What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Palo Alto Networks has completed the two acquisitions that prompted CEO Nikesh Arora to talk about a surging “AI cycle”: CyberArk, which adds identity and privilege controls, and Chronosphere, which adds observability and telemetry capabilities. The company has since added Koi and Portkey to its portfolio. The strategy is broader than buying AI products: Palo Alto Networks is assembling controls for who or what acts, what it can access, what it does, and how security teams respond. Whether those pieces become a coherent platform—and deliver lasting financial returns—remains an execution question.
What Arora meant by the “AI cycle”
In an interview published by CRN on November 19, 2025, Arora described accelerating investment in AI data centers, infrastructure and autonomous applications as a reason Palo Alto Networks could not wait for new security categories to mature on their own. As enterprises deploy more AI workloads and agents, the company argued, they will need to govern more machine identities and privileges while handling new streams of workload data. CRN’s original report records that strategic framing.
“AI cycle” is Arora’s description of a market shift, not a formal economic measure. The underlying needs are not exclusive to AI: cloud applications already use service accounts, credentials and large volumes of telemetry. Palo Alto Networks’ case is that AI can accelerate the scale and autonomy of those systems, making identity, visibility and response more urgent.
Two completed deals address different control layers
CyberArk: identity and privilege
Palo Alto Networks announced its CyberArk agreement on July 30, 2025, at an approximately $25 billion equity value. The announced consideration was $45 in cash plus 2.2005 Palo Alto Networks shares for each CyberArk share, representing a stated 26% premium to CyberArk’s unaffected 10-day average daily VWAP. Palo Alto Networks completed the acquisition on February 11, 2026. CyberArk supplies identity-security capabilities spanning human, machine and agentic identities, including privileged-access controls. The company’s stated rationale is that software agents need identities and permissions—and that their access should be governed with more granularity than a credential left broadly empowered. The deal announcement and completion announcement describe the terms and strategic intent.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall#1 Best Overall
The $25 billion announcement figure and the approximately $21.1 billion purchase consideration reported later in Palo Alto Networks’ Form 10-Q refer to different measures, not necessarily conflicting valuations. The former was the announced equity value; the latter was the accounting purchase consideration, including cash, common stock and replacement awards. The filing gives the accounting figure.
Chronosphere: observability and telemetry
Announced on November 19, 2025, for $3.35 billion in total consideration, Chronosphere brings cloud-native observability and telemetry-pipeline capabilities. Observability gathers and helps interpret signals such as metrics, logs and traces; security uses those signals to detect threats, enforce policy and respond. Palo Alto Networks’ argument is that filtering, transforming and routing high-volume data can help make AI workloads more visible without treating every raw signal as equally useful. At announcement, Chronosphere reported more than $160 million in ARR at the end of September 2025 and triple-digit year-over-year ARR growth. Those were company-reported figures at that date. The announcement set out the terms and rationale.
Palo Alto Networks completed the Chronosphere acquisition in early 2026 and said it planned to connect the capabilities with Cortex AgentiX while keeping the telemetry-pipeline offering available on a standalone basis. The completion announcement describes that plan. It is an intended integration, not evidence that all products and customer deployments already operate as one system.
How the pieces are meant to fit
The strategic logic is a sequence: establish who or what is acting, determine what it may do, observe its behavior, and decide whether to allow, restrict or remediate that activity. Palo Alto Networks presents the acquisitions and products as contributions to those control points:
Recommended Free Tools
| Control layer | Relevant capability | Intended role |
|---|---|---|
| Identity and privilege | CyberArk | Manage human, machine and agent identities, credentials and privileged access. |
| Telemetry and observability | Chronosphere | Collect, process and route metrics, logs and traces to improve workload visibility. |
| AI security and runtime controls | Prisma AIRS | Provide AI security capabilities, including runtime and posture controls. |
| Agent operations and response | Cortex AgentiX | Support agentic automation and connect security signals to response workflows. |
This architecture is a strategic interpretation of Palo Alto Networks’ product and investor materials, not a guarantee of seamless interoperability for every customer. Data models, policy controls, product packaging and deployment still have to work together. The company’s Q2 FY2026 investor presentation sets out its platform positioning.
The strategy widened after the original story
When CRN published its story in November 2025, CyberArk and Chronosphere were proposed transactions. As of August 16, 2026, both had closed, and two further acquisitions had extended the AI-security effort:
| Date or period | Development | Strategic emphasis |
|---|---|---|
| July 30, 2025 | CyberArk agreement announced at approximately $25 billion in equity value. | Identity and privilege. |
| November 19, 2025 | Chronosphere agreement announced for $3.35 billion. | Observability and telemetry. |
| February 11, 2026 | CyberArk acquisition completed. | Identity-security foundation. |
| Early 2026 | Chronosphere acquisition completed. | AI-scale observability and telemetry. |
| April 14, 2026 | Koi acquisition completed. | Visibility and security for AI-agent software operating on endpoints, with integration targets including Prisma AIRS and Cortex XDR. |
| May 29, 2026 | Portkey acquisition completed. | AI gateway capabilities for managing and protecting agents, with Prisma AIRS as the integration target. |
Palo Alto Networks described Koi’s intended role in its completion announcement and Portkey’s in its completion announcement. Together, the additions suggest an ongoing effort to cover identity, telemetry, AI runtime, gateways and endpoints—not a strategy limited to two large transactions.
What the early numbers do—and do not—show
Palo Alto Networks’ Q2 FY2026 investor presentation reported more than 100 Prisma AIRS customers, up more than threefold quarter over quarter; Cortex AgentiX enabled by more than one-third of XSIAM customers; and approximately $200 million in Chronosphere next-generation security ARR. It also reported CyberArk identity-security next-generation ARR above $1.2 billion as of December 2025, SASE ARR above $1.5 billion and Cortex XSIAM ARR above $500 million. These are company-reported figures, not independent measurements.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #2
The Chronosphere ARR snapshot of more than $160 million at September 2025 and the later approximately $200 million next-generation security ARR figure are from different dates and use different descriptions. They should not be read as directly comparable. More broadly, ARR definitions can vary across acquired businesses and product categories; ARR does not by itself establish profitability, retention, customer satisfaction or the amount of growth attributable to acquisitions rather than other sales. The cited presentation does not make those metrics equivalent.
Is Palo Alto Networks becoming an observability company?
Strategically, observability is now part of Palo Alto Networks’ ambitions. That does not make its approach identical to that of a conventional standalone observability vendor. The company emphasizes connecting telemetry to security analysis, AI operations and automated remediation. Whether that proposition suits a customer depends on whether it values shared context and coordinated controls more than independent specialist tools.
Observability can provide the signals security teams need, but it is not itself security enforcement. A large volume of metrics, traces and logs can also create cost and operational complexity; telemetry filtering and routing matter alongside ingestion. Palo Alto Networks has said Chronosphere’s pipeline product would remain available independently, while deeper integration was planned. That leaves room for buyers to assess the standalone capability separately from the broader platform promise.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What enterprise buyers should test before consolidating
These acquisitions may make a platform approach more attractive to organizations already using Palo Alto Networks products. They do not make competing tools automatically unnecessary. Buyers should evaluate the actual deployment, contractual terms and integration available to them rather than assume an acquired capability is already included or unified.
- Platform or best of breed: Compare the value of shared data and fewer consoles with the flexibility and specialist depth of separate tools.
- Identity inventory: Include service accounts, API keys, workload identities, model identities and agent permissions—not only employee accounts.
- Telemetry economics: Model ingestion, retention, cardinality and query volume for AI workloads before expanding data collection.
- Automation boundaries: For high-impact actions, require staged approvals, audit trails, named owners and rollback controls. Faster response is not worth an uncontrolled production change.
- Environment coverage: Verify support for the organization’s actual mix of public and private cloud, Kubernetes, SaaS, on-premises systems and third-party AI services.
- Migration and concentration: Measure policy harmonization, migration effort and the operational consequences of relying on one vendor across more security layers.
For a greenfield buyer, the comparison is not simply whether the Palo Alto Networks stack has more components. It is whether its coverage, integration and total cost match the organization’s needs better than specialist alternatives. Existing Prisma, Cortex or firewall customers may have a different starting point from organizations without that footprint.
Risks that remain after the deals close
- Integration: CyberArk and Chronosphere are substantial businesses with distinct products, cultures and sales motions. Connecting systems while retaining the specialist capabilities customers value takes execution.
- Overlap and migration: Customers may already operate separate identity, observability, cloud-security and AI-security products. Consolidation can require policy changes and data migration rather than simply replacing consoles.
- Vendor dependence: A common platform can reduce tool sprawl, but it also concentrates more operational reliance in one supplier.
- Telemetry cost: AI workloads can produce high and variable data volumes. Observability economics depend on which data is collected, retained and queried.
- Automation errors: Detection signals can be misread, and automated remediation can disrupt production if its scope and safeguards are inadequate.
- Category uncertainty and competition: AI security, agent security and AI observability are evolving categories. Palo Alto Networks must compete with established identity, endpoint, cloud and observability vendors as well as specialist providers.
- Synergy and adoption risk: Product integration, customer uptake and expected synergies may take longer than management expects or fail to materialize. Palo Alto Networks’ Chronosphere acquisition announcement itself cautioned that integration and expected benefits are not assured. The completion announcement is the company’s account of the transaction and its aims, not independent proof of the outcome.
The question now is execution
Arora’s “AI cycle” rationale has become a broader acquisition program. CyberArk addresses identity and privilege; Chronosphere adds observability; Koi and Portkey extend the portfolio toward endpoints and AI gateways; Prisma AIRS and Cortex AgentiX are intended to connect security controls with agent activity and response. The strategic bet is that securing AI will depend not only on scanning models, but also on governing identities, observing behavior and acting on signals.
The completed deals establish ownership, not results. For customers and investors, the meaningful test is whether Palo Alto Networks can integrate the capabilities without eroding their specialist value, demonstrate measurable customer benefit and manage the costs and risks of automation and platform concentration.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitches
