The acquisition of Koi Security is a declaration that the agentic era has created an entirely new threat surface.

Security Boulevard is a leading cybersecurity news and information portal, offering articles, analysis, and insights on cybersecurity threats, vulnerabilities, and best practices. From the latest trends in cyber threats to expert commentary on security technologies and compliance frameworks, Security Boulevard provides resources for security professionals, IT leaders, and business executives seeking to protect their organizations from cyber attacks and data breaches.

Security Boulevard

Palo Alto Networks acquired Koi Security, a one-year-old Israeli startup, for ~$400M just one week after closing a $25B CyberArk deal. Koi's Wings Risk Engine addresses a critical blind spot in traditional EDR: malicious or compromised browser extensions, IDE plugins, and AI agent artifacts that operate inside trusted processes like Chrome or VSCode, invisible to conventional security tools. Koi's approach is preventive rather than reactive — interrogating extensions before installation rather than monitoring behavior after the fact. Palo Alto plans to integrate this into Prisma AIRS and Cortex XDR, creating upstream governance for the AI tool layer. Combined with CyberArk's identity controls, this positions Palo Alto to govern both who can act and what tools are permitted in agentic enterprise environments, where machine identities outnumber humans 82:1.

The Lock, Not the Alarm: How Palo Alto’s Koi Acquisition Rewrites Endpoint Security

The Market’s Skepticism and Why It Might Be Shortsighted