{"resourceId":"pan-cortex-unified-identity-security-dashboard-cloud-itdr-20261105","versions":[{"version":"external-5546eb8dbd83ad03de6e16544b9799075ff971b6d8b9f311e73b61ea4a5356a3","resource":{"id":"pan-cortex-unified-identity-security-dashboard-cloud-itdr-20261105","title":"Palo Alto Networks launches a Unified Identity Security Dashboard that joins Cortex Cloud posture with Cortex ITDR runtime signals for human, non-human and AI-agent identities","organization":"Palo Alto Networks","sector":"Identity security / cloud and SOC operations","geography":"Global product; cloud, SaaS and on-premises environments","publishedAt":"Palo Alto Networks Blog, Nov. 5, 2026","publicationDate":"2026-11-05","eventDate":"2026-11-05","sourceName":"Palo Alto Networks Blog","sourceLabel":"Unifying Identity Posture and Threat Detection with the Cortex Platform","sourceUrl":"https://www.paloaltonetworks.com/blog/cloud-security/unifying-identity-posture-and-threat-detection-with-the-cortex-platform/","evidenceClass":"vendor-claim","outcomeClass":"emerging","topics":["data-security","developers-agents","operating-model"],"finding":"On Nov. 5, 2026 Palo Alto Networks announced a Unified Identity Security Dashboard on the Cortex platform that combines preventive identity posture management from Cortex Cloud with real-time identity threat detection and response from Cortex ITDR. The post says teams can monitor identity exposure, misconfigurations, active threats and authentication activity across cloud, SaaS and on-premises in one view, using interactive risk funnels, high-risk rankings and custom watchlists. It cites the 2026 Unit 42 Global Incident Response Report for the claim that identity weaknesses played a role in nearly 90% of investigations. Coverage explicitly includes human identities, non-human identities, secrets and AI agents. Availability is described as included with existing Cortex Cloud Posture, Cortex Cloud Runtime and/or Cortex ITDR purchases, with capabilities based on existing licenses. No customer deployment results, SLED case studies or independent measurements are provided.","sledRelevance":"State agencies, counties, health departments and universities that already buy Cortex Cloud or ITDR can treat this as a same-license consolidation of identity posture and runtime views, which matters as they deploy service accounts and AI agents alongside staff accounts. Interpretation: the nearly-90% Unit 42 figure is vendor IR reporting, not a SLED-specific study. Buyers still need to confirm which licenses unlock which dashboard features and how on-premises directories are connected.","evidence":"Opened and read the full Nov. 5 blog post, including product description, Unit 42 citation and licensing note. Vendor marketing; no measured customer outcomes.","architectureImplications":"Requires Cortex Cloud posture and/or runtime plus Cortex ITDR telemetry wired into one operational view; identity signals span cloud, SaaS and on-premises.","governanceImplications":"Interpretation: joint ownership between cloud security and identity/SOC teams should be defined so posture findings and runtime cases share escalation paths.","securityPrivacyImplications":"Unifies exposure of overprivileged, dormant and AI-agent identities with authentication anomalies; watchlists concentrate sensitive identity metadata in one console.","caveats":"Vendor claim only; no public-sector deployment evidence; Unit 42 90% figure is vendor IR research; feature depth depends on existing licenses.","streamIds":["palo-alto-networks"],"roles":{"sales":"Sales framing: this is a same-day product announcement for customers already on Cortex Cloud or ITDR, not a new SKU pitch. It joins identity posture and runtime into one dashboard and explicitly covers AI-agent identities. A bounded engagement could be an entitlement check plus a watchlist pilot for privileged and non-human accounts. Do not sell the Unit 42 nearly-90% figure as a SLED statistic or promise outcomes the post does not measure.","engineering":"Engineering framing: the dashboard only helps if Cortex Cloud posture findings and Cortex ITDR signals already land in the tenant. Engineers should map which identity sources (cloud IdP, SaaS, on-prem directories, AI-agent inventories) are connected, confirm license-gated features, and design risk-funnel criteria that combine overprivilege with risky authentication. A proof of value is a side-by-side of one high-risk identity in posture and ITDR before and after enabling the unified view.","delivery":"Delivery framing: rollout is configuration and operating-model work more than new installs when licenses already exist. Delivery should assign owners for posture remediation versus runtime response, build a short list of watchlist identities, and document escalation when exposure becomes active. Proposed acceptance criteria include a tested drill from posture finding to ITDR case. Risks include assuming all features unlock without the right Cortex modules."},"roleDetails":{"sales":{"customerProblem":"Cloud and SOC teams track the same overprivileged or AI-agent identities in separate tools, delaying response when exposure becomes active misuse.","stakeholders":["CISO","Cloud security lead","SOC manager","Identity and access management","AI program owner"],"discoveryQuestions":["Which Cortex Cloud Posture, Runtime or ITDR licenses are already owned?","Where are non-human and AI-agent identities inventoried today?","Who owns remediation of dormant admin accounts versus runtime identity cases?","Are on-premises directories in scope for the unified view?"],"valueHypothesis":"Interpretation: consolidating posture and ITDR in one dashboard could shorten investigation time for high-risk identities already monitored in Cortex.","potentialEngagement":"A two-week entitlement and watchlist pilot for privileged human and non-human identities.","unsupportedClaims":["Measured reduction in identity incidents","Coverage of every IdP or directory","SLED-specific outcomes from the Unit 42 90% figure"]},"engineering":{"fit":"Best for tenants already emitting Cortex Cloud identity posture and Cortex ITDR telemetry.","architectureIntegration":"Cortex platform view over Cortex Cloud posture/runtime and Cortex ITDR; cloud, SaaS and on-prem identity sources must be connected.","prerequisites":["Cortex Cloud Posture and/or Runtime entitlement","Cortex ITDR entitlement for runtime signals","Identity source integrations"],"constraints":["Capabilities depend on existing licenses","On-prem coverage needs directory connectivity","No independent performance data"],"security":"Centralizes high-risk identity rankings and watchlists; access to the dashboard itself must be tightly controlled.","proofOfValue":["Confirm one overprivileged dormant admin appears in both posture and runtime views","Exercise a risk-funnel filter combining exposure and suspicious authentication","Document which AI-agent identities are discovered versus missing"]},"delivery":{"work":"Verify licenses, connect identity sources, configure watchlists and risk funnels, and align cloud and SOC runbooks.","dependencies":["License verification","IdP and directory integrations","SOC and cloud-security operating agreement"],"ownership":"Identity security or SOC engineering owns the dashboard; application and cloud teams own remediation of findings.","skillsAdoption":"Analysts need training to read combined posture and ITDR context without duplicate tickets.","governanceCheckpoints":["Entitlement matrix reviewed before go-live","Watchlist criteria approved by IAM and SOC","Quarterly review of AI-agent identity coverage"],"acceptanceCriteria":["Proposed: one end-to-end drill from posture finding to ITDR case documented","Proposed: privileged and NHI watchlists populated with agreed owners","Proposed: license gaps listed with remediation dates"],"risks":["Partial licenses leaving runtime or posture blank","Duplicate tickets between cloud and SOC","Sensitive identity metadata over-shared in the console"]}},"retrievedAt":"2026-11-06T04:11:32Z","enrichedAt":"2026-11-06T04:16:24Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Reduces tool-switching for analysts but still assumes staff who can interpret both posture and ITDR signals.","procurementImplications":"Sold as available with existing Cortex Cloud Posture, Runtime and/or ITDR purchases; buyers should verify entitlement matrices before assuming full feature access.","operatingModelImplications":"Cloud posture teams and SOC/ITDR teams need shared playbooks for when exposure becomes an active threat.","sourceVerification":{"openedUrl":"https://www.paloaltonetworks.com/blog/cloud-security/unifying-identity-posture-and-threat-detection-with-the-cortex-platform/","referenceExcerpt":"identity weaknesses played a role in nearly 90% of investigations","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}