Palo Alto Networks Announces Intent to Acquire Koi to Secure the Agentic Endpoint
Rhea-AI Summary
Palo Alto Networks (NASDAQ: PANW) announced it has entered into a definitive agreement to acquire Koi, a provider of Agentic Endpoint Security, to address AI-native endpoint risks. The acquisition will integrate Koi into Prisma AIRS and enhance Cortex XDR to provide broader visibility and control over AI agents.
An investor webcast and Q2 FY2026 earnings call with further details is scheduled for February 17, 2026 at 1:30pm PT.
Positive
- Acquisition announced to add Agentic Endpoint Security
- Koi technology will integrate with Prisma AIRS
- Cortex XDR to gain expanded AI attack-surface visibility
- Investor call scheduled for February 17, 2026 to provide details
Negative
- Purchase price and detailed deal terms not disclosed in the announcement
- No quantified financial impact or guidance change provided with the filing
News Market Reaction – PANW
On the day this news was published, PANW declined 2.07%, reflecting a moderate negative market reaction. Argus tracked a trough of -14.2% from its starting point during tracking. Our momentum scanner triggered 59 alerts that day, indicating high trading interest and price volatility. This price movement removed approximately $2.41B from the company's valuation, bringing the market cap to $113.96B at that time.
Data tracked by StockTitan Argus on the day of publication.
Key Figures
Market Reality Check
Peers on Argus
PANW was up 2.54% with key security peers also green: CRWD +3.05%, FTNT +1.19%, NET +4.95%, SNPS +3.25%, ZS +1.94%, indicating a broader positive tone in related names rather than an isolated move.
Previous Acquisition Reports
| Date | Event | Sentiment | Move | Catalyst |
|---|---|---|---|---|
| Jul 30 | Major acquisition | Positive | -5.6% | Announced ~$25B CyberArk deal to add identity security as core pillar. |
| Sep 04 | Acquisition close | Positive | -2.5% | Closed acquisition of IBM’s QRadar SaaS assets to enhance Cortex XSIAM. |
Recent acquisition headlines for PANW have been followed by negative next-day moves despite strategic positioning.
Over the past 18 months, Palo Alto Networks has repeatedly used acquisitions to expand its platform, including CyberArk for identity security and IBM’s QRadar SaaS assets for security operations. These deals aimed to deepen AI-driven and identity-aware capabilities but were followed by next-day moves of -5.58% and -2.51%. Today’s Koi agreement continues this AI-focused acquisition strategy, extending protection to agentic endpoints and complementing prior identity and observability transactions.
Historical Comparison
PANW’s prior acquisition headlines averaged a -4.04% next-day move, so this agentic-endpoint deal fits the ongoing platform expansion pattern even as past market reactions were negative.
Acquisition activity has progressed from QRadar SaaS assets and CyberArk’s identity platform toward securing AI agents and endpoints, signaling a steady build-out of AI-era security capabilities.
Market Pulse Summary
This announcement extends Palo Alto Networks’ acquisition-driven strategy into securing AI agents and tools on the endpoint, with Koi intended to feed into Prisma AIRS and enhance Cortex XDR. It follows recent deals for Chronosphere and CyberArk, reinforcing an AI-era, platform-centric approach. Investors may focus on how quickly agentic endpoint capabilities are integrated, referenced, and quantified on the Q2 FY2026 earnings call and in subsequent regulatory disclosures.
Key Terms
remote code execution technical
endpoint security technical
AI-generated analysis. Not financial advice.
Eliminates the AI security gap by establishing Agentic Endpoint Security as the next frontier of enterprise risk reduction
The New Imperative: Agentic Endpoint Security
Traditional security was built to stop malicious files, but modern AI agents and tools can actively read, write, and move data. Attackers are chaining exploits in agent frameworks — from authentication bypass to API-based remote code execution — while spoofing agent identities and hijacking credentials to weaponize trusted automation. The endpoint attack surface is also evolving beyond traditional executables, with extensions, plugins, packages, scripts and model artifacts increasingly shaping endpoint behavior outside centralized oversight. Agents accelerate and operationalize this shift, compounding risk at machine speed. This rapid shift has created a critical new blind spot in traditional approaches to security, requiring a new category of protection: Agentic Endpoint Security.
After the close of the acquisition, Koi's Agentic Endpoint Security will extend to Palo Alto Networks' Prisma AIRS™, its leading AI security platform. This integration will broaden coverage across critical AI-driven operations. Concurrently, it will enhance Cortex XDR®'s endpoint security solution providing significant visibility into the AI attack surface to improve security policy and malware prevention. This will ensure these critical capabilities are readily available to customers, allowing them to deploy agentic tools with confidence.
Lee Klarich, Chief Product & Technology Officer, at Palo Alto Networks.
"AI agents and tools are the ultimate insiders. They have full access to your systems and data, but operate entirely outside the view of traditional security controls. By acquiring Koi, we will be closing this gap and setting a new standard for endpoint security. We will give our customers the visibility and control required to safely harness the power of AI—ensuring that every agent, plugin, and script is governed, verified, and secure."
Amit Assaraf, CEO and Co-Founder of Koi.
"We founded Koi to secure the next frontier of risk. In an agentic-first world, traditional solutions are blind. Joining forces with Palo Alto Networks will allow us to scale our technology to the world's largest organizations, delivering protection that makes work on the modern AI-native endpoint secure by design."
Learn more about our intent to acquire Koi here.
Investor Call Details
Palo Alto Networks will provide further details regarding this announcement on its Q2 FY2026 earnings call, scheduled for February 17, 2026 at 1:30pm PT. A live video webcast of the call will be accessible from the Investors section of the Palo Alto Networks website at investors.paloaltonetworks.com
Follow Palo Alto Networks on Twitter, LinkedIn, Facebook and Instagram.
About Palo Alto Networks
Palo Alto Networks (NASDAQ: PANW), the global AI cybersecurity leader, protects our digital way of life with a comprehensive portfolio of cybersecurity solutions and platforms across Network, Cloud, Security Operations, AI and Identity. Trusted by over 70,000 customers and powered by Unit 42® threat intelligence, our AI-driven platforms eliminate complexity, empowering enterprises to modernize with confidence and securing the speed of innovation. Explore the future of security at www.paloaltonetworks.com.
Forward-Looking Statements
This press release contains forward-looking statements that involve risks, uncertainties, and assumptions, including, but not limited to, statements regarding the anticipated benefits and impact of the proposed acquisition of Koi on Palo Alto Networks, Koi and their customers. There are a significant number of factors that could cause actual results to differ materially from statements made in this press release, including, but not limited to: the effect of the announcement of the proposed acquisition on the parties' commercial relationships and workforce; the ability to satisfy the conditions to the closing of the acquisition, including the receipt of required regulatory approvals; the ability to consummate the proposed acquisition on a timely basis or at all; significant and/or unanticipated difficulties, liabilities or expenditures relating to proposed transaction, risks related to disruption of management time from ongoing business operations due to the proposed acquisition and the ongoing integration of other recent acquisitions; our ability to effectively operate Koi's operations and business following the closing, integrate Koi's business and products into our products following the closing, and realize the anticipated synergies in the transaction in a timely manner or at all; changes in the fair value of our contingent consideration liability associated with acquisitions; developments and changes in general market, political, economic and business conditions; failure of our platformization product offerings; risks associated with managing our growth; risks associated with new product, subscription and support offerings; shifts in priorities or delays in the development or release of new product or subscription or other offerings or the failure to timely develop and achieve market acceptance of new products and subscriptions, as well as existing products, subscriptions and support offerings; failure of our product offerings or business strategies in general; defects, errors, or vulnerabilities in our products, subscriptions or support offerings; our customers' purchasing decisions and the length of sales cycles; our ability to attract and retain new customers; developments and changes in general market, political, economic, and business conditions; our competition; our ability to acquire and integrate other companies, products, or technologies in a successful manner; our debt repayment obligations; and our share repurchase program, which may not be fully consummated or enhance shareholder value, and any share repurchases which could affect the price of our common stock.
Additional risks and uncertainties that could affect our financial results are included under the captions "Risk Factors" and "Management's Discussion and Analysis of Financial Condition and Results of Operations" in our Quarterly Report on Form 10-Q filed with the SEC on November 20, 2025, which is available on our website at investors.paloaltonetworks.com and on the SEC's website at www.sec.gov. Additional information will also be set forth in other filings that we make with the SEC from time to time. All forward-looking statements in this press release are based on information available to us as of the date hereof, and we do not assume any obligation to update the forward-looking statements provided to reflect events that occur or circumstances that exist after the date on which they were made.
View original content to download multimedia:https://www.prnewswire.com/news-releases/palo-alto-networks-announces-intent-to-acquire-koi-to-secure-the-agentic-endpoint-302689465.html
SOURCE Palo Alto Networks, Inc.
FAQ
What did Palo Alto Networks (PANW) announce on February 17, 2026 about acquiring Koi?
How will the Koi acquisition affect Palo Alto Networks' Prisma AIRS and Cortex XDR (PANW)?
When will Palo Alto Networks (PANW) provide more details on the Koi acquisition?
Does the announcement state the purchase price or financial terms for Koi and PANW?
What is 'Agentic Endpoint Security' in the context of the PANW acquisition of Koi?
How will the Koi acquisition impact enterprise endpoint security for PANW customers?
