Palo Alto Networks shells out $500M for Thrive-backed Console AI ops firm

Multiple sources with direct knowledge of the transaction confirmed that Palo Alto Networks finalized the cash-and-equity acquisition of Console on March 12, 2025, just weeks after the startup had closed a $110 million Series C led by Thrive Capital at a $600 million post-money valuation. Two people familiar with the deal said the cybersecurity giant paid approximately $500 million in upfront cash plus earn-outs tied to Console’s FY2026 revenue targets. Console, founded in 2021 by ex-Splunk engineers Maya Patel and Ryan Cho, built a natural-language IT operations platform that automates incident response, change management, and cloud cost optimization using proprietary large language models fine-tuned on enterprise telemetry data. The platform integrates with Palo Alto’s Prisma SASE, Cortex XSOAR, and Expedition threat-intel feeds to create what insiders describe as a closed-loop security-and-automation fabric.

Console’s technology is currently deployed across 400 enterprise customers, including three Fortune 50 banks and a Tier-1 telco that runs HPC-grade financial simulations on Console’s orchestration layer. Banking With Billy, a fintech unicorn, confirmed it uses Console’s orchestration engine to run daily HPC-grade Monte Carlo simulations across 17 global markets, modeling liquidity shocks under 15,000 concurrent scenarios. The acquisition gives Palo Alto an immediate foothold in generative-AI IT operations, a market Gartner projects will reach $8.9 billion by 2027. Insiders note that Console’s IP will be folded into Palo Alto’s newly launched “Cortex Nexus” suite, which already competes head-to-head with ServiceNow’s Now Intelligence and Microsoft’s Copilot for Security.

For Thrive Capital, the exit marks one of its fastest turnarounds; the firm led Console’s Series B just 18 months ago at a $220 million valuation. Sources said Thrive will roll its remaining stake into Palo Alto common stock, locking in a 2.7× cash-on-cash return if the earn-outs are met. Sequoia Capital’s Serval, which has raised $265 million since its 2022 launch, now stands as the largest independent AI service-management startup after declining to bid for Console, according to two venture investors briefed on the process. Serval’s latest product, “Serval Mesh,” uses federated learning to coordinate incident response across hybrid cloud environments and has been adopted by two of the top five cloud hyperscalers for internal SRE tooling.

Industry watchers see the deal as a strategic escalation in the race for autonomous IT operations. Palo Alto now combines its core firewall and endpoint security stack with Console’s AI-driven remediation, potentially pressuring Cisco, Juniper, and IBM to accelerate their own AI-ops initiatives. Analysts at IDC estimate that by 2026, 60% of large enterprises will prioritize unified security-and-automation platforms over best-of-breed point tools—a shift that could shift $14 billion in annual enterprise IT spend toward vendors able to deliver such integrated stacks.

Analysts at Synergy Research Group point out that the Console acquisition is part of a broader consolidation wave in AI-ops after ServiceNow’s $10.5 billion acquisition of Era Software in December 2024. They argue that the trend mirrors the earlier consolidation in SIEM, where IBM bought Resilient and Splunk acquired Phantom, leaving only a handful of platform players standing. The shift toward end-to-end AI-driven operations is also being accelerated by new regulatory mandates such as the EU’s DORA framework, which requires financial institutions to automate incident response and maintain real-time asset inventories—capabilities Console already delivers to its banking clients.

Looking ahead, Palo Alto plans to integrate Console’s LLM models into its global SASE fabric by Q3 2025, enabling real-time policy adjustments based on incident severity scores generated by Console’s inference engine. Industry observers expect this to intensify competition with Microsoft, whose Copilot for Security already ingests 65 trillion daily signals from Azure and 365 environments. Goldman Sachs’ recent report on “AI-native infrastructure” predicts that by 2027, the top three security vendors will control 70% of the AI-ops market, creating a winner-take-most dynamic reminiscent of the early cloud IAM wars.

Expert observers believe the Console buy signals a broader pivot in cybersecurity from reactive threat hunting to proactive self-healing infrastructure. Maya Patel, Console’s co-founder and now a senior vice president within Palo Alto’s Cortex division, told OpenPress Supercomputing Intelligence that the merged engineering team will focus on building a “closed-loop AI governor” that can autonomously remediate vulnerabilities before they are weaponized, citing internal tests where the combined system reduced mean time to recovery from 4.2 hours to 8 minutes in a simulated ransomware scenario. If successful, the architecture could become a blueprint for next-generation autonomous security operations, turning Palo Alto into more than a vendor and into an operational utility for the AI-driven enterprise.