Palo Alto Networks introduces Idira

What was announced?

Palo Alto Networks introduced Idira on 12 May 2026 and describes it as a next-generation identity platform. It followed the completion of the CyberArk acquisition on 11 February 2026. CyberArk documentation describes the secure AI architecture that sits behind the agent features.

What does Idira document for agents?

The documentation describes zero standing privilege for agents. Credentials are created, rotated and renewed rather than held permanently. An Identity Broker acts as a proxy between the agent and its tools. The broker obtains MCP tokens for agents and manages their rotation. In managed mode, the documentation describes full audit visibility.

These features lift Idira's lifecycle score to eight out of 10 and its audit evidence score to seven. Short-lived credentials (GOV-05) are documented. Per-action policy (GOV-06) and per-action audit (GOV-13) are partly documented. The broker sits in the call path, but the policy semantics and person linkage are not described in detail.

What was not found?

Several controls the register checks were not found in the public material we read.

• Owner mapping for agents was not found, so ownership scores five.
• Human approval for high-risk actions was not found, so approval scores two.
• Agent-specific discovery sources were not found. Continuous identity discovery is described in general terms, so inventory scores six.
• Policy is described as AI-powered, but its semantics are not published, so policy scores six.

Not found does not mean absent. It means a buyer should ask for a demonstration.

How is Idira sold?

Idira is sold as add-on licences. No price is published. Buying clarity scores five.

Where does Idira sit in the register?

Idira ranks tenth of ten with a total of 5.50. The gap to ninth place, Clutch Security at 6.35, is mainly ownership and inventory. The gap to the leader, NewCore at 9.10, is mainly ownership, policy and approval.

Who should consider it?

Organisations that already run Palo Alto Networks or CyberArk products may find Idira the shortest path to short-lived agent credentials. Pair it with a review of how owners and approvals will be handled, since those were not found in its public material.

What will we recheck?

At the next monthly review we will look for published policy semantics, owner mapping and any approval workflow. If Palo Alto Networks publishes material on any of these, the relevant scores will be reviewed and the change dated in the corrections log.