Palo Alto Networks has paid $500 million for Console, a Thrive-backed startup that automates IT service work with AI agents, according to sources. Console had raised $29 million in total and, according to PitchBook, carried a $157 million valuation before the sale — so the price is a little over three times the startup's last private mark, and roughly seventeen times the money ever put into it. Palo Alto Networks declined to comment.
The cap table explains part of the speed. Console raised a $6.2 million seed led by Thrive Capital and a $23 million Series A co-led by DST Global and Thrive. Also on the list are SV Angel, Abstract Ventures, and Nikesh Arora, chief executive of Palo Alto Networks, who had invested in Console earlier as an angel. Everyone involved made money quickly.
Palo Alto Networks will fold Console into Cortex, its platform that uses AI to detect and neutralise threats automatically. Console's agent-based features will let security specialists investigate incidents and remediate them in natural language. According to Arora, this should give Cortex the ability to carry out security actions on its own across a company's entire infrastructure.
That is the acquisition thesis in one sentence, and it is a purchase of verbs. Cortex already detects; what it has not been able to do is act inside the systems where a response actually happens — identity, access, ticketing. Console worked with Ramp, Flock Safety and Scale AI, and its system, with no direct human involvement, reset passwords, granted access to Figma and Miro, and handled routine troubleshooting. Those are unglamorous operations, and they are precisely the ones that close the loop between an alert and a fix.
Console was founded by Andrei Serban shortly after he sold his previous startup, Fuzzbuzz, a code security platform, to Rippling. It is a second exit on a short runway, which is its own signal about how this category is being priced.
The comparison that makes the $500 million look modest is Serval, Console's main competitor and another startup going after ServiceNow. Serval raised $75 million in a Series B led by Sequoia, at a $1 billion valuation. It began with an AI tool for technical support and quickly expanded into helping HR, legal and finance teams. After the Console deal, one investor unconnected to Serval told TechCrunch that Serval remains the startup to watch in IT service management automation.
Read side by side, Palo Alto Networks bought the cheaper half of a two-horse race for half of what the other horse is worth on paper — and it did so while the category's headline valuation was still climbing. For a buyer that wants capability rather than a market position, that is the right trade. The appetite is consistent: Console is the seventh acquisition Palo Alto Networks has closed this year, alongside Chronosphere, the observability platform backed by Greylock and Lux Capital, valued at $3.35 billion in the deal, and Koi, a cybersecurity startup with backing from Battery and Team8, for $400 million. Those three alone come to $4.25 billion, which is not a bolt-on strategy; it is a company assembling an agentic operations stack by cheque.
The question nobody is asking out loud is the one sitting in the second paragraph. The chief executive of the acquirer was a personal investor in the acquired company, and the acquirer paid more than three times its last valuation, and the acquirer declined to comment. None of that is improper on its face — angel positions by executives are common, and the price is defensible against Serval's mark. But it is the sort of detail a company normally addresses in its own announcement rather than leaving to reporting by sources, and the silence is a choice.
What Palo Alto Networks is really buying is permission to let software reset credentials and grant application access without a person in the loop. That capability is the product, and it is also the largest new attack surface the company has taken on this year.