Palo Alto Networks has updated its secure access service edge (SASE) solution with a range of software-as-a-service (SaaS) AI-centric features.

The Prisma SASE 4.0 update introduces a dedicated SaaS Security Posture Management (SSPM) capability to provide continuous, real-time insight into the behavior of SaaS-based AI agents, copilots, and plugins.

As recently reported by SDxCentral, network security faces a new challenge with the rise of agentic AI models.

Cisco recently suggested that the growing number of AI agent deployments will become equivalent to “80 billion” users, posing an identity challenge for networks in the future. In response, vendors such as CrowdStrike have released solutions to detect human users, machine accounts, and AI agents on the network.

Palo Alto’s SSPM solution is said to automatically discover and monitor these agents, giving administrators visibility into which ones access sensitive data, how they are used, and where potential risks arise. In addition, the tool can enforce guardrails to prevent excessive autonomy, regulate user interactions, and block unauthorized access, helping organizations adopt AI responsibly while maintaining innovation.

The SASE platform’s AI reach also extends to the browser level. Palo Alto claimed in-built web protection for Prisma Browser monitors and discovers more than 5,000 AI apps, enforcing responsive access policies, real-time user guidance, and AI-assisted approval processes.

Here the network security focus is on managing shadow AI, the low-key, unmanaged usage of AI apps in an organization which can lead to unsanctioned and invisible data leaks. That increasing threat to the network saw Cato Networks acquire AI governance platform Aim Security this week for integration into its SASE platform.

No updates to Palo Alto’s own agentic AI tool within its SASE offering, Prisma Copilot, were featured in the latest updates. That tool, released last spring, was designed to prioritize risks by analyzing potential attack paths, suggesting remediation options like code fixes, and assisting with security investigations by correlating cloud asset information and automating administrative workflows.

Elsewhere in Prisma SASE 4.0

Prisma SASE 4.0 also includes AI-augmented data classification, which focuses on critical assets such as patents, contracts, and source code. Built on more than 140 pre-trained machine learning (ML) classifiers, Palo Alto said the tool automatically and accurately pinpoints sensitive data, delivering 10-times fewer false positives than traditional regular expression (regex)-based methods.

The new update also includes the Private App Security tool, which is claimed to protect private applications by unifying web application firewall layers and automatically creating application fingerprints. This can enable enterprises to identify anomalies and stop botnets, API abuse, and zero-day exploits without the need for continuous manual updates.

Also featured is the Advanced DNS Resolver (ADNSR), which provides globally distributed, low-latency resolution with added AI-driven protections.

Palo Alto said organizations can direct DNS traffic to the resolver for baseline security without setting up a full tunnel, and if a tunnel fails, the Prisma Access agent automatically reconnects to ADNSR to maintain protection. The service inspects all DNS requests and responses in real time, while allowing centralized visibility and policy management through Strata Cloud Manager.

The new release comes as Palo Alto Networks was recently singled out for its SASE platform growth by Dell’Oro Group.

The analyst firm reported global SASE revenues increased 17% year-over-year (YoY) during Q1 of this year, hitting total sales of $2.6 billion for the quarter. The secure service edge (SSE) space posted a 15% YoY increase in revenues, with Palo Alto Networks noted for outgrowing “the segment fourfold with a 44% leap.”

This year’s SASE surge is feeding what the analyst firm had previously predicted would be a $17 billion market by 2029.