Palo Alto Networks unveiled Cortex XCOR, an AI-powered observability platform that automatically identifies root causes of incidents and proposes remediation steps, aiming to reduce nighttime engineer wake-ups. The announcement represents a broader industry shift away from static dashboards and manual troubleshooting toward autonomous AI agents that investigate problems and recommend solutions without human intervention.

Developed by the Chronosphere team following Palo Alto Networks' January acquisition of the cloud-native observability and telemetry pipeline company, Cortex XCOR transforms observability into an AI-first workflow that handles both routine and intricate investigations. When an alert triggers, the platform deploys a specialized agent that independently analyzes underlying causes and suggests corrective actions.

Martin Mao, senior vice president and general manager of observability at Palo Alto Networks, explained the philosophy behind the tool: "We don't want to keep waking engineers up in the middle of the night to help them make sense of dashboards; to be clear… we don't want to wake them up at all." He noted that while the system defaults to human oversight, engineering teams can gradually expand its autonomous capabilities over time.

Shifting SRE work from reactive to strategic

If platforms like XCOR gain widespread adoption, the site reliability engineer role may evolve beyond routine dashboard monitoring and troubleshooting. Mao drew a parallel to aviation: "SREs will operate like airline pilots; they can rely on autopilot for smooth flying, but you still need an experienced pilot in the cockpit when something goes wrong." By automating root cause analysis, engineers can redirect effort toward architectural improvements rather than incident response.

This shift becomes increasingly important as development velocity accelerates. A BairesDev Dev Barometer analysis found that 42% of developers report AI now writes at least half their code, up from 12% the previous year. This acceleration in code generation requires matching oversight and operational discipline.

Palo Alto Networks introduced XCOR Operator, an AI assistant designed to help operations teams maintain pace with AI-driven development velocity. The tool understands user intent and serves as a conversational interface for specialized agents executing tasks in the background.

Rethinking product design for reasoning models

Mao reflected on how the platform's capabilities influenced product philosophy: "It caused me to fundamentally rethink how we design products." Rather than locking features into predefined specifications, the team is now granting reasoning models appropriate access and capabilities, allowing them to discover multiple paths to solutions.

In typical observability deployments, users juggle multiple responsibilities—investigating incidents, tuning alerts and dashboards, optimizing data volumes. Cortex XCOR mirrors each role with task-specific AI agents optimized to complete end-to-end workflows.

According to Mao's blog post on the update, the AI SRE agent completes root cause analysis in under three minutes on average, achieving a 75% success rate for complex production environments and an additional 19% of incidents where the analysis proved useful. Manual investigation typically requires 20 minutes just to locate relevant issues, gather context, and identify the on-call engineer.

Current limitations and future roadmap

For now, Cortex XCOR pages engineers when incidents occur, but Mao noted the platform often completes its analysis before the engineer logs in. "We're pleased with the current average response time of under three minutes as our customers become familiar with this new experience," he said. As teams gain confidence in the analysis and expand automation, Palo Alto Networks plans to reduce response times further, with cost optimization and declining token prices as key factors.

Complete end-to-end visibility is essential for the platform's autonomous reasoning capabilities. Palo Alto Networks announced in July its intent to acquire Embrace, a real-time user monitoring firm, to combine front-end RUM (XCOR RUM) with its XCOR Synthetics and backend infrastructure observability into a unified full-stack platform.

The cost of missing observability advantages

Mao warned that without such observability capabilities, engineering teams risk spending all their time firefighting rather than innovating. Since troubleshooting is already the most stressful aspect of engineering work, this could trigger "massive burnout"—a risk amplified by the proliferation of AI-generated code.

He also highlighted the importance of cost control: "Uncontrolled observability is like a hyperactive puppy. It's full of promise, but destroys your budget if left unchecked. As cloud-native and AI workloads send telemetry volumes skyrocketing, organizations need built-in discipline. Chronosphere puts those costs on a leash, ensuring teams get total visibility without the runaway bill. This is why data optimization and cost effectiveness remain central to XCOR's mission."

The XCOR Fabric underpins this full-stack visibility strategy, providing AI agents with real-time application, infrastructure, and institutional context. It draws from the organization's knowledge graph—a real-time model of infrastructure, applications, and business logic—as well as operational memory from past incidents, user behavior patterns, and human knowledge embedded in runbooks and documentation.