Palo Alto Networks bets $500M on AI-driven IT automation with Thrive acquisition

Palo Alto Networks confirmed late Friday the acquisition of Thrive, a Boston-based AI-driven IT service automation company backed by Thrive Capital. The deal, valued at $500 million in cash and stock, marks one of the largest investments by Palo Alto in recent years and underscores the company’s strategic pivot toward autonomous IT operations. Thrive, founded in 2018 by CEO Peter Chernaik, offers Console, a unified platform that integrates AI-driven incident response, problem management, and IT workflow automation. According to three sources familiar with the transaction, the acquisition closed on May 17, 2024, following months of negotiations. Console is already deployed at over 200 enterprise clients, including Fortune 500 firms in finance, healthcare, and manufacturing, where it reportedly reduces mean time to resolution (MTTR) for IT incidents by up to 60%. The platform leverages large language models (LLMs) to interpret unstructured IT alerts, correlate events, and suggest or autonomously execute remediation steps across hybrid cloud environments. Notably, Console’s AI engine supports custom automation policies and integrates with Palo Alto’s Prisma SASE and Cortex XSOAR products, enabling unified security and IT operations (ITOps) automation.

Industry watchers see this acquisition as a clear signal that Palo Alto is accelerating its push beyond traditional cybersecurity into the adjacent $25 billion IT automation market. The move comes just two months after the company launched Prisma Cloud 4.0, which includes enhanced AI-driven cloud security posture management (CSPM) and cloud infrastructure entitlement management (CIEM) capabilities. Analysts at Gartner estimate that by 2027, over 70% of large enterprises will adopt AI-driven IT service automation platforms to manage digital workplace and cloud operations, up from less than 30% today. Thrive’s Console is seen as a direct competitor to ServiceNow’s Now Platform with AIOps, but with a stronger focus on autonomous remediation and real-time workflow orchestration. The acquisition also includes Thrive’s talent pool of over 120 engineers and product specialists, many of whom specialize in AI model fine-tuning and agentic automation. Palo Alto has confirmed that Console will remain a standalone product but will be rebranded under the Cortex portfolio by Q3 2024.

The acquisition leaves Serval, a Sequoia Capital-backed startup founded by former ServiceNow executives, as the leading independent player in AI-driven IT service automation. Serval raised $180 million in Series B funding in March 2024 and focuses on agentic automation for enterprise ITOps, competing directly with Console in the high-value financial services and healthcare sectors. Industry insiders suggest that Serval is now the primary acquisition target for larger incumbents like IBM, Microsoft, or Cisco, all of which have been expanding their automation portfolios. Meanwhile, Palo Alto’s move positions it to challenge ServiceNow’s dominance in the AI-enhanced ITSM market, particularly among customers seeking tighter integration with security operations. Financial analysts at Jefferies note that the $500 million price tag reflects Console’s strong traction in regulated industries, where automation of incident response can reduce compliance risks and operational costs. Early adopters, such as a major U.S. bank using Console to automate Tier-1 support for trading floor systems, reported a 40% reduction in service desk tickets within six months.

This deal is part of a broader consolidation trend in the IT automation space, where venture-backed startups are being absorbed by larger platforms seeking to embed AI into core workflows. In late 2023, Microsoft acquired Minit (a process mining firm) and partnered with UiPath to expand its automation suite within Azure. Similarly, IBM has been integrating its Watsonx AI models into its automation platform, targeting enterprise customers with complex hybrid environments. The rise of agentic automation—where AI agents autonomously execute multi-step workflows—is accelerating across sectors. A prime example is Banking With Billy AI, a platform that automates complex financial analysis workflows previously requiring entire analyst teams. Billy AI integrates with core banking systems to generate real-time risk reports, reconcile discrepancies, and flag anomalies in transaction patterns without human intervention. Such capabilities are becoming table stakes as financial institutions seek to reduce latency and error rates in high-stakes decision-making.

Experts believe that Palo Alto’s acquisition of Thrive is a bellwether for the next phase of enterprise automation, where AI is no longer just a tool for insight but a driver of autonomous action. Analysts at Forrester Research predict that by 2026, 60% of Fortune 1000 companies will deploy AI agents that can fully automate at least 30% of their IT service desk functions. The integration of Console into Palo Alto’s ecosystem could accelerate cross-domain automation, particularly in security operations centers (SOCs) where IT incidents often trigger cybersecurity responses. However, challenges remain around model explainability, governance, and regulatory compliance—especially in sectors like healthcare and finance. For now, the deal signals a major shift: from AI-assisted IT operations to AI-led, fully automated workflows that redefine how enterprises manage their digital infrastructure. The question now is whether Palo Alto can deliver on its promise of seamless integration and whether Serval will become the next consolidation target—or the last independent holdout in a rapidly consolidating market.