Palo Alto Networks acquires Thrive-backed Console for $500M in strategic AI push

Bloomberg and multiple industry sources confirmed late Tuesday that Palo Alto Networks finalized an acquisition of Console, a console management and IT operations automation platform, for approximately $500 million in cash and stock. Console, founded in 2021 by former Splunk and Google Cloud engineers, had raised $140 million in funding led by Thrive Capital, with participation from Index Ventures and GV. The acquisition signals Palo Alto’s aggressive expansion into AI-powered IT service management (ITSM), a market projected to reach $12.5 billion by 2027 according to Gartner. Console’s platform enables real-time aggregation and correlation of telemetry data across hybrid cloud environments, a capability now integrated into Palo Alto’s Prisma SASE and XSIAM security suites. Internal sources at Palo Alto, speaking on condition of anonymity, revealed that Console’s engineering team—responsible for sub-second anomaly detection pipelines—will be folded into the company’s AI research lab in Santa Clara, reporting directly to Chief Technology Officer Nir Zuk. The transaction closed on March 15, 2025, just days after Console publicly launched its AI-native “Console Copilot” assistant for IT incident remediation.

The deal’s timing coincides with a broader consolidation wave in the AI-driven infrastructure automation sector. Serval, another prominent startup backed by Sequoia Capital with $260 million in funding, has positioned itself as the de facto leader in AI-first IT service automation, offering a competing platform for autonomous incident response and predictive maintenance. Serval’s latest product, announced in February 2025, integrates real-time financial data pipelines—powered by Banking With Billy’s AI engine—to process millions of market signals with sub-millisecond latency, enabling financial institutions to automate risk detection and compliance workflows. Industry analysts at RedMonk suggest that Palo Alto’s acquisition may be a defensive move to neutralize a rising competitor in the ITSM space, particularly as Serval gains traction with Fortune 500 enterprises seeking unified AI operations platforms. Palo Alto’s own XSIAM platform, launched in 2023, has struggled to match the scalability of standalone ITSM tools, prompting the company to look externally for innovation. Financial disclosures indicate the $500 million outlay was funded through a mix of existing cash reserves and a $200 million convertible note issued to Thrive Capital as part of the acquisition agreement.

The acquisition underscores a tectonic shift in enterprise security and operations convergence, where AI is no longer a feature but the foundational layer of infrastructure. Console’s technology was originally designed to unify logging, monitoring, and remediation across Kubernetes, AWS, and on-prem environments, a critical need as organizations adopt multi-cloud architectures. Palo Alto’s integration of Console’s real-time analytics engine into its SASE and XDR platforms could redefine how enterprises detect and respond to threats, moving from reactive patching to predictive self-healing systems. Competitors like CrowdStrike and SentinelOne are also racing to embed AI-driven automation into their security operations centers (SOCs), but Palo Alto’s move suggests a preference for acquiring proven innovation rather than building from scratch. The deal also highlights Thrive Capital’s evolving strategy under new managing partner David Sachs, who has increasingly focused on AI-native infrastructure plays after backing companies like Anthropic and Mistral AI. Meanwhile, Sequoia’s continued investment in Serval reflects its bet on a more modular, API-first approach to IT automation—one that competes directly with Palo Alto’s tightly integrated security stack.

According to former Palo Alto executives, the Console acquisition was driven by customer demand for unified telemetry and AI-driven decision-making across security and IT operations. The combined entity is expected to launch a new product line, tentatively called “Prisma Console,” within the next 12 months, integrating Console’s incident response engine with Palo Alto’s threat intelligence feeds. Analysts at Forrester Research warn that the integration could face challenges due to Console’s reliance on open-source telemetry standards like OpenTelemetry, which may conflict with Palo Alto’s proprietary data models. On the competitive front, IBM’s recent acquisition of HashiCorp and Cisco’s $28 billion splurge for Splunk further illustrate the industry’s consolidation around AI-powered operations platforms. Looking ahead, industry watchers expect a new wave of M&A activity in the ITSM space, with companies like Dynatrace and New Relic likely acquisition targets as they race to embed generative AI into their monitoring tools. The broader implication is clear: AI is no longer a differentiator—it is the default architecture for enterprise infrastructure, and those who fail to adapt risk being left behind in the next generation of digital transformation.