Palo Alto builds supply‑chain module

Palo Alto Networks used this week’s Cortex Cloud product push to make software supply-chain security a more explicit part of its AI-development pitch. In a company blog post published August 5, the company said it had launched a dedicated Software Supply Chain Security module inside Cortex Cloud to help customers prevent risk, measure software integrity and respond faster across AI-powered development workflows. The release adds two named features — Software Supply Chain Trust Scores and a Supply Chain Attack Threat Center — and ties them to software artifacts, CI/CD systems and other assets used across the software development lifecycle. ### What did Palo Alto actually launch? Palo Alto Networks said the new module is a dedicated software supply-chain security offering within Cortex Cloud, its broader cloud security platform. The company described the product as a way to secure code, pipelines, registries and third-party tools involved in building and shipping software. (paloaltonetworks.com) The August 5 post said the release includes Software Supply Chain Trust Scores, which are meant to help customers assess the integrity of software artifacts, and a Supply Chain Attack Threat Center, which the company said surfaces information on software supply-chain attacks, including CVEs, compromised tools and malicious packages. Cortex Cloud then analyzes a customer environment for affected assets, according to the company. (paloaltonetworks.com) ### Why is the company tying this to AI development? Palo Alto Networks said the module is designed for “AI-powered development” and framed the launch around the need to “build trust” into the software development lifecycle. The company’s product and documentation pages describe software supply-chain security as covering not only code and open-source components, but also development tools, CI/CD workflows, and human and non-human identities that interact with those systems. (paloaltonetworks.com) A separate Cortex Cloud 2.2 announcement published July 28 tied the broader release to “Frontier AI threats,” saying faster software development and faster attack discovery were increasing pressure on cloud security teams. That post presented software supply-chain security as one of several additions in the 2.2 update. ### What does Palo Alto say customers can see or verify? (paloaltonetworks.com) Palo Alto Networks’ documentation says software supply-chain security in Cortex Cloud is meant to provide visibility into repositories, pipelines, software packages and supply-chain tools. The company says customers can manage third-party integrations, review usage evidence, assess risk, and track approval status for tools. (paloaltonetworks.com) The company also says the platform records event history to support audit trails and compliance reporting, and its product pages position the offering as a way to consolidate findings from native and third-party scanners in one place. Those claims are part of Palo Alto’s own product marketing and documentation rather than an independent assessment. (docs-cortex.paloaltonetworks.com) ### How does this fit into Cortex Cloud? Cortex Cloud’s product pages describe the platform as a unified code-to-cloud security offering spanning application security, cloud posture and runtime protection. Palo Alto’s July 28 release for Cortex Cloud 2.2 said the update also added code-to-cloud tracing coverage and other features aimed at connecting code, cloud, identities and data. (paloaltonetworks.com) The software supply-chain module therefore sits inside a larger effort by Palo Alto Networks to present Cortex Cloud as a single platform for securing applications across development and production. The company’s code security and application security pages say the product scans infrastructure-as-code, container images, open-source packages and delivery pipelines earlier in the development lifecycle. (paloaltonetworks.com) ### What should readers watch next? Palo Alto Networks is likely to provide the next concrete details through Cortex Cloud release notes, product documentation and follow-on blog posts tied to the 2.2 rollout. As of August 6, the most specific public materials are the August 5 launch post for the module, the July 28 Cortex Cloud 2.2 announcement, and the company’s software supply-chain security documentation and product pages. (paloaltonetworks.com) (cortex-docs.paloaltonetworks.com)