PRODUCT PROFILE · RANK 7 OF 8
Koi review: Palo Alto Networks Cortex Agentic Endpoint Security
SHORT ANSWER
Koi, sold by Palo Alto Networks as Cortex Agentic Endpoint Security, blocks unsafe AI application interactions and removes insecure packages, extensions and AI tools, as a Cortex XDR module or standalone. Its product page does not describe tool-call mechanics; a Palo Alto Networks blog names Claude Code, Cursor and Codex. It scores 5.75 and ranks 7 of 8.
By The Agent Desk · Agentic Endpoint Compare · Published 2026-10-11
Desk research from public vendor pages, press releases and standards pages read on 27 September and 11 October 2026. Editorial assessment; we did not run the products.
Rank 7 of 8 among broader AI security platforms on our published weights
Palo Alto Networks (acquisition completed 14 April 2026)
Palo Alto Networks Cortex XDR estates
What does Koi control?
Koi, sold by Palo Alto Networks as Cortex Agentic Endpoint Security, adds visibility into models, MCPs and extensions on the endpoint and blocks unsafe AI interactions, as a Cortex XDR module or standalone.
How does Koi reach devices?
A Cortex XDR module, or a standalone agent-based offering.
Source: Palo Alto Networks press release: Koi acquisition completed (14 April 2026) · Read 27 Sep 2026
Which verdicts can Koi return?
- Block or denyDocumented
- Ask a personNot described
- Alert or warnNot described
- Mask or modifyNot described
- Simulate firstNot described
- Remove or scale backDocumented
"Stops malicious actions and offers one-click removal of insecure packages, extensions and AI tools."
Source: Palo Alto Networks: Cortex Agentic Endpoint Security · Read 27 Sep 2026
How does Koi score on each criterion?
| Criterion | Weight | Score | Why |
|---|---|---|---|
| Stop before it runs | 25% | 7 / 10 | Stops malicious actions, blocks unsafe AI application interactions and prevents prompt injections; tool-call decision mechanics are not published. Source: Palo Alto Networks: Cortex Agentic Endpoint Security · Read 27 Sep 2026 |
| Verdict range | 15% | 3 / 10 | Documents 2 of six verdict types: Block or deny and Remove or scale back. "Stops malicious actions and offers one-click removal of insecure packages, extensions and AI tools." Source: Palo Alto Networks: Cortex Agentic Endpoint Security · Read 27 Sep 2026 |
| Capability rules | 15% | 6 / 10 | Out-of-the-box policies, agent runtime custom policies and one-click removal of insecure packages, extensions and AI tools. Source: Palo Alto Networks blog: A Quarter of Innovation with Koi Agentic Endpoint Security (18 August 2026) · Read 11 Oct 2026 |
| Actor trail | 10% | 5 / 10 Tied lowest | Agent versus person attribution is not described on the pages we read. Source: Palo Alto Networks: Cortex Agentic Endpoint Security · Read 27 Sep 2026 |
| Rollout path | 10% | 6 / 10 | Agent-based: a Cortex XDR module or a standalone offering. Source: Palo Alto Networks press release: Koi acquisition completed (14 April 2026) · Read 27 Sep 2026 |
| Cloud and workspace reach | 10% | 6 / 10 | An endpoint product; Palo Alto Networks is integrating Koi with Prisma AIRS for wider AI coverage. Source: Palo Alto Networks press release: Koi acquisition completed (14 April 2026) · Read 27 Sep 2026 |
| Named agent coverage | 5% | 5 / 10 | Names 3 of the six agents we track: Claude Code, Cursor and OpenAI Codex. Source: Palo Alto Networks blog: A Quarter of Innovation with Koi Agentic Endpoint Security (18 August 2026) · Read 11 Oct 2026 |
| Public proof | 10% | 7 / 10 | Acquisition by Palo Alto Networks completed 14 April 2026; pricing not published. Source: Palo Alto Networks press release: Koi acquisition completed (14 April 2026) · Read 27 Sep 2026 |
Which agents does Koi name?
- Claude CodeNamed
- CursorNamed
- GitHub CopilotNot named
- OpenAI CodexNamed
- WindsurfNot named
- Claude DesktopNot named
Koi names 3 of the six agents we track.
Source: Palo Alto Networks blog: A Quarter of Innovation with Koi Agentic Endpoint Security (18 August 2026) · Read 11 Oct 2026
- Palo Alto Networks' Koi blog (18 August 2026) names Claude Code, Cursor and Codex, and also Antigravity.
What does it cost?
Not published
Palo Alto Networks publishes no pricing for Cortex Agentic Endpoint Security.
Source: Palo Alto Networks: Cortex Agentic Endpoint Security · Read 27 Sep 2026
Where is Koi strongest, and where does it fall short?
Strongest
- Fits security teams that already run Cortex XDR.
- Removal of insecure packages, extensions and AI tools as well as blocking.
Falls short
- Stop before it runs: 7 / 10; highest Bay 9 / 10
- Verdict range: 3 / 10; highest Bay and Onyx Security 7 / 10
- Capability rules: 6 / 10; highest Bay 9 / 10
- Actor trail: 5 / 10; highest Bay 8 / 10
- Rollout path: 6 / 10; highest Bay 9 / 10
- Cloud and workspace reach: 6 / 10; highest Onyx Security, Zenity and Noma Security 9 / 10
- Named agent coverage: 5 / 10; highest Zenity 7 / 10
- Public proof: 7 / 10; highest Zenity, Noma Security, Lasso Security and Prompt Security (SentinelOne) 8 / 10
- Agent versus person attribution is not described on the pages we read.
- Tool-call decision mechanics are not published on the product page.
Key facts
| Fact | Detail and source |
|---|---|
| Product | Visibility into models, MCPs and extensions; one-click removal of insecure packages, extensions and AI tools; stops malicious actions, blocks unsafe AI application interactions and prevents prompt injections. Source: Palo Alto Networks: Cortex Agentic Endpoint Security · Read 27 Sep 2026 |
| Ownership | Palo Alto Networks completed the acquisition on 14 April 2026, with a new Cortex XDR module, integration with Prisma AIRS, and Koi still available standalone. Source: Palo Alto Networks press release: Koi acquisition completed (14 April 2026) · Read 27 Sep 2026 |
| Wider Palo Alto Networks context | Prisma AIRS 3.0 (23 March 2026) describes agent discovery across cloud, SaaS and endpoints; Palo Alto Networks completed its Portkey acquisition on 29 May 2026. Source: Palo Alto Networks press release: Prisma AIRS 3.0 (23 March 2026) · Read 27 Sep 2026 |
| Named agents | A Palo Alto Networks blog of 18 August 2026 describes agent runtime policies and names Claude Code, Cursor, Codex and Antigravity. Source: Palo Alto Networks blog: A Quarter of Innovation with Koi Agentic Endpoint Security (18 August 2026) · Read 11 Oct 2026 |
How does Koi compare head to head?
| Pair | Result |
|---|---|
| Bay matched with Koi (Palo Alto Networks) | Bay 7.20, Koi (Palo Alto Networks) 5.75 |
| Koi (Palo Alto Networks) matched with Neo | Koi (Palo Alto Networks) 5.75, Neo 6.85 |
| Koi (Palo Alto Networks) matched with Onyx Security | Koi (Palo Alto Networks) 5.75, Onyx Security 6.85 |
| Koi (Palo Alto Networks) matched with Zenity | Koi (Palo Alto Networks) 5.75, Zenity 6.75 |
| Koi (Palo Alto Networks) matched with Noma Security | Koi (Palo Alto Networks) 5.75, Noma Security 6.55 |
| Koi (Palo Alto Networks) matched with Lasso Security | Koi (Palo Alto Networks) 5.75, Lasso Security 6.40 |
| Koi (Palo Alto Networks) matched with CrowdStrike Falcon Guardian | Koi (Palo Alto Networks) 5.75, CrowdStrike Falcon Guardian 6.25 |
| Koi (Palo Alto Networks) matched with Harmonic Security | Koi (Palo Alto Networks) 5.75, Harmonic Security 5.90 |
| Koi (Palo Alto Networks) matched with Ent | Koi (Palo Alto Networks) 5.75, Ent 5.80 |
| Koi (Palo Alto Networks) matched with Prompt Security (SentinelOne) | Koi (Palo Alto Networks) 5.75, Prompt Security (SentinelOne) 5.45 |
| Koi (Palo Alto Networks) matched with Glow Security | Koi (Palo Alto Networks) 5.75, Glow Security 5.40 |
| Bloom Security matched with Koi (Palo Alto Networks) | Bloom Security 4.65, Koi (Palo Alto Networks) 5.75 |
Frequently asked questions
Can Koi (Palo Alto Networks) stop an agent action before it runs?
Stops malicious actions, blocks unsafe AI application interactions and prevents prompt injections; tool-call decision mechanics are not published. We score this 7 out of 10.
Which verdicts does Koi (Palo Alto Networks) document?
Koi (Palo Alto Networks) documents 2 of six verdict types: Block or deny and Remove or scale back. "Stops malicious actions and offers one-click removal of insecure packages, extensions and AI tools."
How much does Koi (Palo Alto Networks) cost?
Not published. Palo Alto Networks publishes no pricing for Cortex Agentic Endpoint Security.