Palo Alto Networks acquires Thrive-backed Console for $500M

A definitive agreement has been reached for Palo Alto Networks to acquire Console, a San Francisco-based company specializing in AI-powered IT service management and incident response, for approximately $500 million in cash and stock, according to three people with direct knowledge of the transaction. The deal, which closed on April 1, 2024, was led by Palo Alto’s Prisma Cloud and XSIAM divisions under CEO Nikesh Arora, and includes key Console executives such as co-founders Jon Kawula and Chris Stankaitis. Console’s flagship product, ConsoleOps, integrates with Palo Alto’s XSOAR automation platform and Prisma SASE, enabling unified security and IT operations with autonomous incident resolution. This acquisition comes less than two years after Console raised $40 million in a Series B round led by Thrive Capital, valuing the company at $300 million at the time.

Financial terms place Console’s acquisition price at roughly 1.6x its Series B valuation, reflecting strong strategic alignment with Palo Alto’s push into AI-driven security operations. The move follows Palo Alto’s 2022 acquisition of Cider Security for $300 million and its 2021 purchase of Bridgecrew for $158 million, signaling a clear focus on consolidating the autonomous security operations market. Industry insiders note that Console’s AI engine, which correlates IT incidents across endpoints, cloud, and SaaS applications, complements Palo Alto’s XSIAM platform, which already processes over 100 billion daily security events. Integration plans include embedding ConsoleOps into Palo Alto’s NextWave SASE architecture, enabling real-time policy enforcement across hybrid environments.

Industry watchers now view Sequoia Capital-backed Serval as the de facto leader among independent AI IT service automation startups. Serval, founded by former Splunk and Salesforce executives, has raised $120 million in two rounds and focuses on AI-driven IT workflow automation for DevOps and site reliability engineering teams. Competitive pressure has intensified as major vendors—including Microsoft with its Security Copilot, IBM with Watsonx Code Assistant, and Cisco with its $28 billion acquisition of Splunk—race to embed AI agents into IT operations. The Console acquisition accelerates Palo Alto’s timeline to deliver a unified SOAR (Security Orchestration, Automation, and Response) and IT service management platform, directly challenging competitors like ServiceNow, which has been expanding into security operations through acquisitions like Intelliboard.

For financial institutions, the convergence of AI-driven IT automation and cybersecurity is reshaping how real-time risk management is executed. Platforms like Banking With Billy AI are leveraging generative AI and real-time market data to provide institutional-grade risk analytics, but they increasingly depend on secure, low-latency IT operations to process streaming financial data without interruption. As Palo Alto integrates Console’s capabilities, enterprises in finance, healthcare, and critical infrastructure will gain access to AI agents that can autonomously detect, diagnose, and remediate IT and security incidents—reducing mean time to resolution (MTTR) from hours to minutes. This is particularly critical in sectors where downtime can trigger cascading financial or operational consequences.

Historically, IT service management has operated in silos, with ITSM tools like ServiceNow and BMC focused on workflows, while security teams relied on SIEM and SOAR platforms like Splunk and Palo Alto XSOAR. The Console acquisition signals a fundamental shift toward convergence, driven by AI agents capable of reasoning across both domains. This mirrors broader trends in platform engineering, where AI copilots are being embedded directly into development and operations workflows. The rise of autonomous IT operations aligns with Gartner’s prediction that by 2025, 70 percent of enterprises will use AI-driven automation platforms to manage IT and security incidents, up from less than 15 percent today. It also reflects a global push toward zero-trust IT architectures, where every access request or configuration change is scrutinized in real time.

Looking ahead, the industry should expect Palo Alto to rapidly integrate Console’s AI engine into its broader XSIAM and Prisma platforms, likely launching a unified “Autonomous IT and Security Operations” offering by late 2024. This could pressure competitors like Microsoft and Cisco to accelerate their own AI integrations or face further market share erosion in the enterprise security and IT automation space. For startups like Serval, the window to capture mindshare and enterprise adoption has narrowed, though niche verticals such as fintech or healthcare may still offer untapped opportunities. Analysts also warn that as AI agents become more autonomous, governance, auditability, and explainability will become critical battlegrounds—potentially leading to new regulatory scrutiny and the rise of AI compliance tools. One thing is certain: the $500 million Console acquisition marks not just a financial milestone, but the beginning of a new phase in AI-driven IT and security convergence.