{"resourceId":"checkableai-cortex-xsiam-xdr-agentix-controls-46-findings-20261103","versions":[{"version":"external-2ef90d5ea6e6a5e77d79e092f16c8893646ae62bbbb292d19db561a523617f6c","resource":{"id":"checkableai-cortex-xsiam-xdr-agentix-controls-46-findings-20261103","title":"Checkable AI docs review of Cortex XSIAM/XDR/AgentiX: 46 control findings last checked Nov. 3, with many identity, gateway and governance controls not addressed","organization":"Checkable AI","sector":"Independent AI security research / documentation review","geography":"Global (product docs; FedRAMP/IRAP notes for US/AU)","publishedAt":"2026-11-03","publicationDate":"2026-11-03","eventDate":"2026-11-03","sourceName":"Checkable AI","sourceLabel":"Independent documentation review","sourceUrl":"https://checkableai.com/stack-check/platforms/palo-alto-cortex-xsiam/","evidenceClass":"independent-research","outcomeClass":"cautionary","topics":["developers-agents","governance-procurement","operating-model","data-security"],"finding":"Checkable AI’s stack-check for Cortex XSIAM, Cortex XDR (including Agentic Endpoint Security) and AgentiX, last checked 3 Nov 2026, reports 46 findings on controls in scope. Supported examples include human approval for sensitive actions, agent remote scopes bound to user RBAC, HITL plan visibility, some runtime/third-party tool assurance via AES, AI discovery, asset inventory, posture reporting, and FedRAMP High/Moderate (plus IRAP notes). Large gaps called “not addressed” include per-agent issued identity, credential brokerage, OBO delegation to downstream MCP, local agent scopes in admin docs, kill switch/containment for in-flight agents, model/tool/data gateways, and most governance lifecycle workflows. Interpretation: documentation review—not a live red team—useful to temper vendor agentic SOC claims.","sledRelevance":"SLED evaluators considering Cortex agentic SOC features should use this checklist in architecture review: require human approval for containment, clarify that FedRAMP authorization does not equal full agent-identity controls, and demand local proof for AES guardrails that Checkable says appear mainly in blogs. Complements the archived Prisma AIRS Checkable review with SOC-platform coverage.","evidence":"Opened Checkable AI page stating 46 findings, last checked 3 November 2026. Findings cite Cortex docs URLs and vendor blogs. Explicitly not a test of a live deployment. Supported/not-addressed tallies by control area provided in tables.","architectureImplications":"Do not assume Cortex agents have first-class workload identities or gateway mediation; design external PAM/secret brokerage and approval gates accordingly. Treat AES admin-doc gaps as implementation risk.","governanceImplications":"Map Checkable gaps to agency AI governance policies (ownership, registration, exceptions). FedRAMP High helps procurement but does not close agent lifecycle controls Checkable marks missing.","securityPrivacyImplications":"Missing kill-switch and credential-brokerage documentation increases risk if SOC agents are given broad automation; keep sensitive actions approval-bound.","caveats":"Docs-only methodology. Some “supported” items escalated for human settle (inference). AES details sometimes from blogs not admin docs. Page may change after Nov. 3 check date.","streamIds":["palo-alto-networks"],"roles":{"sales":"Sales framing: bring this independent checklist to sober AgentiX/AES deals. Celebrate documented strengths—human approval, FedRAMP, AI inventory—while openly listing gaps Checkable marks not addressed so the customer does not discover them mid-PoC. Position professional services for approval workflows and NHI controls outside Cortex where needed.","engineering":"Engineering framing: use the 46 findings as a gap matrix against the target architecture. Verify sensitive-action defaults, RBAC on MCP integrations, and AES license boundaries in the tenant. Proof of value is reproducing two “supported” controls and documenting two “not addressed” controls with compensating controls.","delivery":"Delivery framing: include Checkable gaps in the design review agenda; assign owners for compensating controls (PAM, gateway, kill criteria). Acceptance should require human-approval demos for containment, not marketing slides."},"roleDetails":{"sales":{"customerProblem":"Buyers hear agentic SOC promises but lack an independent control checklist.","stakeholders":["CISO","SOC architect","Risk/compliance","FedRAMP program office"],"discoveryQuestions":["Which Checkable control areas are must-have for go-live?","Is AES licensed or only XSIAM base?","Who owns compensating controls for gaps?"],"valueHypothesis":"Interpretation: transparent gap handling increases trust and focuses the PoC on demonstrable controls.","potentialEngagement":"Control-gap workshop mapped to Checkable findings plus a bounded AgentiX PoC.","unsupportedClaims":["That docs-supported equals operationally proven","Full coverage of agent identity controls","IRAP dating/version completeness"]},"engineering":{"fit":"Agencies deploying Cortex agents who need an evidence-based control matrix.","architectureIntegration":"Cortex AgentiX + optional AES + external PAM/gateway for gaps.","prerequisites":["Access to Cortex docs and tenant","AES entitlement clarity","Security architecture owner"],"constraints":["Docs lag product","Some findings blog-sourced","Not a penetration test"],"security":"Default sensitive actions to approval; deny broad MCP write tools in production until reviewed.","proofOfValue":["Demonstrate sensitive-action approval","Show agent action audit record","Document compensating control for no agent workload identity"]},"delivery":{"work":"Produce a gap workbook, configure approvals, and run a supervised agent investigation pilot.","dependencies":["SOC process owners","IAM for compensating NHI controls"],"ownership":"SOC engineering owns Cortex config; security architecture owns gap decisions.","skillsAdoption":"Analysts trained to read agent plans and approve/deny actions.","governanceCheckpoints":["Gap workbook signed","Production MCP tool set approved","FedRAMP boundary impact reviewed"],"acceptanceCriteria":["Proposed: human approval proven on one containment action","Proposed: written compensating controls for top 5 gaps","Proposed: AES license decision recorded"],"risks":["PoC scope creep across 46 findings","Docs changing after check date","Over-trusting FedRAMP as agent-governance proof"]}},"retrievedAt":"2026-11-07T04:17:02Z","enrichedAt":"2026-11-07T04:17:02Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Clearer control expectations reduce wasted analyst time chasing agent features that are not documented.","procurementImplications":"Attach control checklists to RFPs; treat FedRAMP as necessary but not sufficient for agentic SOC acceptance criteria.","operatingModelImplications":"Encourages a shared responsibility model: Cortex for SOC agents and approvals; agency IAM/governance for identity lifecycle gaps.","peerReview":"unknown","sourceVerification":{"openedUrl":"https://checkableai.com/stack-check/platforms/palo-alto-cortex-xsiam/","referenceExcerpt":"46 findings on controls in scope for this product. Last checked 3 November 2026.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}