{"slug": "palo-alto-networks-bolsters-ai-security-for-the-endpoint", "title": "Palo Alto Networks bolsters AI security for the endpoint", "summary": "Palo Alto Networks released Cortex XDR 6.0, combining extended detection and response with agentic endpoint security from its Koi Security acquisition in a shared management console and endpoint sensor under the name Cortex XDR One. The release intercepts AI prompts and responses at the operating system level, covering tools including Claude Code, Codex CLI and open-source frameworks such as OpenClaw, and adds preconfigured AI runtime security policies mapped to the MITRE ATLAS framework. Cortex XDR 6.0 also runs optimized small language models directly on the endpoint sensor to identify malicious or obfuscated scripts before execution without a cloud connection, and adds AI-assisted YARA rule management via Palo Alto Networks' AgentiX AI.", "body_md": "Palo Alto Networks further leveraged its Koi Security acquisition with the release of Cortex XDR 6.0.\n\nCentral to the suite is Cortex XDR One, which combines extended detection and response (XDR) with [Koi's agentic endpoint security (AES) capabilities](https://www.sdxcentral.com/news/palo-alto-networks-collects-koi-in-completed-acquisition/) in a shared management console and endpoint sensor.\n\nThe tools runs alongside Cortex Targeted Sensor, a modular deployment option that allows organizations to run selected Palo Alto security capabilities alongside existing third-party endpoint detection and response (EDR) products without immediately replacing them.\n\nThe release also expands agentic security with interception of prompts and responses at the operating system level, extending protection beyond apps that support native monitoring hooks.\n\nPalo Alto Networks named Claude Code, Codex CLI, and open-source frameworks [such as OpenClaw](https://www.sdxcentral.com/news/openclaw-goes-straight-with-enterprise-focused-ai-agents/) among the tools covered by the combined solution.\n\nCortex's new update also introduces preconfigured AI runtime security policies mapped to the MITRE ATLAS framework, giving administrators ready-made controls against known agentic AI threats.\n\nAnother addition is the deployment of optimized small language models (SLMs) directly on the Cortex XDR endpoint sensor to identify malicious or obfuscated scripts before execution. The models complement behavioral threat protection technology, which monitors process activity to detect attacks involving legitimate system utilities and previously unknown exploits.\n\nRunning the models locally also allows detection without relying on a cloud connection or transmitting potentially sensitive scripts for remote analysis. As such, Palo Alto Networks claimed the tech introduces no additional deployment overhead or performance degradation.\n\nCortex XDR 6.0 also introduces AI-assisted YARA rule management, allowing security teams to create or import custom malware-detection rules and run them across managed endpoints. Palo Alto Networks' AgentiX AI can generate rules and help assess whether they are likely to produce excessive alerts and analysts can then search their endpoint estate for matching files without manually connecting to individual devices or writing custom scripts. Matches are returned with file hashes, signing information, and host details, enabling users to isolate affected machines or add newly discovered file hashes to prevention policies.\n\nThe suite also extends native application control through the XDR agent across Windows and MacOS. Administrators can enforce policies at the publisher, application, or individual-file level, with controls for testing the operational impact of restrictions and managing end-user approval requests.", "url": "https://wpnews.pro/news/palo-alto-networks-bolsters-ai-security-for-the-endpoint", "canonical_source": "https://www.sdxcentral.com/news/palo-alto-networks-bolsters-ai-security-for-the-endpoint/", "published_at": "2026-10-20 13:28:50+00:00", "updated_at": "2026-10-20 13:48:57.009323+00:00", "lang": "en", "topics": ["ai-safety", "artificial-intelligence", "ai-agents", "ai-products"], "entities": ["Palo Alto Networks", "Cortex XDR 6.0", "Cortex XDR One", "Koi Security", "Claude Code", "Codex CLI", "OpenClaw", "MITRE ATLAS"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/palo-alto-networks-bolsters-ai-security-for-the-endpoint", "markdown": "https://wpnews.pro/news/palo-alto-networks-bolsters-ai-security-for-the-endpoint.md", "text": "https://wpnews.pro/news/palo-alto-networks-bolsters-ai-security-for-the-endpoint.txt", "jsonld": "https://wpnews.pro/news/palo-alto-networks-bolsters-ai-security-for-the-endpoint.jsonld"}}