Palo Alto Networks adds 24/7 Unit 42 experts to AI endpoint security

October 19, 2026, 14:59Source: Palo Alto Networks

Palo Alto Networks has launched Unit 42 Managed Agentic Endpoint Security (Managed AES), a service that gives organizations round-the-clock Unit 42 experts to govern, hunt and respond to threats tied to AI agents and AI-enabled tools on endpoints. It is built on Cortex AES, the company's AI-native endpoint security platform.

Key points

Palo Alto Networks launched Unit 42 Managed Agentic Endpoint Security (Managed AES), built on Cortex AES.
The service offers 24/7 Unit 42 expertise for AI governance, threat hunting, investigation and response, and AI-related cyber hygiene.
It is available with standalone Cortex AES or with Cortex XDR One, which merges Cortex AES and Cortex XDR in one sensor and console.
The company cites that only 6% of organizations have an advanced AI security strategy and that the fastest attacks can reach data exfiltration in 72 minutes.

Why the company says endpoints need new oversight

According to Palo Alto Networks, AI agents and AI-enabled tools are changing how work gets done. The company points to coding assistants and Model Context Protocol (MCP) servers as examples of autonomous tools that now access sensitive data, execute commands and modify local workflows directly from the endpoint. In its view, traditional endpoint security models do not offer the visibility or governance needed to manage these autonomous actions.

The company cites two figures to describe the gap. Only 6% of organizations have an advanced AI security strategy. And the fastest attacks can move from initial access to data exfiltration in just 72 minutes, according to the 2026 Unit 42 Global Incident Response Report.

What Managed AES covers

Cortex AES provides visibility, contextual risk intelligence and protection for AI agents and artifacts. Managed AES adds 24/7 Unit 42 expertise on top. Backed by Unit 42 threat intelligence, the experts handle AI governance, threat hunting, investigation and response, and AI-related cyber hygiene. Palo Alto Networks says they apply human judgment to turn contextual intelligence into policy recommendations and prioritized actions as the environment evolves.

The service is organized around four areas:

Governance: experts help identify AI tools and associated risks, evaluate exposure and recommend improvements to policies and controls.
Threat hunting: hunters use frontline threat intelligence and Cortex AES signals to proactively search the customer's AI environment for emerging and zero-day threats. They evaluate findings, recommend action and refine policies and correlation rules.
Investigation and response: analysts monitor activity around the clock, investigate suspicious behavior and take permitted actions on the customer's behalf to contain AI-related threats.
Cyber hygiene: Unit 42 assesses the customer's AI security posture as adoption evolves.

For the hygiene work, two reports are named. AI Security Posture Reports identify policy and control improvements, while Threat Impact Reports detail threats, potential impact, response actions taken and recommended next steps.

Two deployment options

Customers can choose the Cortex AES deployment model that fits their environment and receive the same 24/7 Unit 42 expertise either way.

The first option is Managed AES with standalone Cortex AES. Organizations deploy Cortex AES alongside their existing endpoint security solution to get AI-native visibility, contextual risk intelligence, governance and protection for AI agents and AI-enabled tools. Unit 42 experts then help them act on that visibility and risk intelligence.

The second option is Managed AES with Cortex XDR One, which combines Cortex AES and Cortex XDR in a single sensor and console experience. It pairs endpoint detection and response with AI-native security for AI agents and artifacts. Unit 42 experts provide 24/7 governance, threat hunting, investigation and response across the entire endpoint attack surface.

What it means for security teams

The announcement targets teams that are adopting AI faster than they can assess it. Palo Alto Networks says Managed AES helps security teams understand how AI is being used, address risk before it escalates and respond quickly when threats emerge. The source does not give pricing or availability details. The company is also promoting a webinar titled The Next Era of Endpoint Security, which covers how Cortex AES and Unit 42 experts help teams govern AI risks and protect the agentic endpoint.