Palo Alto Networks says its XCOR agent answers production alerts in under three minutes

An engineer paged at three in the morning used to spend the first ten or twenty minutes clicking through dashboards. Palo Alto Networks is now selling a product that fills those minutes with an agent's work before the engineer even logs in.

The company launched Cortex XCOR on 1 October, an AI-driven observability platform whose site reliability agent is triggered automatically when an alert fires. Senior vice president Martin Mao, writing on the company blog that day, said the agent reaches a root cause and recommends remediations in under three minutes on average, with a 75 percent success rate on complex production environments and a further 19 percent of incidents where its analysis was deemed useful. Mao put the equivalent manual response at around twenty minutes to locate the right issue, gather context and find the right on-call engineer.

What the agent does on an alert

The site reliability agent runs inside a wider product. It sits beside XCOR Operator, a conversational interface in front of specialised agents, and XCOR Fabric, the context layer the agents read from. Fabric pulls from a knowledge graph of infrastructure, applications and business logic, from past incident investigations, from how senior engineers use the system, and from runbooks and operational files.

Mao said the current recommendation is to keep the engineer paged in parallel with the agent, so that by the time the engineer logs in the first investigation is already on the screen. He said customers can expand the agent's autonomous permissions over time if they want to.

Who built it

The team came from Chronosphere, the observability company Palo Alto Networks acquired in January 2026 to build real-time agentic remediation. Mao was Chronosphere's co-founder. In the launch post he said he had spent more than a decade on the problem, from internal monitoring for EC2 at Amazon Web Services through the observability platform at Uber. His framing of what changed is that generative AI reasoning became strong enough late last year to work as an autonomous expert rather than a chat summariser.

Palo Alto Networks also announced in July that it had moved to acquire Embrace, a real user monitoring company whose data now feeds into XCOR as XCOR RUM, alongside the backend observability. The platform uses consumption-based pricing, with the company's existing claim that Chronosphere optimises telemetry data volume by an average of 89 percent for its customers.

The limits in the launch itself

Every number here is the vendor's own, measured on its own customers. Palo Alto Networks has not published the sample size behind the 75 and 19 percent figures, the kinds of incidents they cover, or how the agent's response time was measured. Mao said token price declines and better reasoning should bring the time down from three minutes, but he did not give a target.

Mao, quoted in The New Stack's 5 October coverage, said the agent solved problems that went past his own expectations and that it changed how his team designs products. That is a product-launch quote from the person launching the product. A buyer should read every figure above as the company's and ask for the method before trusting any of them in a procurement conversation.

Source

Primary: Palo Alto Networks, 1 October 2026. Reporting: The New Stack, 5 October 2026 by Adrian Bridgwater.