Palo Alto Networks unveils AgentiX & reports 48% IoT device risk

Palo Alto Networks has released its 2025 Device Security Threat Report and launched Cortex AgentiX, a platform focused on enhancing enterprise security operations through AI-driven automation.

Device security report findings

The Device Security Threat Report is based on telemetry from 27 million devices, offering a data-driven perspective on the increasing risks facing enterprise environments. The report highlights that nearly half of all enterprise connections-48.2%-originate from high-risk IoT and IT devices.

The analysis identifies routers and video conferencing systems as among the most vulnerable device types targeted for exploitation. The report also details the growth in IoT device exposure, noting that millions of devices are now globally accessible. Widespread use of insecure protocols such as SNMPv1 and Telnet persists in enterprise environments, and many organisations continue to operate unsupported operating system versions. More than 7.8% of Windows and 26% of Linux systems in scope are reportedly end-of-life, increasing the attack surface for potential threats.

The research notes an active landscape of billions of exploitation attempts. The findings indicate that enterprises must adopt enhanced visibility, improved segmentation, and more proactive risk management to address cybersecurity risks effectively.

Platform launch

Alongside the release of the threat report, Palo Alto Networks has introduced Cortex AgentiX. The platform is described as an agentic AI solution that aims to automate incident detection, investigation, and response activities within security operations centres (SOCs). The company states that AgentiX can reduce mean time to response (MTTR) by up to 98% and decrease manual effort by 75%, enabling organisations to focus more on strategic initiatives.

Unleashing autonomous agents without tight control is a recipe for disaster. That's why we built AgentiX on our proven Cortex platform, delivering the full power of agentic AI with the control, traceability and permission management every enterprise demands. When applied to security teams, this isn't just automation; it's the end of manual toil. We're freeing your experts to transform the SOC, not just chase alerts.

This statement was made by Gonen Fink, EVP of Products for Cortex at Palo Alto Networks.

Capabilities and integrations

According to Palo Alto Networks, AgentiX provides prebuilt agents that plan, reason, and execute solutions similar to human experts. The platform delivers workflow autonomy and is built on a decade of security automation experience and data from 1.2 billion real-world playbook executions. It also comes with over 1,000 prebuilt integrations and native multi-cloud platform (MCP) support to ensure compatibility with a wide range of enterprise tools.

AgentiX offers a suite of security agents out of the box. These include a Threat Intelligence Agent that aggregates and analyses threats, an Email Investigation Agent that automates responses to email-based threats, an Endpoint Investigation Agent for rapid forensic analysis and containment, and a Network Security Agent for orchestrating threat response and policy control across a range of firewalls.

Organisations can also build custom agents using a no-code builder that leverages the existing integrations and offers guardrails for safe operation. The platform aims to allow orchestration of complex, cross-enterprise workflows, with agents that are context-aware and can be launched from any Cortex product or the standalone AgentiX platform.

To address governance and compliance requirements, AgentiX includes role-based access controls, the option for human approval on impactful actions, and full auditability for all agent activity.

Industry response

Cortex AgentiX stands apart by building its agentic workforce on Palo Alto Networks existing SecOps backbone and a decade of SOAR maturity. This foundation is crucial: It ensures agents operate within a fully governed automation framework, unlike newer entrants that often lack enterprise-grade policy enforcement and traceability. By deploying natively across XSIAM, XDR, and Cortex Cloud, Palo Alto Networks is uniquely positioned as the leader in agentic AI, delivering the scale, breadth and compliance standards required for the autonomous enterprise.

This assessment was provided by Francis Odum, Founder of Software Analyst Cyber Research (SACR).

Availability

Palo Alto Networks states that Cortex AgentiX is now available as part of Cortex Cloud, Cortex XSIAM and Cortex XDR. The company plans to make the standalone AgentiX platform available in early 2026.