From $18B to $300B: How Nikesh Arora Rebuilt Palo Alto Networks

This is the beginning. This is not a moment. You've seen most recently all the AI labs flexing, showing how cool their models are and how they can basically become an attacker and attack infrastructure rapidly because of all the vulnerabilities they can find. It's a lot easier to attack. As an AI lab, it's much harder to defend.

If you found a vulnerability, a zero-day vulnerability, the average time to fix it is 55 days. The average time missiles will find it and try to attack you is in minutes. For Black Hat, we launched a capability that allows us to deliver patches in 4 hours and deploy them to every one of our customers, which is huge. From 55 days to 4 hours.

None of the software in the last 20 years came with an opinion, so the entire software industry will get rewritten in the next 10 years.

What do you think the biggest question is that people are not asking? Nikesh Arora, welcome to Sorcery.

Thank you for having me.

Thank you for having us here at Palo Alto Networks.

Well, you guys have done a really good job of making this place look beautiful. So please feel free to come back anytime.

I think a good place to start is that you guys are having a bit of a moment right now. Cybersecurity is very hot. AI is making it really top of mind, so I have to ask you: What is your hottest take right now?

1. Cybersecurity Is Just Beginning

The hottest take right now is this is the beginning. This is not a moment. I think you've seen most recently all the AI labs flexing, showing how cool their models are and how they can basically become an attacker and attack infrastructure rapidly because of all the vulnerabilities they can find.

Well, guess what? That's going to become par for the course. Who's going to protect them? It's a lot easier to attack. As an AI lab, it's much harder to defend.

I think all the cybersecurity companies are on a tear for that reason, because the market understands that to get all the infrastructure in the world up to snuff in terms of its capabilities to protect against this deluge of AI attacks that are going to be upon us, you need all the cybersecurity companies.

So how are you keeping track of everything that's going on? Do you—

Really hard.

—read?

Watching your podcast. Listening to—

2. The AI Race Keeps Changing

Look, it was fascinating. In the last 2 years, you've seen we've been through so many iterations of AI. It started with ChatGPT. OpenAI was going to run away with it. Anthropic came from nowhere. People had written Google off, and they thought Google was not going to be able to compete.

Two years hence, we're sitting here watching all the announcements from all the cloud companies, which are going gangbusters because people want to use more compute and more AI. Now we've gone from LLMs to agents. Agents are going to help us do a whole bunch of stuff. We've gone from agents to open-weight models, open source, closed source.

There are so many variables because the market continues to evolve on a daily basis. In cybersecurity, you've got to make sense of these trends and see which of these trends is likely to catch on, so we've got to build the security infrastructure and harnesses around it. It's kind of a bit of dancing on your toes—

Yeah.

—and constantly being nimble, trying to figure out where this thing is going to land.

It's interesting. I think some things are beginning to emerge. I think a lot still needs to be figured out. But I think one thing is clear: The appetite for AI is huge, and I don't think that trend is going to reverse itself.

If you believe the demand is infinite, then a lot of things have to fall into place for this to be successful, and one of them clearly is cybersecurity.

With more anomalies popping up and rogue agents—which, who knew that would happen?—how are you handling that? How do you stay on top of that kind of thing?

I think it's part of the flex. It's part of demonstrating the capabilities of the technology.

For all practical purposes, the biggest use case you've seen is coding. Everybody's using AI to code. I think that's kind of mainstream because the capabilities of AI models have, it's fair to say, surpassed humans in certain cases from a coding perspective.

You still need humans to watch what's done, ensure that it's the right solution, test it, and run it through QA processes. But clearly, you can see that the use case has been established, the productivity case has been established, and there's a huge amount of consumption in that space.

Outside of that, I think people are still feeling their way through how agents are going to work. How do you give agents what is called true agency? How do you let them decide? I think there's still a whole bunch of experiments going on over there, and it'll take time before people get really comfortable unleashing agents into the enterprise.

There's a little bit of controversy with what happened with the OpenAI thing, and then—

Just a little?

Just a little bit. And then also how the response was after that. The same thing happened with Anthropic, and now those leaders are asking for a slowdown.

What part do you believe is controversial in that? Just out of curiosity.

I guess the main question is whether they're now asking for a slowdown to potentially cover their tracks later on.

Are they asking for a slowdown?

Yeah.

But they're asking for permission—

They're—

—to be able to go release these.

I don't know. You tell me.

I know. Look, I think it's clear from all the recent developments that these models are getting very powerful, and the edge-case intelligence is really strong. It can solve some unique things. You saw some math problems being solved 2 days ago. You've seen that it can find cyber vulnerabilities. It can daisy-chain vulnerabilities and attack infrastructure.

It's clear these models are going to be extremely powerful. They already are. I think it's important that we understand liability. We have to understand who's responsible at the end of the day.

It's very easy to ascribe responsibility and liability to human beings. If you do something wrong, it's your fault. If I do something wrong, it's my fault. If I use a model and the model does something wrong, whose fault is it? Is it the model's fault? Is it my fault for using the model?

I think all these things are going to become very thorny issues. I think a lot of the AI labs want to get ahead of it and make sure there is some governance framework around it to ensure that they can keep developing the technology at the pace at which they'd like to.

In a way, they're probably doing the right thing. It doesn't seem like it, but I think they are doing the right thing in trying to get some governance around it so they don't get held back. As you saw, they did get held back when they tried to launch Mythos or Fable 5. They got held back because the model was not appropriately guardrailed.

I think we're going to go through a bunch of these growing pains.

Mythos was a big moment.

It still is.

It still is. So how are you handling Mythos?

3. Mythos Changes Cybersecurity

For 8 years, I spent my career at Palo Alto trying to convince CEOs they need to pay attention to cybersecurity. I tried everything. I called them, tried to talk to them, and they usually sent you off to their technology team: “Go talk to those guys.”

You know what Mythos did? Every CEO wants to talk about Mythos, which is great.

Mm-hmm.

For the first time, Mythos has every CEO sitting at the edge of their seat saying, “Am I vulnerable? Is something going to happen because of what Mythos is? Do we have Mythos? We're so important. Why don't we have Mythos? Why can't we get Mythos so we can test our own infrastructure?”

I think Mythos has created a bit of a moment for cybersecurity. What's fascinating to watch is that, for now, that moment is an advantage to incumbents and an advantage to big players in cybersecurity, where the customers are going back to them and saying, “Listen, you're my cybersecurity partner of choice. What should I do? What am I supposed to do? How do I get my hands on Mythos? What have you done? How have you done your testing?”

I think it is a moment because it has got everybody's attention, but I also think it's a moment because it is going to change the way cybersecurity is done in the future.

Like what?

People would buy cybersecurity products, and it was okay. If you found a vulnerability, a zero-day vulnerability, the average time to fix it was 55 days in the industry. The average time Mythos will find it and try to attack you is in minutes.

Now you've got to get ahead of it, test all your software, test all your open source, understand the vulnerabilities, and patch them, because 55 days is too long.

This morning, as part of Black Hat, we launched a capability that allows us to deliver patches in 4 hours and deploy them to every one of our customers, which is huge: from 55 days to 4 hours. We do have the benefits of AI from a defensive perspective, which you're beginning to see.

I think what's happening is now it's become apparent to the market that the time from discovery of a vulnerability to an attack is going to compress tremendously, which means you have a lot less time to fix it or find a bad actor in your infrastructure. When time gets compressed, it requires our customers to modernize their infrastructure.

It requires our customers to start using AI in the deployment, in terms of the defensive capabilities that they must have. That's good news for the cybersecurity industry.

Great news.

I think so.

There's a lot of fear-mongering that goes around with AI, so it's nice to have positive, optimistic stuff.

4. AI Needs Guardrails To Scale

Look, every technology eventually needs the right tent poles for it to succeed. You need to make sure that things are done in a certain way so that customers feel comfortable deploying the technology. It's like, I don't know, take a Waymo, ever?

Sometimes.

Feel comfortable in it?

Yeah.

You feel safe?

Sometimes, unless it goes down those hills. Have you done that?

In San Francisco?

Yeah.

No, I haven't.

You haven't taken one in San Francisco?

I have taken a Waymo. Of course I have. I just haven't gone downhill on the rolling hills of San Francisco yet.

Highly recommend you both do that.

Got it.

Got it.

Well, the reason I ask you the question is, a lot had to get done right for you and me to feel comfortable walking into a Waymo and having it drive us. We effectively gave agency to AI to act without being threatened by it or feeling unsafe around it. That process needs to happen in every useful use case that's going to be deployed using AI, and that's a journey. It's not going to happen overnight, but I think the ingredients are in place for that to happen.

Cybersecurity is one of those things that needs to be done right for people to be comfortable that no bad actor is going to take over my Waymo and drive me faster down the rolling hills—or, God forbid, take me away.

The main topic was really cybersecurity. You were a part of that. You signed it as well. So why did you make that decision?

Look, at the end of the day, if you want the diffusion of technology in a way that everybody can use it in every way, shape, or form, you want to make sure that there's no constraint on innovation. Having open source, open weight, having closed weight—all these things are important parts of the puzzle to make sure that people can deploy them in different circumstances.

I don't think it's necessarily bad to hold back the development of open source or open weight, for that matter. Open source will allow people to make these things available globally at the right price point for various people to be able to use. Open weight will allow a significant amount of fine-tuning to make sure that you can adapt a model to your specific use case in a way that is more effective and efficient for the task at hand.

See, all these are important parts of the puzzle to make sure we get innovation right. So that's the reason we signed it. I think there's an over-indexing on the model part of it. I think to make AI useful, the models are important, but it's also important to get all the context collected and all the training data right.

I think billions of dollars were spent to train my favorite example, the Waymo. I think billions of dollars will be spent over the next few years training a whole bunch of use cases in enterprise or consumer to get that part right.

Why do you like Waymo so much?

It's not that I like Waymo so much. I think it's the most obvious, relatable example of AI getting agency, where a human does not get involved and AI is allowed to make decisions that could mean life or death for human beings. That's it right there. If I tell you, "Are you comfortable letting OpenAI make a life-or-death decision for you?" what is your answer?

I mean, I don't want to be in that situation.

See? But you did put yourself in a Waymo, so there's my example.

Yeah.

My example is, if you spend enough money, with enough guardrails and enough training, you can get comfortable in a scenario where AI can be used instead of a human who has agency. So I think that's what I mean by saying, look, would you let AI prescribe medication to you, and—

Depends.

—take it without asking for a second opinion?

No.

Would you allow your doctor to do that?

Yeah.

Now, do you believe it's possible for AI to get trained as well as your doctor and perhaps better?

Yes.

Good. So you would?

Potentially.

Right. But you won't take the models in their current raw form and let it happen. You would still wait for a whole bunch of contextual training data that needs to be deployed, a whole bunch of edge cases to be understood, and even more context about you to be understood. But then you would. And I think that's what needs to happen.

We're over-indexing on the model. I think models are great, but being able to take that model, package that for all that context, all that knowledge, all that training, and be able to deliver a solution to you is what the next big revolution needs to be. That needs to happen in thousands of different use cases.

You're clearly a big beneficiary of this, and it's amazing. You joined the company at an $18 billion valuation?

Market cap, yes.

Market cap. And now it's at around $300 billion, which is crazy.

Who's counting?

I don't know. The markets are definitely counting.

If you were paying attention, yes.

Uh-huh. It's crazy.

There are only 2 days that matter: the day you get stock, the day you sell stock. Every other day, it's a vanity number.

But to get to that point, one of the main things that I took away when we were walking around the office and meeting different people is, one, you're super aggressive. Two, we were talking with Hamza, and he said you're just as good an operator as you are an investor.

Super aggressive. Explain that to me.

You're aggressive. You go after things.

You watch sport?

Yeah.

When you see somebody powering through the defense and trying to make a basketball shot, are they called super aggressive, or are they called people who are trying to get it done?

They just do it.

Good. So I prefer that characterization as opposed to super aggressive. I'm going to get it done.

Mm-hmm.

Yes. That doesn't require me to be super aggressive. But your question was different. You were talking about Hamza.

Yeah.

And?

Talk through that. You have an amazing career as both an investor and an operator. How does that come together in this role here so well?

5. Markets Reward Durable Growth

If you look at what the markets reward, business gets rewarded effectively in metrics like market cap, perhaps. What is market cap? Market cap is the sum total of the world's expectations about the strategy, execution, and potential of your business, right? Nvidia trades at $5 trillion because people believe it has trends of demand that are going to happen, Jensen is a great executor, and they're doing a whole bunch of stuff right.

So you can actually work your way back from market expectations—what the market expects—to what makes for a successful business. Now, the market is pretty straightforward in its expectations on some level. It says, "If you have a durable business that grows at a robust rate, which you can run profitably and generate tons of cash flow, we like you."

Now, that's great, which means you have to run a good business, you must have good cash flow, and you must grow well. But the market is smart on that. It says, "Well, not just that. I want to see the durability of it." What does durability mean? Can you grow at a rapid pace for a long period of time?

If you're a CEO trying to deliver in that environment, it means every time you think that you've done it, the market expects you to grow again. You get from a dollar to $1.15, and the market says, "Great. Tell me tomorrow: Can you grow 15% or 100%?" So the market is expecting you to grow at a certain rate. The numbers keep getting bigger, and the question is: How do you keep making sure your business continues to grow in that regard?

And that's what the art and science of leading a business is. I don't spend all my time worrying about what happens next quarter. I worry about what happens 2 years from now, because I can see for the next 2 years how my business is going to progress, what we're going to be able to sell, what we need to go fix, and how we rally to make things work.

That's great, but after 2 years, your visibility begins to thin. "Oh, my God. What if the market shifts? What if competition gets stronger? What if different products come to the market?" My job is to say, "If all this went well, what would our business need to look like 2 years from now, and what would the growth levers need to be for us to deliver on that business?"

That's the paranoia I live with. In that paranoia, you see we've bought 40-plus companies in the last 8 years. Sometimes we're looking for interesting products, sometimes we're trying to fill gaps, and sometimes we're anticipating the market and saying, "How can we get ahead?"

So all of that goes into that little thing. You shake it together and say, "That's what the market expects from an investment perspective, but what does that mean for our strategy, and what does that mean for how we execute the business?" And sometimes we disagree with the market.

Sometimes we say, “You know what, market? Don’t worry about it.” We went and bought a $28 billion company called CyberArk, and the market didn’t like it for a certain period of time, and then they turned around. We showed them results in a short period of time. They’re like, “Holy shit. We love it.”

Why is M&A so consequential for cybersecurity companies? Because this is a common theme. They’re very acquisitive.

6. M&A Fuels Cybersecurity Innovation

It is the most innovative industry in the world because the bad guys are trying to figure out how to attack you in a different way every time. The moment we suss out how they did it, they move on to finding the next way. So we’re constantly trying to chase them, saying, “Holy shit. They figured out another way to attack us. Let’s go figure that out.” By the time we get there, they move on.

They're all over the world. Nation-states, people in their basements, people with a Nintendo in front of them or a laptop—they’re all trying to figure out, either for trophy reasons or for economic reasons, how to break into something. So it requires us all to be very innovative. Every new technology that comes to the market requires us to harness different kinds of tools and different kinds of capabilities in our products. If you don’t pay attention to every new technology, customers start buying something else.

So it’s almost like we have to stay on our toes on a constant basis to anticipate technologies and anticipate bad actors. It makes us the most innovative sector. In that environment, it’s impossible that all the innovation is going to come from us, right? Because there’s always somebody else who’s got a different angle. There’s always somebody else who’s tried something that’s going to work better than what I thought about. So you just have to live in this industry with humility to understand that you may not always have all the answers.

The question is, however, are you smart enough to anticipate who has the answers, make them part of your team, charm them to be part of Palo Alto, and when you do that, can you then deploy that as quickly as you can to your customers? So I think in the last 8 years, fair to say we’ve struck the right balance between what we build internally, what we can rapidly build internally and layer on top of our platforms, and what is unique out in the market.

If we partner with or acquire somebody, how can we bring them into the fold as part of Palo Alto and deploy the capability to our customer as quickly as we can? The North Star always is, “How do I deliver that capability to my customer as quickly as I can?” Sometimes it’s buy, sometimes it’s build because it’s too complicated to buy and integrate, and sometimes we look at it and say, “No, it’s not worth it. Let somebody else serve that part of the market. We can find a way to integrate that with them.”

So once you do make an acquisition, what is the playbook for getting them to your customers? How do you onboard them, first on a product basis—

Yeah.

—but then also on the team?

Well, we’ve done acquisitions of all shapes and sizes. Some of them have been easier because they’re clear product acquisitions in categories we don’t play in, so that becomes a lot easier because then all we do is say, “Listen, you’re going to be part of Palo Alto. We might slow you down, but we’re going to throw more resources at you so we can give you more scale and more speed.” That’s kind of worked well.

We bought a browser company. We had to integrate it as part of our product, but we were able to let them loose. We bought a bunch of AI security capabilities—again, something we didn’t do. We had to put more resources in there, put it together, and let them loose.

Now, what letting them loose means is that we actually make them part of our go-to-market engine. Our teams out in the field have tons of relationships. They’re used to talking to their customers about unique things that we do. In that context, we plug these capabilities into our go-to-market pipeline. We make sure our customers are aware of the capabilities. That allows our customers to go out there and use these capabilities as fast as we can give them to them.

What do you think the biggest mistakes are that people make during the acquisition?

I think the biggest mistake that people make during acquisitions is underestimating the intelligence of the people who built the business that you acquired. Because sometimes you take on the imperialistic attitude: “I bought you, hence you must work for me.”

Our attitude is, “You kicked our ass. Come tell us what we did wrong. Come run this for us because you did well without our money, our resources, and our scale, so you must have figured something out.” So we spend our time trying to understand what they figured out, find a way that we can make them part of our culture, absorb that capability, and let them run it.

That sometimes really makes it hard for my teams because they suddenly have a new boss in a category where they thought we were acquiring something. But as I said, you have to approach this with humility because there are people out there who are smarter, faster, better-resourced, and more resourceful than you in certain categories. If you can embrace them in the right way, it allows us to build a durable business.

How do you remain curious in this exploration process of finding new potential acquisitions, new companies to bring in?

Paranoia.

Paranoia?

Fear of failure. Remember, we’re in the fear-mongering business.

Mm-hmm.

I also live with the fear of failure. It’s this constant idea: imagine that something happens out there and there’s no security solution. Today, we’re deluged with people like you doing these podcasts with these cool CEOs who are building all kinds of new tech, and I can barely understand half of it. “Oh, we’re going to do open-weight models versus closed-weight models.” “Well, how do I figure out what an open-weight model is?”

Well, you sit down and say, “Well, now you’ve got an open-weight model. What are the consequences from a security perspective? Does it change the game? What do we do with agents?” Oh, shit, we’ve got agents now. How do we deal with security with agents? How do I find one in the first place? Well, they’re going to be all over the place.

So we start thinking about it. We bring a bunch of people together and say, “Dude, these things called agents, where are they going to be?” Well, they’re going to be everywhere. They’re going to be in SaaS software. They’re going to be in our infrastructure. They’re going to be on-prem. Well, how do we collect them together? I don’t know. We’ve got to figure this out.

So we then start looking at the market and saying, “Is anybody working on this problem? How are we thinking about it?” That’s where we find out, “Oh, these guys are thinking about it the same way we are. They started thinking about it 1 year ago. That’s cool. What do we do? Should we build it?” Because they’re thinking about it the same way, or should we acquire them?

You talk to them, saying, “Do you want to come?” They’re like, “No, we’re going to be so big, we don’t need you.” Then you move on. So there’s a whole sort of discovery process: What is the technology? What are the implications for security? How do we solve the security problem? How do we think about it? Where does it fit in our portfolio? Is it going to be big? If so, should we build it? Can we build it? Are we late?

At the same time, we look at what’s happening in the market, which we do, and then decide: well, it’s probably better to build it because it’s going to be more complicated to buy and integrate, or it’s just better to buy something because it’s a lot easier for us to go run with it because they’re ahead.

Hamza mentioned when we were over there that you do see things many years before, that you’re very good at predicting things—

I don’t know.

—like the SaaSpocalypse.

Well, actually, I didn’t predict the SaaSpocalypse. I predicted the market.

I thought you did.

No, I predicted the end of the SaaSpocalypse as opposed to the beginning of it. I think the market got ahead of itself. I think when AI came out, people started trying to predict what’s going to happen to AI.

Mm.

And there was this notion that AI is going to eat software, and the market indiscriminately decided that every software company was destined to go to zero.

And you saw the entire SaaS market go down 50%. We sat there saying, “This makes no sense.” AI can be great at finding vulnerabilities. AI can be great at 80% of use cases. We live in the 0.1% use case.

We’re looking for the needle in the haystack. AI is not good at looking for every needle in the haystack. We write machine learning code. We look for a whole bunch of MITRE ATT&CK techniques. We find the 0.1% use case, just the way somebody goes and tells the car where to turn, and that’s a tree, and that’s the edge case. AI doesn’t understand every edge case. It does the mainstream cases.

So we declared that the SaaSpocalypse for cybersecurity was over. We did not believe that we were going to get impacted, and you can see now that was 6 months ago, and we seem to be having a moment.

What do you think, though, about the broader macro market? Do you think that some of these companies will actually not recover?

What do you mean?

Some of these companies are down 90% and still haven’t—

Look, that’s a fair question. I think every company is different. Every company is different in terms of the capability they bring to the market, or whether the market believes that capability is going to be par for the course in AI.

I think there are a lot of questions in terms of what the native capability of AI models is going to be. If that native capability is exposed to me—as a consumer or as a professional—do I need to buy the packaged software that existed and solved that problem before? Is it better or worse?

I think in some of those categories, the market has already declared those companies dead. In certain categories, the market is wondering: You built software 15 years ago. There’s a new game in town called AI. The shape of software is going to change. The market is making a judgment call on whether you, your team, and your product will survive this transition to AI.

So I think all that is happening, and each company is different. On a fundamental level, I believe we spent our lives building software that had no opinion. You bought software, and it did kind of deterministic tasks. In the future, software will come with an opinion, right? Your AI doctor will actually have an opinion, but somebody has to train it. Somebody has to give it context, and it has to learn.

We can build intelligence into our products. If we build intelligence into our products, they will come with an opinion. None of the software in the last 20 years came with an opinion, so the entire software industry will get rewritten in the next 10 years. The market’s making a judgment call: Which of these categories will survive? Which of these companies will survive? Possibly getting a bunch of them wrong. We’ll see. Time will tell.

What do you think the biggest question is that people are not asking right now?

That’s a hard question to answer. I don’t know what question. I don’t know if it’s a question, per se. I think the market is, in a way, confused, and you can see that every day. Some things go up rapidly for a week, and suddenly they go down rapidly for a week because the market changes its mind.

Some of the long-term trends are obvious. It’s obvious that this technology is big enough that it’s going to have a long, far-reaching impact in our lifetime, so the next 10s of years. I think this is the early days.

It’s also clear that this technology is more compute-consumptive than any other technology in the past. We need to build lots more capacity around the world, and you can see that in the prices of the elements that go into building compute. You can see that in energy prices. You can see that in nuclear. You can see that in generators. You can see that in states saying, “I don’t want more data centers. I’m up to my eyeballs in data centers.”

So you’re seeing all of that, but it’s clear that there’s going to be huge demand going forward. I think it’s also clear that every one of us believes that our personal AI should be able to do a lot more, and it’s going to need to get better, right?

I’m sure you are an avid user of some version of Claude, Gemini, or OpenAI’s ChatGPT. Are you? ChatGPT?

I use all of them.

All of them, right?

Literally Grok, OpenAI—

And when you use them—

—Claude.

—have you ever caught yourself thinking, “I wish it could do a bit more than what it just did”?

Every day. I get very frustrated with them.

Right.

Yeah.

So you’re telling me this thing’s not as good as it needs to be.

No, it’s definitely not.

Which means somebody’s going to have to train it a lot more, get a lot more compute, get it trained, and make it better, right?

Yeah.

So that means there’s immense demand for capacity in the next few years. We’re going to have a lot more capacity demand in AI because we’ve got to train the models better and make this intelligence get smarter.

A lot of us in enterprise are frustrated because it doesn’t understand edge cases, saying, “Why can’t it be smart enough to understand? It was so smart here. Why not here?” So we’re all waiting for it to get more capability and more capacity.

I just think this is an unstoppable trend that’s ahead of us. I think we’re underestimating demand across all dimensions of this, whether it’s compute or intelligence or what these models are capable of, which means that there’s going to be tons and tons of development.

I think every piece of software is going to get rewritten. Every consumer application you use—a lot of the applications we use on our phones, the way we’re used to using them—has a lot of UI involved and a lot of manual work involved. AI is going to be so good at being an agent and using an MCP server, it’s going to fix all that stuff, right?

So there’s lots and lots of stuff that’s going to happen that needs to get done. There’s tremendous demand. The market is just going through its digestion phase of figuring out what gyrations are going to cause which thing to be overvalued or undervalued.

Compute is a huge topic. We were just interviewing fal.ai yesterday. Do you know fal.ai? It’s a generative media AI company. They do both compute, and they also have APIs and all the other kinds of layers.

But they started as compute. Then they noticed with all these video models, the voice, the 3D, the audio, all this kind of stuff that’s going on, those are really just starting.

Mm-hmm.

There’s tremendous demand, and those are going to need more compute than anybody else.

Yeah.

And so we were talking through all the different layers of that, even with the neoclouds that are coming out and how even with hyperscalers.

I was talking to—I forget who it was—but it was at the RAISE Summit. I think it was Andrew Feldman from Cerebras.

Cerebras.

And he was talking about this. We were talking to CJ at MongoDB, and he was saying hyperscalers are turning away their top customers—

Mm.

—because they don’t have capacity.

Yes.

So how do you think about that as a CEO in this era, with everything changing around—

Yeah.

—your customers and your company and all this kind of stuff?

Look, all this—everything you said—is true. There is a constraint in compute right now because there are tremendous amounts of demand. Everybody needs more compute.

Your video-model friends need more compute to be able to build better videos and edit them. Your ChatGPT needs more compute to be smarter, to be able to satisfy you and not have you frustrated. Your enterprise models need more compute because we need to put more intelligence into our enterprise capabilities so we can write and rewrite software with opinions. That’s one point.

The way you think about it is you’re in for a very long build phase in the industry. I think in the next 10 years, it’s highly possible that 10% to 20% of our operating spend moves more toward technology than it already has. So there’s a huge amount of spend that’s going to happen in technology. It happened in people. We’re going to need more AI-ready people, so I don’t buy the jobs argument.

I think we have so many things to do, there aren’t enough people to do it. Either it’s retraining or hiring more people who understand the AI stuff.

I think in that process of technological upheaval, people are going to want more robust security infrastructure. From that perspective, we know the demand is there. We just have to make sure we get both products—new products that serve that demand—and also make sure that our existing products don’t fall short of customers’ expectations of what AI must be embedded in those products as well.

How do you think about this with your workforce? Are you checking whether people are AI-native? I mean, we’ve interviewed some CEOs who are really strict about this.

7. Building An AI Native Workforce

It’s very hard to check on people who are AI-native.

You’re not deploying little tests?

I think there are 2 or 3 things you can do. One, what we’re doing is, when there’s no expert, people learn from each other.

So twice a week, I run this meeting called AI I/O. It’s like “Old MacDonald Had a Farm.” It’s just not E-I-E-I-O; it’s like A-I-I-O, okay?

We get the top 24 technical people on a call every 2 days for 2 hours in the morning, and they walk through what they’re working on, how they’re thinking about it, and why they’re doing certain things.

So it suddenly gives the other 23 people more strength to understand, “Oh my God, this person is a smart engineer.”

Here's how he's thinking about it. They get a chance to ask questions. They get to learn from that person and vice versa. We do that twice a week so that people start understanding what's important and how we get it.

At a more micro level, it's happening in teams. We will take a team and say, “Okay, go out and take a third of your workforce and make sure you're hiring through hackathons, because they're learning themselves.” I think those are the true AI-native people. We infuse those AI-native people into teams and say, “Keep hiring until you make sure there are more people in that team than people who've been there before.”

Once you start overwhelming these teams with more AI-native people, you start seeing a change in behavior. Features start getting out faster. Some of the people who've been there longer and haven't played with AI start playing with it more. Then we have to create a sort of transformation, and if enough people start being part of the transformation, I think some people who don't get it will self-select out.

So that's the approach we have. It's unlike the approach of some other people. They'll say, “Oh, I don't need a third of my people because they're not going to get it.” That's not the way to do it.

When did you start hiring from hackathons?

About, I'd say, 9 months ago.

Really?

Yeah.

How'd you come up with that idea?

How am I going to know that if you know how to use OpenClaw well, you understand what an agent is? If you're not playing with it already, you're not sitting there going back home from work saying, “I can't wait to get my hands on the new development that came out yesterday,” or using Azure Foundry or Anthropic. If you're not going home and figuring stuff out yourself, that's a problem. If you're not curious, you're not learning. Where am I going to find these people?

Damn. That's pretty creative. So before speaking with you, I spoke with Carl, who's on your board, and I asked him, like I asked many people around this office, if they had any questions for you—anything I should ask. For some reason, no one in the office would answer the question besides Lee, and I'll ask that afterward.

Carl mentioned he was on the hiring board. He was on the team when they hired you, and that you were a bit of a controversial hire.

8. Learning To Lead From Scratch

Most likely, yes. I would be a controversial hire for sure. I'd never done cybersecurity in my life. This is a cybersecurity company. I'd never been a public-company CEO. This is a public-company CEO job. And I'd never sold enterprise. I was a consumer guy. Other than that, they got everything right. So yes, it must have been controversial. I was in the room.

What was your learning process in getting up to speed like?

Imposter syndrome all the way.

Do you still have that?

Possibly. Sometimes, yeah, because I didn't grow up in this stuff.

Mm.

That's why I'm blessed to have people like Lee around. When I started, I had Lee and Nir Zuk around me. I'd sit in meetings, learn a few things, keep looking at Lee to see what he thought about what I said, ask him after everybody left, and then call him on my way home. I'd call Nir on the way in and say, “Hey, Nir, what do you think?”

I spent all this time trying to get it out of people in terms of what they thought. Over time, I started understanding the pattern recognition in terms of what works and what doesn't work in cybersecurity, and what's the right thing to do. We did our first acquisition because we wanted to do something in a space where we had no capability. So you learn. Over time, I began to learn. I still rely a lot on him and other technical people in the company.

His question was, “Why do you like LinkedIn so much?”

You know, there is a conspiracy. I think the other people didn't ask you to ask me questions because they all fed it to him.

Really?

The conspiracy is, in my moment of paranoia, I'll go troll X and LinkedIn to see what's going on in the market. I'll see a post from some of our competitors. I'll see a post from somebody about something, and probably between the hours of 4:30 and 6:30, people will get a copy of that LinkedIn post and say, “What are we going to do about this?” Or, “What do you think about this?” And that's why he's like, “Holy shit, he's on LinkedIn again.”

Has that ever led to making pretty big business decisions?

Well, yes. Our general counsel I hired off of LinkedIn. I had a dinner last night with somebody I found on LinkedIn because I think he'd be great for our company. So, damn, it's a great place to find people. You get to go look at everything they say, whether they're intelligent or not. They're not interviewing when they're posting on LinkedIn, right?

No.

If I can read what people have written over the last 4 years on LinkedIn, I can tell you who they are without having to ask them. I bring them in the room for half an hour. If you can't fool me for half an hour, then you shouldn't come work here anyway.

This is probably one of the hottest takes. I don't know anybody who likes LinkedIn.

I think the way to think about it is, I started at Google in 2004, and when you work at Google, you build this sort of thing where you don't meet someone before you Google them. You're like, “Listen, obviously I can find out a lot more information about this person, this product, this capability, because I work at Google.”

There's not?

Of course not. It becomes part of the way you do things as Google people. And then, again, if there's any information I can have, I should have it. So by definition, I will go find out whatever I can.

Now, LinkedIn and X are wonderful places to find out what's happening, both from a business perspective and from a technology perspective. My team doesn't like that, because then I keep sending them, “What do you think?” It's like, “I have my days planned. I don't have time to answer your questions.”

What does a typical day look like for you?

Like, podcast in the afternoon, breakfast in the morning, golf in the evening. Just kidding. No. Enterprise jobs are interesting. They're, I'd say, 1% inspiration, 99% perspiration. In some way, shape, or form, either you're fixing a product, adapting strategy, trying to hire people in places, or trying to meet customers.

But look, I joke that every job in the company that requires some accountability is already taken. I have a CFO who's responsible for finance. I have a marketing person. So I kind of don't have a job, right? My job is to orchestrate these people and the strategy.

My job is to set the North Star and define the strategy. My job is to make sure I resource the North Star. If I want to go win in this, I just need to understand how many people it takes, how many hours it takes, and what other things I need. Then I give it to the right people.

Then my job is to remove obstacles from their way and course-correct them if they're falling short. That's the job, right? It's course-correcting, getting people lined up behind you, and making sure that you have the right people in the right place.

When I came to Palo Alto, for the first 3 months, they all sat and looked at me. “Who is this guy? He's strange. He has different ideas. What's he about?” Then I realized we didn't speak the same language. They didn't understand me.

So I sat back one weekend and wrote down something called my belief document, which basically describes why I do certain things a certain way and what I believe. Then I walked up on a Monday morning and said, “All right, guys, here's my belief document. This is why I act the way I do. Now we can debate this. Once we debate it, I'm happy to change certain parts of it if you don't like it and if I agree. But once we decide this is the way we act, then we're going to act like this.”

For example, I get really tough on hiring senior people. I want to spend time. I want to understand who they are. I want to have references. I want to meet that person. People always say, “Why are you slowing me down? I need to get going, and I need to hire this person.”

I'm like, “Listen, you hire the wrong person, they have 500 people who work for them. It means 500 people in my organization are headed in the wrong direction. They're not climbing the mountain I want them to climb, not doing things the way we all want to do them. So it's an important hire. I'd rather have nobody and do it myself until I find the right person.”

If you explain it like this, it's like, “Oh, I get it.” Otherwise, I was just stopping them, saying, “You're not hiring that person.” They'd say, “Oh my God, he's frustrating me. He's not letting me hire people.” I'm like, “No, I'm not letting you hire people for a reason.”

Sometimes you realize, as leaders, we don't communicate the why. We just tell people the what: “Go do this.” If you explain the why, people actually do a much better job.

I always have this thing: people don't come to work to screw up. It's not like, “Good morning, I'm going to go to work, and I'm going to do the worst possible job I can.” That's not how people think. They all come saying, “I'm going to do the best.” And at the end of the day they say, “Holy shit, I didn't do the best,” or, “Somehow my boss wasn't happy because he or she seemed like they weren't happy with what I did.” Maybe you aren't communicating.

I have 2 questions. One, what were the changes that you made, if you made any? And two, what are the key traits you look for in leaders?

I did make changes over time because we've morphed our business from—you said it was an $18 billion business—to a much bigger business that required us to get into new product categories and sell new things. So you definitely need people. I have this framework which basically says: Have you ever built a house?

I grew up—my mom built houses.

Yeah.

Lots of them.

So, you build a house, you hire an architect, right? What's their job? They build this beautiful aesthetic: Here's what it needs to look like. Here's how it's going to be beautiful. Then they do a bunch of drawings, and you get a builder. He or she starts building the house. And then, when they're gone, there's a person who comes and maintains it, right? Makes sure the stuff's working. You never let a maintenance person be the builder, would you? That'd be a bad idea.

No.

You would never let a builder architect your house because they may not have the design aesthetic. You probably don't want your architect building your house either because they don't have the capability. Yet at work, we expect our people to be all 3. We say, "I have a new idea." Great. Why don't you architect the idea, then build the idea, and make sure, when it's working, that you run the idea?

All of us have a different mix of capabilities among us. We're part architects, part builders, part maintenance people, and everyone's different. So, for almost every leadership job, I need someone who's part architect and part builder. If I get someone who's too architecture-oriented, then I need to make sure they're coupled with the best builders in the world.

I think building teams is a combination of finding that fit among people. My job as a leader is to build a team around me that is part architect, part builder, and to know who's capable of what, then make sure they have people with them who can build.

Hmm.

So it's not like there's a consistent set of traits across people. It's always a combination of people in terms of what they can do. But there's a basic level of smarts they must have because, if you're not smart and you're not creative, there's a risk you will miss the inflection.

Then you have to have a little bit of—what do you call it? Super aggressive?

A little aggressive.

Assertive. A little bit of—

The "just do it" attitude.

A go-get-it attitude. How's that?

Yeah. Agency.

There we go. Well, I give agency.

We all have a little bit of agency in us.

I have to give agency. If I don't give agency to people, then they feel constrained. So, yes, we all have to give a little bit of agency to people. My board gives me agency. I give my team agency. But you only give agency with the right guardrails and training, right?

Yeah.

Otherwise, your agent is going to do shit you don't want it to do.

So, where did that develop for you? How do you get this? Some people call it a chip on their shoulder. Where did that come from for you?

The chips are in high demand.

Yeah.

Just kidding. No time to have that hanging on your shoulder. Sell them. They get full price.

No, it's not a matter of a chip on your shoulder. I think it's learned behavior, right? Over time, you understand businesses, you invest in businesses, you operate businesses. You figure out what patterns make them successful and what patterns make them less successful. It's kind of pattern recognition over time. You figure it out and you try things.

I'm sure all of us have tried things that haven't worked as well as they should have, and I'm sure we've tried things that have worked out spectacularly.

I want to ask you this because you have such a unique perspective from all the points in your career. What was the day-to-day like at Google and at SoftBank? You explained really well what it's like here and how it's changed over time, too.

Google's a great place. It still is. It was a great place when I was there. Remember, Google had this interesting business, right? We all spent time on Search, and Google had built the best commercial model around Search in terms of how to monetize it, in terms of search advertising.

For the most part, Google was a scale problem. How do you keep scaling the business in such a way that the business keeps working, nothing goes down, nothing fails? There's constant innovation in the pipeline, which keeps attracting more and more consumers to consume these internet services, whether it was Search or YouTube over time. And then you build a monetization harness around it, whether it's search ads or video ads, et cetera.

I believe that most companies take on the form of their leader. Larry Page had this firm belief that great products win, and Google is product-obsessed. If you think about it, there are so many products, even today, that don't make money, right? Gmail doesn't pay for itself. You and I get Gmail for free. Google Maps doesn't make as much money, but it was a product. Google Chrome does make money.

There are so many products that Google built over the years that are great products. They didn't think about a monetization model because that was the philosophy: Go build a great product. If it's great, we'll figure out a way to monetize it, or else it's going to contribute to the brand. The good news is it kind of worked, and, as I said, it's a bit of a scalability thing.

Now, at Masa—

Yeah.

It's the same thing. Again, it takes on the form of the leader. He's the oldest man I know with the risk appetite of a teenager. As he gets older, his risk appetite becomes bigger. He keeps things very simple, and he's very focused on winning.

I remember he told me once—I had made an investment with him in a company, and he saw me a bit disturbed. He saw me grinding away, talking to the CEO multiple times a week. He said, "What are you doing?"

I said, "I'm trying to talk to the CEO because, when we invested 6 months ago, we thought this was going to happen, and I think we need to coach him because he's down 50% from where we thought he was going to be. If we can coach him, we can get him back on course. In 6 months, he should be back where we started, and then he can go from there."

He looked at me and said, "If you put in that much effort on a company that's doubling, it might quadruple. You might make more money on the one that quadruples than fixing the one that's broken."

That was an insight from him to me. As operators, our tendency is to try to fix everything because we don't want things to break. As an investor, he said, "Double down on your winners. They're going to be way more interesting for you than the ones that are not going to make money."

Concentration and power law.

Something like that, yes. See, if I knew all those words then.

So I know we're well into the conversation, but is there anything that we haven't covered that you want to talk about?

We can talk about anything you want. We can talk about AI, we can talk about spending, we can talk about whatever you want.

So we had a special guest in here earlier. Can you explain who your newest intern is?

My son was running around here. He loves coming and hanging out here. He was very intrigued by all the cameras being put up and all this stuff being arranged because some famous podcaster was going to be here. So he came over and was part of the arrangement, and today he wanted to see the fruits of his labor. He came by to see what a podcast looks like. I think he's become the newest intern in our comms department.

I mean, he'd be great. You should have him run some strategies over there. I don't know. Does he have any content ideas for you?

He's always full of ideas about how I should do things differently so they'll be better.

I was curious: As we think about the next 12 months—I know you think 2 years out or so—do you think that will compress? Has that compressed over time?

You're going to think 2 to 5 years out.

I think at the pace at which we are, things will happen much faster than we're used to, so you just have to believe that what you thought was gonna take 5 is gonna take 2. What you thought was gonna take 10 is gonna take 5. So you just have to change your horizon in terms of what you're gonna think.

I think if you go back and think about when we went through a technological sea change like this, it was in the late '90s with the internet. There were crazy valuations on certain companies because people thought that these things were gonna grow infinitely, and we're seeing a bit of a phenomenon at this point in time, similarly, with the market perhaps getting ahead of itself or not, where it believes there's infinite capacity, infinite demand for AI, which I think there is.

I think it'll be interesting to watch. Some players will move around because the market moves so fast in terms of capability. At present, the market is pricing in perfect execution for every company. Every idea that you see, the market wants to reward it because it thinks that their returns are outsized and the gains are gonna be so huge that it doesn't matter. Even if you fumble your way to some amount of success, it's gonna be a lot better than where you are today.

I think 2 years from now, that'll become less apparent. I think the market will have figured out its fair share of failures and successes, and the market will get more discerning, which is what typically happens at that point in the cycle. It's usually 5 years, but then we talked about compressing timelines.

I think it doesn't take away from the immense appetite for AI. It doesn't take away from the amount of reimagination and redevelopment that's gonna be needed from a software perspective. But yeah, I think the market could go through some stumbles and bumbles over the course of the next 2 to 5 years.

I know this company. I was an investor in Brex when it had just started.

Before the acquisition?

I was an investor at a billion-dollar valuation when they were there. My daughter used to work there. My son-in-law used to work there.

No way.

I know Henrique really well, yes. And Pedro, yes.

Oh, amazing. So this is great. This is my favorite question. You've had an outstanding career. You've learned from Larry, you've learned from Masa, you learned from yourself, you learned from Lee, you learn from everybody in this office every day, but I'm curious if there's anybody throughout that arc who has really inspired you and kept you motivated.

Yeah, I've struggled to find 1 role model in life because every role model has certain parts of their life that you don't want to emulate, but there are certain parts you do. And I think you don't have to go spend time with them incessantly, but you obviously get a chance to spend time.

But look, take Elon. What is there not to get inspired by? He built electric cars when people didn't think electric cars existed. He put a rocket up in space. He's got things landing on Mars and the Moon, and he's done things that NASA was funded for years to do and didn't do as well. He's doing them.

He's got Starlink. He's got satellites up there. We're sticking them on cars, boats, and planes to make sure that we have connectivity. So there's tons of stuff that he's done which is so radical, which none of us would've thought.

And I think the principle he's sort of explained to us there is, if you take a really hard problem nobody's working on, if you get it right, you win, and you win big. And if you look around you, a lot of entrepreneurs are busy trying to solve small problems because this is the problem they can see. They can see that far to solve the problem.

Mm.

Elon cannot see that far when he comes up with a problem he's trying to solve, but he thinks if he tries to put his mind to it, that problem gets solved. We're talking about space companies, space manufacturing, SpaceX, mining, space data centers. Shit, no one knows how or where it started, right? But they're out there thinking about it, and tons of people are thinking about it, so I think that's inspirational.

I think you look at Masa. He's got a crazy appetite for risk, and he's taken that business which used to be SoftBank. It was a software bank. He used to sell software, package software when he started his company, and he's pivoted 20 times since then. He's been the richest man in the world, and he's become poorer. He was the richest man for 80-some days, and he went back to being worth nothing, and he's gone back and built himself up.

So these people are inspirational for different reasons: for their creativity, their innovation, their big thinking, their relentlessness, and their persistence. People like Larry—there are so many people who can inspire you in different aspects of life. So you find the person to inspire you for the particular thing you're looking at.

I was somewhere last week. I went to a conference, and Steph was onstage speaking, and my son was there listening to him. My son is obsessed with basketball. Steph talked about this next-play mentality. You can't win if you can't get rid of the last play that you missed. You gotta focus on the next play.

That's an interesting lesson, whether you're in business or you're in sport. So you can find different people to inspire you.

As you get more and more successful, how do you continue to find people who challenge you and don't just become yes-men?

I'm constantly feeling like I'm an underachiever every time I look around me. There are young people running large hedge funds who've done so well in investing until the time they go back and reinvent themselves. There are people who put stuff on Mars, and compared to their achievements, I'm just running a regular cybersecurity company trying to make sure that we protect the world.

So what comes next?

Next comes tomorrow, and tomorrow's gonna be a wonderful day. It's gonna be beautiful. We're gonna wake up really excited about the day. We'll work hard, and we'll go home really excited to hang out with the family. Then there'll be the day after. We'll do the same thing.

Pretty good answer.

The problem is, if you set too many expectations of yourself, you're bound to feel disappointed. But if you don't set that high an expectation, if you set an expectation of doing your best, then good things will happen.

Were you always this calm?

This is my calm. It's kind of the karmic calm. The karmic calm is that you have to try to do your best. You have to put your heart and soul into it. You have to wanna win.

But do you see? It's kind of contradictory.

I understand.

You're so paranoid—

Life is contradictions.

But you're also like, “It'll be okay.”

Life is a series of contradictions.

Mm-hmm.

Right? It's the yin and the yang. If I talk myself up every time and start feeling freaked out if I fail or something doesn't work out, I'll be a mental mess, and I won't be able to make anything happen. So I have to work on a principle of doing your best, and then things will take their course. And if it works against you, wake up in the morning, shake it off, and do your best again. This is the next-play mentality.

If you get hung up on what happened yesterday, you won't be good. You can't be somebody else, because if you do, then you lose all the other things that are you. So yes, you can be all the things I said: go-get-shit-done, be paranoid because you wanna win. At the same time, you have to have some degree of inner calm to be able to deal with the moves, the pressures, everything else, the job.

Good. No AI psychosis over here, I guess.

There's no AI psychosis.

Amazing. Well, I think that's a great, positive, optimistic way and place to end it. Nikesh, thank you so much for taking the time and letting us rearrange your office.

Thank you for coming all the way here. We appreciate that. Thank you.

Of course.

My pleasure. Thank you.