AI security becomes the new control plane

The fortnight was not quiet. It was a product land-grab around AI security. On 2 Nov, Fortinet launched FortiGuard Inline AI Security Service for AI threat protection and governance. On 1 Nov, SentinelOne announced Agentic Detection and Response for enterprise AI security. On 30 Oct, SentinelOne also moved Claude Mythos 5.1 into its Wayfinder Frontier AI Services, while Qualys announced TruRisk Eliminate 2.0 with AI remediation features.

The same centre of gravity showed up outside launch copy. Okta added roles across product, engineering and compliance during the week, including Principal Product Manager for Enterprise AI and Staff Security Compliance Analyst posts, with job descriptions emphasising AI and identity security. Arctic Wolf said on 29 Oct that its AI technology now resolves 60% of security investigations and highlighted Aurora support for Cyber Threat Exposure Management.

The market signal is simple: AI is no longer being sold only as a productivity layer for analysts. It is being packaged as a governance surface, a detection surface and a remediation surface. That puts pressure on every vendor still treating AI as a feature label rather than a control plane.

The PHP2Shell thread gave the exposure vendors a live test of speed. On 29 Oct, reports linked PHP2Shell flaws to Palo Alto Networks management interfaces. On 1 Nov, Palo Alto Networks was again mentioned in coverage of attacks using PHP2Shell against firewalls. In the same window, Qualys added product pages for PHP2Shell remediation on 29 Oct and a free PHP shell risk assessment service on 30 Oct.

Tenable used the period to keep widening its exposure-management shelf. On 30 Oct it replaced a critical infrastructure cyber security page with a renamed Critical Infrastructure Cybersecurity page. On 1 Nov it added cloud security and Kubernetes content, including pages tied to zero trust cloud functionality for Kubernetes and NIS2 compliance. On 2 Nov it added three more cybersecurity practice and exposure-management blog posts, plus seven product-related pages, while removing ten older product pages.

This was the category’s real tempo. The named vulnerability drove public remediation pages inside the same fortnight, while exposure vendors refreshed language around critical infrastructure, Kubernetes and compliance. Buyers are being trained to expect a vendor response while the incident is still fresh, not at the next campaign cycle.

The visible launches were only half the movement. CrowdStrike, Palo Alto Networks, Okta, Rapid7, Tenable, Fortinet and Qualys all had 40 Google creatives running in the observed period, with new creatives appearing across several vendors. CrowdStrike had 22 new creatives recorded on 29 Oct, earliest first shown on 12 Oct, and another 16 recorded on 1 Nov, earliest first shown on 14 Oct. Palo Alto Networks had 15 new creatives recorded on 29 Oct, earliest first shown on 15 Oct, and 11 more recorded on 1 Nov, earliest first shown on 14 Oct. Okta had 12 new creatives recorded on 1 Nov, earliest first shown on 8 Oct.

The content layer moved just as quickly. On 31 Oct, Palo Alto Networks added pages around AI transparency and workplace protection while removing pages related to artificial intelligence, SIEM tools and secure AI coding. Rapid7 added 38 blog pages and two product pages on 30 Oct, while removing 17 blog pages and 33 product pages. CrowdStrike added seven product pages focused on endpoint and identity security on 31 Oct. Proofpoint added Flex and phishing simulation pages on 29 Oct, then a semantic business policies blog page on 31 Oct.

These edits matter because repositioning rarely arrives as a single announcement. It shows up as simultaneous page swaps, ad rotations and developer releases. By the time the market sees a launch headline, the category language has often already moved.

GitHub activity showed how much of this market is now fought through developer access and automation. On 29 Oct, CrowdStrike added eight repositories, including foundry-sample-category-blocking and falcon-digest, and its top-repository stars rose by 707. On 30 Oct, it released fusion-skills 1.3.0 and created repositories including Falcon-Toolkit and cloud registration assets. On 31 Oct, it released foundry-skills 1.7.0 with app-upgrades and app-audit skills, while top-repository stars rose from 266 to 730.

Palo Alto Networks created pan-chainguard on 29 Oct, then prisma-access-egress-ips and terraform-provider-cortexcloud on 30 Oct, followed by homebrew-cortexcli on 1 Nov. Okta created okta-sdk-dotnet and samples-java-spring on 30 Oct, then customer-detections, workflows-templates and okta-sdk-java on 31 Oct. On 2 Nov, Okta released okta-mcp-server 1.1.7 with updates addressing security advisories and created okta-mcp-server and okta-java-parent repositories.

For operators, this is not developer relations theatre. Security platforms are trying to become programmable infrastructure. The winners will not just have consoles. They will have templates, CLIs, remediation scripts, workflow libraries and enough repository gravity to make adoption feel operationally native.

Public-market attention was intense. Fortinet reported Q3 2026 revenue growth of 20% on 2 Nov and raised its full-year outlook, with analysts adjusting forecasts around its refresh cycle. Yet on 1 Nov, coverage also noted that Fortinet’s stock had fallen 22.2% over the prior four weeks amid concerns over its service revenue forecast and an insider trading plan. Both facts can be true: strong results and a market still testing the durability of the model.

Tenable had the opposite short-term tape. On 30 Oct, coverage cited a 39% stock increase over nine days and Canaccord Genuity raising its target from $36 to $54. On 1 Nov, Tenable’s Q3 earnings call coverage pointed to AI-fuelled growth, with Wells Fargo and Truist Securities raising targets to $45 from $38 and $35 respectively, alongside reports of a 114% stock price increase. On 29 Oct, however, coverage also described a soft revenue guide overshadowing the earnings beat.

Qualys also caught a bid, with coverage on 29 Oct saying the stock had risen 26% over the past week and reached a new 12-month high. The shared message is not that the market is indiscriminately rewarding cybersecurity. It is rewarding vendors that can attach AI, exposure management and remediation to credible operating evidence.