Palo Alto Acquires AI Help Desk Console for $500 Million

Palo Alto Networks has acquired Console, a startup specializing in IT help desk automation with AI agents, for $500 million. According to reporting by Marina Temkin of TechCrunch AI, the deal value, comprising cash and stock, was revealed by two sources familiar with the transaction. The two companies officially announced the acquisition on September 2, but had not disclosed the terms.

Founded two years ago, Console has provided AI agents that autonomously handle routine help desk tasks since its founding in 2024. The acquisition illustrates how competition over security operations automation is expanding to encompass IT service management as a whole. The purchase price significantly exceeded its most recent valuation, delivering a high return to investors in a short period.

Full Details of Palo Alto’s $500 Million

Acquisition

According to reporting by Marina Temkin of TechCrunch AI, Palo Alto Networks acquired Console for a total of $500 million in cash and stock. While the official announcement did not disclose the terms, testimony from multiple sources revealed the scale of the deal. Palo Alto Networks has declined to comment.

Console is a startup founded in 2024 that has offered products that use AI agents to automate password resets, granting access to applications, and routine troubleshooting without human intervention. Its customers have included fintech company Ramp, surveillance camera technology company Flock Safety, and data company Scale AI.

After the acquisition, Palo Alto Networks plans to integrate Console into Cortex, its security operations platform. Cortex is positioned as a platform that uses AI to automatically detect and neutralize threats. By combining Console’s agent capabilities, the company aims to build a system that enables security teams to investigate and respond to alerts using natural language.

In a statement, Palo Alto Networks Chief Executive Officer Nikesh Arora said the following about the significance of integrating Console into Cortex:

It will give Cortex “the hands and feet to deliver autonomous security outcomes across the entire enterprise”

This phrasing emphasizes a shift to autonomous operations that handle not only detection but also execution.

How AI Agents Automate the Help Desk

At its core, Console autonomously handles repetitive inquiries received by help desks with AI agents. It automatically completes password resets, granting access to business applications such as Figma and Miro, and routine troubleshooting for devices and accounts.

In conventional IT service management, it was common for operations to involve manually reviewing employee requests and granting permissions or making configuration changes. Console is designed to complete this process with natural language instructions, reducing wait times and operational burden. Administrators no longer need to manually handle individual tickets and can focus on more advanced security and infrastructure tasks.

The company’s founder is Andrei Serban. Serban previously founded Fuzzbuzz, a code security platform, which was acquired by Rippling. Console, launched after the sale of Fuzzbuzz, can be seen as an example of applying expertise gained in the developer-focused security domain to IT operations automation. Rippling has continued to invest in AI since then, and in Rippling Announces AI Spend Tracking Tool ‘AI Spend Console’, it unveiled enhanced visibility into spend management associated with corporate AI usage.

Rapid Valuation Surge and the Investment

Return Structure

Console has raised a total of $29 million in the two years since its founding, consisting of a $6.2 million seed round led by Thrive Capital and a $23 million Series A co-led by DST Global and Thrive Capital.

According to PitchBook data, Console’s valuation prior to the sale was $157 million. The $500 million sale represents more than triple that valuation, resulting in a swift return for investors. Investors included SV Angel and Abstract Ventures, as well as Palo Alto Networks’ own Arora as an angel investor.

The structure of Arora acquiring a startup in which he had invested for his own company could draw attention from a conflict-of-interest perspective. On the other hand, it can also be noted that having top management recognize the product’s value early enables swift execution of an integration strategy. As major cybersecurity companies race to implement AI agents, insider knowledge may have helped drive the acquisition decision.

The Vision for Autonomous Security Through

Cortex Integration

Palo Alto Networks has indicated its policy of integrating Console into Cortex to automate the entire process from threat detection to response. While Cortex has traditionally handled threat detection and analysis, actual remediation still relied in part on manual work or integration with separate systems.

By incorporating Console’s agent capabilities, security teams will be able to issue instructions in natural language and execute a series of responses, including investigating alerts, identifying the scope of impact, and changing access controls. The aim is to shorten the time from detection to containment and reduce the burden on operations personnel.

The company describes Console’s capabilities as the “hands and feet to deliver autonomous security outcomes across the entire enterprise.” The concept is to further advance automation of the security operations center by integrating AI-driven decision-making with the execution capability to actually operate systems. A distinctive feature is the repurposing of agent execution capabilities honed in the help desk domain for the security domain.

The Rise of Serval and the Competitive

Landscape for IT Automation

In the AI-driven IT service automation space to which Console belongs, Serval has been considered a major competitor. Serval has attracted attention as a challenger to ServiceNow, reaching a $1 billion valuation in a $75 million Series B led by Sequoia in December 2024.

Serval started as an AI-powered technical support tool and later expanded into AI assistance for HR, legal, and finance departments. It aims not only to handle inquiries for IT departments but to automate operations across all corporate support functions.

Speaking to TechCrunch AI, one investor not invested in Serval said that Console’s acquisition has effectively made Serval the category leader among startups automating IT service management. With Console now under a large corporation, the competitive focus among independent startups is increasingly converging on Serval.

This sector has expanded against the backdrop of corporate demand for both improved employee experience and reduced operational costs. Advances in generative AI and agent technology have made automation of routine tasks a realistic option, creating a competitive structure where incumbents like ServiceNow, emerging startups, and security giants like Palo Alto Networks intersect.

Palo Alto’s Accelerating Acquisition

Strategy in 2026

According to PitchBook, Console is Palo Alto Networks’ seventh acquisition in 2026. The company has been actively pursuing acquisitions of venture-backed companies this year.

These include the $3.35 billion acquisition of Chronosphere, an observability platform backed by Greylock and Lux Capital, and the $400 million acquisition of Koi, a cybersecurity startup backed by Battery and Team8. Both are large-scale deals aimed at expanding its foundation in monitoring and threat response.

The series of acquisitions can be interpreted as part of a strategy to integrate data visibility, detection, and response in security operations onto a single platform. The enhanced observability from Chronosphere, the strengthened cyber defense from Koi, and the added execution automation from Console are elements that complement the autonomous security vision centered on Cortex.

Behind this string of acquisitions is the progress in practical application of AI agents, with automation of security operations now becoming a decisive factor in competitiveness. Not only detection accuracy but also the automation capability to actually take action has become a differentiator, and the flow of help desk automation technology into the security domain is becoming clear.

Editorial Opinion

In the short term, we expect Palo Alto Networks’ integration of Console to accelerate Cortex’s differentiation. If investigation and response via natural language is realized, agents will handle Tier 1 response in the security operations center, allowing human staff to focus on higher-level judgment. Competing security vendors will be pressured to achieve similar execution automation, and acquisition and partnership activity could intensify in the next 3-6 months. In the long term, we assess that the boundary between IT help desks and security operations will blur. As a single agent platform handles everything from granting permissions to containing threats, IT service management and security operations are converging toward an integrated platform. Within 1-3 years, functional overlap between IT operations giants like ServiceNow and security giants like Palo Alto Networks will increase, and customer companies will likely prioritize operational integration when selecting vendors. As a question from the editorial team, was governance appropriate when the company’s top executive acquired a startup in which he had angel-invested? Should the surge in valuation from $157 million to $500 million be seen as reflecting market value, or as a result of insider information advantage?

References

• “Palo Alto Networks paid $500M for Thrive-backed Console, sources say”, by Marina Temkin — TechCrunch AI, 2026-09-02T22:44:56.000Z (ARR)
• Source URL: https://techcrunch.com/2026/09/02/palo-alto-networks-paid-500m-for-thrive-backed-console-sources-say/