Palo Alto’s $400M Move to Secure the AI Software Stack

Palo Alto Networks is reportedly in advanced discussions to acquire Washington D.C.–based endpoint security startup Koi for around $400 million, signalling a strategic shift toward securing the modern, AI-driven software supply chain.

The potential acquisition reflects how enterprise attack surfaces are evolving. Traditional endpoint security has focused on devices, malware, and user behaviour. Koi, by contrast, operates at the convergence of endpoint security, software governance, and AI risk management. Its platform is designed to secure browser extensions, AI models, open-source code packages, and containers—assets that increasingly power modern applications but often remain poorly governed.

As organisations accelerate adoption of GenAI, cloud-native development, and containerised workloads, software sprawl has become a major blind spot. Enterprises frequently lack clear visibility into what software components are running across environments, where they originate, and the level of risk they introduce. Koi’s core strength lies in mapping and assessing software risk at enterprise scale, enabling governance across complex and opaque software ecosystems.

This capability aligns closely with Palo Alto Networks’ broader platform strategy, which aims to unify security across network, cloud, endpoint, and AI layers. Rather than point solutions, Palo Alto has been steadily building an integrated control plane to address emerging risks holistically.

From an industry standpoint, the deal underscores a clear shift in cybersecurity priorities. Modern attacks increasingly exploit trusted software components, developer tools, and AI assets instead of conventional vulnerabilities. Securing the software supply chain—particularly AI models and extensions—is fast becoming a board-level imperative.

If completed, the acquisition would significantly strengthen Palo Alto Networks’ endpoint and platform portfolio, positioning it to lead in one of enterprise security’s fastest-growing domains: software and AI trust in an automated, AI-first world.