Palo Alto Networks Completed Its Koi Security Deal—But the Final Price Was $231 Million, Not $400 Million

Short answer: Palo Alto Networks did pursue the acquisition of Koi Security, but “eyes $400 million acquisition” is now outdated. Palo Alto announced the deal in February 2026, completed it on April 14, 2026, and later disclosed $231 million in purchase consideration, plus $61 million in replacement equity awards tied to future employee service.

The approximately $400 million figure came from early media reports about the transaction’s expected valuation. It was not the final purchase price confirmed in Palo Alto’s filings.

#	Preview	Product	Price
1		Network Security, Firewalls, and VPNs	$66.62	Buy on Amazon
2		Network Security, Firewalls, and VPNs: . (Issa)	$60.31	Buy on Amazon
3		TP-Link ER605, Wired Gigabit VPN Router	$49.99	Buy on Amazon
4		Cybersecurity for Small Networks: A Guide for the Reasonably Paranoid	$33.90	Buy on Amazon

What happened with Palo Alto and Koi Security?

Palo Alto Networks entered a definitive agreement to acquire Israeli cybersecurity startup Koi Security on February 16, 2026. It announced the proposed acquisition the next day, and the transaction closed on April 14, 2026.

Early reports from Israeli business media described the deal as worth approximately $400 million. Palo Alto’s subsequent financial reporting provided a more authoritative figure: $231 million in total purchase consideration, substantially in cash. The company also disclosed $61 million in replacement equity awards, including restricted shares that vest over three years and are connected to future employee service.

#1 Best Overall

Sale

Network Security, Firewalls, and VPNs

$66.62

Buy on Amazon

That means readers should not describe Palo Alto as having paid $400 million for Koi. The accurate formulation is that the transaction was reported at roughly $400 million, while Palo Alto later disclosed $231 million in purchase consideration and separate replacement awards.

See Palo Alto’s June 2026 Form 10-Q for the final accounting disclosure.

The acquisition timeline

Why did the $400 million figure circulate?

The roughly $400 million valuation came from reporting by outlets including Globes, The Jerusalem Post, and SiliconANGLE.

Those reports described an expected or negotiated deal value. They did not represent a final purchase-price disclosure from Palo Alto. Acquisition headlines can also use different measures, such as an implied valuation, cash consideration, assumed obligations, retention awards, or a broader transaction value. The later SEC filing is therefore the better source for what Palo Alto recorded as purchase consideration.

Media reports also said Koi had raised approximately $48 million across two funding rounds, with backing from investors including Battery Ventures, NFX, Team8, and Picture Capital. Those funding and investor details come primarily from secondary reporting and should be treated accordingly.

What does Koi Security do?

Koi built security technology for software that can fall outside the conventional inventory of executable applications protected by traditional endpoint tools. Its product materials describe coverage for:

Rank #2

Sale

Network Security, Firewalls, and VPNs: . (Issa)

• Available with the Cloud Labs which provide a hands-on, immersive mock IT infrastructure enabling students to test their skills with realistic security scenarios
• New Chapter on detailing network topologies
• The Table of Contents has been fully restructured to offer a more logical sequencing of subject matter
• Introduces the basics of network security—exploring the details of firewall security and how VPNs operate
• Increased coverage on device implantation and configuration

$60.31

Buy on Amazon

• Browser extensions and developer-tool plugins
• Code packages, scripts, and operating-system packages
• Containers, drivers, and software distributed through registries and marketplaces
• AI models and AI agents
• Model Context Protocol, or MCP, components

Koi’s approach combines software discovery, risk analysis, policy enforcement, and remediation. That is broader than simply detecting known malware. The intended question is not only whether a file is malicious, but also what software exists on an endpoint, where it came from, what it can access, whether it has changed, and whether the organization should permit it.

Koi previously positioned this area as endpoint security posture management. After the acquisition, Palo Alto has emphasized the term Agentic Endpoint Security.

Koi’s own product descriptions are available on its endpoint page and platform page.

What Palo Alto means by “Agentic Endpoint Security”

“Agentic Endpoint Security” is Palo Alto Networks’ category label for protecting AI agents and other autonomous software operating on enterprise endpoints. Palo Alto says these agents may read, write, or move data; use a user’s existing credentials; take privileged actions; and interact with local files, applications, APIs, and services.

The underlying security problem is more concrete than the label suggests. Enterprise software is increasingly assembled from packages, plugins, models, scripts, extensions, and agent tools. Some of these components can change frequently, arrive through third-party channels, or operate with substantial permissions. Conventional endpoint inventories may not represent all of them clearly.

In practice, an agentic-endpoint program may involve:

Rank #3

Sale

TP-Link ER605, Wired Gigabit VPN Router

• 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
• 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
• 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
• 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
• Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q

$49.99

Buy on Amazon

1. Discovery: identifying software, packages, extensions, models, agents, and MCP components.
2. Risk analysis: assessing publishers, permissions, provenance, behavior, changes, and supply-chain signals.
3. Policy enforcement: allowing, blocking, quarantining, or requiring approval for selected software.
4. Runtime monitoring: observing how software or agents act after installation.
5. Remediation: removing, disabling, rolling back, or otherwise containing risky components.

These controls are not interchangeable. Visibility does not automatically provide malware prevention, data-loss prevention, identity governance, or protection against every unsafe AI action. Palo Alto’s announcements describe its intended capabilities, but they do not independently establish superior detection rates or effectiveness.

Why did Palo Alto want Koi?

The acquisition fits Palo Alto’s effort to connect endpoint security with enterprise AI security. The company said Koi’s technology would be integrated into Prisma AIRS, its AI-security platform, and Cortex XDR, its endpoint detection and response and extended detection platform. Palo Alto also said Koi’s capabilities would remain available as a standalone offering for organizations using another EDR product.

The strategic rationale is that AI security cannot be limited to cloud-hosted models or centralized AI infrastructure. Security teams may also need visibility into the agents, plugins, packages, models, and developer tools running on employee and developer devices.

This is a strategic interpretation of Palo Alto’s stated plans, not a verified financial outcome. Public materials do not establish that the acquisition has increased Palo Alto’s revenue, margins, customer retention, or market share.

Read Palo Alto’s acquisition announcement and closing announcement for the company’s stated rationale and integration plans.

What does the deal mean for enterprise buyers?

The acquisition may be relevant to companies trying to govern software that sits between traditional endpoint protection, application control, software supply-chain security, and AI governance. Buyers should evaluate the actual controls rather than purchase based on the category name.

Rank #4

Sale

Cybersecurity for Small Networks: A Guide for the Reasonably Paranoid

$33.90

Buy on Amazon

Questions to ask vendors

• Coverage: Can the product inventory browser extensions, packages, plugins, containers, models, agents, and MCP components across Windows, macOS, and Linux?
• Analysis: Does it inspect code and behavior, or mainly rely on reputation feeds?
• Change detection: Can it identify a compromised update or a change in publisher and package contents?
• Enforcement: Can policies apply before installation, after installation, at runtime, or at all three stages?
• Integrations: Does it work with the organization’s EDR, MDM, identity, SIEM, SOAR, proxy, and secure web gateway tools?
• AI governance: Can it map an agent’s actions and permissions to a user, endpoint, application, and data source?
• Operations: Are findings explainable, and can analysts challenge or reproduce a risk score?
• Developer impact: Are there staged rollouts, approval workflows, exception handling, and rollback controls?

Broader visibility can create more alerts. Aggressive blocking can also disrupt development teams. Organizations may need staged enforcement, risk-based policies, and clear exception processes before turning on restrictive controls.

Financial and strategic questions that remain

The final disclosed consideration is important, but it does not answer every question about the transaction. Palo Alto has not publicly disclosed Koi’s revenue, customer concentration, retention, margins, or the methodology behind the reported $400 million valuation.

The $61 million in replacement equity awards also matters when assessing the overall economics. Because those awards are tied to future service, they should not simply be added to the $231 million and called the cash purchase price. They represent a separate employee-compensation component disclosed in the acquisition accounting.

There is also an integration question. Koi could remain a distinct product, become a Cortex XDR capability, feed Prisma AIRS, or be distributed across Palo Alto’s broader platform. Each outcome has different implications for pricing, deployment, product overlap, and vendor concentration. Public announcements identify the intended integration targets but do not fully resolve the long-term product structure.

Risks and unresolved issues

The main risks are execution and validation. Palo Alto must integrate Koi’s technology without creating duplicated inventories, excessive alerts, developer friction, or confusing product boundaries. Buyers also need evidence that Koi’s controls provide materially different protection from existing application-control, EDR, software-composition, browser-security, and supply-chain tools.

A later dispute adds a separate credibility question. Reporting by Axios and TechRadar Pro described a lawsuit involving Koi research that allegedly linked a startup’s infrastructure to a Chinese spying operation. The complaint reportedly alleged that AI-generated findings were inaccurate. The legal claims are allegations, not established findings of misconduct, and should not be treated as proof that Koi’s broader security platform is ineffective.

Still, the episode highlights a practical buyer concern: security findings generated or assisted by AI need review procedures, provenance, explainability, and a way to correct false attribution before an organization acts on them.

Bottom line

Palo Alto Networks did acquire Koi Security, and the deal is strategically significant because it expands Palo Alto’s endpoint and AI-security ambitions beyond conventional binaries and malware detection. But the headline’s $400 million figure is not the final confirmed purchase price. The stronger factual account is that the deal was initially reported at approximately $400 million, while Palo Alto later disclosed $231 million in purchase consideration plus $61 million in replacement equity awards tied to future service.

Quick Recap

SaleBestseller No. 1

Network Security, Firewalls, and VPNs

$66.62

SaleBestseller No. 2

Network Security, Firewalls, and VPNs: . (Issa)

New Chapter on detailing network topologies; Increased coverage on device implantation and configuration

$60.31

SaleBestseller No. 3

TP-Link ER605, Wired Gigabit VPN Router

$49.99

SaleBestseller No. 4

Cybersecurity for Small Networks: A Guide for the Reasonably Paranoid

$33.90

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.