* [Blog](https://www.paloaltonetworks.com.au/blog) * [Palo Alto Networks](https://www.paloaltonetworks.com.au/blog/corporate/) * [Announcement](https://www.paloaltonetworks.com.au/blog/category/announcement/) * Observability's AI Moment... # Observability's AI Moment [](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.paloaltonetworks.com.au%2Fblog%2F2026%2F10%2Fobservabilitys-ai-moment-introducing-cortex-xcor-ai-driven-observability-for-autonomous-response-with-ai-sre%2F) [](https://twitter.com/share?text=Observability%E2%80%99s+AI+Moment&url=https%3A%2F%2Fwww.paloaltonetworks.com.au%2Fblog%2F2026%2F10%2Fobservabilitys-ai-moment-introducing-cortex-xcor-ai-driven-observability-for-autonomous-response-with-ai-sre%2F) [](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.paloaltonetworks.com.au%2Fblog%2F2026%2F10%2Fobservabilitys-ai-moment-introducing-cortex-xcor-ai-driven-observability-for-autonomous-response-with-ai-sre%2F&title=Observability%E2%80%99s+AI+Moment&summary=&source=) [](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https://www.paloaltonetworks.com.au/blog/2026/10/observabilitys-ai-moment-introducing-cortex-xcor-ai-driven-observability-for-autonomous-response-with-ai-sre/&ts=markdown) \[\](mailto:?subject=Observability’s AI Moment) Link copied By [Martin Mao](https://www.paloaltonetworks.com/blog/author/martin-mao/?ts=markdown "Posts by Martin Mao") Oct 01, 2026 6 minutes [Announcement](https://www.paloaltonetworks.com/blog/category/announcement/?ts=markdown) [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown) [Observability](https://www.paloaltonetworks.com/blog/tag/observability/?ts=markdown) **Introducing Cortex XCOR: AI-Driven Observability that Delivers Autonomous Response with AI SRE** I've been tackling the observability problem for more than a decade, since before it was coined observability. From building internal monitoring for EC2 at AWS to building the observability platform for Uber, the holy grail was always to create a solution that would automatically tell you what the issues were and help remediate them, instead of just being a tool that showed you dashboards. But standing in the way were the foundational scale and cost challenges of cloud-native architectures, which is what my co-founder Rob Skillington and I solved by creating Chronosphere. With the ability to effectively manage observability data at scale and as we undergo another major industry shift with AI, we're finally at a point in time where the technology available puts the holy grail within grasp. Six months after joining Palo Alto Networks, we're taking a major step forward with the launch of **Cortex XCOR** - an AI-native observability platform that delivers on that long promise of automatically root causing the issue. ## **Reimagining Observability for the Modern SDLC** Getting to this point required a fundamental leap in model intelligence. When generative AI was broadly released in late 2022, LLMs were intriguing, but the reasoning capabilities were rudimentary. Although we saw limited applications for chatbots and assistants within observability, those early models could only help the end user, they couldn't ultimately solve the issue. They assisted investigations by summarizing logs or translating queries, but weren't transformative. That changed in late 2025 with frontier models like OpenAI's GPT-5 and Anthropic's Claude Sonnet and Opus. My own AI moment in observability came a couple of months ago when our chat functionality evolved from acting like an assistant to functioning as an autonomous expert that gave me the answer and showed me how it got there. As I pushed our agents with increasingly complex scenarios, they began reasoning through problems far beyond their initial capabilities. Much like how LLMs have replaced my need for web search, our chat is now my primary interface in our product, completely overhauling how I interact with it. This shift for observability is needed now more than ever as operations teams struggle to keep up with the surge in AI-driven software development, caused by the same step up in reasoning capabilities from late 2025. Research shows that [42% of developers](https://www.bairesdev.com/blog/dev-barometer-q3-2026-devs-answering-for-code/) now report that AI writes at least half their code, up from 12% last year. Rapid code releases continuously expand the surface area for production failures and drive up the burden on developers and SREs to manually identify root causes. To match this velocity, observability needs to modernize now to avoid becoming the bottleneck for product innovation. ## **Introducing Cortex XCOR, the Next-Generation AI-Native Observability Platform** That is precisely why we are launching XCOR\*\*.\*\* We designed it to transform observability from static dashboards and manual remediation to an AI-first experience that automates both routine and complex investigations. ![](https://www.paloaltonetworks.com/blog/wp-content/uploads/2026/09/XCOR_operator.png) Cortex XCOR is an AI-driven platform that delivers autonomous response. At the heart is our **XCOR Operator** , an AI assistant embedded throughout the platform that helps operations teams match AI-coding velocity. What makes the XCOR Operator especially powerful is that it understands the user intent and serves as the conversational interface for our specialized agents that execute behind the scenes. The user of an observability platform plays many roles depending on the situation: investigating incidents, tuning alerts and dashboards, optimizing data volumes, and so on. Each of these roles are mirrored by specialized AI agents that have been optimized to complete those task-specific workflows from end to end. The most challenging role is the **AI SRE** - investigating an incident to get to the root cause and identify remediation. Triggered automatically when an alert fires, the AI SRE agent autonomously reasons through underlying issues and recommends actions and mitigations in under three minutes on average, with a **75% success rate** of root cause analysis in complex production environments and a further 19% of incidents where the analysis was deemed useful. By comparison, manual responses can take 20 minutes just to locate the relevant issues, gather initial context and find the right on-call engineer. None of this automated reasoning is possible without complete end-to-end visibility and context. With the recent acquisition of Embrace, we now bring together front-end Real User Monitoring (**XCOR RUM** ) and proactive **XCOR Synthetics** with our backend and infrastructure observability to deliver a true, full-stack platform. RUM captures every web and mobile session in full fidelity without sampling, tying crashes and slow loads directly to session timelines, while synthetics simulates global user traffic to proactively catch regressions before they hit production. Underpinning this full-stack visibility is the **XCOR Fabric** , which we engineered to provide our agents with rich, real-time institutional, application and infrastructure context and draws from: * **Knowledge Graph:** A real-time, detailed model incorporating your infrastructure, applications and business logic. Unlike many other solutions, it normalizes and incorporates custom telemetry to provide the most complete context. * **Operational Memory:** Institutional learnings and historical context captured from past incident investigations. * **User Behavior:** Patterns revealing which specific queries and dashboards senior engineers rely on during active resolutions. * **Human Knowledge:** Context pulled directly from runbooks, documentation, and operational files. By delivering total visibility and grounding our AI agents in this deep operational context, XCOR delivers rapid root-cause analysis and recommends steps toward remediation. ## **Automated Optimization Continues to Deliver the Most Cost-Effective Platform on the Market** Yet observability without cost control is like an untrained puppy, adorable until it chews through your furniture, shoes and budget. Managing observability costs remains a persistent challenge because modern cloud and AI-native architectures produce massive volumes of telemetry data. We designed Chronosphere to solve this exact problem, and it remains a major pillar of XCOR. We help customers optimize data by an average of 89% without sacrificing visibility, earning [top industry rankings](https://www.paloaltonetworks.com/resources/research/gartner-critical-capabilities-observability) for cost efficiency and the trust of industry leaders like OpenAI, DoorDash and Compass. Now with expanded consumption-based pricing models across the XCOR platform and granular consumption budgets that automatically adjust to usage patterns over time, we eliminate the tradeoff between critical visibility and rising costs. The quest for observability's holy grail is finally within reach. As engineering teams race to keep pace with the speed and scale of AI-driven development, XCOR moves operations beyond static dashboards and manual troubleshooting toward true autonomous remediation. This is observability's AI moment. [DISCOVER AI-DRIVEN REMEDIATION](https://www.paloaltonetworks.com/cortex/xcor) *** ** * ** *** ## Related Blogs ### [Announcement](https://www.paloaltonetworks.com/blog/category/announcement/?ts=markdown), [Partners](https://www.paloaltonetworks.com/blog/category/partners/?ts=markdown), [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown) [#### Securing AI Agents at Scale with NVIDIA](https://www.paloaltonetworks.com.au/blog/2026/09/securing-ai-agents-at-scale-with-nvidia/) ### [AI and Cybersecurity](https://www.paloaltonetworks.com/blog/security-operations/category/ai-and-cybersecurity/?ts=markdown), [AI Security](https://www.paloaltonetworks.com/blog/category/ai-security/?ts=markdown), [Announcement](https://www.paloaltonetworks.com/blog/category/announcement/?ts=markdown), [Cybersecurity](https://www.paloaltonetworks.com/blog/category/cybersecurity/?ts=markdown), [Must-Read Articles](https://www.paloaltonetworks.com/blog/security-operations/category/must-read-articles/?ts=markdown), [News and Events](https://www.paloaltonetworks.com/blog/security-operations/category/news-and-events/?ts=markdown), [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown) [#### Cortex XDR is the only Certified Leader in AV-Comparatives EPR 7 years in a row](https://www.paloaltonetworks.com.au/blog/security-operations/cortex-xdr-is-the-only-endpoint-security-market-leader-to-be-certified-by-av-comparatives-7-years-in-a-row/) ### [Agentic Identity Security](https://www.paloaltonetworks.com/blog/identity-security/category/agentic-identity-security/?ts=markdown), [Announcement](https://www.paloaltonetworks.com/blog/category/announcement/?ts=markdown), [Machine Identity Security](https://www.paloaltonetworks.com/blog/identity-security/category/machine-identity-security/?ts=markdown), [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown), [Zero Standing Privilege](https://www.paloaltonetworks.com/blog/identity-security/category/zero-standing-privilege/?ts=markdown) [#### Secure Human, Machine, and AI Identities in Kubernetes with Idira](https://www.paloaltonetworks.com.au/blog/identity-security/zero-standing-privilege-managed-kubernetes/) ### [AI and Cybersecurity](https://www.paloaltonetworks.com/blog/security-operations/category/ai-and-cybersecurity/?ts=markdown), [Announcement](https://www.paloaltonetworks.com/blog/category/announcement/?ts=markdown), [Cybersecurity](https://www.paloaltonetworks.com/blog/category/cybersecurity/?ts=markdown), [Must-Read Articles](https://www.paloaltonetworks.com/blog/security-operations/category/must-read-articles/?ts=markdown), [Product Features](https://www.paloaltonetworks.com/blog/security-operations/category/product-features/?ts=markdown), [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown), [Use-Cases](https://www.paloaltonetworks.com/blog/security-operations/category/use-cases/?ts=markdown) [#### Cortex XDR Scores Perfect 100% in SE Labs 2026 Ransomware Test](https://www.paloaltonetworks.com.au/blog/security-operations/cortex-xdr-scores-perfect-100-in-se-labs-2026-ransomware-test/) ### [Announcement](https://www.paloaltonetworks.com/blog/category/announcement/?ts=markdown), [Cybersecurity](https://www.paloaltonetworks.com/blog/category/cybersecurity/?ts=markdown), [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown) [#### Scale Network Security beyond Human Limits: Introducing Network Security Agents in PAN-OS 12.2](https://www.paloaltonetworks.com.au/blog/network-security/scale-network-security-beyond-human-limits-introducing-network-security-agents-in-pan-os-12-2/) ### [Announcement](https://www.paloaltonetworks.com/blog/category/announcement/?ts=markdown), [Cloud Delivered Security Services](https://www.paloaltonetworks.com/blog/network-security/category/cloud-delivered-security-services/?ts=markdown), [Cybersecurity](https://www.paloaltonetworks.com/blog/category/cybersecurity/?ts=markdown), [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown) [#### Blocking Attacker Infrastructure at the Network Layer: Advanced IP Defense for PAN-OS 12.2](https://www.paloaltonetworks.com.au/blog/network-security/block-attacker-infrastructure-advanced-ip-defense/) ### Subscribe to the Blog! Sign up to receive must-read articles, Playbooks of the Week, new feature announcements, and more. ![spinner](https://www.paloaltonetworks.com.au/blog/wp-content/themes/panwblog2023/dist/images/ajax-loader.gif) Sign up Please enter a valid email. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) and acknowledge our [Privacy Statement](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown). Please look for a confirmation email from us. If you don't receive it in the next 10 minutes, please check your spam folder. This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. {#footer} {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security?ts=markdown) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs?ts=markdown) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown) * [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/unit42/respond/managed-detection-response?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) * Observability * [Cortex XCOR](https://www.paloaltonetworks.com/cortex/xcor?ts=markdown) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira?ts=markdown) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management?ts=markdown) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management?ts=markdown) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager?ts=markdown) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance?ts=markdown) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management?ts=markdown) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic?ts=markdown) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management?ts=markdown) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance?ts=markdown) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery?ts=markdown) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access?ts=markdown) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/prepare-for-emerging-risks/continuous-frontier-ai-defense?ts=markdown) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses?ts=markdown) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy?ts=markdown) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence?ts=markdown) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond?ts=markdown) Company * [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown) * [Customers](https://www.paloaltonetworks.com/customers?ts=markdown) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown) * [Communities](https://www.paloaltonetworks.com/communities?ts=markdown) * [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications?ts=markdown) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown) * [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) * [Documents](https://www.paloaltonetworks.com/legal?ts=markdown) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language