AI security moved from slogan to shelf space

The AI security land grab became operational

This was not a quiet fortnight. On 4 Sep, Palo Alto Networks was reported to have acquired AI startup Console for $500 million to enhance its autonomous security platform. The same transaction was then picked up repeatedly through 5, 6, 7, 8 and 9 Sep, alongside reports of strong Q4 earnings, positive fiscal 2027 guidance and nearly $1 billion in net new ARR from its latest earnings call.

CrowdStrike used Fal.Con 2026 to widen the frame. On 5 Sep it introduced Falcon Guardian and Safe Mind for AIDR, expanded its OpenAI partnership and updated its psfalcon repository to version 2.2.9 with new case-file management commands. On 6 Sep, it guided to 24.6% ARR growth in FY28, and on 7 Sep it was reported to have raised long-term growth targets and its annual revenue forecast after Q2 FY2027 revenue and ARR surpassed expectations.

SentinelOne pushed the same theme through Wayfinder. On 4 Sep it added a product page for Wayfinder Frontier AI services incorporating OpenAI Daybreak models, while reports noted Q2 FY2027 revenue growth of 21%, EPS ahead of estimates by $0.07, a $24.4 million restructuring charge and AI security ARR tripling. By 7 Sep, reports said it had integrated GPT-5.6-Cyber into Wayfinder, following malware analysis benchmarks and an expansion of its AI services.

Fortinet joined the acquisition line on 10 Sep, completing the acquisition of Virtue AI to expand AI-driven and agentic security capabilities. Proofpoint, meanwhile, expanded AI-powered investigations into Microsoft 365 on 11 Sep and launched an AI agent for SOC teams. The point is not that every vendor has the same AI product. It is that every serious platform is now trying to make AI visible in the buying motion.

CrowdStrike put price on the table

The most concrete commercial move came on 5 Sep. CrowdStrike cut Falcon Go from $59.99 to $7.99 and Falcon Pro from $99.99 to $14.99, while adding IT Hygiene to Falcon Go, Falcon Pro and Falcon Enterprise. It also added a new message: flexible pricing, pay monthly or save with annual billing.

That is not a cosmetic edit. It takes an enterprise-grade brand and gives smaller buyers a cheaper on-ramp, with hygiene bundled into the same front door. In a market where AI security announcements can blur together, a visible price reset is harder for rivals to ignore.

The surrounding page changes were just as telling. On the same day, CrowdStrike added a website section promoting “AI Unlocked: Agents of Chaos” with a chance to win up to $100,000, and removed a section headed “Stop software supply chain threats before execution.” On 13 Sep, Rapid7 changed its primary demo call to action from “Request Demo” to “Get demo.” These are small moves, but they show a category optimising the first conversion step while the strategic narrative shifts to AI.

Identity, data and exposure are converging

Okta’s fortnight showed why identity is becoming a core AI-security battleground. On 4 Sep, Okta introduced new Auth0 tools for AI agents and B2B logins. Its stock rose 20% after-hours after increased FY27 revenue forecasts were linked in reports to stronger cybersecurity demand. On 13 Sep, its Q2 earnings report showed subscription growth, a raised fiscal 2027 outlook and a $75 million backlog above expectations, with shares reported up 20.9%.

Okta also added Sunil Kedaraji to expand its partner business in APJ on 13 Sep and appointed former Splunk executive Scott Morgan as Chief Legal Officer on 5 Sep. The company was not just reporting demand. It was adding go-to-market and governance capacity around it.

Proofpoint’s reported talks with Varonis on 13 Sep put data security into the same consolidation story. Proofpoint had already appointed Brian Levey as Chief Legal Officer and Puja Jaspal as Chief People Officer that day, after expanding Microsoft 365 investigations and launching an AI SOC agent on 11 Sep. Email, identity, insider risk and data controls are being pulled into one procurement conversation because AI makes access and information flows harder to separate.

Tenable sat on the exposure side of that same shift. On 12 Sep, it priced an upsized $725 million convertible notes offering at a 40% premium and was recognised in reports for topping device exposure market share for the eighth consecutive year. The market is rewarding platforms that can frame the expanding attack surface as a single operating problem.

The surfaces changed before the slogans settled

The quietest signal was the amount of website and repository movement around AI. On 4 Sep, Palo Alto Networks introduced a product page focused on intent and five blog pages on AI in security and cyber resilience, while removing five product pages related to AI risk management and incident response. On 5 Sep, it added four blog pages on certificate management, cloud security and operational divides, while removing four product pages, including explainable AI and MDR versus MSSP content. On 9 Sep, it introduced 19 product pages focused on AI governance, risk management and cybersecurity frameworks, plus two blog pages on its Deutsche Bank partnership.

SentinelOne’s Wayfinder page appeared on 4 Sep. Rapid7 added 11 careers pages and five blog posts on 14 Sep, after adding two job listings on 7 Sep and changing its demo CTA on 13 Sep. Okta cycled through new and removed roles across 4, 5, 6, 7 and 9 Sep, including engineering, SRE, product design, customer success, finance and account roles.

Developer surfaces moved too. Okta launched four repositories on 4 Sep, added two more on 5 Sep and released okta-cli version 0.10.0 on 7 Sep, with repository stars rising in the observed period. Palo Alto Networks released version 3.5.1 of terraform-azurerm-swfw-modules and created a repository called shifter on 8 Sep. Rapid7 released InsightConnect and Azure DevOps extension updates across 4 and 7 Sep. These are not headline events, but they are where positioning starts to become product surface.

Security vendors had to show their own resilience

The fortnight also carried operational reminders. On 5 Sep, Palo Alto Networks reported three incidents: a critical MLAV outage lasting about 198 minutes, a minor degradation affecting Cortex XDR, XSIAM, XSOAR8 and CLOUD login for about 694 minutes, and a URL filtering service degradation linked to GCP network issues lasting about 284 minutes. All were reported as resolved.

On 8 Sep, six CVEs were published for Okta Access Gateway and the Hyperdrive Integration plugin, with CVSS scores from 4.8 to 7.5. On 10 Sep, Fortinet had six new CVEs naming its products over the prior 30 days, including CVE-2026-26035 with a CVSS score of 9.8 in FortiWeb, and it also announced patches for critical FortiMonitorOnSight Chrome extension vulnerabilities. On 11 Sep, four CVEs were published naming Tenable, including CVE-2026-19626, a remote code execution issue with a CVSS score of 9.9.

For buyers, this does not negate the demand story. The same fortnight brought strong earnings commentary, acquisitions, product launches and analyst target increases across several names. It does mean that resilience, disclosure cadence and patch handling remain part of the platform sale, even when the front page says agentic AI.