PANW to Buy Koi: Is Agentic Endpoint Security the Next Growth Engine?

Palo Alto Networks PANW recently announced its intent to acquire Koi, a company focused on Agentic Endpoint Security. Nowadays, new security risks are created by AI agents, tools, plugins and scripts that operate directly on endpoints. These AI-driven tools often have broad access to data and systems but sit outside the visibility of traditional endpoint security products, creating a new security gap. Through its acquisition of Koi, PANW aims to target this very security risk created by AI agents, tools, plugins and scripts that operate directly on endpoints.

As enterprises move from testing AI to using it in daily operations, the endpoint attack surface is changing. Existing endpoint tools were built to detect files and malware, not AI agents, plugins, scripts, or other non-traditional activity. As a result, AI-driven activity has created a visibility and control gap that attackers can exploit. Koi focuses on securing this type of AI-driven behavior, which Palo Alto Networks views as the next inflection point in endpoint security.

Once the acquisition is complete, Koi’s technology is expected to extend Prisma AIRS, Palo Alto Networks’ AI security platform, to the endpoint layer. It will also enhance Cortex XDR by improving visibility into AI-driven activity on devices. This supports PANW’s broader platform strategy, which aims to secure cloud, network, identity and endpoint through a single, integrated platform.

Agentic Endpoint Security could become a new opportunity over time since PANW already has a large installed customer base that could support future upsell opportunities. Overall, the deal strengthens PANW’s AI security offering and addresses a growing endpoint risk, where the Koi acquisition could support long-term growth as AI use across enterprises continues to expand. The Zacks Consensus Estimate for fiscal 2026 and 2027 indicates revenue growth of around 14.2% and 13.3%, respectively.

How Do Competitors Fare Against PANW?

CrowdStrike CRWD and Zscaler ZS are key players competing with Palo Alto Networks, which are also focusing on acquisitions for platform expansion and AI innovation.

In January 2026, CrowdStrike signed a definitive agreement to acquire Seraphic Security to expand its protection to secure web browsers. For CrowdStrike, the acquisition is set to help extend the Falcon platform from endpoint protection into browser security. The deal is expected to close in the first quarter of fiscal 2027.

In early February, Zscaler completed its acquisition of SqareX. Through this acquisition, Zscaler aims to improve browser-based security as companies deal with more AI-driven risks. The goal is to secure users working on any browser and any device without needing special enterprise browsers.

PANW’s Price Performance, Valuation & Estimates

Shares of Palo Alto Networks have lost 17.4% in the past six months compared with the Zacks Security industry’s decline of 10%.

PANW 6-month Price Return Performance

From a valuation standpoint, Palo Alto Networks trades at a forward price-to-sales ratio of 10.08X compared with the industry’s average of 10.42X.

PANW Forward 12-Month P/S Ratio

The Zacks Consensus Estimate for Palo Alto Networks’ fiscal 2026 and 2027 earnings implies year-over-year growth of 14.9% and 12.5%, respectively. Estimates for fiscal 2026 and 2027 have both remained unchanged over the past 60 days.

Palo Alto Networks currently carries a Zacks Rank #4 (Sell).

You can see the complete list of today’s Zacks #1 Rank (Strong Buy) stocks here.

Want the latest recommendations from Zacks Investment Research? Today, you can download 7 Best Stocks for the Next 30 Days. Click to get this free report

This article originally published on Zacks Investment Research (zacks.com).

Zacks Investment Research