Loading story…
Palo Alto Networks is reportedly in advanced negotiations to acquire Israeli cybersecurity startup Koi Security for approximately $400 million. While Palo Alto Networks has not officially confirmed the deal, sources indicate that a preliminary memorandum of understanding has been signed and both parties are working to finalize the terms. Koi Security, founded by former members of the IDF's 8200 Intelligence Corps, specializes in endpoint software security and has raised $48 million in funding to date. The acquisition would mark Palo Alto Networks’ first purchase of an Israeli company since the departure of its founder Nir Zuk from the CTO role.
The potential deal highlights Palo Alto Networks’ ongoing strategy to expand its portfolio with advanced cybersecurity technologies, particularly those leveraging AI. If completed, the acquisition would provide a significant exit for Koi’s founders and investors, and could signal renewed confidence in Israeli cybersecurity startups amid a recovering tech sector. The move follows a series of recent acquisitions by Palo Alto Networks, including the purchase of Protect AI and ongoing negotiations to acquire CyberArk.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
Multiple outlets reported that Palo Alto Networks was in advanced talks to acquire Koi Security for roughly $400 million. Neither company publicly confirmed the transaction at the time.
Palo Alto Networks and Koi Security signed a memorandum of understanding indicating mutual strategic interest in a potential acquisition. The proposed deal was reported at about $400 million, though it was not yet finalized.
Koi Security was founded in 2024 as a startup focused on securing non-binary software such as extensions, AI models, code packages, and containers across enterprise environments.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
4 references tracked. Mallory keeps watching after this page renders.
bankinfosecurity.com
Open sourcegovinfosecurity.com
Open sourcego.theregister.com
Open sourcetechrepublic.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Endpoint security startup Koi has secured $48 million in seed and Series A funding to expand its platform for securing non-binary software, including AI models, code packages, and containers. The company, led by former Israeli Military Intelligence soldier Amit Assaraf, differentiates itself by providing risk mapping and governance for software types often missed by traditional endpoint security tools. Koi's technology leverages large language models to classify and assess risk across distributed enterprise environments.
Jun 29, 2026
Palo Alto Networks initiated discussions to acquire CyberArk, marking the second-largest deal in cybersecurity history. The initial outreach from Palo Alto Networks CEO Nikesh Arora to CyberArk founder and chairman Udi Mokady occurred in May 2023, but CyberArk initially declined, preferring to remain independent. After a two-year pause, Arora renewed acquisition interest in June 2025, leading to an in-person meeting between the two companies' leadership on June 17, 2025. Both firms entered into a mutual nondisclosure agreement on June 25, 2025, to facilitate confidential negotiations. On July 1, 2025, Palo Alto Networks submitted a non-binding letter of interest, proposing an all-stock acquisition of CyberArk at $457.99 per share. The CyberArk board evaluated the offer, considering the strategic benefits of merging with Palo Alto Networks compared to other potential acquirers. The deal nearly collapsed at the last minute, but both companies accelerated their announcement timeline due to media leaks. The acquisition, valued at $25 billion, is set for a shareholder vote on November 13, 2025. The transaction is expected to reshape the cybersecurity landscape by combining Palo Alto Networks' strengths in network security and cloud security with CyberArk's expertise in privileged access management. The deal reflects ongoing consolidation in the cybersecurity sector, driven by the need for integrated security solutions amid evolving threats. Both companies have significant portfolios in artificial intelligence, machine learning, and network access control, which are anticipated to be leveraged post-acquisition. The acquisition process involved careful due diligence and strategic planning to ensure alignment of business objectives. The announcement has generated significant attention due to the size of the deal and the prominence of both companies in the cybersecurity industry. Shareholders and industry analysts are closely monitoring the outcome of the upcoming vote. The deal underscores the increasing value placed on identity and access management as a core component of enterprise security. If approved, the acquisition will position Palo Alto Networks as a dominant player in the cybersecurity market, with expanded capabilities across cloud, network, and identity security domains. The transaction is also expected to drive further innovation and integration of security technologies to address complex enterprise needs.
Jun 29, 2026
Palo Alto Networks has acquired Console, an AI-native platform that lets organizations create agentic workflows through natural-language instructions. The company plans to integrate Console into its Cortex security-operations platform, enabling agents to investigate alerts, enrich and correlate events, prioritize cases, coordinate with enterprise data sources, isolate endpoints, and execute remediation across security and IT environments. Financial terms were not disclosed. The acquisition is intended to move Cortex beyond analyst-facing recommendations toward governed autonomous operations. Palo Alto Networks said such deployments require restricted system access, comprehensive activity logging, approvals for high-impact actions, and safeguards against inaccurate or unauthorized agent behavior. The announcement accompanied the company’s fiscal fourth-quarter 2026 results, which reported $3.41 billion in revenue and nearly $1 billion in net new next-generation security ARR; the timing and success of Console integration remain uncertain.
Sep 3, 2026