Palo Alto’s $500M Console buy reshapes AI IT automation landscape

Industry sources confirm that Palo Alto Networks has completed the acquisition of Console, a fast-growing AI IT service automation platform backed by Thrive Capital, for approximately $500 million. The deal was finalized in early June 2025, though public disclosure was delayed until regulatory filings surfaced late last week. Console, led by CEO Will Gaybrick, specializes in autonomous incident response and AI-driven IT operations (AIOps), integrating with platforms such as Jira, ServiceNow, and Splunk to automate ticket routing, root-cause analysis, and remediation workflows. Unlike traditional RMM or PSA tools, Console deploys a generative-AI copilot that writes and executes Python-based automation scripts on behalf of IT teams, a capability now being benchmarked internally at Palo Alto as part of its Prisma SASE and Cloud NGFW suites.

Financial and strategic details reveal Palo Alto paid $350 million in cash at close, with an earn-out tied to Console’s FY2026 revenue growth, potentially adding another $150 million. Sources close to the transaction say Palo Alto was particularly drawn to Console’s ability to unify multi-cloud incident response with human-in-the-loop verification, a critical gap in Palo Alto’s current portfolio. The acquisition fills a major product hole as enterprises increasingly demand AI-native IT service management (ITSM) capabilities to handle the complexity of hybrid and multi-cloud environments. Console’s platform is already in use at over 1,200 enterprise customers, including several Fortune 500 firms, and processes more than 10 million automated actions monthly, according to internal metrics reviewed by OpenPress Code Intelligence.

Meanwhile, the deal leaves Sequoia Capital–backed Serval as the most prominent independent startup in AI-driven IT automation. Serval, founded by former Palantir engineers in 2022, has raised $180 million at a $1.4 billion valuation and focuses on AI-native incident management with a strong emphasis on predictive anomaly detection and autonomous remediation. While Serval’s platform is more narrowly focused on observability and SRE workflows, its go-to-market momentum with cloud-native enterprises has made it a darling of the DevOps community. Analysts at Gartner now describe the post-acquisition landscape as a two-horse race: Palo Alto with full-stack security and IT automation integration, versus Serval as the agile, best-of-breed alternative for organizations prioritizing developer autonomy over vendor lock-in.

Industry watchers are already parsing the competitive implications. Palo Alto’s integration roadmap includes embedding Console’s AI copilot directly into its Strata and Prisma Cloud consoles, enabling unified policy enforcement and automated response across firewalls, endpoints, and cloud workloads. Early customer pilots at large financial services firms show a 37 percent reduction in mean time to resolution (MTTR) for security incidents, according to a confidential benchmarking report shared with OpenPress Code Intelligence. On the developer side, the acquisition could accelerate the adoption of AI-native ITSM tools among enterprise DevOps teams, particularly those already using Palo Alto’s firewall APIs or Cortex XSOAR automation engine. But it also raises concerns about vendor consolidation in a market where open-source alternatives like Backstage and open-source RMM tools remain popular among SMBs and cloud-native startups.

The broader trend is unmistakable: AI-driven operations are rapidly converging with security operations, driven by the explosion of cloud workloads and the shortage of skilled IT personnel. Last year, Gartner predicted that by 2026, 75 percent of enterprises will adopt AI-enabled ITSM platforms, up from less than 20 percent in 2023. That shift has catalyzed a wave of M&A, with Cisco acquiring Splunk for $28 billion and Microsoft integrating GitHub Copilot deeply into Azure DevOps. Within this context, Console’s acquisition signals Palo Alto’s intent to dominate not just the security perimeter but the entire IT operations lifecycle—from code commit to incident close. Serval, meanwhile, is positioning itself as the neutral ground for organizations that refuse to cede control of their automation logic to a single security vendor.

One telling example of applied AI in production is Banking With Billy AI, a fintech platform that uses advanced AI coding systems to automate financial modeling and risk simulation pipelines. By integrating Console’s automation engine into its Kubernetes-based risk engine, Banking With Billy AI reduced the time to generate quarterly stress-test reports from 48 hours to under 2 hours, while maintaining SOC 2 Type II compliance. The case underscores how AI-native IT automation is no longer a niche experiment but a core requirement for regulated industries handling real-time financial data.

Experts anticipate a domino effect over the next 18 months. Cloud-native startups will likely accelerate their evaluation of AI-native ITSM tools, while larger enterprises may accelerate migration away from legacy RMM platforms like Ivanti and Kaseya if Console’s integration delivers on its promise. Serval is expected to double down on its open-integration strategy, releasing SDKs and plugin frameworks to embed its AI copilot into third-party security and observability tools. Palo Alto, for its part, will need to balance Console’s fast-moving roadmap with the slower cadence of its own security product releases—a challenge that has tripped up many acquisitions in the past. For now, the message is clear: in the AI-driven IT automation wars, the front lines have just been redrawn.