Palo Alto Networks' Cortex XCOR Aims to Automate Incident Response and Spare Engineers the Night Shift

Palo Alto Networks unveiled Cortex XCOR last week, an observability system that deploys AI agents to investigate infrastructure failures and propose remedies without human intervention. The platform promises to root-cause incidents in under three minutes on average, reducing the need to page engineers during off-hours.

The shift represents a departure from traditional observability tools centered on dashboards and manual troubleshooting. Cortex XCOR, built by the Chronosphere team following Palo Alto Networks' acquisition of that company in January, aims to move observability toward autonomous investigation and remediation.

Martin Mao, senior vice president and general manager of observability at Palo Alto Networks, explained the philosophy behind the product: We don't want to keep waking engineers up in the middle of the night to help them make sense of dashboards; to be clear… we don't want to wake them up at all. He noted that while the system defaults to a human-in-the-loop configuration, engineering leaders can gradually expand its autonomous permissions as confidence grows.

Reimagining the SRE Role

If platforms like XCOR gain traction, the responsibilities of site reliability engineers may shift substantially. Rather than spending hours on routine diagnostics, SREs could focus on strategic infrastructure improvements and architectural decisions.

Mao offered an analogy for this evolution: SREs will operate like airline pilots; they can rely on autopilot for smooth flying, but you still need an experienced pilot in the cockpit when something goes wrong. By automating troubleshooting, he suggested, teams free capacity for higher-level work instead of reactive firefighting.

The urgency of this shift reflects broader trends in software development. A BairesDev Dev Barometer study found that 42% of developers report AI now writes at least half their code, up from 12% a year earlier. This acceleration in code generation velocity creates corresponding pressure on operations teams to keep pace with security and stability demands.

Cortex XCOR Operator, an AI assistant bundled with the platform, helps operations teams manage this velocity by understanding user intent and serving as a conversational interface to specialized agents executing behind the scenes.

Rethinking Product Design for AI Reasoning

Mao reflected on how the product's capabilities are reshaping design philosophy at Palo Alto Networks. It caused me to fundamentally rethink how we design products. Rather than locking in rigid feature specifications, the company is now granting reasoning models appropriate access and capabilities, allowing them to discover multiple solution paths autonomously.

In traditional observability platforms, users juggle multiple roles simultaneously: investigating incidents, tuning alerts, adjusting dashboards, and managing data volumes. Cortex XCOR mirrors each of these functions with specialized AI agents optimized for end-to-end task completion in their respective domains.

According to Mao's blog post on the announcement, the AI SRE agent activates automatically when an alert triggers and reasons through root causes while recommending actions and mitigations in under three minutes on average. The system achieved a 75% success rate for root cause analysis in complex production environments, with an additional 19% of incidents where the analysis proved useful.

Speed Advantage Over Manual Investigation

Manual incident response typically consumes 20 minutes just to identify relevant issues, gather initial context, and locate the appropriate on-call engineer. By contrast, Cortex XCOR completes its investigation in a fraction of that time.

Mao acknowledged the current workflow: We're pleased with the current average response time of under three minutes as our customers become familiar with this new experience. For now, we start by paging the engineer when an incident occurs, and it typically takes a few minutes for them to log into the platform. In that time, XCOR has already completed the investigation, so three minutes fulfills our current needs.

As organizations gain confidence in the system's analysis and expand automation permissions, Palo Alto Networks intends to further reduce response times. Mao indicated the team has identified the path forward, noting that cost remains a critical consideration alongside declining token prices.

Building Full-Stack Visibility

Autonomous reasoning across the platform depends on complete end-to-end visibility and contextual information. In July, Palo Alto Networks announced plans to acquire Embrace, a Real User Monitoring firm, to integrate front-end RUM capabilities with its existing XCOR Synthetics and backend infrastructure observability into a unified full-stack platform.

The XCOR Fabric underpins this full-stack approach, supplying AI agents with real-time application, infrastructure, and institutional context. The fabric draws from the organization's knowledge graph—a real-time model of infrastructure, applications, and business logic—as well as operational memory capturing historical incident context, user behavior patterns from senior engineers, and human knowledge embedded in runbooks and operational documentation.

The Cost of Missing Out

Without observability advantages like those XCOR provides, engineering teams risk spending nearly all their time on reactive troubleshooting rather than innovation and business delivery. Since troubleshooting ranks among the most stressful aspects of an engineer's job, Mao warned this scenario could trigger massive burnout—a risk amplified by the proliferation of AI-generated code requiring oversight.

Mao used a vivid metaphor to describe the challenge of uncontrolled observability: Uncontrolled observability is like a hyperactive puppy. It's full of promise, but destroys your budget if left unchecked. As cloud-native and AI workloads send telemetry volumes skyrocketing, organizations need built-in discipline. Chronosphere puts those costs on a leash, ensuring teams get total visibility without the runaway bill. This is why data optimization and cost effectiveness remain central to XCOR's mission.