Koi Purchase Bolsters Palo Alto’s AI Attack Surface Defense

Palo Alto Networks plans to purchase an endpoint posture management startup to address the emergence of a new artificial intelligence-driven attack surface at the endpoint.

See Also: AI Turning Tool Sprawl Into an Attack Surface

The Silicon Valley-based platform security giant said its proposed buy of Tel Aviv-based Koi Security will safeguard AI agents, MCP servers, browser extensions, plug-ins and non-binary packages that operate outside traditional security controls, said Hadar Oren, senior vice president for product management at Palo Alto Networks. Traditional XDR tools focus on malicious files, executables and processes, and lack visibility into AI-related components.

“These agents are operating entirely outside of traditional security controls,” Oren told Information Security Media Group. “So, they’re running with very high permissions to do actions that were technically given to them in order to provide that service. But they can also do other things if not managed correctly.”

Koi, founded in 2024, employs 155 people and tapped Battery Ventures, Team8, Picture Capital and NFX to lead its $10 million seed round and $38 million Series A funding, which were announced in September 2025. CEO Amit Assaraf spent four years as an Israeli Military Intelligence soldier focused on cybersecurity and more than five years as chief technology officer of real estate investing app Lando (see: Koi Raises $48M to Safeguard AI Models, Code and Extensions).

Palo Alto Networks will pay $300 million for Koi. The deal is expected to close by the end of July. The proposed Koi acquisition comes just five days after Palo Alto completed its $25 billion purchase of privileged access management heavyweight CyberArk, and less than a month after Palo Alto closed its $3 billion buy of observability company Chronosphere (see: Why Palo Alto Is Eyeing a $400M Buy of Endpoint Vendor Koi).

Why Traditional XDR Falls Short in the Age of AI Tools

Traditional XDR systems were designed primarily to detect malicious binaries, files, processes and executables, but Oren said AI tools frequently operate through non-binary packages, plug-ins, IDE extensions, ephemeral code and agent frameworks that bypass conventional detection models. As a result, security teams lack visibility into what these tools are accessing, modifying or transmitting.

“They’re actually giving them permissions to do a lot of action because the reason that they actually went with AI was to increase their effectiveness from a team perspective,” Oren said. “So, they’re actually weaponizing these tools and hurting the organizations themselves. The traditional tools don’t bring visibility into such things.”

Koi collects detailed telemetry across plugins, non-binary packages, AI tools, permissions and endpoint configurations, Oren said, enabling organizations to see what AI tools are installed, what permissions they hold and what actions they can take. It evaluates the risk introduced by specific permissions and configurations, helping organizations understand why it matters from a security standpoint, Oren said.

“They collect all the data across the endpoint, bring you that information, and then give you the assessment on the risk and what is the risk added to it because of the permission given,” Oren said. That data gives organizations “the ability to act based on the set of policies that you defined. There’s just nothing like that right now in the market.”

How Koi Security Fits Into Palo Alto’s Cortex XDR, Prisma AIRS

Rather than imposing a one-size-fits-all model, Koi helps customers determine what AI tools can be accessed, which configurations are acceptable and which actions should trigger remediation. This policy-based control adds an additional layer of defense beyond what is configured natively within AI tools themselves and ensuring that organizational standards are actively upheld, Oren said.

“You as a customer can define your own and say, ‘This is where my lines cross’ versus different customers who can say, ‘My lines are actually crossed somewhere else,'” Oren said. “So, they give the customers the ability to define it in different places.”

Within Cortex XDR, Koi will enhance endpoint security by adding the visibility and remediation controls that are currently missing for AI-related risks and extend XDR beyond traditional file and process-based detection, Oren said. In Prisma AIRS, Koi’s capabilities will strengthen AI platform security by extending governance and visibility down to the device layer to provide endpoint-level insight and control.

“It will give us the extra layer that we’re now lacking from visibility and remediation controls,” Oren said. “The idea is that we obviously want to make it part of the platformization that we’ve been doing, and we want to enhance the solution that we’re offering today to customers, and making sure that in a unified way, they can actually enhance their security and solve more issues.”

The endpoint is becoming more dynamic, more agent-driven and more decentralized, which CEO Nikesh Arora said creates new threat vectors that traditional security tools are ill-equipped to manage. Palo Alto Networks aims to consolidate AI traffic, governance and controls into an integrated platform before competitors can establish dominance, and the company even became a Koi customer prior to the acquisition.

“We’re all laying the groundwork right now in an arms race to try and see who can get the AI security platform up and running as quickly as we can,” Arora told investors Tuesday. “You can see innovation is happening in every direction. That’s why you see us buy Protect.ai, which is now well integrated. We took the firewall, made an AI firewall. Now we’re taking Koi. We see that that’s where the action is.”