https://sled.lighthouseadvisory.consulting/feeds/palo-alto-networks.xml2026-11-11T05:15:41.461ZLighthouse Advisoryhttps://sled.lighthouseadvisory.consulting/streams/palo-alto-networks/editions/2026-11-102026-11-11T05:15:41.461Z2026-11-10T00:00:00.000Z

Palo Alto published three Nov. 10 AI-security announcements, and independent evidence complicates each. Its Cortex AES team said Claude Fable 5.2 scored a 0% attack success rate on the in-house Model Compass benchmark and that scores will feed model allow-lists in Cortex AES; the same day Notebookcheck reported Anthropic's own system-card figures of 4.09% injection success at 15 attempts, and 89.82% under an adaptive attacker without probes, driven largely by fallback to Opus 4.8, while a September preprint shows single headline attack rates often misrank defenses. Palo Alto also made a locally run Data Security MCP Server generally available for agents such as Claude Code, but a preprint scanning 10,655 MCP servers found credential and PII leakage above 10%. Finally, the eBPF-based Cortex Cloud Sensor claims up to 75% fewer resources than Palo Alto's standard sensor; a peer-reviewed study shows eBPF overhead ranges from about 1.5% to nearly 89% by workload and policy. No new U.S. SLED deployment evidence surfaced; relevance to agencies, campuses and research clusters is interpretive.

Palo Alto published three Nov. 10 AI-security announcements, and independent evidence complicates each. Its Cortex AES team said Claude Fable 5.2 scored a 0% attack success rate on the in-house Model Compass benchmark and that scores will feed model allow-lists in Cortex AES; the same day Notebookcheck reported Anthropic's own system-card figures of 4.09% injection success at 15 attempts, and 89.82% under an adaptive attacker without probes, driven largely by fallback to Opus 4.8, while a September preprint shows single headline attack rates often misrank defenses. Palo Alto also made a locally run Data Security MCP Server generally available for agents such as Claude Code, but a preprint scanning 10,655 MCP servers found credential and PII leakage above 10%. Finally, the eBPF-based Cortex Cloud Sensor claims up to 75% fewer resources than Palo Alto's standard sensor; a peer-reviewed study shows eBPF overhead ranges from about 1.5% to nearly 89% by workload and policy. No new U.S. SLED deployment evidence surfaced; relevance to agencies, campuses and research clusters is interpretive. 7 sources · 3 cross-source patterns Palo Alto's 0% score for Claude Fable 5.2 meets Anthropic's own non-zero injection figures and evidence that single headline attack rates are often unreliable What method details (attack budget, repetitions, routing, variance) will the organization require before a model-security score can support an AI model approval? Palo Alto's locally run DLP MCP server versus research showing local MCP servers commonly leak secrets and PII into model context Which model provider receives DLP incident content when an agent uses the connector, and is that permitted for the agency's regulated data? Palo Alto claims up to 75% fewer resources for its eBPF Cortex Cloud Sensor, while independent eBPF benchmarks show overhead swings with workload and policy What CPU, memory and latency budget must a runtime sensor meet on each workload class before prevention mode is approved?https://sled.lighthouseadvisory.consulting/streams/palo-alto-networks/editions/2026-11-092026-11-10T07:05:01.805Z2026-11-09T00:00:00.000Z

Nov. 9 brought two Palo Alto framing pieces and two independent checks on them. In an IT Brief byline, VP Jaimin Patel described Claude lifecycle controls: Cortex discovery of coding agents and MCP servers, Prisma AIRS inspection of prompts and MCP tool calls, AI Gateway quotas and agent identity, with no performance data. An independent Nov. 2 arXiv study found MCP tool poisoning succeeded in 22.9% of 9,720 real-execution tests across 12 frameworks and that description scanning blocked only 20 of 45 scenarios. Palo Alto's Digital Contagion blog used the French supermarket refrigeration attacks to argue for machine-speed defense, citing Unit 42's under-72-minute fastest-quartile exfiltration, but its 80°C and loss figures conflict with Unit 42 and French officials. The same day France attributed the October attacks to IRGC-linked Shahid Kaveh (BleepingComputer, NPR), and NPR linked the pattern to U.S. water and food-storage incidents. Palo Alto also announced VM-Series support on the AWS European Sovereign Cloud. No Nov. 8 edition was filed because that scheduled run failed.

Nov. 9 brought two Palo Alto framing pieces and two independent checks on them. In an IT Brief byline, VP Jaimin Patel described Claude lifecycle controls: Cortex discovery of coding agents and MCP servers, Prisma AIRS inspection of prompts and MCP tool calls, AI Gateway quotas and agent identity, with no performance data. An independent Nov. 2 arXiv study found MCP tool poisoning succeeded in 22.9% of 9,720 real-execution tests across 12 frameworks and that description scanning blocked only 20 of 45 scenarios. Palo Alto's Digital Contagion blog used the French supermarket refrigeration attacks to argue for machine-speed defense, citing Unit 42's under-72-minute fastest-quartile exfiltration, but its 80°C and loss figures conflict with Unit 42 and French officials. The same day France attributed the October attacks to IRGC-linked Shahid Kaveh (BleepingComputer, NPR), and NPR linked the pattern to U.S. water and food-storage incidents. Palo Alto also announced VM-Series support on the AWS European Sovereign Cloud. No Nov. 8 edition was filed because that scheduled run failed. 6 sources · 2 cross-source patterns Palo Alto markets MCP tool-call inspection and skill scanning for Claude while an independent study shows MCP tool poisoning is common and metadata scanning only partly helps Before approving agent-security tooling, what poisoning and exfiltration tests will the organization run to prove the controls catch attacks in its own agent workflows? Palo Alto frames the French refrigeration attacks as an AI-speed supply-chain problem, while French officials describe state-backed sabotage of exposed controllers Which refrigeration, water and building controllers are reachable from the internet today, and who owns closing that exposure?https://sled.lighthouseadvisory.consulting/streams/palo-alto-networks/editions/2026-11-072026-11-08T05:04:31.810Z2026-11-07T00:00:00.000Z

No Palo Alto Networks blog, press release or security advisory dated Nov. 7 appeared after the published Nov. 6 edition. Two Nov. 6 items that were not yet archived are newly filed. Computer Weekly interviewed CIO Meerah Rajavel, who said two-thirds of the vulnerabilities Palo Alto has uncovered with frontier AI models had never been disclosed as CVEs and that attack-path chaining, not merely finding bugs, was the larger surprise from Project Glasswing access to Claude Mythos Preview; she also described Prisma AIRS artefact checks, LLM gateways and MCP proxies, while warning that AI security fails if the zero-trust and endpoint base layer is weak. Separately, Unit 42 used Cortex Xpanse on Nov. 5–6 to identify over 5,000 internet-exposed devices from manufacturers listed in a CERT-FR advisory after European supermarket refrigeration attacks (about 700 French stores on Oct. 11–12 and 100–115 locations across at least 10 additional countries on Nov. 1–2) and medical-facility impact without evidence of spoiled blood products. A companion Nov. 5 CISA/FBI/HHS/USDA/DOT fact sheet was inspected as context but is not a Palo Alto evaluation. Unconfirmed Clutch and Beacon talks had no confirmation, and no new independent Prisma AIRS or Cortex benchmark appeared.

No Palo Alto Networks blog, press release or security advisory dated Nov. 7 appeared after the published Nov. 6 edition. Two Nov. 6 items that were not yet archived are newly filed. Computer Weekly interviewed CIO Meerah Rajavel, who said two-thirds of the vulnerabilities Palo Alto has uncovered with frontier AI models had never been disclosed as CVEs and that attack-path chaining, not merely finding bugs, was the larger surprise from Project Glasswing access to Claude Mythos Preview; she also described Prisma AIRS artefact checks, LLM gateways and MCP proxies, while warning that AI security fails if the zero-trust and endpoint base layer is weak. Separately, Unit 42 used Cortex Xpanse on Nov. 5–6 to identify over 5,000 internet-exposed devices from manufacturers listed in a CERT-FR advisory after European supermarket refrigeration attacks (about 700 French stores on Oct. 11–12 and 100–115 locations across at least 10 additional countries on Nov. 1–2) and medical-facility impact without evidence of spoiled blood products. A companion Nov. 5 CISA/FBI/HHS/USDA/DOT fact sheet was inspected as context but is not a Palo Alto evaluation. Unconfirmed Clutch and Beacon talks had no confirmation, and no new independent Prisma AIRS or Cortex benchmark appeared. 2 sources · 1 cross-source patterns Nov. 6 vendor interview and Unit 42 research both argue defenders cannot rely on known-CVE patching alone How will the organization find exposures that have no CVE and virtually shield internet-reachable or unpatchable systems before an attacker changes them?https://sled.lighthouseadvisory.consulting/streams/palo-alto-networks/editions/2026-11-062026-11-07T05:48:31.780Z2026-11-06T00:00:00.000Z

Nov. 6 brought two Palo Alto Networks blogs: Checkmate for Checkboxes argues autonomous AI has obsolete annual compliance checklists and pushes continuous authorization, Zero Standing Privileges for agents, isolation and virtual patching; and an Automated Multicloud Security Fabric announcement for software firewalls on PAN-OS 12.1 with AI-runtime prompt-injection and model-exfiltration controls. Independent press on Nov. 5–6 deepened M&A signals—TechCrunch detailed Clutch talks at $500M cash plus milestones near $10M ARR, while Ctech reported separate Beacon Security talks for an agentic SOC context platform. A missed Nov. 3 Cortex AES post analyzed the Oct. 29 Claude Code extension compromise (up to 5,000 Cursor users). Checkable AI’s Nov. 3 docs review of Cortex XSIAM/XDR/AgentiX logged 46 control findings with major identity and governance gaps. CSA Singapore’s Nov. 3 alert AL-2026-157 government-confirmed active PHP2Shell exploitation against PAN-OS and chaining to CVE-2026-46300 for root.

Nov. 6 brought two Palo Alto Networks blogs: Checkmate for Checkboxes argues autonomous AI has obsolete annual compliance checklists and pushes continuous authorization, Zero Standing Privileges for agents, isolation and virtual patching; and an Automated Multicloud Security Fabric announcement for software firewalls on PAN-OS 12.1 with AI-runtime prompt-injection and model-exfiltration controls. Independent press on Nov. 5–6 deepened M&A signals—TechCrunch detailed Clutch talks at $500M cash plus milestones near $10M ARR, while Ctech reported separate Beacon Security talks for an agentic SOC context platform. A missed Nov. 3 Cortex AES post analyzed the Oct. 29 Claude Code extension compromise (up to 5,000 Cursor users). Checkable AI’s Nov. 3 docs review of Cortex XSIAM/XDR/AgentiX logged 46 control findings with major identity and governance gaps. CSA Singapore’s Nov. 3 alert AL-2026-157 government-confirmed active PHP2Shell exploitation against PAN-OS and chaining to CVE-2026-46300 for root. 7 sources · 2 cross-source patterns Unconfirmed Nov. 5–6 reporting says Palo Alto is pursuing both AI-agent credential security (Clutch) and agentic SOC platforms (Beacon) How will the organization secure credentials used by AI agents and the SOC agents that act on telemetry—without waiting on unannounced acquisitions? Vendor AES supply-chain narrative and an independent Cortex control review both show agentic tooling outpacing documented governance Which agentic endpoint and SOC controls are actually configured and evidenced in the tenant, versus only described in blogs?https://sled.lighthouseadvisory.consulting/streams/palo-alto-networks/editions/2026-11-052026-11-06T11:56:34.958Z2026-11-05T00:00:00.000Z

Nov. 5 was an identity-and-agents day for Palo Alto Networks. A new Unified Identity Security Dashboard joins Cortex Cloud posture with Cortex ITDR for human, non-human and AI-agent identities, available with existing Cortex licenses. A long Idira guide argues local coding agents inherit the logged-on user's token, so OS least privilege must sit beside agent hooks. Prisma AIRS November notes add Kubernetes IP-tag harvesting and FP/FN auto-remediation. Independently, AI Security Platform scores Prisma AIRS 7.6/10 on documentation and RightAIChoice rates Cortex XSIAM 70/100, both warning that stack fit and local proof matter more than vendor percentages. Ctech reports unconfirmed talks to buy Clutch Security for about $500 million to secure AI-agent credentials.

Nov. 5 was an identity-and-agents day for Palo Alto Networks. A new Unified Identity Security Dashboard joins Cortex Cloud posture with Cortex ITDR for human, non-human and AI-agent identities, available with existing Cortex licenses. A long Idira guide argues local coding agents inherit the logged-on user's token, so OS least privilege must sit beside agent hooks. Prisma AIRS November notes add Kubernetes IP-tag harvesting and FP/FN auto-remediation. Independently, AI Security Platform scores Prisma AIRS 7.6/10 on documentation and RightAIChoice rates Cortex XSIAM 70/100, both warning that stack fit and local proof matter more than vendor percentages. Ctech reports unconfirmed talks to buy Clutch Security for about $500 million to secure AI-agent credentials. 6 sources · 2 cross-source patterns Nov. 5 materials push identity security from human accounts into AI-agent and non-human credentials across dashboard, endpoint and M&A signals How will the organization inventory, constrain and monitor AI-agent and other non-human identities with the same rigor as privileged human accounts? Two independent documentation reviews say Prisma AIRS and Cortex XSIAM fit best on existing Palo Alto estates and that headline metrics need local proof Before expanding Prisma AIRS or XSIAM, which detection, staffing and licensing claims will be re-tested on the entity's own telemetry and use cases?https://sled.lighthouseadvisory.consulting/streams/palo-alto-networks/editions/2026-11-042026-11-05T05:44:00.261Z2026-11-04T00:00:00.000Z

Palo Alto Networks published nothing new on Nov. 4, so this edition looks at independent scrutiny. Two outside reviews of Prisma AIRS were re-checked this week. AnchorTerminal grades the runtime API a C (61.6/100). It credits detector breadth and FedRAMP Moderate support but flags 10-year retention of payloads flagged as malicious, an EULA ban on published benchmarks and no SLA. Checkable AI finds 8 of 38 agent-security controls documented, with no human-approval step or kill switch. A new preprint, StateFence, shows that poisoned logs can mislead SOC AI agents and that defenses need to fit each task. All three rely on documentation or benchmarks, not live public-sector deployments.

Palo Alto Networks published nothing new on Nov. 4, so this edition looks at independent scrutiny. Two outside reviews of Prisma AIRS were re-checked this week. AnchorTerminal grades the runtime API a C (61.6/100). It credits detector breadth and FedRAMP Moderate support but flags 10-year retention of payloads flagged as malicious, an EULA ban on published benchmarks and no SLA. Checkable AI finds 8 of 38 agent-security controls documented, with no human-approval step or kill switch. A new preprint, StateFence, shows that poisoned logs can mislead SOC AI agents and that defenses need to fit each task. All three rely on documentation or benchmarks, not live public-sector deployments. 3 sources · 2 cross-source patterns Two independent reviews of Prisma AIRS agree it is a strong scanning and gateway layer but leave approvals, containment and contract terms for buyers to solve Before an agency puts agent traffic through Prisma AIRS, has it mapped which controls AIRS does not provide and cleared the retention and benchmark terms with counsel? Allow/block content verdicts are not enough for AI agents in security operations Does each agentic SOC workflow have task-specific safeguards and human approval for containment actions, tested with poisoned evidence before go-live?https://sled.lighthouseadvisory.consulting/streams/palo-alto-networks/editions/2026-11-032026-11-04T15:02:02.925Z2026-11-03T00:00:00.000Z

A quiet day for Palo Alto Networks. Its one new post argues that AI should draft DLP policy through conversation, with human approval and a monitor-first rollout. It names no product and gives no data. A new independent preprint backs the general idea that how policy is written matters: rules with explicit examples caught more risky coding-agent actions and caused fewer false alarms, though the test data was synthetic. The edition also catches up on the Brotli flaw (CVE-2026-111497), which this stream had not covered. PAN-OS 11.2 and later firewalls are exposed only when Brotli inspection and TLS decryption are both on. Hotfixes have shipped, and CISA has added the flaw to KEV.

A quiet day for Palo Alto Networks. Its one new post argues that AI should draft DLP policy through conversation, with human approval and a monitor-first rollout. It names no product and gives no data. A new independent preprint backs the general idea that how policy is written matters: rules with explicit examples caught more risky coding-agent actions and caused fewer false alarms, though the test data was synthetic. The edition also catches up on the Brotli flaw (CVE-2026-111497), which this stream had not covered. PAN-OS 11.2 and later firewalls are exposed only when Brotli inspection and TLS decryption are both on. Hotfixes have shipped, and CISA has added the flaw to KEV. 4 sources · 2 cross-source patterns AI-generated or AI-enforced security policy works better with explicit examples and staged enforcement, but evidence is still thin Before any AI-generated or AI-enforced policy blocks traffic or agent actions, has the team tested it on labeled examples and measured false positives in monitor mode? Brotli CVE-2026-111497: Palo Alto's advisory limits firewall exposure to a specific configuration while independent reporting adds KEV status and adjacent exploitation Has the agency confirmed Brotli inspection status on every PAN-OS 11.2+ firewall and checked bundled Brotli in Node.js and .NET applications before its KEV deadline?https://sled.lighthouseadvisory.consulting/streams/palo-alto-networks/editions/2026-11-022026-11-03T11:43:40.889Z2026-11-02T00:00:00.000Z

Palo Alto Networks had a big product day. Cortex XSIAM 4.0 pushes the SOC toward autonomous AI agents, adding global frontier-model routing, ingestion filtering and federated cloud search. Cortex Cloud 2.3 adds an eBPF workload sensor and an MCP server for AI coding agents. A new Cortex XDR sensor will run inside Claude Cowork's desktop VM. All three are vendor claims with no outcome data. Anthropic's own guide shows the Cowork monitoring is beta, local-only and exposes prompts to the EDR vendor. An independent preprint finds SOC agents cite evidence for only a quarter of attack actions and degrade quietly when telemetry changes, so SLED SOCs should test agents on their own incidents first.

Palo Alto Networks had a big product day. Cortex XSIAM 4.0 pushes the SOC toward autonomous AI agents, adding global frontier-model routing, ingestion filtering and federated cloud search. Cortex Cloud 2.3 adds an eBPF workload sensor and an MCP server for AI coding agents. A new Cortex XDR sensor will run inside Claude Cowork's desktop VM. All three are vendor claims with no outcome data. Anthropic's own guide shows the Cowork monitoring is beta, local-only and exposes prompts to the EDR vendor. An independent preprint finds SOC agents cite evidence for only a quarter of attack actions and degrade quietly when telemetry changes, so SLED SOCs should test agents on their own incidents first. 5 sources · 2 cross-source patterns XSIAM 4.0 moves the SOC toward autonomous agent investigation while independent benchmarks show agent evidence gathering is incomplete and telemetry-sensitive Before relying on XSIAM 4.0 agents for investigations, has the SOC measured action-level evidence coverage on its own past incidents under its actual (and filtered) telemetry? Palo Alto is treating AI agents as monitored endpoint and development assets, but coverage is partial and preview-stage For each AI agent tool piloted (desktop, coding or SOC), can the agency show which sessions are monitored, which are not, and who approved the data that monitoring sends to vendors?https://sled.lighthouseadvisory.consulting/streams/palo-alto-networks/editions/2026-10-312026-11-02T01:21:24.223Z2026-10-31T00:00:00.000Z

A quieter day for the PHP2Shell firewall campaign: the Palo Alto advisory and Unit 42 brief are unchanged and new coverage only retells earlier reports. The news is on the AI side. Palo Alto's November XSIAM release, updated Oct. 30, lets SOC agents draw on SharePoint, Google Drive and Confluence content and ingest Prisma AIRS data, and Cortex Cloud now inventories AI agents across about 100 SaaS apps. Two independent preprints show why SLED SOCs should test before enabling: instructions planted in log fields steered LLM triage and summaries in most trials, and defenses reduced but did not remove the effect. Atos's UK Cortex service offers a contract model with humans retaining decision authority.

A quieter day for the PHP2Shell firewall campaign: the Palo Alto advisory and Unit 42 brief are unchanged and new coverage only retells earlier reports. The news is on the AI side. Palo Alto's November XSIAM release, updated Oct. 30, lets SOC agents draw on SharePoint, Google Drive and Confluence content and ingest Prisma AIRS data, and Cortex Cloud now inventories AI agents across about 100 SaaS apps. Two independent preprints show why SLED SOCs should test before enabling: instructions planted in log fields steered LLM triage and summaries in most trials, and defenses reduced but did not remove the effect. Atos's UK Cortex service offers a contract model with humans retaining decision authority. 5 sources · 2 cross-source patterns Palo Alto is widening what SOC AI agents read and do, while two independent studies show attacker-written log text still steers LLM analysis Before enabling XSIAM enterprise-knowledge agents or AgentiX remediation, has the SOC measured how they respond to planted instructions in its own logs and connected documents, and which actions still require analyst approval? Managed and shared Cortex SOC models are being defined by scoped tenant access and explicit human decision authority For a state shared SOC or managed provider using Cortex, is there a written matrix of which AI actions run automatically, which need human approval, and what the parent tenant can do inside each local or school tenant?https://sled.lighthouseadvisory.consulting/streams/palo-alto-networks/editions/2026-10-302026-10-31T04:40:11.074Z2026-10-30T00:00:00.000Z

Day two of the PHP2Shell firewall story brings independent explanation of why Palo Alto devices were the target. Hunt.io and Field Effect show that PAN-OS ships a single PHP build per firmware line, so an exploit that mostly fails on ordinary web servers works reliably on exposed management interfaces. Field Effect flags data-plane interfaces with management profiles as a common blind spot. SecurityWeek’s compilation finds mass attempts against WordPress largely failing, with healthcare and education among targeted sectors. CISA listed the kernel half of the chain on Oct. 28 and required forensic triage. Dream says the government victim cannot be identified, so SLED entities must verify their own exposure. On the AI side, Prisma AIRS added a model-scanning agent for Gemini Enterprise, with no efficacy data.

Day two of the PHP2Shell firewall story brings independent explanation of why Palo Alto devices were the target. Hunt.io and Field Effect show that PAN-OS ships a single PHP build per firmware line, so an exploit that mostly fails on ordinary web servers works reliably on exposed management interfaces. Field Effect flags data-plane interfaces with management profiles as a common blind spot. SecurityWeek’s compilation finds mass attempts against WordPress largely failing, with healthcare and education among targeted sectors. CISA listed the kernel half of the chain on Oct. 28 and required forensic triage. Dream says the government victim cannot be identified, so SLED entities must verify their own exposure. On the AI side, Prisma AIRS added a model-scanning agent for Gemini Enterprise, with no efficacy data. 6 sources · 2 cross-source patterns Independent sources agree PHP2Shell mostly fails on ordinary web servers but works on PAN-OS management, and that patching does not undo a compromise Has every PAN-OS and Panorama device been checked for management access on all interfaces, patched, and triaged for compromise, with stored credentials rotated? No source identifies which government or sector organizations were hit, so state, local, health and education entities must prove their own non-exposure Can the agency, district or university produce a signed, evidence-backed statement that its PAN-OS management interfaces were not reachable, or were checked for compromise, from Oct. 8 onward?https://sled.lighthouseadvisory.consulting/streams/palo-alto-networks/editions/2026-10-292026-10-30T03:21:35.577Z2026-10-29T00:00:00.000Z

The first Palo Alto Networks edition is dominated by the firewall management interface. Dream Research documented a custom PHP2Shell and Linux kernel exploit chain that rooted 24 internet-exposed PAN-OS firewalls and a management server, then reached a US government-affiliated Active Directory; Palo Alto Networks and Unit 42 confirmed exploitation and put impact at about 0.02% of its base, all with exposed management. CISA had already listed a separate PAN-OS management flaw as exploited on Oct. 14. Unit 42 also retracted an earlier European government claim. On the AI side, Prisma AIRS added a FedRAMP Moderate option at a 15% surcharge, while a new preprint shows prompt-injection detector benchmarks predict little. Jordan School District and Unit 42’s university case add K-12 and higher-ed signals.

The first Palo Alto Networks edition is dominated by the firewall management interface. Dream Research documented a custom PHP2Shell and Linux kernel exploit chain that rooted 24 internet-exposed PAN-OS firewalls and a management server, then reached a US government-affiliated Active Directory; Palo Alto Networks and Unit 42 confirmed exploitation and put impact at about 0.02% of its base, all with exposed management. CISA had already listed a separate PAN-OS management flaw as exploited on Oct. 14. Unit 42 also retracted an earlier European government claim. On the AI side, Prisma AIRS added a FedRAMP Moderate option at a 15% surcharge, while a new preprint shows prompt-injection detector benchmarks predict little. Jordan School District and Unit 42’s university case add K-12 and higher-ed signals. 8 sources · 2 cross-source patterns Two separately exploited PAN-OS flaws this month both run through the firewall management interface, so exposure of that interface, not the product itself, decides who is at risk Can the agency show, from an outside scan this week, that no PAN-OS management interface or Panorama is reachable from the internet, and has every previously exposed device been hunted for webshells and tunnels? AI security claims, whether threat intelligence or guardrail effectiveness, are moving faster than their evidence and need verification on the agency’s own data Before adopting an AI guardrail or acting on an AI-attack claim, what agency-side test or second source will confirm it?