Agentic security becomes the whole board

AI stopped being a feature lane

This was not a quiet fortnight. The common move across the category was to make AI security the organising layer for the platform, not a side module. Palo Alto Networks acquired the AI agent platform Console for a reported $500 million, with the deal repeatedly reported between 2 Sep and 7 Sep as part of a push into autonomous and agentic security operations. On 7 Sep, The Wall Street Journal linked Palo Alto Networks' double-digit growth to increased spending on AI in cybersecurity.

CrowdStrike used Fal.Con 2026 to push the same frame from the endpoint side. On 5 Sep it introduced Falcon Guardian and Safe Mind for AIDR, expanded its partnership with OpenAI, and was reported to have extended Falcon capabilities across Google Cloud's AI ecosystem on 3 Sep. On 6 Sep, it guided to 24.6% ARR growth in FY28, and on 7 Sep it announced SafeMind as an agentic cybersecurity solution for defenders while expanding its Cognizant collaboration into OT cybersecurity for converged IT and OT environments.

SentinelOne moved by model integration. On 4 Sep and 5 Sep it added OpenAI Daybreak models to Wayfinder Frontier AI Services, added a Wayfinder product page, and put Prompt Security on its IT product list. Okta moved through identity for agents, with Auth0 tools for AI agents and B2B logins reported on 4 Sep, followed by a 20% after-hours stock rise tied to higher FY27 revenue forecasts and stronger identity security demand. Even Rapid7, quieter commercially, added product pages on 3 Sep around AI in the SOC and a 2026 IDC MarketScape report.

The websites moved before the story settled

The public narrative was being edited in near real time. On 2 Sep, CrowdStrike changed its hero from 'The Agentic Security Platform. Unified and built to secure the AI revolution.' to 'CrowdStrike Falcon Platform:' and added the subtext 'One unified platform to secure the agentic enterprise'. On 3 Sep it added 'Stop software supply chain threats before execution'. On 4 Sep it added headings including 'CrowdStrike Unveils the Next Evolution of the Agentic SOC' and 'Turning the Falcon platform advantage into frontier AI breakthroughs'. On 5 Sep, it removed the software supply chain heading and added a campaign section for 'AI Unlocked: Agents of Chaos'.

That sequence matters. It shows the category testing language at the exact moment product, partner and investor messages were being compressed into one AI platform story. CrowdStrike added 19 product pages and nine blog entries on 3 Sep while removing 27 product pages and one documentation page. On 4 Sep it added 15 product pages tied to AI security, reports and partnerships, plus three blog posts.

Palo Alto Networks showed a similar pattern. On 2 Sep it added pages tied to an acquisition and financial results. On 4 Sep it added an intent product page and five blogs on AI in security and cyber resilience, while removing pages related to AI risk management and incident response. On 5 Sep it added four further blogs around certificate management, cloud security and operational divides, while removing pages on explainable AI, MDR versus MSSP, SWG versus SASE and syndication.

The smaller signals were not noise. SentinelOne added a Wayfinder Frontier AI product page on 4 Sep. Okta repeatedly added and removed careers pages between 2 Sep and 6 Sep, including new identity, UX research, business technology, finance, sales and customer success roles, while removing engineering and customer-facing listings. The firms were not only announcing AI security. They were rearranging the shop floor around it.

CrowdStrike made packaging the fight

The clearest commercial move came from CrowdStrike. On 3 Sep, it added Firewall Management, Endpoint Detection and Response, Threat Intelligence and Hunting, Identity Protection and Express Support to Falcon Go. It also added Endpoint Detection and Response, Threat Intelligence and Hunting, Identity Protection and Express Support to Falcon Pro, while adding Identity Protection and Express Support to higher packaging.

On 5 Sep, the price move landed. Falcon Go fell from $59.99 to $7.99, Falcon Pro fell from $99.99 to $14.99, and IT Hygiene was added to Falcon Go, Falcon Pro and Falcon Enterprise. CrowdStrike also added a promotion for flexible pricing, with monthly billing or annual savings.

That is a large repositioning of the entry motion. It puts more detection, identity, threat intelligence and hygiene into lower tiers at the same time CrowdStrike is raising revenue forecasts, lifting long-term growth targets and seeing multiple analysts raise price targets. In a week dominated by agentic SOC language, the most concrete competitive pressure was still packaging.

The expanding surface came with public checks

The breadth race also made operational resilience more visible. On 5 Sep, Palo Alto Networks reported three incidents: a critical MLAV outage of about 198 minutes, a minor degradation affecting the Cortex XDR, XSIAM, XSOAR8 and CLOUD login page for about 694 minutes, and a minor URL filtering service degradation tied to GCP network issues for about 284 minutes. On 2 Sep, six CVEs published on 13 Aug were reported for Palo Alto Networks' Prisma Browser and Prisma Access Agent, covering issues including security bypass, information disclosure, improper link resolution, authentication bypass and privilege escalation.

CrowdStrike had its own public scrutiny. On 1 Sep, CVE-2026-76380, published on 19 Aug, was reported for versions below 5.1.3 of the CrowdStrike OAuth API app for Splunk SOAR, with medium severity and a CVSS score of 4.3. On 4 Sep, articles discussed proof-of-concept exploits related to Falcon privilege escalation and zero-day vulnerabilities. Okta had two reported vulnerabilities on 1 Sep: CVE-2026-77585, published on 25 Aug, in the Okta Privileged Access client, and CVE-2026-54245, published on 26 Aug, in the Okta conditional access integration.

Rapid7's signals were more about governance and continuity. On 1 Sep, reports said two directors had joined its board while four existing board members resigned. On 2 Sep, Rapid7 announced Maria Barrett as Lead Cybersecurity Director, with a 1 Sep start date. On 3 Sep, further reports again highlighted four resignations, two new board members and an equity grant to a new director. On 4 Sep, Rapid7 also resolved an Exposure Command degradation in about nine minutes. Okta, meanwhile, appointed former Splunk executive Scott Morgan as Chief Legal Officer on 5 Sep.