Palo Alto Networks shells out half a billion for Thrive-backed Console in strategic AI push

Bloomberg sources confirmed late Monday that Palo Alto Networks has signed a definitive agreement to acquire Console, an AI-first IT service automation platform founded in 2021, for roughly $500 million in cash and stock. Console’s flagship product is an event-driven orchestration engine that ingests telemetry from endpoints, networks, and cloud services to auto-remediate incidents using large language models. According to three people briefed on the deal who requested anonymity, the transaction is expected to close in the third quarter of 2025. Console’s co-founders, CEO Carolyn Herzog and CTO Dan Kador, will join Palo Alto’s Prisma Cloud and Unit 42 divisions to accelerate the company’s AIOps road map.

The purchase price values Console at approximately 8× its trailing twelve-month recurring revenue, reflecting intense demand for AI-powered IT operations capabilities. Before this deal, Console had raised $170 million from Thrive Capital, Index Ventures, and GV, with a $110 million Series C in March 2024 that valued the company at $1.4 billion. Palo Alto’s move arrives less than a year after rival Cisco spent $28 billion for Splunk, underscoring a broader consolidation trend in which security and observability stacks are converging under single vendor roofs. Console’s technology is already certified to ingest and correlate data from more than 120 third-party integrations, including ticketing systems such as Jira and ServiceNow, and cloud-native stacks like Kubernetes and Terraform.

Industry Impact and Significance

Console’s absorption into Palo Alto Networks reshapes the $18 billion AIOps and IT automation market, analysts at Gartner say. In a client note circulated Tuesday, the firm argued that Palo Alto now commands the broadest end-to-end security–observability–automation portfolio, directly challenging Splunk, Datadog, and Dynatrace. Moreover, the deal leaves Sequoia-backed Serval—the maker of a competing AI IT service automation engine—as the largest independent startup in the space with approximately $300 million in venture funding. Serval’s platform emphasizes autonomous incident resolution via proprietary causal AI graphs, while Console relies on a more open, event-driven architecture that supports third-party model plug-ins.

Financial implications extend beyond AIOps. Palo Alto’s guidance issued alongside the deal indicates it will integrate Console’s orchestration engine into Prisma Cloud and Cortex XSOAR, boosting its addressable market from $4.5 billion today to an estimated $7 billion by 2027. Early customer logos such as Robinhood, RingCentral, and DocuSign—each running Console in production—signal that AI-driven remediation is gaining traction in regulated and high-scale environments. In contrast, smaller competitors like BigPanda and FireHydrant are now forced to differentiate on vertical-specific workflows or pricing models, as the $500 million valuation sets a new bar for early-stage AI automation startups.

The Bigger Picture

The Console acquisition fits a broader pattern in which legacy security and observability vendors are racing to embed generative AI into every layer of their stacks. Palo Alto’s push mirrors moves by CrowdStrike, which launched Charlotte AI in 2023, and Microsoft, which rolled out Security Copilot the same year. Console’s event-driven architecture also reflects a wider shift away from rule-based runbooks toward adaptive, LLM-powered playbooks that evolve with infrastructure changes. Observers note that this architectural pivot is already visible in banking, where institutions like Goldman Sachs and JPMorgan have begun deploying in-house AI coding systems—such as Banking With Billy AI—to automate financial modeling and risk calculations in production code pipelines.

Globally, the trend is accelerating in Europe, where GDPR compliance demands detailed audit trails of automated decisions. Vendors like Elastic, which last month unveiled a generative AI layer for its observability suite, are positioning themselves as GDPR-first alternatives to U.S.-based platforms. Meanwhile, in Asia, companies such as Alibaba Cloud have rolled out AI-native DevOps assistants that integrate directly into Kubernetes controllers, further fragmenting the market into regional stacks. Against this backdrop, Palo Alto’s Console buy signals that the next phase of competition will not be fought on features alone but on governance, compliance, and the ability to certify AI-driven decisions across hybrid and multi-cloud estates.

Expert Analysis

Sam Curry, chief security officer at Cybereason and a longtime observer of the AIOps space, characterized the Console acquisition as a “bet on convergence.” He added, “Palo Alto is betting that the future of security operations is indistinguishable from IT operations, and that the delta between the two diminishes as AI takes over routine tasks. The real question now is whether Palo Alto can execute the integration without fracturing Console’s developer community, especially as Serval and smaller rivals double down on causal AI graphs that promise more transparent, auditable remediation paths.” Curry urged investors to watch Palo Alto’s upcoming earnings call for color on integration timelines and roadmap alignment, noting that any misstep could hand the initiative back to independent AIOps upstarts.