The deals
SentinelOne announced a definitive agreement to acquire Prompt Security on 5 August 2025, for cash and stock. Its blog, updated 3 September 2025, is titled SentinelOne Acquires Prompt Security, and Investing.com reported from SentinelOne's filing that the deal closed on 5 September 2025 for about $180 million in cash and stock. SentinelOne now describes Prompt Security as built into the SentinelOne Singularity Platform, and the product brands itself as Prompt Security from SentinelOne.
Palo Alto Networks completed its acquisition of Koi on 14 April 2026. Its press release describes three things: integration with Prisma AIRS, a new Cortex XDR module, and Koi remaining available as a standalone offering. Koi's own website now redirects to Cortex Agentic Endpoint Security.
Around the Koi deal, Palo Alto Networks made two related moves. Prisma AIRS 3.0, announced on 23 March 2026, describes agent discovery across cloud, SaaS and endpoints and an AI Agent Gateway in limited preview. On 29 May 2026 the company completed its acquisition of Portkey, an AI gateway, which it describes as the gateway for Prisma AIRS.
The rounds
Onyx Security came out of stealth on 12 March 2026 with $40 million in funding from Conviction Partners and Cyberstarts, and announced a $113M Series B led by Bessemer Venture Partners on 29 July 2026. Zenity announced a $125 million Series C led by Norwest on 3 August 2026, to fund expansion in Europe and Asia Pacific and research through Zenity Labs. Earlier, Noma Security announced a $100M Series B led by Evolution Equity Partners on 31 July 2025, and in September 2026 Lasso Security's newsroom described a $30 million round led by ClearSky. Bloom Security published its launch post on 30 July 2026; its about page says its founders previously worked at Palo Alto Networks and Dig Security, and Ctech reported a $20 million seed round led by Glilot Capital Partners and Ten Eleven Ventures the same day.
What it means for a buyer
The market now has two kinds of seller. Platform owners sell agent controls as part of an endpoint platform you may already run. Standalone vendors sell agent controls as their whole product and deploy alongside whatever endpoint tools you have.
For a Cortex XDR or SentinelOne Singularity customer, the platform route can mean one console, a module on an agent you already manage, and a contract you already have. That is why our designations describe Koi as best for Cortex XDR estates and Prompt Security as best for SentinelOne Singularity estates.
For a mixed estate, or one that may change EDR vendor, a standalone product avoids tying agent control to the endpoint platform. Several standalone products deploy through existing EDR or MDM: Bay and Noma Security state this on their pages, and Harmonic Security rolls out through endpoint management tools.
How the deals show up in our scores
Ownership is not a criterion. Backing by a large company counts in the public proof criterion, which is why Prompt Security scores 8 and Koi 7 there. Acquisitions also affect what we can read: our limitations note says that Koi and Prompt Security now sit inside larger platforms and that their public pages may lag the product. Neither publishes pricing for the agent product on the pages we read.
Funding rounds count in public proof too, as one signal among documentation, attestations and pricing. Onyx Security and Zenity score 7 and 8 on public proof; Bloom Security, with limited public company information and funding reported only by trade press, scores 5.
Questions to ask after a deal
- What is in the platform module, and what stays in the standalone offering?
- Will the standalone offering continue, and on what terms?
- Does the product still support EDR platforms from other vendors?
- How is it priced inside the platform agreement?
What to watch next
Platform owners will fold agent controls deeper into their consoles, and standalone vendors will compete on how specifically they control agent actions and how easily they deploy. Both trends are good for buyers who write down their question first: which agents, on which devices and workspaces, and which decisions must be made before an action runs.