Mesh Firewall
We believe being named a Leader for the second consecutive time reinforces our conviction in an integrated platform that delivers consistent prevention and operations everywhere an enterprise operates.
But we believe industry leadership is also about preparing customers for what comes next.
As Frontier AI accelerates attacks, autonomous systems reshape security operations and quantum risk changes the foundations of digital trust, enterprises need more than a collection of firewalls. They need an intelligent security platform that can transform shared intelligence into prevention across every environment.
Palo Alto Networks is building that future, helping organizations reduce exposure before attacks succeed, operate at machine speed, secure AI infrastructure and modernize digital trust for the post-quantum era.
Gartner, Magic Quadrant for Hybrid Mesh Firewall, 7 September 2026
This graphic was published by Gartner, Inc. as part of a larger research document and should be evaluated in the context of the entire document. The Garner document is available upon request from Palo Alto Networks.
Gartner does not endorse any company, vendor, product or service depicted in its publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner publications consist of the opinions of Gartner’s business and technology insights organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this publication, including any warranties of merchantability or fitness for a particular purpose.
Gartner and Magic Quadrant are a trademark of Gartner, Inc., and/or its affiliates.
Between mid-July and early August 2026, models being evaluated internally by OpenAI, Anthropic, and Meta reached real production systems outside their test environments. One exploited a previously unknown vulnerability to escape its sandbox entirely. At the same time, criminal groups showed that frontier capability isn’t required for serious attacks: a ransomware affiliate ran a full intrusion through Claude Code, and a separate campaign, JADEPUFFER, is now documented as the first case of agentic ransomware, an extortion operation a model carried out end to end once a human set it in motion. Check Point Research’s July-August 2026 AI Threat Landscape Digest […]
We ensure alignment and control in agents using synchronous control monitoring. Our model oversees agent execution, continuously ingests the trace as context, and prevents harmful actions before they execute in real time at sub-100ms latency. Agent trace at 30 tok/s, streamed to the control monitor model on the right. Prevents harmful actions before they are executed. Background Control Monitoring is a powerful tool for ensuring the runtime alignment and safety of autonomous agents. Since the Hugging Face Incident, the need for control monitoring on top of existing safety mechanisms was reinforced: OpenAI started investing more heavily into monitoring safety tools. […]
Frontier AI has compressed attack timelines from weeks to minutes.
For defenders to gain the upper hand, they need to fight back at machine speed. That’s why Palo Alto Networks Unit 42 launched Frontier AI Defense, our comprehensive service that pairs advanced frontier AI models with leading threat intelligence to uncover hidden risks, validate real attack paths, and accelerate remediation before adversaries strike.
Today, in a major milestone for organizations to defend themselves against AI-powered attacks, Unit 42 is expanding its Frontier AI Exposure Analysis capabilities with Anthropic’s Claude Mythos 5, giving organizations access to its advanced cyber capabilities.
Unlocking High-Fidelity Security with the Right Models, Harness and Expertise
While incredibly powerful, achieving high-fidelity results with frontier AI requires three things: the right models, an advanced harness, and the expertise to run it. With Unit 42 Frontier AI Exposure Analysis, guided and reviewed by Unit 42 experts, Claude Mythos 5 goes beyond identifying exposures. It tests whether those exposures can actually be exploited, connects weaknesses into attack paths, and helps prioritize the most urgently needed fixes. That answers the questions conventional scanners alone cannot: Is this exploitable? What can an attacker reach from here? And what should we fix first?
Further,our research shows models have different strengths. Unit 42’s multi-model approach applies the model best suited for the task, improving coverage and results while allowing us to continuously incorporate the strongest new capabilities as models advance.
Human expertise remains at the center. Unit 42 combines these models with our offensive security experts, global Palo Alto Networks telemetry, and Unit 42 Threat Intelligence to turn model output into validated attack paths, prioritized remediation, and clear defensive action.
How It Works
Our Frontier AI Defense service uses the most advanced AI models to discover exposures, test whether they are exploitable, validate attack paths and help customers prioritize what to fix first, including:
Leading Cyber Models: Advanced AI applied to discovery, testing, and validation.
Multi-Model Harness: Dynamic routing for stronger results, wider coverage, and managed costs.
Exposure Discovery: Identification of vulnerabilities, misconfigurations, exposed credentials, and unmanaged attack surfaces across apps and networks.
Advanced Adversary Simulation: Live exploitability testing and end-to-end attack path validation.
Custom Remediation Plans: Prioritized fixes delivered directly into existing IT, development, and security workflows.
Security teams do not need more findings. They need to know which weaknesses lead to a viable attack path. Attackers do not think about applications, identity, cloud, and infrastructure in isolation. They look for ways to move across them to reach their objective.
By putting frontier models to work with Unit 42 experts, we can identify and validate those attack paths before attackers do, and help organizations close them first.
Login
