Cybersecurity turns AI from slogan to surface

The fortnight was not quiet. It was synchronised. On 23 Oct, Okta changed its homepage hero from “Welcome to the secure agentic future” to “Okta secures AI”, and rewrote the supporting copy around bringing agents under the same trusted identity platform. On the same date, Tenable announced OPEN for AI, an initiative to integrate enterprise security tools and agents. On 25 Oct, SentinelOne launched Singularity Agentic Detection and Response, aimed at rogue and malicious AI agents.

That is the shape of the market now. Identity, exposure management and endpoint vendors are each trying to define the control plane for agentic systems. Palo Alto Networks added 65 product pages on 23 Oct covering topics including artificial intelligence and data governance, then introduced six research and whitepaper pages on 24 Oct while removing six product comparison and definition pages. This was not merely more content. It was a visible reweighting of the front door.

The most consequential move was Proofpoint’s. On 23 Oct, multiple reports said Proofpoint would acquire Varonis in a cash transaction valued at $6.3bn, positioned around AI security and data risk. By 26 Oct, Proofpoint had added a blog on insider threat management and removed a webinar page about email and endpoint threats. The arc is clear from the observed moves: the data layer is becoming a primary security battleground, not a compliance afterthought.

The same week’s vulnerability work showed how quickly messaging now has to become operational. On 24 Oct, CrowdStrike added a website section titled “PHP2Shell: What You Need to Know Now and How to Prepare for What's Next”. The same day, Palo Alto Networks added “Close your PHP exposure gap with Frontier Virtual Patching” and removed a SASE leadership section from the same observed surface. On 23 Oct, Qualys added pages for PHP2Shell risk assessment and infrastructure security, then published guidance on PHP2Shell and Node.js patches on 24 Oct.

Arctic Wolf’s changelog, observed on 26 Oct, included a 22 Oct entry on critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619. The sequence matters. Four vendors moved from general platform language to named vulnerability response within a narrow window, and the fastest visible changes were not tucked inside long-form research. They appeared on primary product and website surfaces.

Fortinet’s week sat in the same execution frame. On 24 Oct, reports said Fortinet had issued critical patches ahead of official CVE disclosures, alongside a security hardening release advising users to upgrade. On 25 Oct, Fortinet issued a warning about critical security hardening updates for multiple products and urged immediate patching. Publicly, this reads as a reminder that patch cadence and disclosure timing are now part of brand trust for every security vendor.

The code layer was busy. On 23 Oct, CrowdStrike added ten repositories, including “foundry-sample-logscale” and “foundry-sample-detection-translation”. On 24 Oct, it released version 1.0.1 of “ngis-sgnl-policy-action”, and on 25 Oct it released version 3.6.3 of “falcon-integration-gateway” with a fix for CVE-2026-111497. By 26 Oct, CrowdStrike had added “Cloud-AWS”, while top repository stars had risen from 644 to 806 in the latest observed snapshot.

Palo Alto Networks also expanded the developer perimeter. On 23 Oct, it added “AppSecMCP”. On 24 Oct, it created “shifter”. On 26 Oct, it added “cortex-helm”. Tenable released pyTenable 26.10.1 on 26 Oct, adding Nessus quick-start documentation and support for selecting vulnerability export properties, after adding “integration-jira-cloud” and “Security-Hub” on 23 Oct. Okta added “okta-management-openapi-spec” on 24 Oct and “samples-java-spring” on 26 Oct.

This is the quiet tell inside a noisy market. The vendors competing to secure AI systems are also expanding samples, Helm charts, OpenAPI assets, integrations and export controls. The category is not only being sold to CISOs. It is being made easier to wire into developer and platform teams.

Paid media was active across the category. CrowdStrike had 28 new Google ad creatives observed on 23 Oct, with the earliest first shown on 13 Oct, and 25 new creatives observed on 26 Oct, with 40 creatives running in total. Palo Alto Networks had 35 new creatives observed on 25 Oct and 19 observed on 26 Oct, also with 40 running in total. Okta had 11 new creatives observed on 23 Oct and 14 observed on 26 Oct, again with 40 running in total.

Customer proof moved as well. On 24 Oct, Palo Alto Networks added new customer logos for Major League Baseball and Cogentrix, alongside case studies for Major League Baseball and Cogentrix AI Endpoint Security. On 25 Oct, Okta added logos for McLaren, PGA of America, Hitachi and Rocket, then on 26 Oct added the case study “Securing Rocket’s customers and partners with Auth0”. Qualys added a CKB Bank customer success story on 24 Oct, focused on risk-based audit readiness.

The pattern is useful because it separates motion from message. Most large vendors can now light up 40 running creatives. Fewer can pair that spend with fresh proof, live developer assets and dated vulnerability response in the same week. That is where positioning starts to look like operating rhythm.