Palo Alto Networks launches Cortex XSIAM 4.0 — autonomous SOC agents with enterprise knowledge

On Nov 2, 2026, Palo Alto Networks announced Cortex XSIAM 4.0: AI agents become collaborators with access to institutional knowledge (Google Drive, Confluence, SharePoint, SOPs), frontier models available globally with US/EU opt-in hubs, prioritized playbook execution, agentic endpoint security, and native Prisma AIRS telemetry ingestion into the SOC. It also adds data model acceleration at ingestion, federated search across AWS/GCP/Azure, and XDR Virtual Patching (private preview).

This moves agentic SOC from AI assistance toward autonomy, and is the first major SOC platform to pull enterprise AI-application threat telemetry (Prisma AIRS) into the same investigation workflow. Agents carrying institutional knowledge plus approval gates signals the next competitive bar for SOC platforms.

SOC leads and platform teams evaluating agentic detection/response should run a Cortex XSIAM 4.0 pilot, especially those already on Prisma AIRS to unify AI-application and infrastructure security. Applies to new work rather than a patch.