> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/november-2026/release-highlights.md).
# Release Highlights
The following are the key highlights for this release.
| FEATURE | DESCRIPTION |
| ----------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Introducing SaaS security | Extend cloud security across SaaS configuration, data, identity and AI with support for \~ 100 applications spanning data classification, identity governance, AI agent security and threat detection and response. |
| Security initiatives | Set and track security goals aligned to business outcomes, with recommended initiatives based on posture and finding trends to help teams prioritize remediation beyond simply addressing the highest-priority alerts. |
| Cloud optimized agent | A lightweight eBPF Cortex sensor designed specifically for Linux cloud workloads and Kubernetes deployments. |
| Unified Identity Security dashboard | Connect identity posture risk with real-time ITDR signals across cloud, SaaS and on-premises environments to identify and investigate risky human identities, non-human identities and AI agents from one view. |
| DLP harmonization | Ingest and normalize policies from first- and third-party DLP vendors into a unified inventory for easier analysis of policy coverage across supported integrations, starting with Cortex Endpoint DLP and Microsoft Purview. |
| Azure Container Apps support | Extend vulnerability management, compliance, runtime drift detection and real-time protection to Azure Container Apps. |
| Expanded AI Security for AWS and GCP | Secure more of the AI ecosystem with coverage for AWS Bedrock AgentCore, AWS SageMaker, and GCP Gemini Enterprise Agent Platform, including visibility and risk detection across agents, datasets, identities, MCP servers, and supporting AI infrastructure. |
| Fix-Oriented Vulnerability Policies | Turn vulnerability findings into more manageable remediation tasks. New policies aggregate CVEs that can be resolved with the same fix into a single issue, reducing ticket volume and helping teams systematically remediate more effectively. Available as a limited GA. |
| Agentless file integrity monitoring | Detect unauthorized changes to system files, binaries and configurations across cloud workloads without deploying agents. |
| Support for IBM Cloud | Extend continuous posture management, automated compliance and risk detection across IBM Cloud for unified multi-cloud security. |
| Kubernetes Advanced Admission Security Policy | Prevent risky Kubernetes deployments that are associated with active threats with Admission Controller security policies infused by Unit42 threat research. |
| Ensure only trusted software reaches production | Evaluate artifact trust across the SDLC with the new Supply Chain Security Dashboard and Artifact Attestation, enabling teams to sign and verify software artifacts for integrity and provenance.
AppSec Add-on license required.
|
| Native integrations with Claude Code and Cursor | Start secure by embedding code scanning directly into AI-assisted development through the Cortex Cloud MCP Server to prevent insecure code generation.
AppSec Add-on license required.
|
| Discover and assess MCP risk | Identify MCP servers across your environment and analyze associated risks to improve visibility into AI development infrastructure.
AppSec Add-on license required.
|
| Prioritize reachable open-source risk | Cut through CVE noise by identifying which vulnerable packages and functions are actually reachable, helping teams focus remediation on the risks that matter most.
AppSec Add-on license required.
|
| Expanded AppSec ecosystem | Seamlessly ingest GitHub Advanced Security SAST and SCA findings into Cortex Cloud to centralize visibility, improve prioritization and prevention without disrupting development workflows.
AppSec Add-on license required.
|
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/november-2026/release-highlights.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.