Check Point has launched its
Agentic Network Security Orchestration Platform, a new autonomous agent architecture designed to help security teams manage network security operations with less manual work. The platform uses AI agents to take on everyday network security work, including firewall rule changes, policy cleanup, troubleshooting, and compliance checks. Security teams decide what they want to protect and set the rules for how far the agents can go. The agents handle the follow-up work, while humans stay involved for bigger or higher-risk changes.
Network Security Management Is Getting Harder
Enterprise networks are getting harder to manage by hand. Companies now run across hybrid cloud environments, multiple vendors, connected devices, and growing numbers of AI agents. Mergers and acquisitions can add even more layers. As a result, even one policy change can take time because teams have to check dependencies, review security risks, and make sure they do not break access. That slows down bigger security projects, too. Zero-trust and segmentation work can get stuck because old policies are hard to clean up manually. Workloads move. Access rules drift. Security teams are left trying to keep policy aligned with how the business actually works.
How Check Point Is Applying Agentic AI
Check Point’s platform is built around a Network Knowledge Graph, which creates a live model of the customer’s environment. The graph tracks topology, traffic flows, asset dependencies and configuration data. That gives the agents the current context before they recommend or execute a change.
Dr. Yossi Saad, head of product management AI at Check Point Software, said the distinction is in how Check Point applies AI to network security operations.
“AI intelligence is generic and comes from the LLM, however, the way you ‘harness’ this power is important to get results that are relevant, accurate, and with no hallucinations,” Saad said. “Check Point provides such a harness using Skills that are based on its experience with 100K+ enterprise customers, Tools like Semantic Intelligence that allow translation from ‘intent’ to policy rules and between vendors, and Context of the customer’s specific environment that is achieved by our unique live Graph representation of the customer’s environment.”
The company said the platform also includes a semantic intelligence layer that interprets existing firewall policies and the business intent behind them. That matters because many enterprises still rely on rules created years ago, often by teams that have changed or documentation that no longer reflects the environment.
The platform also includes four core capabilities. Intent-to-Policy translates natural language business requirements into firewall rules across multi-vendor environments. Zero Trust and Policy Tightening analyzes traffic to identify unnecessary access and over-permissive configurations. Autonomous Troubleshooting reviews topology, policy history, and logs to diagnose failures. Continuous Compliance maps rule and configuration changes to frameworks such as DORA, PCI-DSS, and NIST.
What Multi-Vendor Orchestration Means in Practice
The multi-vendor environment aspect is important because most large organizations are not running one clean security environment. They have firewalls, cloud controls, network tools, and security platforms from multiple vendors. That is where policy work often becomes slow, manual, and dependent on specialized knowledge across each environment.
“Our Orchestration platform aims to automate end-to-end processes across domains and vendors,” Saad said. “It is not aiming to replace the vendors’ management in specific configuration activities, like software upgrade, but is designed to automate time-consuming processes, such as allowing access from one server to another across the whole multi-vendor network.”
For customers, Saad said the goal is to let teams express what they want in a more generic format instead of managing every step vendor by vendor.
“Customers with multiple vendors will see significant savings in time and effort for many of their common workflows, since they could manage their security based on defining their ‘intents’ in a generic format, such as natural language, simple tables, etc.,” Saad said.
What This Means for MSSPs
The platform could also change how MSSPs manage policy work for enterprise customers. MSSPs often deal with complex customer environments, recurring policy requests, compliance needs, and troubleshooting issues across multiple tools. If agentic orchestration can reduce the manual work behind those processes, it could help providers move faster while keeping customers involved in the decisions that matter.
“It will make the MSSP work more automated and efficient,” Saad said. “They will be able to collaborate with their enterprise customers on the desired intents, and from there, let the agents do the work.”
Saad said agents could also support more continuous oversight after the initial policy change is complete.
“The use of agents will also allow them to continuously monitor and improve the environment, ensuring compliance with the customer requirements,” he said.
Deepchecks Acquisition Supports the AI Roadmap
Check Point is also adding more AI expertise through its planned acquisition of Deepchecks’ team and intellectual property. Deepchecks works on evaluation, observability, testing, and monitoring for AI systems. For Check Point, that could help with a key issue: making sure the agents can be measured, tuned, and trusted as they take on more network security work.
For enterprises and MSSPs, if the platform helps teams understand policy intent, reduce drift, and document changes clearly, it could help move long-running security projects out of the backlog and into daily operations.
