* [Blog](https://www.paloaltonetworks.com/blog) * [Security Operations](https://www.paloaltonetworks.com/blog/security-operations/) * [AI and Cybersecurity](https://www.paloaltonetworks.com/blog/security-operations/category/ai-and-cybersecurity/) * Deploying Agentic AI in t... # Deploying Agentic AI in the Modern Federal SOC [](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.paloaltonetworks.com%2Fblog%2Fsecurity-operations%2Fagentic-ai-federal-soc%2F) [](https://twitter.com/share?text=Deploying+Agentic+AI+in+the+Modern+Federal+SOC&url=https%3A%2F%2Fwww.paloaltonetworks.com%2Fblog%2Fsecurity-operations%2Fagentic-ai-federal-soc%2F) [](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.paloaltonetworks.com%2Fblog%2Fsecurity-operations%2Fagentic-ai-federal-soc%2F&title=Deploying+Agentic+AI+in+the+Modern+Federal+SOC&summary=&source=) [](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https://www.paloaltonetworks.com/blog/security-operations/agentic-ai-federal-soc/&ts=markdown) \[\](mailto:?subject=Deploying Agentic AI in the Modern Federal SOC) Link copied By [Jane Goh](https://www.paloaltonetworks.com/blog/author/jane-goh/?ts=markdown "Posts by Jane Goh") Nov 12, 2026 9 minutes [AI and Cybersecurity](https://www.paloaltonetworks.com/blog/security-operations/category/ai-and-cybersecurity/?ts=markdown) [Cybersecurity](https://www.paloaltonetworks.com/blog/category/cybersecurity/?ts=markdown) [Must-Read Articles](https://www.paloaltonetworks.com/blog/security-operations/category/must-read-articles/?ts=markdown) [Product Features](https://www.paloaltonetworks.com/blog/security-operations/category/product-features/?ts=markdown) [Autonomous soc](https://www.paloaltonetworks.com/blog/tag/autonomous-soc/?ts=markdown) [Cortex](https://www.paloaltonetworks.com/blog/tag/cortex/?ts=markdown) [Cortex XSIAM](https://www.paloaltonetworks.com/blog/tag/cortex-xsiam/?ts=markdown) [Security Operations](https://www.paloaltonetworks.com/blog/tag/security-operations/?ts=markdown) Federal security operations centers operate in one of the most demanding threat environments in the world. Defending dispersed enclaves, legacy infrastructure, and modern multi-cloud environments against well-resourced adversaries requires exceptional agility. Yet, most security teams remain constrained by tools designed for a simpler era: static dashboards, manual swivel-chair analysis, and brittle automation scripts that break the moment an adversary alters their tradecraft. Buried under routine alert triage, federal defenders simply don't have the bandwidth to catch sophisticated adversaries moving through blind spots across siloed networks. Solving this operational bottleneck requires moving past conventional automation and adopting **agentic AI**. With agentic reasoning in SecOps, agencies can deploy AI agents that evaluate context, test hypotheses, and correlate evidence across enterprise boundaries. Crucially, these agents operate under the strict oversight, auditability, and governance that public sector security demands. ### From Deterministic Automation to Adaptive Reasoning For years, Security Orchestration, Automation, and Response (SOAR) was hailed as the answer to SOC burnout. In practice, traditional SOAR relies on predefined, deterministic logic: *If Alert A fires, execute Action B, then Action C.* Adversaries do not follow deterministic scripts. When a nation-state actor employs living-off-the-land techniques or abuses valid credentials across hybrid tenants, static playbooks hit a wall. If a playbook encounters unexpected telemetry, the workflow fails. Maintaining hundreds of bespoke playbooks across sprawling federal directorates can become an administrative burden in itself. Agentic systems shift the paradigm from **predefined paths to goal-directed reasoning** . Instead of following a rigid flowchart, an autonomous agent is given an objective. For example: *Determine the scope, root cause, and blast radius of this anomalous privilege escalation.* The agent dynamically evaluates incoming data using a full suite of tools, including EDR queries, identity logs, and network telemetry: * It analyzes an alert and constructs an initial hypothesis. * It selects and executes the appropriate diagnostic query. * It assesses the resulting output, determines whether the finding is benign or suspicious, and decides the next analytical step based on evidence rather than a rigid script. This dynamic problem-solving mirrors the thought process of a senior tier-3 analyst, executing investigative routines in seconds rather than hours. ![Flowchart titled "Anatomy of an AgentiX Workflow" illustrating a three-stage process: Flexible Agent Invocation via automated alerts or user prompts, Context Awareness using internal SOPs and threat telemetry, and Governed Execution with human-in-the-loop approval across connected security tools.](https://www.paloaltonetworks.com/blog/wp-content/uploads/2026/11/Gemini_Generated_Image_egdqnnegdqnnegdq-scaled.jpeg) ### Autonomous Triage Meets Active Case Collaboration An agentic architecture supports mission workflows across two operational modes: autonomous initial response and collaborative case investigation. **1. The Autonomous First Responder** When a high-fidelity alert triggers in the middle of the night, an autonomous agent initiates an investigation immediately. The agent executes forensic collection, host-level containment, and remediation across disparate security tools, feeding structured evidence and case updates directly into the team's ticketing and collaboration stack. By the time an analyst reviews the incident ticket, the agent has already filtered out background noise, correlated indicators, determined case severity, and assembled a recommended plan of action. The analyst begins their review with a fully scoped case file rather than starting from scratch. #### **2. The Interactive Case Collaborator** Agentic capabilities extend far beyond automated initial triage. As analysts work complex, multi-day incidents, the agent functions as an on-demand investigative wingman during active case investigation. To make these investigations truly effective, AI agents cannot rely on generic security training data alone. They must be grounded in the agency's proprietary operational context. By connecting the agent to internal System Security Plans (SSPs), approved SOPs, network topology maps, and High Value Asset (HVA) registries, the system gains immediate situational awareness. It knows whether an anomalous login affects an isolated test node or a mission-essential system, tailoring every query and risk assessment to the agency's actual operational environment. An incident responder can prompt the agent naturally: *"Query the last 30 days of identity logs across our regional tenant to check if this compromised service account touched any high value assets."* *"Map the external IPs observed against our threat intel repositories and summarize the results."* Rather than manually switching between separate consoles and writing custom query syntax for each tool, the analyst tasks the agent. The agent handles query synthesis, normalizes data schemas, and returns structured findings directly into the case record. ### Turning Intelligence Overload into Action Federal agencies possess no shortage of threat intelligence. On any given day, security teams ingest an overwhelming volume of data: real-time feeds from sector ISACs, operational advisories from CISA, open-source intelligence (OSINT), and high-cost commercial feeds from multiple security vendors. Yet, having intelligence is not the same as being able to act on it. In most SOCs, threat data remains largely passive. Static indicators of compromise (IOCs) such as malicious IPs and file hashes age out in hours, while rich narrative advisories outlining adversary tactics, techniques, and procedures (TTPs) and APTs pile up as unread PDF reports. Analysts simply do not have the hours required to translate every incoming bulletin into proactive queries across their environment. Embedding threat intelligence directly into the incident response lifecycle allows security teams to move past isolated indicator feeds and actively fuse external threat signals with internal organizational context. It bridges what adversaries are doing in the wild with an agency's actual digital attack surface, asset criticality, and active telemetry. ### ![Vertical flowchart titled "Threat Intelligence Workflow" illustrating a three-step threat intelligence pipeline: External Intelligence Feeds (ISAC Advisories, CISA Bulletins, OSINT, CTI) flow downward into an Agentic AI Engine—which parses unstructured reports into MITRE TTPs, cross-references internal asset and patch states, and formulates dynamic hunting queries—to produce Actionable Threat Intelligence consisting of validated vulnerability exposure, proactive threat hunting results, and prioritized, mission-relevant defense postures.](https://www.paloaltonetworks.com/blog/wp-content/uploads/2026/11/Gemini_Generated_Image_hdumd6hdumd6hdum-scaled.jpeg) Agentic AI provides the reasoning power required to convert raw intelligence into real-time operational response: * **Translating unstructured bulletins into executable logic:** When a critical agency advisory or an ISAC flash report drops, an agent can ingest the unstructured narrative, extract relevant behavioral patterns, and map the adversary's tradecraft to the MITRE ATT\&CK framework. * **Correlating external threats with internal environment:** Instead of generating blanket alerts for every newly reported vulnerability, the agent cross-references the intelligence with internal asset inventories and patch telemetry. If an exploited vulnerability affects a system your agency does not run, the agent suppresses unnecessary noise. If an affected workload is exposed, the agent immediately escalates the finding. * **Autonomous, hypothesis-driven hunting:** Rather than waiting for an alert to fire, the agent uses incoming threat intelligence to form an investigative hypothesis. It automatically constructs and executes queries across internal telemetry to verify whether the agency has already exhibited subtle signs of the campaign, such as unusual administrative script executions or specific registry modifications. By using agentic reasoning to turn threat intelligence into proactive hunting missions, federal agencies can finally move adversary data out of static repositories and directly into daily SOC operations. ### Trust, Auditability, and the Human-on-the-Loop Autonomous capability without rigorous control is non-viable in the public sector. Federal missions require absolute transparency, data protection, and clear lines of operational authority. Agentic architecture meets these operational standards through three foundational guardrails: | **Architectural Principle** | **Operational Implementation in SecOps** | | **Reasoning Provenance** | Every conclusion is backed by an auditable trace detailing which tools were invoked, what queries were executed, and the exact evidence evaluated. | | **Human-on-the-Loop Governance** | Disruptive mitigation actions (e.g., host isolation, credential revocation) can be flagged for human approval prior to execution by the agent. | | **Least-Privilege Scoping** | Just like human analysts, non-human agents should operate under role-based access control (RBAC) to restrict their permissions. Pairing RBAC with SBAC (scope-based access control) adds an additional governance layer, strictly limiting which specific data, systems, and telemetry the agent can view. | |----------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| #### **Auditability and Transparency** In public sector oversight, a black-box verdict is unacceptable. If an agent concludes that an alert is a benign false positive or flags an account for compromise, its decision trail must be defensible under post-incident reviews, congressional inquiries, and inspector general audits. Enterprise-grade agentic frameworks log full **reasoning traces**. The agent does not simply deliver an output; it documents the chain of evidence: * *Why* it queried a specific endpoint. * *Which* artifacts matched suspicious criteria. * *What* criteria ruled out collateral damage. Every raw query and API response is preserved as an immutable piece of digital evidence. #### **Human Authority Over Consequential Actions** Deploying agents does not mean handing over automated command of core operational infrastructure. The SOC team can pre-define how much autonomous latitude is granted to agents to investigate, enrich, run diagnostic queries, and assemble case documentation. When remediation could disrupt public-facing services or sensitive agency operations, the agent never acts unilaterally. Instead of immediately isolating a critical database server or modifying firewall rules, it stages the action for analyst approval. ### Up-Leveling the Federal Cyber Workforce The cybersecurity talent gap remains an ongoing challenge across government agencies. SecOps teams frequently face high turnover, driven by the fatigue of handling thousands of low-level alerts on rotating shifts. Agentic AI changes the human equation: 1. **Eliminating the incident triage grind:** Agents absorb the repetitive legwork of initial triage, IP reputation lookups, and case prioritization, freeing human analysts to focus on adversarial analysis, proactive hunting, and response coordination. 2. **Accelerating junior analyst skills:** For junior civilian and military analysts, an agent can serve as an expert on their SOC environment. Analysts can chat with agents to help them in different aspects of investigation or perform deeper research. 3. \*\*Institutional knowledge retention:\*\*Veteran responders carry years of unwritten context about network quirks, maintenance windows, and legacy configurations. By integrating this institutional knowledge into the agent's reference store, agencies ensure that veteran expertise remains permanently operational in the SOC, even as military personnel reassign or civilian contractors transition off the program. ### The Balanced SOC: Aligning Human Oversight and Agentic Speed The question facing federal cyber leaders is no longer whether AI has a place in the SOC, but how to deploy it safely, defensibly, and effectively. Modern security operations require a balanced division of labor. By pairing deterministic automation for predictable execution and reasoning agents for adaptive investigations, analysts are freed from the alert grind to focus on strategic decision-making and mission defense. Under this model of human-led oversight and machine-speed investigation, public sector teams can stay ahead of modern adversaries while keeping critical operations resilient. Ready to transform your SOC? Tune in to the [Cortex Forward](https://www.paloaltonetworks.com/cortex/cortex-forward-series?ts=markdown) webinar series to explore how Cortex XSIAM delivers AI-driven security operations. *** ** * ** *** ## Related Blogs ### [AI and Cybersecurity](https://www.paloaltonetworks.com/blog/security-operations/category/ai-and-cybersecurity/?ts=markdown), [Announcement](https://www.paloaltonetworks.com/blog/category/announcement/?ts=markdown), [Cybersecurity](https://www.paloaltonetworks.com/blog/category/cybersecurity/?ts=markdown), [Must-Read Articles](https://www.paloaltonetworks.com/blog/security-operations/category/must-read-articles/?ts=markdown), [Product Features](https://www.paloaltonetworks.com/blog/security-operations/category/product-features/?ts=markdown), [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown), [Use-Cases](https://www.paloaltonetworks.com/blog/security-operations/category/use-cases/?ts=markdown) [#### Cortex XDR Scores Perfect 100% in SE Labs 2026 Ransomware Test](https://www.paloaltonetworks.com/blog/security-operations/cortex-xdr-scores-perfect-100-in-se-labs-2026-ransomware-test/) ### [AI and Cybersecurity](https://www.paloaltonetworks.com/blog/security-operations/category/ai-and-cybersecurity/?ts=markdown), [Must-Read Articles](https://www.paloaltonetworks.com/blog/security-operations/category/must-read-articles/?ts=markdown), [Product Features](https://www.paloaltonetworks.com/blog/security-operations/category/product-features/?ts=markdown) [#### What's New in Cortex (May '26)](https://www.paloaltonetworks.com/blog/security-operations/whats-new-in-cortex-may-26/) ### [AI and Cybersecurity](https://www.paloaltonetworks.com/blog/security-operations/category/ai-and-cybersecurity/?ts=markdown), [Must-Read Articles](https://www.paloaltonetworks.com/blog/security-operations/category/must-read-articles/?ts=markdown), [Product Features](https://www.paloaltonetworks.com/blog/security-operations/category/product-features/?ts=markdown) [#### Threat Intelligence in the Era of AI](https://www.paloaltonetworks.com/blog/security-operations/threat-intelligence-in-the-era-of-ai/) ### [Agentic Endpoint Security](https://www.paloaltonetworks.com/blog/security-operations/category/agentic-endpoint-security/?ts=markdown), [AI and Cybersecurity](https://www.paloaltonetworks.com/blog/security-operations/category/ai-and-cybersecurity/?ts=markdown), [AI Security](https://www.paloaltonetworks.com/blog/category/ai-security/?ts=markdown), [Cybersecurity](https://www.paloaltonetworks.com/blog/category/cybersecurity/?ts=markdown), [Endpoint security](https://www.paloaltonetworks.com/blog/security-operations/category/endpoint-security/?ts=markdown), [Must-Read Articles](https://www.paloaltonetworks.com/blog/security-operations/category/must-read-articles/?ts=markdown), [News and Events](https://www.paloaltonetworks.com/blog/security-operations/category/news-and-events/?ts=markdown), [Product Features](https://www.paloaltonetworks.com/blog/security-operations/category/product-features/?ts=markdown), [Use-Cases](https://www.paloaltonetworks.com/blog/security-operations/category/use-cases/?ts=markdown) [#### Claude Fable 5.2 Hits a Perfect Score on Our Security Benchmark, the First Model Ever to Do It](https://www.paloaltonetworks.com/blog/security-operations/claude-fable-5-2-hits-a-perfect-score-on-our-security-benchmark-the-first-model-ever-to-do-it/) ### [AI and Cybersecurity](https://www.paloaltonetworks.com/blog/security-operations/category/ai-and-cybersecurity/?ts=markdown), [AI Security](https://www.paloaltonetworks.com/blog/category/ai-security/?ts=markdown), [Announcement](https://www.paloaltonetworks.com/blog/category/announcement/?ts=markdown), [Cybersecurity](https://www.paloaltonetworks.com/blog/category/cybersecurity/?ts=markdown), [Must-Read Articles](https://www.paloaltonetworks.com/blog/security-operations/category/must-read-articles/?ts=markdown), [News and Events](https://www.paloaltonetworks.com/blog/security-operations/category/news-and-events/?ts=markdown), [Product Features](https://www.paloaltonetworks.com/blog/security-operations/category/product-features/?ts=markdown), [Use-Cases](https://www.paloaltonetworks.com/blog/security-operations/category/use-cases/?ts=markdown) [#### Introducing Cortex XDR 6.0: Built for Endpoints. Ready for Agents.](https://www.paloaltonetworks.com/blog/security-operations/cortex-xdr-6-0/) ### [AI and Cybersecurity](https://www.paloaltonetworks.com/blog/security-operations/category/ai-and-cybersecurity/?ts=markdown), [AI Security](https://www.paloaltonetworks.com/blog/category/ai-security/?ts=markdown), [Cybersecurity](https://www.paloaltonetworks.com/blog/category/cybersecurity/?ts=markdown), [Must-Read Articles](https://www.paloaltonetworks.com/blog/security-operations/category/must-read-articles/?ts=markdown), [Product Features](https://www.paloaltonetworks.com/blog/security-operations/category/product-features/?ts=markdown), [Use-Cases](https://www.paloaltonetworks.com/blog/security-operations/category/use-cases/?ts=markdown) [#### Cortex AES Extends Code Package Visibility to Go](https://www.paloaltonetworks.com/blog/security-operations/cortex-aes-extends-code-package-visibility-to-go/) ### Subscribe to Security Operations Blogs! Sign up to receive must-read articles, Playbooks of the Week, new feature announcements, and more. ![spinner](https://www.paloaltonetworks.com/blog/wp-content/themes/panwblog2023/dist/images/ajax-loader.gif) Sign up Please enter a valid email. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) and acknowledge our [Privacy Statement](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown). Please look for a confirmation email from us. If you don't receive it in the next 10 minutes, please check your spam folder. This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. {#footer} {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security?ts=markdown) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs?ts=markdown) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown) * [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/unit42/respond/managed-detection-response?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) * Observability * [Cortex XCOR](https://www.paloaltonetworks.com/cortex/xcor?ts=markdown) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira?ts=markdown) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management?ts=markdown) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management?ts=markdown) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager?ts=markdown) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance?ts=markdown) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management?ts=markdown) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic?ts=markdown) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management?ts=markdown) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance?ts=markdown) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery?ts=markdown) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access?ts=markdown) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/prepare-for-emerging-risks/continuous-frontier-ai-defense?ts=markdown) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses?ts=markdown) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy?ts=markdown) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence?ts=markdown) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond?ts=markdown) Company * [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown) * [Customers](https://www.paloaltonetworks.com/customers?ts=markdown) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown) * [Communities](https://www.paloaltonetworks.com/communities?ts=markdown) * [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications?ts=markdown) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown) * [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) * [Documents](https://www.paloaltonetworks.com/legal?ts=markdown) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language