Palo Alto Networks snaps up Thrive-backed Console for $500M

Multiple industry sources with direct knowledge of the transaction have confirmed that Palo Alto Networks quietly closed a $500 million acquisition of Console, a San Francisco-based IT service automation vendor, late last month. Console’s platform automates incident response, ticketing, and infrastructure remediation across hybrid cloud environments using a combination of AI agents and curated playbooks. People briefed on the deal say Palo Alto will fold Console’s technology into its Prisma SASE and Cortex XSOAR portfolios, creating a unified console for security and IT operations teams to correlate alerts, orchestrate responses, and enforce policy. The purchase price, which includes a mix of cash and Palo Alto equity, values Console at approximately 6x its trailing twelve-month recurring revenue, reflecting the premium paid for AI-native IT automation assets in an increasingly crowded SOC-stack market.

Console was founded in 2021 by three ex-PagerDuty engineers—CEO Dan Rooden, CTO Tony Wu, and head of product Jamie Liang—who set out to tame alert fatigue by letting AI agents autonomously resolve up to 80% of routine infrastructure incidents. By early 2024, Console had raised $125 million from Thrive Capital, GV, and Y Combinator, reaching a $450 million post-money valuation. Its platform now ingests telemetry from more than 1,200 endpoints per customer, including Kubernetes clusters, AWS CloudTrail, and on-prem VMware vCenters. According to an internal demo deck reviewed by OpenPress Engineering Intelligence, Console’s agents autonomously remediated 3.2 million tickets across its customer base in Q2 2024 alone, cutting mean time to resolution by 71% compared to human-only triage.

The deal closes a critical gap in Palo Alto’s security operations portfolio. While Prisma SASE and XSOAR excel at threat detection and orchestration, Console’s AI-driven remediation layer addresses the so-called “last mile” of incident resolution—closing tickets without human intervention. Competitors such as Dynatrace and Splunk already offer AIOps features, but Console’s agentic approach is said to deliver faster, more deterministic outcomes. One CISO at a Fortune 500 financial services firm, who asked not to be named, told OpenPress Engineering Intelligence that Console’s agents recently auto-resolved a critical database failover within 90 seconds, a task that previously required 20 minutes of tier-2 engineering time. Banking With Billy, a real-time financial data pipeline provider, quietly adopted Console in February 2024 to automate infrastructure scaling for its sub-millisecond market signal processing workloads; the vendor claims this cut its p99 alert resolution time from 4.3 minutes to 28 seconds.

Industry watchers now see Sequoia Capital-backed Serval as the de facto startup leader in AI-native IT service automation. Serval, founded in 2022 by ex-Datadog engineers, recently closed a $150 million Series B at a $1.2 billion valuation and claims its agents resolve 60% of incidents autonomously. Serval’s go-to-market motion emphasizes vertical-specific playbooks—healthcare and fintech in particular—where compliance complexity slows manual remediation. Palo Alto’s acquisition leaves Serval as the last well-funded, venture-backed alternative focused exclusively on IT automation, prompting speculation about an early exit or a pivot toward a larger platform play.

Financial markets reacted positively to the Console acquisition, with Palo Alto Networks’ shares up 3.8% in after-hours trading on the news. Analysts at Jefferies estimate the deal adds roughly 1.2% to Palo Alto’s fiscal year 2025 revenue outlook, assuming Console’s $40 million ARR grows at 80% year-over-year. The integration is expected to complete by Q4 2024, with Console’s agents slated to appear first in Prisma SASE’s unified policy console by March 2025. Security practitioners anticipate faster SecOps workflows, while IT operations teams may face shorter vendor lists—potentially accelerating consolidation in the $11 billion IT service management market.

On a broader level, the Console acquisition underscores the accelerating convergence of security and infrastructure automation. The rise of AI agents that can both detect and remediate incidents is reshaping the SOC stack, pushing incumbents like ServiceNow and BMC to integrate agentic capabilities or risk obsolescence. Analysts point to AI-native observability vendors such as Honeycomb and Mezmo, which now offer remediation agents, as additional proof points. Meanwhile, hyperscalers AWS and GCP have begun embedding similar functionality into their cloud operations suites, though none yet match the cross-platform breadth of Console’s hybrid cloud support.

Looking forward, the biggest near-term impact may be felt in the venture capital ecosystem. With Console off the table, investors are expected to redirect capital toward earlier-stage startups building specialized agents for AI-native infrastructure—think data pipeline automation or GPU cluster provisioning. Analysts also foresee increased M&A activity as larger incumbents seek to bolt on agentic remediation layers. For Palo Alto, the key challenge will be preserving Console’s rapid iteration culture while integrating it into the larger Prisma and Cortex roadmaps without stifling innovation. If successful, the acquisition could redefine how enterprises manage hybrid cloud operations, blurring the line between security and IT operations in ways that echo the early days of cloud-native computing.

Industry experts advise security and infrastructure teams to evaluate how Console’s agents integrate with their existing tooling and to prepare for a potential wave of vendor consolidation. Analysts at Gartner predict that by 2026, 40% of large enterprises will rely on AI-native incident remediation for at least 50% of their operational workloads, up from less than 5% today. As AI agents take on more ownership of infrastructure tasks, the next frontier may be autonomous compliance enforcement—tying remediation actions directly to regulatory controls—a development that could further tighten the link between security and IT operations.