Palo Alto eyes $400m acquisition of Israeli startup Koi

Palo Alto Networks is in talks to acquire Israeli cybersecurity startup Koi for about US$400 million, Calcalist reported.

If completed, the deal would expand Palo Alto Networks’ offerings in endpoint security as demand rises for AI-driven protection.

Koi, founded in 2024 by former members of Israel’s IDF 8200 Intelligence Corps, develops enterprise endpoint protection tools and has raised US$48 million from investors including Team8, NFX, Battery Ventures, and Picture Capital.

The company reportedly built its platform after demonstrating a security gap in the VSCode Marketplace, later creating a product called Supply Chain Gateway that manages software inventory and analyzes risks.

Neither company commented on the potential deal.

Koi says its platform is used by large enterprises and protects more than 500,000 endpoints worldwide.

🔗 Source: Calcalist

🧠 Food for thought

Implications, context, and why it matters.

Koi’s valuation signals market risks and endpoint detection and response (EDR) blind spots in reported $400M talks

A $400 million valuation for a one-year-old startup seems steep though Koi says it protects 500,000 endpoints (laptops, servers, and other devices) 1. It hit $1 million in annual recurring revenue (ARR) in three months 2.
Koi’s white-hat test built a malicious extension in 30 minutes and seeded it in the Microsoft Visual Studio Code Marketplace 2. It reached employees at Oracle and Pizza Hut 2.
Most EDR tools watch binaries and OS flaws but miss non-binary software like extensions or AI models 3. Supply Chain Gateway adds visibility and policy enforcement 3.
Timing matches Palo Alto Networks CEO Nikesh Arora seeking to merge endpoint tools as AI reshapes security 1. Palo Alto sees value in Wings, a real-time risk engine that scores supply-chain components and enforces policy 1.

ISVs and MSSPs can build connectors to bring third-party data into Cortex XSIAM (Extended Security Intelligence and Automation Management)

With Cribl, Cortex XSIAM needs API tokens and pipelines for sources 4. Routing Okta, Check Point VPN, and Fortinet data takes custom field tagging 4.
MSSPs plus system integrators can ship connectors and migration services for firms moving from legacy Security Information and Event Management platforms to XSIAM 4.