Palo Alto's reported $500m for Console puts a price on agents that do the work

Palo Alto Networks announced on Tuesday, September 1, that it has acquired Console, a startup founded in 2024 whose AI agents handle routine corporate IT requests such as password resets and access to applications. The company did not disclose terms. TechCrunch, citing two people with knowledge of the deal, reported on September 2 that Palo Alto paid $500 million in cash and stock. Palo Alto declined to comment on the figure.

On its face this is a modest transaction for a company that has spent tens of billions of dollars on acquisitions this year. Its significance lies elsewhere. Console is not a classic security product. It is a tool that takes actions inside a company's identity systems and software applications on behalf of employees. By folding it into Cortex, its security operations platform, Palo Alto is betting that the next phase of security software will be judged less by how well it detects problems and more by whether it can fix them without a human in the loop.

A small company at a large multiple

The numbers on the private side are striking. According to TechCrunch, Console raised $29 million across two rounds: a $6.2 million seed led by Thrive Capital and a $23 million Series A co-led by DST Global Partners and Thrive. Other backers include SV Angel and Abstract Ventures. PitchBook valued the company at $157 million before the sale. If the reported price is accurate, Palo Alto paid roughly 3.2 times that valuation and about 17 times the capital Console ever raised.

Console's founder, Andrei Serban, started the company shortly after selling his previous startup, the code security platform Fuzzbuzz, to Rippling. Its customers reportedly included Ramp, Flock Safety and Scale AI. Nikesh Arora, Palo Alto's chairman and chief executive, was an angel investor in Console. That is not unusual in a world where senior executives back young companies in their own field, but it is a detail that shareholders are entitled to note, and one the company will want to see handled through the normal governance process.

For Thrive, which led both rounds, the outcome is a fast and clean return on a company barely two years old. For the wider venture market, it is a reminder that strategic buyers are willing to pay well ahead of private marks for teams that have shipped working agent technology to demanding customers.

Why a security company wants a help desk

The logic becomes clearer from the way Palo Alto describes the deal. According to the company, Console's software connects to a customer's identity systems, SaaS applications and security tools. Its agents interpret a request, gather context, carry out a workflow and keep a record of what they did. Palo Alto says the technology will extend Cortex so that security teams can investigate alerts, set priorities and act more quickly, using natural language.

Mr Arora framed the purchase as "the shift to software-as-an-agent". In the company's announcement he added: "Security operations can no longer be about managing dashboards and queuing tickets just to help humans work faster." He said Console would give Cortex "the arms and legs to deliver autonomous security outcomes across the entire enterprise." Mr Serban put it more simply: "We built Console around a simple idea: people should be able to express an operational goal," with the software working out the steps.

There is a sound commercial reason behind the rhetoric. Detection has become crowded and increasingly automated. The bottleneck in most security teams is the queue of follow-up work: revoking access, resetting credentials, isolating accounts, documenting what happened. Much of that work runs through the same identity and access plumbing that an IT help desk touches every day. A vendor that already sits in that plumbing, and has earned the trust to change things there, holds a valuable position.

The seventh deal of the year

Console is Palo Alto's seventh acquisition of 2026, according to PitchBook. Network World lists the larger ones that preceded it: Chronosphere for $3.35 billion, completed in January; CyberArk for $25 billion, closed in February; Koi for about $400 million in April; and Portkey, completed in May. Palo Alto says it serves more than 70,000 customers.

The pattern is consistent. CyberArk brought privileged identity, Chronosphere brought observability data, and Koi and Portkey added capabilities around software and AI usage. Console adds the ability to act. Taken together, the deals describe a platform that wants to see the data, understand who has access to what, and then make changes directly. That is a broader ambition than selling firewalls, and it puts Palo Alto into closer competition with IT service management vendors as well as with other security platforms.

It also raises a question that buyers of security software will ask more often. An agent that can reset passwords and grant access is, by definition, a powerful tool that an attacker would like to control. Concentrating detection, identity and automated remediation in one vendor promises efficiency, but it also creates a single system whose compromise or misconfiguration would carry larger consequences. Palo Alto will need to show that the agents it sells are themselves governed as tightly as the users they serve.

What it means for the independents

The deal leaves a clearer field among standalone startups in AI service automation. TechCrunch notes that Serval, a Sequoia-backed challenger to ServiceNow, reached a $1 billion valuation after a $75 million Series B led by Sequoia last December, and has expanded from technical support into HR, legal and finance. One unaffiliated investor described Serval to the publication as the "category-leader-to-watch".

That cuts two ways for founders. A $500 million exit for a two-year-old company with $29 million raised sets an attractive reference point and suggests that large platforms will buy rather than build when a team has proven its product with credible customers. But it also shows that the natural acquirers for agent startups are not only IT software companies. Security platforms, which already hold the identity data and the budget, are now bidders too. Startups in adjacent categories should expect both more interest and more competition from incumbents moving into their territory.

Our view

Palo Alto has paid a premium price for a small company because it wants its platform to take actions, not merely raise alarms. The strategy is coherent, and the price is affordable for a company of its size. The more interesting signal is for the venture market: agent technology that safely changes things inside corporate systems is now worth several times its private valuation to a strategic buyer.

Founders building such agents should treat auditability and permission control as the core of the product, because that is what an acquirer in security will examine first. Investors should recognise that early exits at strong multiples are possible, but that they cap the upside of companies that might otherwise have grown into independent platforms. What to watch: how quickly Console's agents appear inside Cortex, whether rivals respond with similar purchases, and whether Serval and its peers raise again at higher prices on the strength of this deal.

Sources

• TechCrunch: Palo Alto Networks paid $500M for Thrive-backed Console, sources say
• Network World: Palo Alto Networks buys Console to boost agentic security
• Pulse 2.0: Palo Alto Networks acquires Console to expand agentic security capabilities

Filed under Cybersecurity. Written by InvestTimes Editorial under our editorial standards. Commentary and analysis for information only, not investment advice.