Just a few years ago, AI security was mostly about guidelines: which tools employees were allowed to use and what data they weren’t allowed to paste into a chat. Today, more and more organizations are deploying AI in production, with agents reading code, calling tools, and interacting with business systems. Security has followed suit, and it’s now reflected in budgets.
One clear sign is the growth of Palo Alto Networks’ AI security platform, Prisma AIRS. According to financial media reports, it has surpassed $100 million in annual recurring revenue in a short period of time. At the same time, Palo Alto is expanding protection to developers’ computers, where AI agents now work with code, terminals, and external services. Here, we examine what this says about the market and what it means for organizations that want to use AI securely.
What the Number Tells Us
According to Zacks Investment Research, as reported on Yahoo Finance, Prisma AIRS surpassed $100 million in annual recurring revenue (ARR) during the fourth quarter of Palo Alto’s 2026 fiscal year. This occurred within four quarters of the product becoming generally available, which, according to the same source, makes it the fastest-growing product in the company’s history. The platform has over 800 customers, and most of the quarter’s largest deals included multiple Prisma AIRS modules. One example highlighted is a $53 million deal with a global payment platform, in which the customer committed a high seven-figure amount to Prisma AIRS as part of its expansion of its AI initiatives.
This figure should be viewed in context. Prisma AIRS still accounts for only a small portion of Palo Alto’s overall business. But what’s interesting isn’t the size—it’s the pace and what it signals: AI security has moved from experiments and pilot budgets to a line item that companies are actually purchasing, renewing, and expanding.
Note: The ARR figure comes from a financial analysis and not directly from Palo Alto’s own press materials.
From the platform to the developer’s computer
Prisma AIRS is designed to protect AI at multiple levels. The platform currently includes, among other things, protection of machine identities and login credentials, monitoring of AI agents, and real-time security checks via an AI gateway.
In September, Palo Alto unveiled its next step: a combination of Prisma AIRS and Cortex Agentic Endpoint Security (AES), targeting AI coding tools such as Cursor, Claude Code, Codex, and Antigravity. The reason is that these tools are gaining increasing access to developers’ terminals, source code, and external APIs. This creates a new attack surface that traditional network and endpoint protections are not designed to monitor. The division of labor between the two components is as follows:
Cortex AES runs on the computer. It detects AI agents, add-ons, and other AI components, assesses the risk, sets policies, and enforces protection locally.
Prisma AIRS analyzes the content. It inspects prompts, MCP tool calls, and network calls in real time, looking for prompt injection, malicious code, and leaks of sensitive data. Each call receives a decision to allow or block it before anything happens.
The policy is defined once and then applies to all agents, regardless of whether they run on a computer, in the cloud, or in SaaS services. When something is blocked, the developer receives an explanation directly in the tool and instructions on how to request an exception. Everything is logged in the agent’s session history, so the security team can see what happened, on which computer, and according to which rule.
Why AI-Driven Traffic Needs Control, Detection, and Protection
Regardless of the vendor, the trend points to the same thing: AI traffic needs to be treated as a separate category in security efforts. A prompt may contain trade secrets. A response from a model may contain instructions that cause an agent to do something it shouldn’t. An MCP call can give an agent access to systems that no one anticipated. Traditional firewalls and endpoint protection see the traffic but do not understand what it means. In practice, this comes down to three capabilities:
1. Governance. Determine which AI tools, models, and agents may be used, by whom, and on which systems. Without this, shadow AI will grow rapidly, especially among developers who choose their own tools.
2. Detection. Maintain an overview of which agents are actually running and what they’re doing. Many organizations have significantly more AI components in operation than they realize.
3. Protection. Review the content of prompts, responses, and tool calls in real time, and stop data leaks and manipulation before any damage occurs.
This doesn’t just apply to cloud services. As more organizations adopt open models in their own environments, the amount of infrastructure, data, and traffic that needs to be protected grows, and the responsibility then lies entirely with the organization itself.
Secure AI Operations On-Premises
For many Swedish organizations, having their own AI infrastructure is a conscious choice. This may be due to requirements regarding where data can be stored, security considerations, or the fact that costs are lower when GPUs are used extensively. But operating the infrastructure in-house also means that security becomes an integral part of the platform—not something the cloud provider handles. This requires that infrastructure and security be planned together from the very beginning:
- Segment the AI environment. GPU clusters, storage, and model services should be placed in separate segments with clear rules governing which traffic is allowed to pass through.
- Monitor traffic to and from the models. Who is calling the model, which systems are the agents allowed to access, and what data leaves the environment?
- Protect developers’ workflows. This is often where AI agents first gain access to code, keys, and internal systems.
- Collect logs and events. The security team needs to be able to monitor AI traffic in the same way as other traffic on the network.
This is where network security and AI infrastructure converge. A well-scaled GPU platform without a well-thought-out security strategy becomes a risk, and advanced AI security without control over the infrastructure becomes difficult to maintain.
AI Infrastructure and Security from the Same Partner
Aixia is Scandinavia’s only NVIDIA DGX SuperPOD-certified partner and has a long-standing partnership with Palo Alto Networks in the areas of networking and security. This enables us to build AI environments where the GPU platform, network, and security are designed as a unified whole, whether they’re deployed in your own data center, at a colocation provider, or in a hybrid setup.
Schedule a security review of your AI environment. We’ll examine your current AI traffic patterns, identify potential risks, and outline what’s needed to run AI securely—both on-premises and in the cloud.
