Palo Alto's Unit 42 rolls out always-on AI defense

Palo Alto Networks is positioning its Unit 42 threat-intelligence arm as the delivery vehicle for frontier AI models that enterprises cannot easily use on their own. The new service follows an April launch of Frontier AI Defense, which offered a one-time exposure analysis, and an August plan to expand that analysis with OpenAI's GPT-5.6-Cyber and Anthropic's Claude Mythos 5. The continuous version adds a scanning engine that keeps running as environments change, plus a routing layer the company calls a multi-model harness.

The pitch rests on a specific asymmetry. Palo Alto says attackers are using AI to compress breach cycles by almost 97% in some cases, from weeks to hours, and that defenders cannot match that at human speed. Its answer is a service rather than a pure software product, with models selected per task and remediation guidance included. Anthropic's cybersecurity lead says Claude Mythos found more than ten thousand high-severity vulnerabilities, while OpenAI's head of global cyber partnerships frames the work as putting frontier models inside tools organizations already trust.

The evidence behind the launch is a six-month internal program, more than 100 customer engagements, and a $17 million R&D investment. During internal deployment, the company says it found a year's worth of exposures in three weeks. Whether that translates into sustained value for buyers is likely to hinge on how quickly always-on testing surfaces new, actionable exposures once the initial backlog is cleared, and on how subscription pricing scales as more models are added. Palo Alto's own customer base of 75,000+ is the natural first audience for that test.