Palo Alto Networks Closes Koi Acquisition To Tackle Agentic Endpoint Security

Palo Alto Networks has completed its acquisition of Koi, a deal the cybersecurity firm is using to stake out a new product category it calls Agentic Endpoint Security.

The acquisition comes as enterprises grapple with the security implications of autonomous AI tools and coding agents that are rapidly being adopted across development teams. While these tools are delivering productivity gains, they are also expanding the attack surface at the endpoint in ways that conventional security products were not designed to address.

Vibe Coding Creates New Risks

The rise of so-called vibe coding agents and autonomous endpoint tools has created a gap in enterprise security postures. Tools like Claude Code and OpenClaw give AI agents direct access to critical systems and sensitive data, effectively creating a new class of insider threat.

Koi’s technology is purpose-built to secure these agentic AI tools at the endpoint. By folding Koi into its portfolio, Palo Alto Networks is betting that enterprises will need dedicated controls for this emerging risk category rather than relying on traditional endpoint detection and response products alone.

Lee Klarich, Chief Product and Technology Officer at Palo Alto Networks, framed the challenge in stark terms.

“Agentic AI presents tremendous opportunity for the enterprise, yet they create a new attack surface that traditional security tools were not built to detect,” Klarich stated.

“These agents operate with access to critical systems and sensitive data, creating the ultimate insider threat. With the acquisition of Koi, we are delivering the only solution I’ve seen to secure vibe coding and agentic AI at the endpoint, so our customers don’t have to choose between innovation and security.”

Integration With Prisma AIRS And Cortex XDR

Palo Alto Networks plans to integrate Koi’s capabilities with Prisma AIRS, extending visibility and security controls for agentic AI on the endpoint. The goal is to offer a single control plane for securing enterprise-wide AI adoption under the Agentic Endpoint Security banner.

The acquisition also enables Palo Alto Networks to introduce a new module for Cortex XDR that can identify and remediate risks within the AI software ecosystem.

Koi’s capabilities will continue to be available as a standalone product, allowing organisations that run other endpoint detection and response solutions to deploy Koi’s agentic security features alongside their existing tools.

A New Security Category

Amit Assaraf, CEO and Co-Founder of Koi, pointed to the breadth of the combined offering.

“By joining Palo Alto Networks, we will be able to provide our customers with the most comprehensive solution for securing all AI and software on the endpoint and across the enterprise,” Assaraf explained.

“Together, we are establishing Agentic Endpoint Security as the new imperative, giving our customers the secure foundation they need to lead in an AI-native world.”

Agentic Adoption At An Inflection Point

The acquisition reflects a broader industry shift as frontier AI models and autonomous coding agents move from experimental deployments into production environments. As agentic adoption accelerates, the security tooling required to manage these systems is becoming a priority for enterprise security teams.

Palo Alto Networks is positioning the Koi deal as a way to get ahead of this curve, offering purpose-built protections before the attack surface widens further.

The company serves more than 70,000 customers globally and operates across network security, cloud security, security operations, AI and identity. Its threat intelligence arm, Unit 42, underpins the company’s AI-driven platform strategy.

Last Updated on April 15, 2026 by Nick Ross