New Features - Prisma AIRS - July 2026

Prisma AIRS now supports AI Gateway functionality. An AI Gateway acts as a centralized control plane for enterprise AI. It acts as a secure proxy built specifically for AI traffic; think of it as a digital toll booth that has complete visibility of all AI interactions within the enterprise. It helps track costs and usage across teams, models, and apps so budgets stay predictable. It allows total visibility into runtime behavior of models, apps and agents. It can integrate with different security guardrails so that every interaction can be monitored for threats. You can use this functionality to centrally enforce policies and govern how AI is being used within your organization.

Prisma AIRS AI Red Teaming introduces Custom Target Adapter, extending the platform's ability to scan any AI target an organization deploys, regardless of how that target handles authentication, session management, or response formatting. The goal is straightforward: any AI application that a human red teamer can interact with should be scannable by AI Red Teaming without requiring custom middleware.

Enterprise AI targets rarely expose a simple, stateless API. They require creating sessions before accepting messages, refreshing authentication tokens that expire mid-scan, threading conversation identifiers across multi-turn interactions, or returning AI responses in proprietary formats that standard extraction cannot parse. Until now, connecting these targets required building and maintaining a bespoke proxy server, a significant effort that could take weeks per target and introduced ongoing operational overhead. Custom Target Adapter replaces this with a standardized approach that is seamless and quick to configure.

Custom Target Adapter uses a simple Python SDK where customers implement plain functions that control how requests are prepared and how responses are processed. The SDK supports automatic token refresh with configurable expiry, session creation and state management across multi-turn conversations, flexible response extraction from any format, and explicit error signaling for rate limits, authentication failures, and content filtering. For targets that use non-HTTP protocols such as WebSocket, a full request override is available.

To configure Custom Target Adapter section in the AI Red Teaming web interface, create a Python script, define any required variables and secrets, and validate end-to-end before linking to a target. Validation runs the complete communication chain so configuration issues surface before a scan begins. A single processor configuration can be shared across multiple targets, with per-target overrides for environment-specific values.

If your organization scans AI applications that require authentication flows, session-based conversations, or return responses in custom formats, Custom Target Adapter provides native connectivity without external middleware. This is particularly valuable for teams running long-duration dynamic scans against OAuth-protected targets, testing multi-turn attack scenarios against session-based chatbots, or scanning AI applications with proprietary API contracts that standard connectors cannot accommodate.

You can now define custom security rules in Prisma® AIRS™ AI Model Security to enforce organization-specific policies alongside the built-in managed rules during model scans. Each custom rule operates at the tenant level, evaluating a combination of model scan labels and the pass/fail results of managed rules using AND/OR logic. When the rule's condition matches, it returns the violation message and remediation steps you define, giving your team clear, actionable guidance.

You set the rule_action to FAIL, which flags a violation when the condition matches, or PASS, which flags a violation when the condition does not match. After creating a rule, you assign it to one or more security groups with a state of BLOCKING, ALLOWING, or DISABLED, controlling whether violations affect scan outcomes. A custom rule is evaluated only for scans that use a security group it has been assigned to, and you cannot assign an archived rule without unarchiving it first.

Custom rules are useful when managed rules do not cover your organization's requirements, such as enforcing label-based policies on production models or combining multiple managed rule results into a single compliance check. You can create, update, archive, and unarchive custom rules through Strata Cloud Manager, the CLI, or the Python SDK.

The feature supports up to 100 active custom rules per tenant, 25 rule assignments per security group, and condition expressions with up to 25 levels of nesting and 100 leaf nodes.

Customizable Goal Categories is an agent scan configuration enhancement for Prisma AIRS AI Red Teaming that gives you direct control over which goal categories the system uses when generating attack goals for your AI targets. Previously, AI Red Teaming distributed these goals across different categories with no transparency into which specific goals are being tested and no mechanism for you to select the ones that matter the most for your deployment. The enhancement solves this gap by surfacing goal categories as a first-class configuration option in the new scan setup workflow.

Additionally, the agent scan report is enhanced to give you full visibility into the goal category and corresponding result. Each goal in the report carries a category badge so you can immediately see whether a goal was testing tool misuse, goal manipulation, or any other attack vector. Exported reports in CSV and PDF format include a goal_category field against each goal so you can perform this analysis in downstream tooling.

This feature would be helpful when your AI deployment has a specific, well-understood attack surface that a generic goal distribution does not adequately cover. For instance, if you are securing an agent with extensive tool-calling capabilities, opting in for Tool Misuse over others lets you maximize coverage of the exact risk vector your deployment exposes. If you are evaluating a model's risk to generate harmful content ahead of a production release, you can select Toxic Content Generation to ensure thorough testing without diluting results with categories that are not applicable to the model.

Palo Alto Networks introduces a redesigned transport architecture for cloud-delivered security services that eliminates performance bottlenecks in the Multi Inline Cloud Analysis (MICA) data forwarding channel. This architecture improves inline cloud analysis for Enterprise DLP, Advanced Threat Prevention, Advanced URL Filtering, Advanced WildFire, Prisma AIRS (AI Runtime Security), and ACE (App-ID Cloud Engine) when used alongside SaaS Security Inline, and AI Access Security.

The new architecture removes the fixed-core transport limitation that previously constrained cloud submission throughput regardless of available hardware resources. All data plane cores now natively handle payload forwarding to the cloud through a scalable connection pool. Each connection is established directly from the data plane over TLS, eliminating the intermediate process that previously serialized all cloud submissions through a single core.

The redesigned transport reduces latency by replacing protocol translation layers with a direct binary protocol between the data plane and advanced service addresses. Native PAN-OS memory pools replace the previously fixed-size memory allocation, reducing dedicated memory consumption and increasing overall system capacity. The newly introduced Advanced Forwarding discovery service dynamically assigns advanced service addresses based on your NGFW's location and configuration, improving reliability and enabling automatic failover without manual intervention.

When Advanced Forwarding is enabled, the NGFW establishes TLS connections directly from the data plane to the cloud. To use the legacy transport instead of Advanced Forwarding, you must manually disable Advanced Forwarding. The NGFW does not automatically fall back to the legacy transport method.

AI Red Teaming Multimodal File Attacks extends the Attack Library scan to include file-based attack delivery for AI targets that accept document uploads. When you enable this feature, the scan delivers PDF and Markdown (MD) files with malicious prompts from a curated library alongside your existing text-based attacks and surfaces the results in the same scan report. This gives you coverage of the file ingestion attack surface that text-only scans cannot reach.

To configure a target for file-based attacks, you enable the File Modality option in the target configuration wizard and map the file content and MIME type fields to the corresponding fields in your API request. If you paste a cURL command, the system auto-detects the file fields in the request. When you run an Attack Library scan against this target, you select the Attack Modality (Text only or Text and File) to control how AI Red Teaming delivers attacks. After the scan completes, you can filter the Attack Details report by Attack Modality to view text or file-based findings.

If your AI deployment includes an application or agent that processes uploaded files, such as a document summarizer, text-only scans cannot test those file ingestion pathways. An attacker can embed prompt injection instructions, system prompt extraction commands, or data exfiltration payloads within the text layer of a PDF or MD file. The target processes the document, executes the embedded instructions, and the attack succeeds (none of which a text-only scan detects). The file-based attack testing tests these pathways by delivering curated documents with malicious prompts through the same scan pipeline you already use.

Note: The PDF and MD file formats are supported. File attacks consume the same scan quota as text attacks, and no changes to your existing license are required.

Palo Alto Networks is migrating Prisma AIRS Discovery services to a new infrastructure (the Multi Cloud Security Fabric (MSF) platform)). This change affects existing customers who have onboarded cloud accounts and requires action depending on your cloud provider:

Azure

• Azure accounts will be disabled after migration due to a perimeter firewall public IP change.

• To restore access, add the new perimeter firewall public IPs to your allow list for Azure storage flow logs.

• Cloud IP Tag (CIPT) service remains unaffected and continues to function during and after migration.

AWS

• Account enable/disable status is not affected.

• Customers with public clusters must add new perimeter firewall public IPs to their API server allow list to continue discovering container workloads.

• Cloud IP Tag (CIPT) service is unaffected.

GCP

• GCP accounts will be disabled after migration due to the new Service Account on MSF infrastructure.

• You need to download and apply the GCP account onboarding terraform after migration.

• CIPT continues to function on the existing account; once a new GCP account is onboarded and CIPT is reconfigured, the old account can be deleted.

Note : Delicensing will not be available during the migration maintenance window.

Strata Cloud Manager now supports tenant-level onboarding for Azure Tenants in Prisma AIRS, enabling you to bring your entire tenant under SCM management in one streamlined workflow—eliminating the need to onboard each subscription individually.

You can now license Hyperscale Security Fabric (HSF) clusters in air-gapped or internet-restricted environments, eliminating the need for HSF nodes to contact the Customer Support Portal directly during licensing. Previously, HSF licensing required each cluster node to reach the Customer Support Portal to validate and activate its subscription — a workflow that fails in secure data centers, government networks,and private cloud environments where firewall nodes have no outbound internet access.

HSF Offline Licensing routes all license operations through Panorama, which acts as the license distribution point for the entire cluster. You generate a Panorama Air-Gap license file from the Customer Support Portal on any internet-connected machine, upload it to Panorama, and Panorama distributes license credentials to each P-Node and S-Nodeduring bootstrap. The same license file covers both node types — the file procures the correct number of credits from the Customer Support Portal based on the CPU core count of each instance. Each node still receives a unique serial number, and the cluster operates with full security inspection capability from the moment it comes online.

You can use offline licensing to manage the full license lifecycle without exposing your cluster to the internet. This includes license renewals, HSF subscription changes, node deactivation, and credit reclaim. When you modify the number of planned vCPUs per firewall or add subscriptions in the Customer Support Portal, download the updated Panorama Air-Gap file and re-upload it to your existing offline license profile on Panorama to keep all nodes current.

The Security Lifecycle Review (SLR) report gives you a comprehensive view of application workloads, traffic flows, and threats detected across your cloud infrastructure. Prisma AIRS expands SLR coverage to Azure by adding support for inline and monitor-mode AI Runtime firewalls, while restructuring multi-account reports for clarity.

Prisma AIRS AI Red Teaming now includes Tool Chaining as a new attack category within agent-led scans. When you select the Tool Chaining category in Agent Scans, the scan tests whether an AI agent can be manipulated into combining multiple individually safe tools into a dangerous sequence that results in unauthorized actions such as credential theft, data exfiltration, or unauthorized transactions.

Modern AI agents are designed to chain tools together to complete tasks, such as looking up account information, retrieving credentials, drafting messages, and sending communications as part of a single workflow. While each tool may pass its own security review in isolation, the combinations an agent constructs at runtime can create an attack surface that does not exist in traditional applications. An attacker who crafts the right request can cause the agent to execute a sequence of approved tools that, taken together, produce a harmful outcome, such as retrieving API keys and transmitting them to an external address, without any single tool behaving outside its intended function.

This capability systematically analyzes the agent's available tools, identifies which combinations can produce these outcomes, and validates that data can actually flow through each chain before testing it. This approach ensures that every chain tested represents a real, exploitable path rather than a theoretical concern. Results appear alongside existing findings in the scan report, grouped by outcome category.

Organizations deploying AI agents with access to multiple tools, particularly agents that handle credentials, manage data across systems, communicate externally, or modify access permissions, should enable this capability to identify exploitable tool combinations before attackers do. This is especially relevant for customer-facing agents, internal workflow automations, and any agent that bridges sensitive data sources with external communication channels.

Prisma AIRS removes the requirement of needing a minimum of 4 vCPUs. Prior to this release, Prisma AIRS required a minimum of 4 vCPUs, making it cost-prohibitive for customers migrating from 2 vCPU VM-Series firewalls — particularly for non-AI workloads. This feature introduces 2 vCPU support to reduce that barrier and improve adoption.

Note: 2 vCPU Prisma AIRS supports non-AI workloads only. AI traffic inspection requires a minimum of 4 vCPU. When you configure AI policy on a 2 vCPU device it will generate warnings and errors at both commit time and runtime.

The following use cases are supported:

• Container security. Enforce security policy for containerized workloads on lightweight 2 vCPU instances.
• Micro-perimeter. Protect east-west traffic and segment micro-services, consistent with existing 2 vCPU VM-Series deployments.

  Note: High-Speed Forwarding (HSF) is not supported on 2 vCPU Prisma AIRS.