> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/july-2026/release-highlights.md). # Release Highlights The following are the key highlights for this release. | FEATURE | DESCRIPTION | | ----------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | New graph-powered attack path detection | Cortex Cloud uses graph-based detections to identify and prioritize potential attack paths across identities, code, data, workloads and cloud resources. This ensures teams can see how isolated risks connect to critical assets in a visual graph so they can remediate what matters most. | | Identity permission support in graph search | Visualizes cloud access relationships across AWS, Azure, and GCP to uncover hidden attack paths via risky permission chains. | | Extended Threat Intel (XTI) | Introducing XTI, a comprehensive threat intelligence offering that embeds adversary insights directly into SOC workflows through enriched case investigations and AI-driven behavioral analysis. Powered by Unit 42, XTI delivers a unified catalog of threat actors, malware, and vulnerabilities to supercharge XQL-based threat hunting and continuous IOC detection. Analysts can further accelerate triage and remediation by automating threat-aware responses in playbooks and leveraging the AgentiX AI assistant for natural language intelligence searches. | | Expanded DSPM coverage | Extends sensitive data discovery, classification, exposure analysis, and governance across SaaS and AI environments, including Google Drive, Microsoft 365, Teams, Salesforce, and Claude. | | AI dataset security for AWS S3 Vectors | Helps teams discover and assess AI datasets in AWS Bedrock environments for risky configurations, exposure paths, and sensitive data. | | File topic classification | Accelerates sensitive data review by using AI-powered document classification to categorize files by business topic and risk context. | | Agentless malware sandboxing | Protects your cloud registries from hidden threats with the industry's first solution that actively detonates and convicts unknown files using [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire). | | Cloud service provider API ingestion | Grants immediate visibility into the latest cloud features and assets. This release accelerates ingestion velocity, expanding coverage by approximately 10x new cloud provider APIs per month. | | New compliance based rule customization | Cuts alert fatigue, allowing you to tailor your compliance posture to specific business risks. Easily adjust rule severities and seamlessly toggle single or multiple rules within a policy. | | Extending Container as a Service (CaaS) support | Protects CaaS workloads from unauthorized changes and attacks with real-time drift detection and enhanced image scanning for AWS, Azure, and GCP. | | Kubernetes graph | Empowers security teams to prioritize Kubernetes-related risks with a visual and interactive map for faster incident remediation. | | New upgrade recommendation | Identifies the optimal upgrade path for base images within the existing workflow. | | Supply Chain attack threat center | Accelerate responses to novel supply chain risks with a new dashboard that surfaces critical information and automatically identifies exposures across your environment from code to cloud. | | New Code-to-Cloud tracing dashboard | Bridge critical gaps between code and cloud assets to enhance visibility and collaboration across AppSec and cloud security teams. | | Expanded AppSec ecosystem | Seamlessly ingest Checkmarx SAST and SCA findings into Cortex Cloud to centralize visibility, improve prioritization and prevention without disrupting existing development processes. | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/july-2026/release-highlights.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.