Palo Alto Networks paid $500M for Thrive-backed Console, sources say

This is less a direct P&L event for the acquirer and more a signal that cybersecurity is moving from point products toward workflow ownership. The strategic value is in controlling the first and last mile of enterprise incidents: if security tooling can also resolve internal IT requests, the vendor becomes stickier, reduces churn, and gains a better shot at becoming the default operating layer for AI-driven operations. That can support a modest multiple premium for PANW if management can show Cortex attach rates and higher platform consolidation, but the near-term financial lift is likely immaterial.

The first-order loser is the incumbent IT service-management stack, because low-complexity tickets are the easiest wedge for agentic automation. Even if a full replacement cycle is years away, the more important second-order effect is budget reallocation: CIOs may shift spend from seat-based help desk tooling toward outcome-based automation, which pressures pricing power at the margin. For NOW, the risk is not immediate displacement but slower incremental growth in the most commoditizable workflows, especially if customers decide to buy security-ops and help-desk automation from a single platform vendor.

Contrarian take: the market may be overestimating how fast these agents translate into durable enterprise spend. Without deep permissions, integrations, and human trust, “autonomous” workflows often stay in pilot purgatory, which means the revenue impact could lag the narrative by 2-4 quarters. The cleanest falsifier is any evidence that NOW’s ITSM/employee-workflow growth remains intact while PANW fails to show measurable Cortex monetization or margin discipline after repeated tuck-in M&A.