Zero-trust security startup Zero Networks Ltd. today expanded its integration with Palo Alto Networks Inc., adding automated threat containment and a set of controls aimed at artificial intelligence agents.

The two companies first integrated their products in February 2025. Zero Networks discovers and tags assets without agents. Palo Alto Networks firewalls take that context in as Dynamic Address Groups, and the policy follows a device when it moves.

The expansion pushes the pairing from policy orchestration into enforcement. Customers can now contain a compromised asset on its own instead of pulling an entire segment offline. Selected traffic from protected workloads can also be routed to Palo Alto Networks firewalls for Layer 7 threat prevention, which puts deep inspection on internal east-west traffic that would usually stay inside the segment it started in. Anything flagged as malicious gets blocked and the affected asset is cut off.

Redirection runs on Linux systems today. Windows support is planned, which would extend the same inspection and containment to the Windows systems that make up much of the enterprise attack surface.

Assets and policies managed by Zero Networks now surface inside Strata Cloud Manager, the Palo Alto Networks management console. Security teams see what has been discovered, which segmentation policies apply and which firewall controls are inspecting the traffic, all in one place. Dynamic tagging keeps that view accurate as workloads shift and IP addresses change, in place of hand-maintained static rules.

The second half of the announcement ties Zero Networks AI Segmentation, launched in April, to Prisma AIRS, the Palo Alto Networks product for securing AI traffic. AI agents connect straight into applications, models, databases and production systems, normally carrying valid credentials and broad permissions.

Zero Networks said that makes manipulated or compromised activity hard to tell apart from ordinary automation. Its software identifies the agents and fixes deterministic, identity-based boundaries around where each one is allowed to connect. Unsanctioned AI services can be blocked outright. Where a closer look is warranted, the traffic goes to Prisma AIRS for inspection of the prompts, responses and data moving through the interaction.

Co-founder and Chief Executive Benny Lakunishok said customers “should not have to stitch together separate controls” for their firewalls, internal assets and AI agents. The expanded integration gives them a single enforcement model, he said, with Zero Networks deciding which connections are permitted and Palo Alto Networks running the deep inspection.

Neither company is asking customers to redesign the network for any of this. The joint solution runs on enforcement capabilities both platforms already ship, across on-premises, cloud, operational technology, Kubernetes and hybrid environments.

Automated microsegmentation, dynamic asset tagging, policy synchronization and Linux traffic redirection are available now. The Prisma AIRS integration and Windows traffic redirection has not been given a release date.

Zero Networks was founded in 2019 and has raised more than $100 million in funding. Highland Europe Ltd. led its $55 million Series C in June 2025.

Image: Zero Networks