Why Palo Alto Is Eyeing a $400M Buy of Endpoint Vendor Koi

Deal Represents Return to Tuck-In M&A for Palo After 3 Multi-Billion Dollar Deals Michael Novinson (MichaelNovinson) • January 6, 2026

After reeling in some big fish, Palo Alto Networks appears ready to return to its bread and butter.

See Also: Going Beyond the Copilot Pilot - A CISO's Perspective

The Silicon Valley-based platform security giant has been an active buyer since Nikesh Arora became CEO in 2018, but Palo Alto Networks traditionally opted for startups with promising technology over longtime incumbents with a large customer base and go-to-market team. That all changed in August 2024, when Palo Alto Networks bought the legacy IBM QRadar SaaS business for $1.14 billion.

Then in July 2025, Palo Alto Networks announced the biggest deal in its 21-year history, bursting into identity security with its $25 billion proposed buy of PAM provider CyberArk. Then in November, the company agreed to buy next-gen observability platform Chronosphere ...