Penetration tests usually produce a snapshot. For a few days, a team looks for weaknesses, validates some of them and delivers a report. Applications, APIs, identities and infrastructure keep changing after the PDF arrives. Palo Alto Networks wants to turn that snapshot into continuous monitoring with Unit 42 Continuous Frontier AI Defense, launched on September 22.
The service combines Unit 42 specialists with a multi-model orchestration layer. Its model set includes Anthropic's Claude Mythos 5, OpenAI's GPT-5.6-Cyber and open-weight models. This is not a chatbot completing a security checklist. Each model handles the type of test where it is expected to be most useful, while the system discovers exposures, tries to prove exploitability and sends prioritized remediation guidance.
From scanning to validating an attack
Finding a suspicious configuration is relatively easy. Showing that it can be chained with other flaws to reach a critical account, dataset or system is a different problem. That is where the service becomes interesting for engineering teams.
Palo Alto Networks says the service covers first- and third-party applications, APIs, cloud infrastructure, source repositories, identities and network assets. It creates a baseline, then keeps testing as the environment changes. Results may include code-level guidance and virtual-patching recommendations.
The design targets a familiar problem: security teams rarely lack alerts. They lack evidence about which alerts form a credible attack path. If AI only expands the backlog, it has automated the wrong part. The benefit appears when discovery, validation, remediation and retesting become a cycle fast enough to follow the software.
Why one model is not enough
Unit 42 says no individual model found more than 40% of vulnerabilities in its evaluations, while findings from Mythos 5 and GPT-5.6-Cyber overlapped by less than 10%. These are vendor-published results, not an independent benchmark, but they explain the architecture: different models see different parts of the problem.
For AI Engineering, this is a practical routing pattern. Instead of selecting one universal model, the harness matches capability, context and cost to the task. The principle resembles multi-model development pipelines, with one extra requirement: every conclusion needs reviewable evidence for a human specialist.
The company also describes a zero-data-retention architecture intended to keep customer code and telemetry from being retained or used to train public models. Responsible adoption still needs precise answers about where tests run, which data reaches each provider, who can authorize offensive actions, and how credentials and findings are isolated.
The numbers need context
In its internal deployment, Palo Alto Networks reports producing more than a year's worth of traditional penetration-testing results in three weeks, finding 3.2 times more high and critical vulnerabilities per product, and cutting mean time to remediation by 51%. The approach was also used across more than 100 customer engagements.
That is meaningful evidence, but it still comes from the vendor. A useful evaluation should also measure false positives, human validation time, how often engineering teams accept proposed fixes, and whether the issue stays resolved after retesting. Finding more weaknesses is not enough if the process slows delivery without reducing exposure.
The service is available worldwide through annual subscriptions. The important change, however, is not the model catalog. It is treating offensive security as a continuous process connected to the pace of software. For teams that still run one major test each year and spend the following months chasing the report, that may be the most uncomfortable and useful part of the announcement.