From the Palo Alto Networks edition of November 5, 2026
Palo Alto Networks launches a Unified Identity Security Dashboard that joins Cortex Cloud posture with Cortex ITDR runtime signals for human, non-human and AI-agent identities
Palo Alto Networks · Identity security / cloud and SOC operations · Global product; cloud, SaaS and on-premises environments
- Publisher
- Palo Alto Networks Blog
- Original publication
- Palo Alto Networks Blog, Nov. 5, 2026
- Source retrieved
- 2026-11-06
- Event date
- 2026-11-05
What happened
On Nov. 5, 2026 Palo Alto Networks announced a Unified Identity Security Dashboard on the Cortex platform that combines preventive identity posture management from Cortex Cloud with real-time identity threat detection and response from Cortex ITDR. The post says teams can monitor identity exposure, misconfigurations, active threats and authentication activity across cloud, SaaS and on-premises in one view, using interactive risk funnels, high-risk rankings and custom watchlists. It cites the 2026 Unit 42 Global Incident Response Report for the claim that identity weaknesses played a role in nearly 90% of investigations. Coverage explicitly includes human identities, non-human identities, secrets and AI agents. Availability is described as included with existing Cortex Cloud Posture, Cortex Cloud Runtime and/or Cortex ITDR purchases, with capabilities based on existing licenses. No customer deployment results, SLED case studies or independent measurements are provided.
Why it matters
State agencies, counties, health departments and universities that already buy Cortex Cloud or ITDR can treat this as a same-license consolidation of identity posture and runtime views, which matters as they deploy service accounts and AI agents alongside staff accounts. Interpretation: the nearly-90% Unit 42 figure is vendor IR reporting, not a SLED-specific study. Buyers still need to confirm which licenses unlock which dashboard features and how on-premises directories are connected.
Evidence and measured results
Opened and read the full Nov. 5 blog post, including product description, Unit 42 citation and licensing note. Vendor marketing; no measured customer outcomes.
Limitations and uncertainty
Vendor claim only; no public-sector deployment evidence; Unit 42 90% figure is vendor IR research; feature depth depends on existing licenses.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-06; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Cloud and SOC teams track the same overprivileged or AI-agent identities in separate tools, delaying response when exposure becomes active misuse.
- Stakeholders
- CISO
- Cloud security lead
- SOC manager
- Identity and access management
- AI program owner
- Discovery questions
- Which Cortex Cloud Posture, Runtime or ITDR licenses are already owned?
- Where are non-human and AI-agent identities inventoried today?
- Who owns remediation of dormant admin accounts versus runtime identity cases?
- Are on-premises directories in scope for the unified view?
- Value hypothesis
- Interpretation: consolidating posture and ITDR in one dashboard could shorten investigation time for high-risk identities already monitored in Cortex.
- Potential engagement
- A two-week entitlement and watchlist pilot for privileged human and non-human identities.
- Unsupported claims
- Measured reduction in identity incidents
- Coverage of every IdP or directory
- SLED-specific outcomes from the Unit 42 90% figure
Pre-sales engineering
Role takeaway
- Fit
- Best for tenants already emitting Cortex Cloud identity posture and Cortex ITDR telemetry.
- Architecture and integration
- Cortex platform view over Cortex Cloud posture/runtime and Cortex ITDR; cloud, SaaS and on-prem identity sources must be connected.
- Prerequisites
- Cortex Cloud Posture and/or Runtime entitlement
- Cortex ITDR entitlement for runtime signals
- Identity source integrations
- Constraints
- Capabilities depend on existing licenses
- On-prem coverage needs directory connectivity
- No independent performance data
- Security
- Centralizes high-risk identity rankings and watchlists; access to the dashboard itself must be tightly controlled.
- Proof of value
- Confirm one overprivileged dormant admin appears in both posture and runtime views
- Exercise a risk-funnel filter combining exposure and suspicious authentication
- Document which AI-agent identities are discovered versus missing
Delivery
Role takeaway
- Work
- Verify licenses, connect identity sources, configure watchlists and risk funnels, and align cloud and SOC runbooks.
- Dependencies
- License verification
- IdP and directory integrations
- SOC and cloud-security operating agreement
- Ownership
- Identity security or SOC engineering owns the dashboard; application and cloud teams own remediation of findings.
- Skills and adoption
- Analysts need training to read combined posture and ITDR context without duplicate tickets.
- Governance checkpoints
- Entitlement matrix reviewed before go-live
- Watchlist criteria approved by IAM and SOC
- Quarterly review of AI-agent identity coverage
- Acceptance criteria
- Proposed: one end-to-end drill from posture finding to ITDR case documented
- Proposed: privileged and NHI watchlists populated with agreed owners
- Proposed: license gaps listed with remediation dates
- Risks
- Partial licenses leaving runtime or posture blank
- Duplicate tickets between cloud and SOC
- Sensitive identity metadata over-shared in the console
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Requires Cortex Cloud posture and/or runtime plus Cortex ITDR telemetry wired into one operational view; identity signals span cloud, SaaS and on-premises.
Governance
Who approves, reviews and stays accountable for outcomes?
Joint ownership between cloud security and identity/SOC teams should be defined so posture findings and runtime cases share escalation paths.
Security and privacy
What data, permissions and controls need testing?
Unifies exposure of overprivileged, dormant and AI-agent identities with authentication anomalies; watchlists concentrate sensitive identity metadata in one console.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Reduces tool-switching for analysts but still assumes staff who can interpret both posture and ITDR signals.
Procurement
What should contracts, pricing and exit terms secure?
Sold as available with existing Cortex Cloud Posture, Runtime and/or ITDR purchases; buyers should verify entitlement matrices before assuming full feature access.
Operating model
Which teams own the service once it runs?
Cloud posture teams and SOC/ITDR teams need shared playbooks for when exposure becomes an active threat.
Publication history
- 2026-11-05Palo Alto Networks · Issue 076 resources
Stable resource ID: pan-cortex-unified-identity-security-dashboard-cloud-itdr-20261105