Modern endpoints are evolving at machine speed with an ungoverned AI ecosystem. Driven by agentic artifacts, the attack surface expands faster than legacy security architectures can adapt—letting AI-accelerated threats progress from initial breach to data exfiltration in as little as 25 minutes. Traditional EDR was not built for this reality. It was designed to watch processes, files, and users, not agentic supply chains, and siloed tools cannot connect the dots across surfaces. As a result, the question for security leaders is changing. It is no longer just "what is running on my endpoints?" but "what is acting on my endpoints?" Answering it requires a platform that sees across AI, identity, and data at once. The endpoint is where all three converge, which makes it the right foundation for securing this new frontier.
As the pioneer of XDR, we are defining what comes next. Today, we are proud to unveil Cortex XDR One, delivering AI-driven endpoint protection built for autonomous agents.
Key Highlights of the 6.0 Release
- Agentic Endpoint Security in the SOC: Cortex XDR One brings XDR and Agentic Endpoint Security (AES) together in a single console and sensor. It discovers every agent, MCP server, plugin, model, and extension and scores the real risk each one introduces, with optional 24/7 Unit 42 managed expertise.
- Native App Control for Cortex XDR & AES: Discovers every executed binary on managed endpoints and enforces tailored allow or block policies with intelligent guardrails.
- Runtime Protection and AI Detection & Response (AIDR): Captures every action an AI agent takes into a session-centric audit trail and intercepts policy-violating actions before they execute.
- Cortex Targeted Sensor: Deploys only the modules you need such as AES or the Active Directory Security Posture Management (AD-SPM) alongside existing third-party EDRs, with a one-step path to the full Enterprise XDR Sensor.
- AI-Powered Protection: Combines AI-Powered Behavioral Threat Protection with Small Language Models (SLMs) running on the endpoint to stop zero-days, living-off-the-land attacks, and obfuscated scripts.
- Extended On-Write Protection: Performs real-time hash reputation checks across all WildFire-supported file types on Windows, macOS, and Linux the moment a file is written to disk.
- AI-Powered YARA Rule Management: Lets threat hunters auto-generate, noise-validate, and sweep custom detection logic across the fleet via AgentiX AI.
1. Extend Agentic Endpoint Security into the SOC
Enterprises are adopting AI agents and AI-enabled tools faster than security teams can inventory them. Every agent brings models, plugins, MCP servers, extensions, and dependencies, and any of them can change through a silent update. Security teams are left managing two disconnected problems in separate tools: traditional endpoint threats and the emerging risks of agentic AI. Even when they find these components, they lack a reliable way to judge which ones are actually dangerous.
Cortex One unifies both problems. Cortex XDR and AES now share a single console and sensor experience, giving you complete visibility and control across your endpoint ecosystem, including AI adoption. Cortex AES scans all public sources to evaluate risk by analyzing publisher identity, code composition, and runtime behavior. This ensures every agent, MCP server, plugin, model, and extension is assessed the moment it is discovered on your endpoints. Additionally, these signals are continuously scanned, producing a dynamic, context-aware risk level that evolves with real-world threats rather than a one-time snapshot. With it, you can govern the agentic supply chain against risky components and silent updates, and enforce guardrails and policies at scale across both EDR and AES. Organizations that want to extend their team can have dedicated Unit 42 security expertise manage agentic endpoint security around the clock. Unit 42 Managed AES provides continuous AI governance, proactive threat hunting, 24/7 investigation and response, and AI-related cyber hygiene to help organizations securely adopt and manage AI at scale.
The operational impact is a single pane of glass for a problem that previously required several. Security teams understand their exposure quickly, prioritize remediation by actual risk rather than by inventory size, and enforce policy with confidence. Leaders get a defensible answer to the question every board is now asking: how are we governing AI on our endpoints?
Figure 1. Cortex AES Managed by Unit 42
2. Native App Control with Cortex XDR & AES
You cannot control what you cannot see. On most endpoints, the complete inventory of executed binaries remain a blind spot where unsanctioned tools, risky software, and attacker-introduced binaries hide. As autonomous AI agents begin launching and chaining executables on their own, this visibility gap only grows wider.
App control delivers complete visibility across both Windows and Mac endpoints, allowing security teams to enforce governance with intelligent guardrails. Delivered natively through Cortex XDR and Agentic Endpoint Security (AES), the existing XDR agent acts as your enforcement point. It requires no separate tool to deploy, no complex integrations, and no additional console to monitor. Instead of hunting for context across individual endpoints, security teams can now manage their entire environment through a single, unified workflow.
Complete enterprise visibility starts with a comprehensive binary inventory that discovers every executable running across your endpoints. To act on these insights, granular governance controls allow admins to build tailored allow or block policies at the publisher, application, or single-file level. These policies can then be scoped to specific device groups, tested for potential operational impact prior to enforcement, and paired with built-in end-user approval requests to keep business moving safely.
Beyond policy creation, forensics logs every action's user, location, timing, and enforcement rationale. This gives teams the exact context needed for fast investigations, audits, and policy tuning. Additionally, application discovery helps eliminate software sprawl by flagging tools (such as unauthorized remote access utilities) while proactively alerting teams about weak or expiring signing certificates.
To complement high-level application policies, guardrails automatically block execution from high-risk paths. Attackers frequently drop malicious payloads into user directories because they are easy to access and rarely draw attention. Because legitimate software almost never executes directly from these locations, enforcing execution blocks in these folders neutralizes threats right away with zero impact on everyday productivity.
Figure 2. An application being blocked by a Cortex AES app control policy
3. Cortex AES Runtime Protection and AI Detection & Response (AIDR)
Coding and desktop agents work autonomously: they read files, run shell commands, invoke MCP tools, and reach out to the network with the developer's privileges. Since fixed security rules can't predict what an AI agent will do while running, security teams need to monitor and block risky actions in real time. Runtime protection brings visibility and enforcement together. Cortex AES captures every agent action across the environment into a single, normalized audit trail and intercepts actions that violate guardrails or custom policies before they execute. Secrets stay on the endpoint, dangerous commands stay out of production, and unvetted tools stay out of the agent loop, with minimal disruption to end user workflows.
Rather than flooding analysts with disconnected events, AI Detection & Response (AIDR) centers visibility around sessions, a continuous interaction between a user and an AI agent. AIDR uses native hooks to capture and correlate every prompt, shell command, file read, tool invocation, and network call directly at the agent loop level. Analysts no longer need to stitch together logs by timestamp or endpoint. Teams can see the full story with Cortex AES: what the user requested, what tools the agent reached for, what files were touched, and what actions were blocked.
While AES standalone provides runtime visibility for coding agents with built-in hooks, many everyday desktop AI applications and developer environments lack native integration points, creating a critical blind spot. By pairing AES with Cortex XDR, protection expands across the enterprise to cover widely used AI applications and CLI tools including Hermes, ChatGPT, OpenClaw, and Claude Desktop. Open-source execution frameworks represent a growing security gap because they can route prompts to any LLM or model, including open source or self-hosted models, creating high exposure for data exfiltration and ungoverned AI activity. The combined solution intercepts the outgoing prompts and provides visibility to the incoming responses to enforce real-time blocking across all model destinations.
To help teams quickly harden their environments, our security team has introduced out-of-the-box AI runtime policy templates. Mapped directly to the MITRE ATLAS framework, these preconfigured rules allow you to address known agent risks in just a few clicks.
Figure 3. Cortex AES AIDR runtime scope
Figure 4. AI Agent Runtime Policy Violation
4. Cortex Targeted Sensor
Every organization moves to a new endpoint platform on its own timeline. Many teams want to add agentic and identity security now, while keeping the EDR they already rely on, and running multiple full sensors side by side adds complexity.
The Cortex targeted sensor introduces a new deployment model. Customers deploy only the security modules they need, such as AES or Identity threat detection and response (ITDR), to run alongside existing third-party EDRs without conflict. When you are ready, you can flip instantly to the full Cortex enterprise XDR agent at any time.
The impact is flexibility. You gain protection where you need it now, and you keep a clear, low-friction path to consolidation when it makes sense for your organization.
5. AI-Powered Protection
Attackers are increasingly evading signature and file-based defenses. Zero-day exploits and living-off-the-land techniques abuse legitimate operating system tools, while fileless scripts hide intent until the moment they run. Defending against them requires AI-driven protection that updates as new attack patterns are identified and analyzes behavior directly on the endpoint.
Cortex XDR 6.0 delivers two complementary layers. AI-powered behavioral threat protection (BTP) continuously monitors runtime process chains to block zero-day exploits and living-off-the-land attacks. New protections are validated and delivered through regular content updates, with no agent upgrade required. Complementing it, optimized small language models (SLMs) execute directly on the endpoint sensor to analyze hidden scripts before they run.
The result is real-time protection against fileless threats, without performance degradation and with zero deployment overhead. Every detection raises a clear alert, so analysts can see when AI-powered protection stopped an attack and why.
Figure 5. High-severity AI language model security event detected by Cortex
6. Extended On-Write Protection
Extended on-write protection performs real-time hash reputation checks across all WildFire-supported file types, and it prevents attacks at the exact moment a file is written to disk. File types are identified by their content rather than their extension, so renaming a file does not hide it.
The impact is broad, consistent on-write coverage across your entire endpoint environment, and a stronger answer for auditors, evaluators, and red teams. A malicious file that previously slipped through unnoticed becomes a blocked and documented event.
7. AI-Powered YARA Rule Management
When new threat intelligence arrives, the natural next question is: is this file on any of my machines? Cortex XDR 6.0 makes that easy to answer. Threat hunters can take a rule and check it across the environment on demand, without custom scripts or remote sessions.
Bring your own YARA rules, or have AgentiX AI generate them for you. Before a rule runs, the platform checks it for errors, and AgentiX can confirm what it is meant to catch and how noisy it is likely to be. Each match comes back as a searchable event with the file's name, hashes, signer, and host details. From there, threat hunters can add the hash as an IOC, isolate the endpoint, or hand the next steps to a playbook.
One host's finding can become every host's protection, so threat hunters can go from discovery to prevention in a single step.
Other Key Updates from Cortex Add-on Modules
Additional licenses required.
- Advanced Email Security: A centralized threat inbox with automated analysis, email rendering, and AI-driven investigation summaries accelerates triage in a unified workspace.
- ITDR Identity Security Dashboard: A new unified dashboard brings identity posture and real-time runtime signals across human, non-human, and agentic identities into a single view.
- Endpoint DLP Enhancements: A new dashboard tracks module activation, primary egress vectors, and top-detected data profiles. This release also adds support for file-share channels, an upgraded file-retrieval mechanism for data-in-motion, and tab-level user identity visibility across supported web browsers.
- XDR Virtual Patching for Exposure Management: Protect vulnerable applications when patching and downtime are not an option. The Cortex XDR agent selectively blocks malicious traffic with high precision and minimal performance impact using active vulnerability data to activate targeted threat prevention signatures.
- Integrated Threat Intelligence: Cortex XTI combines native Unit 42 threat intelligence with third-party intelligence sources for enhanced threat coverage, enrichment, and prioritization across investigations. Extend threat hunting with a new retrohunting capability and a more robust Threat Intelligence agent.
- Cortex Data Security: Unifies DSPM, DLP, and DDR to protect sensitive data across cloud, SaaS, on-premises, and AI environments, extending XDR protection beyond the endpoint with unified data classification and connected prevention and detection. Email and browser coverage is planned for the future.
Built for Endpoints. Ready for Agents.
Cortex XDR 6.0 redefines what endpoint security must be in the age of AI. It brings agentic endpoint security into the SOC, scores the real risk of every agent component, and governs what agents do at runtime before risky actions execute. It gives you control over what runs with app governance, meets you where you are with flexible deployment, and stops evasive threats with AI that runs on the endpoint itself. It also turns threat intelligence into organization-wide answers in minutes.
This release advances our vision for a platform that protects the traditional endpoint and the agentic enterprise together, in one console, with one sensor, and with the expertise to back it. As AI reshapes how work gets done, 6.0 gives security leaders a foundation that is ready for what comes next.
See Cortex XDR 6.0 in Action
Register for the Cortex XDR 6.0 FWD here.