Zero Networks and Palo Alto cross from orchestration into enforcement, on Linux first

Zero Networks has expanded its Palo Alto Networks integration from policy orchestration into enforcement, adding containment of individual compromised assets and redirection of selected internal traffic into Palo Alto firewalls for Layer 7 threat prevention ^[1][3][4][5]. The consequence is that east-west traffic which would normally stay inside the segment it started in can now be deeply inspected, and anything flagged as malicious is blocked with the affected asset cut off ^[5][6].

The original February 2025 pairing was a context pipe ^[1]. Zero Networks discovered and tagged assets without agents, Palo Alto firewalls consumed those tags as Dynamic Address Groups, and policy followed a device when it moved ^[2]. Useful, but it stopped at telling the firewall who was who.

What changed is the granularity of the response and the path traffic takes. Containment now applies to a single asset rather than requiring an entire segment to be pulled offline ^[4], which is the difference between a contained incident and a self-inflicted outage. Redirection puts firewall inspection on internal flows ^[5]. Assets and policies managed by Zero Networks also appear inside Strata Cloud Manager, so discovered inventory, applicable segmentation policy and the firewall controls inspecting the traffic sit in one console ^[8], with dynamic tagging keeping the view current as workloads shift and IP addresses change instead of hand-maintained static rules ^[9].

Now the fine print that decides whether any of this lands in a real estate: redirection runs on Linux today, and Windows support is planned ^[7]. Zero Networks itself frames Windows as much of the enterprise attack surface ^[7]. So the deep inspection story currently applies to the part of the fleet that is generally better instrumented already, while the domain-joined desktops and Windows servers where lateral movement usually happens wait. Automated microsegmentation, dynamic asset tagging, policy synchronization and Linux traffic redirection are available now ^[16]. Windows redirection has no release date ^[17].

The second half of the announcement is the AI agent piece, tying Zero Networks AI Segmentation, launched in April, to Prisma AIRS ^[10]. The problem statement is reasonable: agents connect directly into applications, models, databases and production systems while carrying valid credentials and broad permissions ^[11], which, according to Zero Networks, makes manipulated or compromised activity hard to distinguish from ordinary automation ^[12]. Its software identifies agents and sets deterministic, identity-based boundaries on where each may connect, blocks unsanctioned AI services outright, and can send traffic to Prisma AIRS for inspection of prompts, responses and data ^[13]. That integration also has no release date ^[17]. Of the six capabilities described, four ship and two do not ^[18].

Co-founder and Chief Executive Benny Lakunishok said customers "should not have to stitch together separate controls" for firewalls, internal assets and AI agents, with Zero Networks deciding which connections are permitted and Palo Alto running the deep inspection ^[14]. Neither company is asking for a network redesign; the work runs on enforcement capabilities both platforms already ship across on-premises, cloud, operational technology, Kubernetes and hybrid environments ^[15].

Watch for a Windows redirection date and, when it arrives, what redirecting Windows east-west traffic through a firewall does to latency and firewall capacity. Zero Networks, founded in 2019, has raised more than $100 million, with Highland Europe leading a $55 million Series C in June 2025 ^[19].