The deal would mark the cybersecurity firm’s fifth acquisition this year, according to a Wednesday (Nov. 4) report by The Information citing sources familiar with the matter.
The report said that Palo Alto CEO Nikesh Arora is looking to strengthen the company’s products that protect against new artificial intelligence (AI) threats. Israel-based Clutch makes software that helps companies monitor passwords and authentication codes used by AI agents.
The Information also noted the increasing demand for cybersecurity services due to AI-related threats, now that new models have demonstrated they can uncover vulnerabilities in popular software. At the same time, several high-profile incidents involving AI agents that have breached other companies’ systems has underlined the need for security tools that can identify, track and control customers’ AI agents.
These risks have sparked a series of recent acquisitions of startups offering protections against AI-related mishaps, The Information said. For example, HR and finance company Workday acquired startup C1.ai last month to manage AI agents as well as human identities.
In July, identity security company Okta acquired Permiso Security while rival Sailpoint purchased Entro Security in June. In both cases, the target companies focused on managing AI agent identities, the report added.
The findings come at a moment when AI is turning cybersecurity from an arms race into “a war of attrition, where the winner may be whoever can afford to keep fighting the longest,” as PYMNTS wrote last month.
This came after Sarah Breeden, deputy governor of the Bank of England, warned that advances in AI meant the technology now posed a “systemic risk” to the world’s financial system.
One day earlier, Bank of America CEO Brian Moynihan said his company had deployed 1,000 contractors and 3,000 employees to fix software flaws identified by Anthropic’s Mythos and other frontier AI models.
“The emerging imbalance is straightforward,” PYMNTS wrote. “An attacker can deploy inexpensive AI agents to probe software, identify weaknesses and test potential exploits around the clock. A company defending that software must determine which findings are credible, investigate whether systems are exposed, prioritize remediation, deploy patches and verify that nothing breaks in the process.”
