Koi

• Palo Alto Networks could deprioritize Koi's standalone product as it folds the technology into Cortex XDR and Prisma AIRS, leaving standalone customers with a slower roadmap.
• Koi's core capability is reproducible software, and Palo Alto Networks is already building an equivalent Cortex XDR module, so rival endpoint vendors could add the same non-binary software governance.
• Koi's traction covers only a short early window of roughly forty to fifty accounts, with no public multi-year retention record, so early-customer churn would undercut the growth story.
• Koi scores risk from public marketplace metadata and behavioral analysis a funded competitor could reconstruct rather than from a named non-public dataset, so the underlying data is not a durable advantage.
• Sold as an agentless overlay that complements endpoint detection and response, Koi risks being treated as a feature rather than a standalone platform, which would pressure independent pricing.

Koi sells to enterprise security and platform teams that have lost visibility into the software their own people install. Browser extensions, code and operating-system packages, AI models, AI agents, and Model Context Protocol servers now arrive on endpoints outside the antivirus and device-management tools built for static binaries. Because each of these can run code and reach data, self-provisioned software becomes an attack surface most controls never inspect.

The founders demonstrated the gap before building the product. They uncovered a security hole in the Visual Studio Code extension marketplace and used a planted extension to breach organizations, which became the origin of Koi. Independent reporting now frames extensions and packages as an expanding enterprise blind spot, and a Dell'Oro analyst places the agent-tooling layer among the next endpoint attack surfaces. [s4, s9, s2]

Koi combines continuous discovery with a risk engine and a policy gate, delivered agentlessly across macOS, Windows, and Linux. It catalogs every binary and non-binary artifact on an endpoint, then its Wings engine scores each one by correlating code diffs, runtime behavior, ownership changes, update channels, network egress, and install source to flag malware, impersonation, and policy drift in real time.

A Supply Chain Gateway screens installs before they reach the endpoint. It curates incoming software from marketplaces and registries such as GitHub, Hugging Face, the Chrome Web Store, the Visual Studio Code Marketplace, and Homebrew, approving safe items and blocking or quarantining risky ones by policy. After install, Koi keeps watching for malware, sideloading, and risky update channels, and it can roll back versions or remove items in one step. [s1, s2, s3]

Koi positions itself as a new endpoint layer that complements rather than replaces existing controls. It governs the self-installed software that endpoint detection and response and device-management tools were not designed to inspect, and it markets the result as agentic endpoint security. Palo Alto Networks adopted that framing when it acquired Koi and built a category around it.

The competitive reality is that the capability is attractive to larger platforms. Palo Alto Networks now sells Koi standalone and folds it into Cortex XDR and Prisma AIRS, and other endpoint and software-supply-chain vendors work adjacent ground, governing agent connectors, build-pipeline dependencies, or container images rather than the installed software on the endpoint. [s10, s2, s9]

Koi reached enterprise traction quickly for a company founded in 2024. Independent reporting names OpenAI, Fireblocks, and FHLBank Dallas among roughly forty to fifty accounts, and the company reported passing one million dollars in revenue within eight months while protecting more than 500,000 endpoints. Its own account of early customers points to Fortune 50 organizations and large financial institutions.

The motion is direct enterprise sales rather than self-service purchase. Koi publishes threat research on live supply-chain compromises to build awareness among security teams, and buyers reach the product through a sales conversation rather than a public price or signup. [s8, s6, s13]

Koi's founders come from Israel's Unit 8200 with prior security-industry experience. CEO Amit Assaraf earlier founded the real-estate startup Landa, CTO Idan Dardikman leads the engineering, and CPO Itay Kruk came from Sygnia and Zscaler. The team built Koi after demonstrating a security gap in the Visual Studio Code extension marketplace.

Palo Alto Networks validated the team by acquiring Koi within roughly two years of its founding, in a reported deal near $400 million, a rare in-domain outcome for founders this early. [s4, s7]

Koi publishes no inspectable security attestation. Its homepage footer shows image-only ISO 27001, SOC, and GDPR badges, but a probe on 2026-07-06 found no trust portal on a trust or security subdomain and no security page, and no third-party audit report is public. The self-display is a credibility floor rather than evidence of an independent audit.

For a control that screens software before it reaches endpoints, that missing report is a procurement question a security review will raise. Koi runs agentlessly and installs no software agent on the endpoint, which lowers one class of operational risk, but buyers evaluating it still lack an external assurance document. [s11, s1, s2]

Add analyzed competitors to compare them side by side with Koi.

Koi sells to the enterprise security and platform teams that must govern software their own employees and developers install. That buyer runs a growing sprawl of browser extensions, code and operating-system packages, AI models, AI agents, and Model Context Protocol servers, some of it able to execute code and reach sensitive data outside the antivirus and device-management tools built for static binaries.

The product is aimed at large organizations rather than individual developers. Independent reporting names OpenAI, Fireblocks, and FHLBank Dallas among roughly forty to fifty accounts, and Koi's own account points to Fortune 50 companies and large financial institutions. The design, an agentless control that spans macOS, Windows, and Linux and enforces org-wide policy, fits a centralized security team rather than one developer's tooling choice.

Koi's claimed advantage is a real-time risk engine that judges software by behavior and provenance rather than signatures alone. The Wings engine correlates code diffs, runtime behavior, ownership changes, update channels, network egress, and install source to detect malware, impersonation, and policy drift as software changes, and Koi describes it as an agentic AI risk engine.

A Supply Chain Gateway pairs the engine with enforcement. It screens incoming software from marketplaces and registries such as GitHub, Hugging Face, the Chrome Web Store, the Visual Studio Code Marketplace, and Homebrew, approving safe items and blocking or quarantining the rest by policy before they reach a machine. An independent Dell'Oro analyst locates that value at the install and supply-chain layer, where extensions and packages are a growing blind spot.

The depth is real engineering rather than a proprietary data or model moat. The risk signals come from public marketplace metadata and behavioral analysis a funded rival could reconstruct, so the advantage is the breadth of coverage and the real-time enforcement. A cross-customer telemetry signal could sharpen detection over time, but the public record does not evidence Koi pooling behavior across its customer base as a realized advantage.

Koi runs a direct enterprise sales motion. Buyers reach the product through a sales conversation rather than a public price or self-service signup, which points at negotiated enterprise deals. The founders' original research, which surfaced a major security gap in the VS Code extension marketplace, seeded credibility with security teams before a commercial conversation.

Named demand is unusually strong for the company's age. Independent reporting names OpenAI, Fireblocks, and FHLBank Dallas among roughly forty to fifty accounts, and Koi reported passing one million dollars in revenue within eight months while protecting more than 500,000 endpoints. The CEO also said every early customer stayed, an own-voice retention claim that independent sources do not yet corroborate.

The reviewed pages show no pricing. It routes buyers to a demo request and a sales conversation, which signals negotiated enterprise deals rather than self-service purchase, and it names no billing unit such as per endpoint or per user.

Without a public price or meter, what Koi charges for and how it scales cannot be read from the site, and a buyer gets no budget anchor before contacting sales. The enterprise motion and the reported early revenue points toward annual contracts, but the public record does not state the pricing model.

Koi runs as an agentless service across macOS, Windows, and Linux. It is agentless per its positioning, discovering and scoring software and enforcing policy centrally, a design that leaves no per-endpoint agent in the deployment path.

Because the Supply Chain Gateway can block an install, its decisions affect whether software reaches endpoints at all. That enforcement raises the operational stakes: a wrong block can stop a developer's tool, so approvals, cooldowns, and allow and block lists are the controls a change-management review will examine before the gate governs production installs.

Koi publishes no inspectable security attestation. Its homepage footer shows image-only ISO 27001, SOC, and GDPR badges, but a probe on 2026-07-06 found no trust portal on a trust or security subdomain and no security page, and no third-party audit report appears in the reviewed record. The self-display is a credibility floor rather than an independent audit a buyer can read.

For a control that decides which software reaches endpoints, the missing report is a procurement question a security review will raise. Koi runs agentlessly, which limits one class of risk, but a buyer evaluating the product still lacks an external assurance document, and the acquisition may fold Koi under a Palo Alto Networks trust program the standalone brand does not yet publish.

Koi presents itself as a horizontal control across every software marketplace rather than a single-marketplace tool. It tracks and gates software from GitHub, Hugging Face, the Chrome Web Store, the Visual Studio Code Marketplace, Homebrew, and more, positioning as the checkpoint any of these feed rather than a point product tied to one store.

Its ecosystem position is now defined by the acquisition. Palo Alto Networks says the acquisition enables a new Cortex XDR module and prospective Prisma AIRS integration, and keeps Koi's capabilities available standalone alongside existing endpoint detection and response. That places Koi inside a large security platform's roadmap, where the acquirer decides how deeply the standalone offering and the bundled capability diverge.

Koi's founders come from Israel's Unit 8200 with prior security-industry experience. CEO Amit Assaraf earlier founded the real-estate startup Landa, CTO Idan Dardikman leads the engineering, and CPO Itay Kruk came from Sygnia and Zscaler. The three built Koi after demonstrating a security gap in the Visual Studio Code extension marketplace.

Palo Alto Networks validated the team's execution by acquiring Koi within roughly two years of its founding in a reported deal near $400 million, and the founders join a larger platform. That speed of exit is a rare in-domain outcome, though it also reflects an acquirer choosing to buy the capability rather than let it grow independent.