Palo Alto Networks extends Unit 42 service to continuous AI-powered exposure testing

Palo Alto Networks announced on September 22 the expansion of its Unit 42 Frontier AI Defense offering into a continuous, always-on service. The new capability, called Unit 42 Continuous Frontier AI Defense, combines frontier AI models with ongoing threat intelligence and offensive security expertise to discover, validate, and guide remediation of enterprise exposures.

What the service adds

The update turns the earlier point-in-time analysis into a persistent testing engine. It monitors environments as they change, using a multi-model harness that routes tasks across Anthropic’s Claude Mythos 5, OpenAI’s GPT-5.6-Cyber, and selected open-weight models. Key functions include continuous baseline scans, adversary simulation for attack path validation, and prioritized remediation steps that include code guidance and virtual patches.

Company testing over six months plus more than 100 customer engagements reportedly identified significant exposures, including many without assigned CVEs. The service targets the compressed timelines attackers now achieve with AI assistance, shifting defense from periodic assessments to ongoing coverage.

Practical implications for security teams

Enterprises gain an external, model-driven layer that flags exposures before they become active attack paths. Integration requires mapping the service’s prioritized outputs into existing vulnerability management and patch processes. Organizations already using Unit 42 or Palo Alto platforms may see faster handoff from detection to fix, while others will need to evaluate how the subscription fits alongside internal red teaming and scanner fleets.

The approach trades some control for speed: teams receive validated findings and suggested fixes rather than raw scan data. Success depends on timely action on the prioritized list and maintaining accurate asset inventories so the continuous engine sees the full environment.

What to watch

• Model routing behavior and false-positive rates once deployed at scale
• Integration depth with existing SOAR or ticketing systems
• Comparative results against purely internal continuous testing programs

Security leaders evaluating the service should request pilot metrics tied to their own infrastructure and measure time from exposure identification to validated remediation.

Sources

• investors.paloaltonetworks.com

Cover photo by Jakub Zerdzicki on Pexels, used under the Pexels License.