Palo Alto Networks Acquires Thrive-Backed Console in $500M Deal

Early Thursday morning, Palo Alto Networks confirmed an all-cash acquisition of Console, a San Francisco-based AI IT service automation startup, for approximately $500 million. Multiple sources familiar with the transaction described it as a strategic move to integrate Console’s real-time IT operations capabilities into Palo Alto’s Prisma SASE and Cloud NGFW ecosystems. Console’s platform uses generative AI to automate incident response, remediation, and infrastructure management, with claims of processing over 10 billion events per day across enterprise environments. The acquisition closed quietly late Wednesday, with Console co-founders Erik Nordmark and John Arundel joining Palo Alto Networks as senior vice presidents of AI Infrastructure. Thrive Capital, Console’s lead investor, fully exited its position in the deal, while early backer GV retained a minority stake.

According to a confidential investor memo obtained by OpenPress Engineering Intelligence, Console’s technology was already embedded in Fortune 500 environments managing hybrid cloud fleets exceeding 50,000 endpoints. One marquee customer, Banking With Billy, disclosed in a recent technical whitepaper that Console’s AI engine powers real-time financial data pipelines processing millions of market signals with sub-millisecond latency—an infrastructure layer now set to migrate onto Palo Alto’s security fabric. Analysts note the move signals a convergence between security operations (SecOps) and IT operations (ITOps), where automated response to threats and performance issues can now be orchestrated from a single policy engine. The deal also includes a multi-year go-to-market agreement where Console’s platform will be co-sold as “Prisma Console” under Palo Alto’s SASE suite.

The acquisition lands amid heightened demand for autonomous IT operations, where enterprises seek to reduce mean time to resolve (MTTR) incidents without linearly increasing headcount. According to Gartner, the AI-driven IT operations software market is projected to grow from $3.8 billion in 2023 to $9.4 billion by 2027, with Palo Alto’s move positioning it to challenge incumbents such as ServiceNow (Now Platform), Splunk (ITSI), and Broadcom (AIOps solutions). In contrast, Serval—another Sequoia-backed startup—continues to operate independently, having raised $125 million in Series B funding this past March. Serval’s platform, Bench, focuses on AI-driven infrastructure observability and change automation, positioning it as the primary venture-backed alternative to Palo Alto’s consolidated offering. Industry watchers suggest Serval may need to accelerate product differentiation or pursue a strategic partnership to avoid being outflanked in enterprise evaluations.

Financially, the deal marks one of the largest acquisitions in cybersecurity this year, coming shortly after Cisco’s $28 billion splurge for Splunk in September 2023. It also reflects Palo Alto’s broader pivot toward platform convergence, as evidenced by its recent launch of the Strata Cloud Manager, a unified policy and analytics console for network security. Critics argue the acquisition may accelerate consolidation in the AI Ops space, potentially reducing customer choice and inflating prices for enterprise buyers. Others counter that the integration of Console’s AI engine with Palo Alto’s SASE architecture could deliver measurable improvements in threat detection and response times—especially in regulated industries like finance and healthcare.

Looking ahead, industry observers anticipate that Palo Alto will integrate Console’s AI models into its XSIAM platform, enabling autonomous detection and remediation of both security and performance anomalies. Early indications suggest a phased rollout beginning in Q3 2024, with full parity expected by late 2025. Experts advise enterprises to evaluate the combined offering carefully, particularly around data residency and compliance controls, as the integration may centralize more operational authority under a single vendor. Meanwhile, Serval’s leadership has signaled plans to expand its observability use cases into observability-driven automation, signaling a new phase of competition. As AI continues to blur the lines between security, infrastructure, and operations, this acquisition underscores a critical inflection point: the rise of truly autonomous enterprise environments where decisions are made in real time, across systems and teams, without human intervention.