Summary
- Unit 42 Continuous Frontier AI Defense uses gated OpenAI and Anthropic models alongside open-weight models to identify and validate exposures.
- Palo Alto says the service moves from point-in-time assessment towards continuous retesting as applications and infrastructure change.
- The launch puts advanced offensive-model capability inside a commercial assurance service, adding new scope, authorisation, and procurement questions.
Palo Alto Networks has launched a subscription service that uses frontier AI models for continuous offensive security testing across applications, APIs, cloud infrastructure, source-code repositories, and network assets.
Unit 42 Continuous Frontier AI Defense uses a multi-model system that can draw on gated cyber-capable models from Anthropic and OpenAI alongside open-weight models. Palo Alto describes the service as moving offensive testing away from a point-in-time exercise towards a process that repeatedly reassesses an environment as applications and infrastructure change.
The offering builds on Unit 42’s Frontier AI Defense work launched earlier this year. The new service begins with a baseline assessment and then continues testing as the customer estate changes.
Palo Alto says its model harness routes work to the model considered most suitable for a particular task. Testing can extend from finding a potential weakness to validating whether it forms part of an exploitable attack path, after which the service produces prioritised remediation information.
The company says the service can test first- and third-party web applications, APIs, cloud infrastructure, source-code repositories, and network assets. That gives the platform a broader scope than vulnerability scanning based solely on published CVEs or known software versions.
Palo Alto developed the approach over six months of internal testing and more than 100 Unit 42 customer engagements, backed by a reported $17 million research and development investment. Those figures, along with the efficacy data released alongside the launch, are company-reported rather than independent performance measurements.
In customer assessments, Palo Alto said exposures were identified in every participating organisation, with 37% rated high or critical. It also said more than two-thirds of the exposures found in third-party applications did not have a known CVE.
The results support the commercial argument behind continuous offensive testing: exposure can arise from configuration, application logic, identity relationships, chained attack paths, and bespoke software as well as from publicly disclosed vulnerabilities.
The launch also changes the procurement context around frontier cyber models. Enterprises are not simply being offered AI-assisted alert triage or vulnerability prioritisation; they can now buy access to models intended to conduct more capable offensive testing against their own environment.
That creates a governance requirement around scope. Persistent testing needs durable rules about which assets can be targeted, what techniques are permitted, how sensitive data is handled, and how activity changes when the service encounters production rather than staging infrastructure.
Traditional penetration tests are generally bounded by a statement of work, a defined period, and a human testing team. An always-on service needs those boundaries to survive changes in cloud workloads, repositories, applications, and third-party connections.
The NCSC has separately argued that autonomous defensive action is constrained by the risk of disrupting live systems. Continuous offensive testing sits in a related but distinct position: it uses attacker-style methods for defensive assurance and still has to operate within limits that prevent the test itself becoming a source of operational harm.
Palo Alto says the service is available worldwide through annual subscriptions, with model options varying by package. The launch is another indication that frontier-model cyber capability is moving from research demonstrations into enterprise security services, where its effectiveness will be judged alongside questions of control, accountability, and repeatability.
