What changed in the market
Palo Alto Networks completed its acquisition of Koi on 14 April 2026. Its press release describes a new Cortex XDR module, integration with Prisma AIRS, and Koi remaining available as a standalone offering. Koi's website now redirects to Cortex Agentic Endpoint Security. Palo Alto Networks also completed an acquisition of Portkey, an AI gateway, on 29 May 2026.
SentinelOne announced a definitive agreement to acquire Prompt Security on 5 August 2025. Its blog, updated 3 September 2025, is titled SentinelOne Acquires Prompt Security, and Investing.com reported from SentinelOne's filing that the deal closed on 5 September 2025. SentinelOne now describes Prompt Security as built into the SentinelOne Singularity Platform.
At the same time, standalone vendors raised large rounds. Onyx Security announced a $113M Series B led by Bessemer Venture Partners on 29 July 2026. Zenity announced a $125 million Series C led by Norwest on 3 August 2026.
The case for a platform owner
If you already run Cortex XDR or SentinelOne Singularity, the agent control from the same vendor shares a console, an agent or module you already manage, and often a contract you already have. Alerts land where your analysts already work. Procurement is simpler.
The case for a standalone vendor
A standalone product does not depend on which EDR you run, so it can cover a mixed estate, and it can stay with you if you change EDR vendor. Standalone vendors in this category ship quickly because agent security is their whole product. Some deploy through whatever EDR or MDM you already have, which removes the main argument for buying from the platform owner.
What to watch after an acquisition
Product names and packaging change. Public pages can lag the product for months; our limitations note says so for Koi and Prompt Security. Roadmaps often shift toward the parent platform. Ask what is in the module versus the standalone offering, whether the standalone offering will continue, and how pricing works inside the platform agreement.
How we score it
Ownership is not a criterion. It appears in our public proof criterion, where backing by a large company counts in a product's favour along with documentation, attestations and published pricing. It also appears in the designations on the rankings: Koi is described as best for Cortex XDR estates and Prompt Security as best for SentinelOne Singularity estates.
A simple test
List the EDR and MDM tools you run today and expect to run in two years. If one platform covers all of them, weigh its agent module seriously. If the estate is mixed or likely to change, weigh products that deploy through whatever you run.