Cortex XDR 6.0 and Cortex XDR One: endpoint security ready for the age of AI agents

On 19 October 2026, Palo Alto Networks unveiled Cortex XDR 6.0, headlined by Cortex XDR One: endpoint security that monitors not only processes and users, but also the AI agents now running on virtually every endpoint. At Nomios Netherlands, we're proud of this. Our Nomios Guardian xMDR service is built on Cortex, and as a Palo Alto Networks partner we deliver this innovation directly to our customers.

What is Cortex XDR One?

Cortex XDR One brings Cortex XDR and Agentic Endpoint Security (AES, born from the acquisition of Koi) together in a single console and a single sensor. This lets it protect both traditional system processes and AI agents.

That protection is badly needed. Coding agents, copilots, MCP servers and personal AI tools run with the user's permissions and behave non-deterministically. Through poisoned data or malicious plugins, they can be manipulated without an attacker ever touching the AI model. In the ClawHavoc attack, hundreds of rogue skills gave attackers direct command-line access to hosts. Many of these tools are also installed by employees without IT's knowledge: shadow AI. Traditional EDR simply wasn't designed for this.

Cortex XDR One addresses this with:

• A real-time inventory of every agent, MCP server, plugin and extension, including a dynamic risk score.
• Control at the source: policies that define which AI tools may be installed and used.
• Hard boundaries: runtime guardrails stop prompt injections and destructive commands, while the OS layer blocks zero-days and living-off-the-land attacks.
• One attack chain: telemetry from every layer is stitched together, which according to Palo Alto Networks cuts false positives by up to 95%.

Highlights of Cortex XDR 6.0

Beyond Cortex XDR One, 6.0 also delivers:

1. Native App Control – an inventory of every executed binary, with allow and block policies at publisher, application or file level.
2. Runtime Protection and AI Detection & Response (AIDR) – every agent action captured in a session-centric audit trail, with interception before execution and policy templates mapped to MITRE ATLAS.
3. Cortex Targeted Sensor – deploy only the modules you need, such as AES or ITDR, alongside your existing EDR, with a one-step path to the full sensor.
4. AI-Powered Protection – AI-driven behavioural analysis plus small language models on the sensor that analyse scripts before they run, even offline.
5. Extended On-Write Protection – real-time hash reputation checks for all WildFire-supported file types on Windows, macOS and Linux.
6. AI-Powered YARA Rule Management – AgentiX AI generates and validates YARA rules and sweeps them across the entire fleet in one go.

Read the full announcement in the Palo Alto Networks blog.

Available through Nomios Guardian xMDR

Cortex is the standard for our SOC, which means Cortex XDR One is also available through Nomios Guardian xMDR. You don't need to design and staff a new security layer yourself: our SOC team monitors your endpoints and the AI agents running on them, 24/7. You get visibility into shadow AI, guardrails that match your policies, and a single point of contact for detection, triage and response. And thanks to the Targeted Sensor, you can start alongside your current EDR and consolidate at your own pace.

A partner at the top

Choosing Cortex was no coincidence. In the May 2026 Magic Quadrant for Endpoint Protection, Gartner positions Palo Alto Networks as a Leader for the fourth consecutive year, citing effective prevention and EDR, flexible customisation and a strong AI security roadmap as strengths. Gartner also expects that by 2028, 90% of endpoint vendors will offer AI discovery and usage control, and advises buyers to factor those requirements in today. With Cortex XDR One, Palo Alto Networks is ahead of that curve.

We see the same shift in the Dutch market: demand for our joint proposition, Cortex as the platform and Nomios Guardian as the service, has grown enormously over the past year. Organisations want to move away from scattered point solutions and choose one platform with a SOC partner that makes it work in practice.

Join the Nomios Guardian SOC tour & lunch

Want to see how our SOC team works on Cortex and what Cortex XDR One does in practice? During the Nomios Guardian SOC tour & lunch, you'll get a tour of our SOC and catch up with our experts over lunch. New dates have been added in November and January. Places are limited, so register soon.

Register for the Nomios Guardian SOC tour & lunch

Gartner, Magic Quadrant for Endpoint Protection, 26 May 2026. Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner's research organization and should not be construed as statements of fact. GARTNER and MAGIC QUADRANT are trademarks of Gartner, Inc. and/or its affiliates.