Firewall and Network Security: from Check Point to AI agents

The commercial firewall era starts with Check Point FireWall-1 in 1994. Its idea was stateful inspection: decide on the first packet of a connection, then track the session instead of judging every packet alone. Cisco followed with the PIX appliance and, in 2005, folded PIX, its IPS line and its VPN concentrators into the ASA 5500 series.

The model was a castle with a moat. A firewall sat between the trusted inside and the untrusted internet, and remote workers tunneled in through IPsec and later SSL VPNs. Anything inside the wall was trusted by default. That trust model is why the corporate VPN became the front door attackers kept walking through.

The work was manual. An engineer received a change request, found the right place in a rule base that could run to thousands of lines, typed the rule, and pushed it in a maintenance window. Nobody could say with confidence which old rules were still needed, so they stayed. Rule bases only grew.

What broke was visibility. A port-and-protocol firewall saw that traffic was on port 80. It could not tell you which application was running over it, which user sent it, or whether the allow rule written in 1999 still had an owner.

Palo Alto Networks shipped its first product, the PA-4000 series next-generation firewall, in 2007. The pitch was to classify traffic by application and user instead of by port. That fixed the visibility problem and set the template for every firewall that followed: NGFW boxes from Palo Alto, Fortinet, Check Point and Cisco, with intrusion prevention and threat subscriptions billed every year.

The same year, Zscaler was founded on the opposite bet: move the inspection into the cloud and send users to it. In 2010 Forrester analyst John Kindervag named the zero trust model, and in 2014 Google published how BeyondCorp removed the privileged intranet entirely. The perimeter idea was losing its intellectual footing well before it lost its budget.

In 2019 Gartner named the merger of these ideas SASE: SD-WAN plus secure web gateway, CASB, firewall as a service and ZTNA, delivered from the cloud. Pricing shifted from appliance refresh cycles toward per-user subscriptions.

The work itself barely changed. Engineers still wrote rules, now in more consoles. Policy managers like AlgoSec and Tufin appeared because enterprises ran several firewall brands at once and could not reason about them together.

NIST published SP 800-207 in August 2020, which gave zero trust a reference architecture that procurement teams could cite. Remote work did the rest. ZTNA and SASE moved from slideware to purchase orders, and the zero trust blueprint became the default design conversation for new networks.

AI arrived as an assistant. Check Point announced Infinity AI Copilot in January 2024, Fortinet put FortiAI into FortiOS that spring, and in May 2024 Palo Alto Networks launched Strata Copilot under its Precision AI brand. These tools answered questions in plain English, explained why traffic was blocked, and drafted rules. A human still reviewed and pushed every change.

Cisco took a different swing with Hypershield in April 2024, promising AI-driven autonomous segmentation enforced through eBPF. That was the first major vendor to say out loud that a machine should write segmentation rules.

Meanwhile the edge itself was on fire. In January 2024 CISA ordered federal agencies to mitigate exploited Ivanti Connect Secure flaws. In April 2024 a maximum-severity PAN-OS GlobalProtect bug was exploited as a zero day. The security appliances were now the target.

In 2025 and 2026 every large network security vendor shipped or announced agents that act, not just answer. Fortinet said in April 2025 that FortiAI-Assist could create configuration and policy updates and remediate network issues on its own. Cisco introduced AgenticOps and AI Canvas in June 2025. Palo Alto Networks launched Cortex AgentiX in October 2025 with a Network Security Agent for policy control across its own and third-party firewalls, gated by human approval for impactful actions.

Check Point went furthest on the rule base itself. Its Agentic Network Security Orchestration Platform, announced in May 2026, turns business intent into multi-vendor firewall rules, tightens unused access from live traffic, and maps changes to PCI DSS and NIST. Some pieces are available now; the Playblocks agents are in early availability. Zscaler added the ZAgent framework for SASE administration in June 2026, and Cato launched agentic threat prevention and CVE mitigation that it says can apply protections within 45 minutes.

Here is the honest picture. Agents in production today troubleshoot, find over-permissive rules, write draft policy and apply virtual patches. Write access to the rule base still runs through approval gates for anything consequential. AI Canvas sat in controlled availability in the US months after launch. Most vendor outcome numbers are self-reported.

The bigger shift is identity. Palo Alto Networks closed its CyberArk acquisition in February 2026, and its CEO framed it as securing every identity, human, machine and agent. As I argued in zero trust in the age of AI, the classic model assumed the actor was a person. Now the actor writing firewall rules may be an agent, and that agent needs its own dynamic authorization.

My bet is that by 2031 the firewall rule base stops being something people write. Humans will state intent, such as which team or agent may reach which application under which conditions, and agents will compile that into enforcement across NGFW, SASE and cloud controls, prune what is unused, and prove compliance continuously. That is the same direction as zero trust becoming the default for new networks.

The unit of policy will be identity, not address. Every user, workload and AI agent gets a verifiable identity and short-lived access, and the network enforces it. The acquisitions of 2025 and 2026, including Palo Alto Networks buying CyberArk, point straight at this.

The constraint is trust in the change itself. A bad rule pushed at machine speed is an outage or an open door at machine speed. So I expect routine tightening, troubleshooting and virtual patching to run with exception-only review, while new exposure to the internet, changes to crown-jewel segments, and anything touching the agent's own permissions stay behind a human approval.

The edge device problem will force the pace. Edge appliances keep getting exploited, as the 2026 GlobalProtect auth bypass showed, and FortiBleed showed that patching alone does not end the exposure. Teams that cannot patch fast enough by hand will let agents apply compensating controls first and ask later.