Palo Alto buys Console: IT automation moves inside Cortex
Palo Alto Networks acquired Console to add natural-language agentic workflows to Cortex, reportedly for $500M. Standalone IT automation keeps getting absorbed.
Palo Alto Networks announced it is acquiring Console on September 1, folding an AI-native agentic platform into Cortex. TechCrunch reports the price at $500 million in cash and stock, citing two people with knowledge of the deal; Palo Alto did not disclose terms (Palo Alto Networks, TechCrunch). Another standalone automation tool just became a feature of a security platform.
What actually happened
Console lets teams investigate signals, prioritize work and take action across an environment using natural-language workflows. Palo Alto's framing is that customers can "have a direct conversation with data and build agentic workflows in natural language," per CEO Nikesh Arora. Co-founder Andrei Serban said joining gives the team platform foundation and enterprise scale. The technology goes into Cortex to deepen its agentic capabilities.
The pattern behind the announcement is the interesting part. Console's work — reading enterprise signals, deciding what matters, executing the fix — is generic operations automation. Palo Alto is buying it as a security capability. The same engine that resets a password is the engine that remediates an alert.
Why an absorbed automation vendor matters for your business
If you run a small operation, you are almost certainly using at least one point tool that does something like this: a workflow builder, an alerting router, a helpdesk automation layer. Console's outcome is the base case for that category. The tool gets acquired, the roadmap re-points at the acquirer's platform, standalone pricing quietly becomes suite pricing, and your integration is now a line item in someone else's bundle.
That is not a reason to avoid buying tools. It is a reason to know which layer of your stack you actually own. The durable question for any automation vendor: if this company is bought in eighteen months, what do I still have? If the answer is "my workflow definitions, in a format I can read, hitting APIs I could call myself," you are fine. If the answer is "a login," you are exposed.
Concretely, keep the decision logic — what triggers, what escalates, what auto-resolves — in your own repo. Let the vendor be the execution surface, not the system of record. Export your workflow configs on a schedule. Prefer tools whose actions are plain API calls you could reimplement in a weekend, because one day you might have to.
Palo Alto is buying agentic operations because it works. Fine. Just don't confuse "this vendor is winning" with "this vendor will exist in its current form when your renewal comes up."
Key takeaways
- Palo Alto Networks announced its acquisition of Console on September 1, 2026; terms were not disclosed
- TechCrunch reports $500M in cash and stock, sourced to two people with knowledge of the deal
- Console builds natural-language agentic workflows that investigate, prioritize and act across enterprise data; it goes into Cortex
- Generic operations automation is being bought as a security capability — the same engine resets passwords and remediates alerts
- Keep your decision logic and workflow definitions in your own repo so an acquisition costs you a vendor, not a system
Every automation vendor is someone's acquisition target. We build the workflow logic into systems you own, with the vendor as a swappable execution layer. See what that looks like in production, or tell us which tool you'd be stuck with tomorrow.
Sources: Palo Alto Networks, TechCrunch.
- #ai-agents
- #acquisitions
- #it-automation
- #vendor-risk
- #security
Tommy Rush — Founder, Rush Commerce
Operator turned builder. 15+ years running operations — now shipping the systems businesses run on. More
Get The Rush Report weekly — one email, zero fluff.
Keep reading
HiddenLayer raises $100M: the AI security checklist
HiddenLayer's $100M Series B and 10x ARR growth show AI security became a budget line. Here's the free version of their product map for a small team.
Read itGitHub Copilot seats go prepaid as signups reopen Sept 1
GitHub Copilot Business and Enterprise signups reopen September 1, 2026 — and every seat now bills upfront before the developer can use it. Existing customers hit October 1.
Read it