No Priors | 对话 Palo Alto Networks CEO、前 Google 首席商务官 Nikesh Arora

Today we're here with Nikesh Arora, the CEO of Palo Alto Networks. He joined Palo Alto in 2018 when it was the nextG firewall player and has since grown it to six to seven times the size as a leader as a platform security company. Previously he was the SVP and CBO of Google during its massive growth phase from 2004 to 2014. Welcome, Nikesh. Nikesh, thanks so much for being with us.

My pleasure.

I don't know where to start because I want to talk about AI, security, and leadership. Given your history growing Google as chief business officer, we have to ask you: What do you think is the future of search, and how threatened is it?

Nothing like a slow little lowball to welcome me to your show. Turn it up a little bit.

This guy was at Google, too, at that point in time, weren't you?

But I talked to him too much.

What did you think?

I think we should defer the question to you as the expert.

Oh, look at that. He knows how to put his own mouth back. Have him do all the hard work.

I think the idea when search came about—I still remember going out there and trying to sell search to people, and it was, “Oh, my God, you mean I can just go to the internet, type something, and get the answer?” We spent 2 decades trying to get all the information out there on the internet so it was easily accessible to people. You saw the benefits: the democratization of information. Farmers in India could get stuff, and people could get information.

I think now we're in an age where people are saying, “Great, don't give me all this stuff to sift through myself. Try to make sense of all of it for me because it's too much.” That's what you're seeing in today's generative AI models. In my own words, I call that the democratization of intelligence. All of us will have the basic intelligence that every other person next to us has because we can figure it out. I don't have to hire the same people to solve the same problem for me for the 10,000th time and pay the money, because it's already been solved 9,999 times and the outcome is somewhere on the internet.

To the extent that Google has sharpened its skills in putting all that information together, being able to synthesize it, understand it, interpret my intention as an end user, and try to present me with the most likely outcome, I think that should translate well to the notion of generative AI being able to summarize the same things in a much more enhanced, orderly way.

I think, from that perspective, they are in a good position to transition the current search product into a future product. Call it what you want—“Ask Me Anything,” or whatever. It's funny: when you worked at Google 15 years ago, Larry had that vision. He used to talk about getting to a point where you answer my question and answer my intent, as opposed to answering what I type. He had the foresight to talk about that.

From a product perspective, they are in a good position to transition the product to what end users need. You've seen that with Gemini, ChatGPT, and other models that are getting to the same place. Let's not underestimate the power of distribution. There are 2 or 3 companies in the world that have distribution to billions of people, whether it's Facebook with all its properties, Apple with its properties, or Google with its properties.

They have the distribution, the product chops, and the AI chops. I think the bigger question is: How does the business model transform from what it has been, with text links and ads being represented against them? What's the new monetization that will come as a result of that?

It's likely to be agents or something else in terms of starting to take action.

Yeah, we can come there, too, but I think, because she has a search question, search is an advertising-revenue question. The question is, how does advertising revenue morph into some version of a consumption or transaction metric? Because when I say, “What are the best blue pants in the world?” I'm not doing it for academic interest. I'm actually going to transact. Maybe an agent could do this, or know the fastest flight to get to Rome. The agent could do that, and we'll talk about agents in a second, because I think that's much more disruptive than generative AI.

To that extent, how they transition the business model is going to be interesting. I don't think anyone knows what the business model is, but all I can say is that, having been there and admired what they do, they spend time getting the product adopted first. Eventually, when there are tremendous amounts of distribution for the product, you find that a model emerges.

I remember how, for the longest time, nobody quite knew how YouTube was going to make money. Everybody was looking at Netflix as the one making money in streaming, and YouTube wasn't. I think YouTube is a big-ass business now compared to most other streaming players in the world. They'll figure out how that model transforms. I do think the agentic challenge is a much bigger challenge than the generative AI challenge.

What sort of challenge do you think that is, or how do you think that's going to take shape?

Look, the idea is that, if you step back, we spent 30 or 40 years building products where we focused on the UI. Product managers are effectively glorified UI managers who are trying to make sure that we common folks can interact with data and some sort of engineering algorithm behind it, because we're not smart enough to talk to the engineering algorithm ourselves.

You go to Expedia, and it's a bunch of boxes we're supposed to fill in as humans, and it gives us the answer without having us write any search query, SQL, XQL, or whatever you want to use to find the information. I think generative AI has made that easier. We can talk to the UI in natural language to some degree, and it can generate outcomes on the fly. To that extent, all of product development is going to change with generative AI and this natural-language capability.

If you take that next step further and say, “I actually don't need to come interact with the UI; my agent can go do the task for me,” step back and think of that. Fifty percent of the applications in the world are some sort of transaction-fulfillment applications. If there are 5 million apps on the iPhone or Android phone—I'm picking a number; I think it's more than 5 million—half of them are trying to get you and me to interact with the engineering algorithm and give it some data.

Mhm.

If all those become agentic actions of an Uber agent, the question becomes—

Who sits atop?

Yeah.

Who's the Uber?

And that's also a lot of Google's traditional revenue, at least on the advertising side. It's not the brand ad.

So it's part of that business model in some sense.

Yes, it is. Most direct response is lead gen. In marketing speak, it's lead gen, which eventually results in a transaction or fulfillment of an information request.

At some level, it is a precursor to a transaction. People pay a lot more for the consummated transaction than for the lead. Maybe the business-model transition is: Stop giving me leads; give me consummated transactions through agents. Maybe I'll get paid more to buy you the airline ticket directly than to have you find an airline-ticket provider that is advertising, versus transactions.

I think the opportunity is there from a business-model perspective. Before we go back to that stable world where these business models have transformed, we're going to go through a very disruptive phase where a lot of these apps will be rewritten. We'll have to question whether some of these apps are direct-to-consumer apps or APIs—or perhaps MCP client-server interactions, if we don't call them APIs anymore—that will actually consummate that transaction.

Who do you think is most vulnerable?

Wow. You guys don't ask simple questions. He has to go for the jugular on every one of them. Who do I—

That's why you're such a good investor.

Yeah, we're looking forward to your insights on this stuff.

No, I know. Look, I think the most vulnerable people are where there is poor loyalty to the UI. If it's just a thin front end to a transaction-processing system in the back, do you care who you get your ticket to India from?

My wife is coming back. Do you care which airline, travel agency, or travel UI you get your ticket from? Perhaps you don't. You just want a ticket that allows you to get on a plane and get to the other side. Do you care who books your reservation for a restaurant?

At the end, where you're effectively a transaction-processing interface, where you build some degree of brand loyalty through a whole bunch of non-product experiences, I think those become vulnerable.

There are several more controversial ideas that OpenAI is trying to prove out. One is the scalability of consumer subscription.

How does that work?

Well, it's just like: Can you imagine? I think it's actually quite surprising how many people are paying subscriptions for this intelligence today.

Yes. Right. Yes.

I think the other is—and I want to talk about the B2B side—that you should get paid for thinking harder and solving harder tasks in a scalable way.

This is what they want. They want to sell work, right, to businesses.

What do you mean by work to businesses?

I think there’s a view that the traditional way you sell most enterprise software or products is as a seat unit.

Yes.

Or it’s some sort of volume unit, like an appliance or something, or a coverage, right?

Throughput-based, yes.

And here, the view would be, well, if I solve a really hard problem for you, I have a unit of work. It’s essentially translating to a unit of compute, or sort of charging for value, and I think there’s a strong belief in some of the labs that they should be able to charge for that.

How do you react to either of those business model ideas, because you’re now at Palo Alto in the business of selling direct value versus ads?

Yeah. Okay. So are we pivoting from consumer to business now? Are we moving away from the subscription? We went off on the whole idea of people paying for subscriptions. I think that is a bigger leap.

The bigger leap is that, in the consumer world, we are much more tolerant of inaccurate answers, or not-perfect answers. How many times do you go to a search, even today, where you’re looking for something, you don’t find the right answer, and you say, “Well, let me look again. I must have asked the question wrong. Let me ask the question.” You probably do that in your prompts in ChatGPT or Gemini, or pick your favorite LLM.

But in the enterprise world, there is not that tolerance for an inaccurate outcome. Especially if you get into the agentic world, you could say, “Oops, sorry, I made a mistake. I meant you to turn off that server, not this one. I blew up a whole bunch of my enterprise because you gave me the wrong answer, dear friend LLM.”

So I don’t think we’re going to—I don’t think we’re there yet, to be fair. None of us are giving autonomy to any form of LLMs to create any agentic task or do any work for me. We’re all using them with humans in the loop for suggestions, and we’re still using the use cases where we’re okay with multiple answers.

We’re actually having the humans be— it’s almost like a glorified assistant, or better assistant, or somebody who’s a knowledge worker who’s summarizing a whole bunch of information that I may not be able to have from the outside. I don’t think we’re getting into precision tasks. We’re not getting into precision actions yet.

So, look, if you can generate precision tasks with accuracy, precision actions with accuracy, yeah, sure, maybe you can charge me for a unit of work. But—

I almost feel that in the enterprise, we’re going to go back to some version of redefined, for lack of a better word. Let’s call them AI as a service instead of SaaS.

Perhaps AIaaS.

Right. Sounds nuts as a term. Yeah, yeah.

SaaS wasn’t a real term either. Sure. Yeah, yeah.

Sounds even worse. But anyway, imagine that, because you literally have to design the enterprise workflow—

End to end, and see how I can do that from an AI-first perspective, right? Perhaps the likes of Cursor or vibe-coding apps today. They’re trying to at least look at a part of a developer’s workflow and say, “Here’s what you do. Here’s a bunch of tools that can help you through that journey, dear human, and I’m going to see, based on how you use it over time, I’m going to get smarter and smarter and be able to take over more and more of what you need to get done.”

So I think it’s kind of like these are AI apps under training. When they grow up, they’re going to take over more and more of our tasks and allow the repetitive tasks to go away, so you can apply yourself to new, unique problems. But I think there’s a long time coming—

If you look at a lot of the platform shifts that have happened in the past—for example, with Microsoft OS, they eventually bundled the Office suite on top, right? Those were applications that were running on top. They ended up rebuilding or buying them, bundling, and cross-selling.

Right. Travel and local and a variety of other areas.

Um—

But they’re doing that in Workspace too, right? You guys are beginning to see Gemini show up, and, yeah, exactly. So actually, coding is a great example, right? OpenAI tried to buy Windsurf. Anthropic has Claude. People are trying to forward-integrate there. Claude also—or Anthropic—mentioned they want to forward-integrate into financial tooling right now.

Yes. Do you view this world as basically the platform—the big foundation lab companies—are likely to try and move into the biggest business verticals directly over time?

That’s an interesting debate. So let’s go back and see why. Look, the reason you’re seeing developers as the first adopters is that they’re the most likely to experiment and to be able to work with half-baked outcomes. If you give me 75% of the code that I need, I can parse through it and figure out the remaining 25%, because that’s what I do for a living.

It’s much harder to do that in other professions, where we’re not fully in tune with all the guts of what we’re doing. So I think that’s an interesting place to start, and over time that workflow will go out into testing and other parts of the software development life cycle. So I think that’s kind of interesting.

I’ve had this conversation specifically with some of the people who are driving some of these larger LLM businesses, and I remember the very first phone call I made to Thomas. We talked about small models and large models, and he gave me good advice: “Don’t chase a cybersecurity model, but don’t chase a small model, because these large models become so much smarter that the smaller models will not be able to be as smart as these things.”

That was sage.

Yeah, yeah. That was very good. In the very early days, one of our competitors announced they were going to work on cybersecurity. If I go back and look, I’m pretty sure that was a great announcement. I don’t think anything has come out of it.

So we decided not to chase that because it didn’t seem to make sense. That was pretty sage. I do believe that, after a point in time—and I think you and I talked about this right before doing this—you were giving me great insight that the models are converging. Their reasoning capabilities are converging.

If you believe all these models are going to be extremely smart but somewhat similar in capability, the question—and I always say this to people—is, look, in the enterprise world, getting the smartest model in the world is like hiring the smartest PhD from the best university you can find in the world.

For that PhD to be useful at Palo Alto, we still have to teach them our ways, right? They’re not going to be useful when they walk in the door. They have to understand our context, they have to understand how we do things, and they have to understand how to take our problem and solve the problem.

Whether you call that pharmaceuticals or genetics, you have to make the model get smart about genetics. It’s a very smart model, but you have to give it a lot more training data in a particular domain for it to become really smart in that domain.

So I think the interesting opportunity will be: How can we take these models and apply them to domains where we have proprietary data? The developer use case is a generic use case. There’s enough code out there in the public domain that you can actually get 90% of the way to being smart at coding.

There’s not enough genetic data in the public domain, or pharmaceutical drug-discovery data in the public domain, or proprietary cybersecurity data in the public domain. So the question becomes: How do you take these models, how do you take that brain, and apply that to a domain to make it really smart?

I think the challenge right now is that if you’re building a wrapper, effectively, as an AI-as-a-service company, and all your wrapper does is enhance the capabilities of a model or put some guardrails around it, then your biggest risk is that the model slowly expands into those capabilities and you’re no longer in business.

The difference those companies are going to have from others that might survive is, if you look at every SaaS company, it’s actually the packaging of a workflow—the system of record, right? My HR system is a connection to the workflow. Every employee knows how to use that workflow, and every time it locks down a certain table and says, “This is your system of record. This is what Nikesh gets paid. This is when he took holidays. This is what his equity looks like. This is when he vests.”

It’s less about the app; it’s more about that data and that system of record. So eventually, if these apps have to live in the long term, they have to marry the capabilities of AI, which effectively becomes an enterprise system of record.

A model is not going to become my system of record. It’ll still be some proprietary, locked database somewhere, or some data tables—pick your pick. Maybe the interaction mechanism is no longer a workflow; it’s some sort of agent or some sort of AI interface that allows that system of record to be maintained and created. But there still have to be some rules.

So I think that’s where the opportunity is, as compared to just putting a wrapper around generic processing. Today, I’m going to help you analyze legal contracts. Well, guess what? I ran my legal contracts with ChatGPT, and it works just fine.

Where are we, actually, given your visibility into enterprises, in terms of actual adoption, value, and use cases?

So I think the use cases—there are 2 current major use cases, right? One, let’s call it—what do you call it—generalized, or perhaps cross-enterprise, consistent activities. Right? Generalized, so—

To have a legal team.

Yes. Do you have legal teams? Does every enterprise have a legal team? Yes. Do they have any particular proprietary knowledge compared to, you know, a particular LLM? Unlikely. It’s more that I need them for legal advice, not for Palo Alto advice.

In that use case, could we use a Harvey equivalent or whatever those are? Sure. It enhances their productivity. They get their 50% faster. Could I possibly, in the future, use some sort of AI-based interpretive application that helps me process my accounts payable faster and codify them? Sure.

There’s a whole bunch of repetitive, generic tasks across the enterprise that I’m pretty sure could be done by some version of an AI wrapper around an LLM, with some particular context or my data. To that extent, I think we’re all experimenting with those things, but my caution to my team is: don’t try and build it. Somebody’s going to build them for all of us. It’ll be much cheaper to rent them.

It might be by some metric of work or per seat, maybe an agentic seat. I don’t know. There’ll be some mechanism that they’ll charge us on, but we don’t have to build it because it’s going to cost me a lot more to build my own accounts-payable smart AI system than what I can buy off the shelf.

Is that what your customers believe now? All the largest enterprises?

I think many of them do, because this is not an easy problem to solve. First of all, finding the skill set and finding people who understand this means living in this world of constantly evolving models. You know this better than me: you can’t take one model out and put the next version in, and have it work exactly the same way. This is like getting a new PhD and training all over again, saying, “Let me explain how we work here.”

From that perspective, I think most rational players in the enterprise space—customers—would want somebody who’s the expert to build it, for us to have some version of adaptability to it, and to make sure it’s secure. None of us—no enterprise customer—wants their data floating in a multitenant environment, saying, “Oh my God, my data is training other people’s data.”

If it’s accounts payable, have a good time. You can understand how I codify stuff; have a good time. But if it’s proprietary data, when I’m doing FDA trials, I don’t want my FDA trial data training somebody else’s data. I think they’ll err on the side of caution and say, “I want my instance to be secured.”

We spend half our time, before we look at any of these packaged AI apps, talking to customers and understanding the security. I don’t want my source code to be training somebody else’s coding app. To that extent, there’s a whole bunch of conversation: Is it ring-fenced? Is my data mine? Are you using it to train your model? Are you using it to train your system?

We spend a lot of time testing it to make sure that they’re not doing it. A lot of time and effort is spent there. Not every enterprise is as discerning; we have to be because we’re in the security business. But I think you’ll see some version of stability and acceptance there, where people will take these generic, AI-as-a-service apps that are helping humans get better.

Mhm.

Like, I don’t want my source code to be training somebody else’s coding app.

How do you think about that in the context of applications you think may make the most sense in cybersecurity? If I look at founder activity, there’s more and more activity around SOC. There’s a lot of activity around pentesting.

There’s activity around a lot of areas that are very human-intensive, and in some cases involve repetitive tasks, which make a lot of sense for this form of generative AI to take over. Then there are people incorporating AI into existing products, like Socket, for sort of a Snyk-like competitor, and other aspects of code security.

I’m curious, from your vantage point, what do you think are the most interesting areas of cyber AI?

If you step back and think about cybersecurity, there’s a world of cybersecurity that operates by saying, “This is the known bad. I found it; let me stop it.” Sure, that’s a good thing. I found a bad actor; let me stop it. I found malware; let me stop it.

To be able to stop bad things from getting into your network, you have to be deployed on every sensor. The first thing a cybersecurity company says is, “Look, I can’t stop what I don’t see.” So I have to be present at every edge, every endpoint, and every sensor of your organization.

Five years ago, we made a conscious choice that our strategy should be to get into as many sensor locations or control points as we can. So we did that. We have a SASE product and an endpoint product.

I think the sensor business will have to stay, because if you’re not there, you can’t find anything. It doesn’t matter how much AI you have; you have to be there to find it. Sensors are pretty good at stopping the known bad. If it’s known bad, I stop it.

Most cybersecurity breaches happen because of the unknown bad, because we stop all the known bad. So everything you’re talking about is trying to find the unknown bad, or a vulnerability that has left the door open so bad guys can get in. That’s what a Socket- or Snyk-like competitor is trying to do.

Now, in cybersecurity, there are companies that are the sensors. A sensor allows you to do 2 things: stop the known bad, but also collect valuable data to analyze and understand what the unknown bad may be. So we get the benefit from both: we’re a sensor stopping the known bad, and we also collect a lot of data.

Traditionally in cybersecurity, people have been, I’ll call it, vertically integrated from end to end. They say, “Let me sit at the endpoint. I’m going to trap all the data around a particular topic. I’ll take that data into the cloud, analyze it, and then tell you, ‘Oh my God, I found something suspicious. Here are 5 suspicious things you should investigate.’”

But the problem is that I don’t have context. When the data passes my sensor, it’s gone.

Take a simple example: I send you an email with a phishing link. You click on it, and when you go to the website, I steal your credentials. Now, I’m an email security company. I see a bad email. I know how to stop it. I don't know it's a bad email and Elad clicks on it.

Now you’ve gone from my email product somewhere else in the company and gone to the internet through a firewall. I have no idea what you did. So all I can say is, “That link looks suspicious. I clicked on it. Maybe you want to investigate.”

No customer wants a list of 5,000 things they have to investigate. People are busy building these agents, saying, “Let me build an agent to help you investigate this and investigate that.” But I think the better answer is: if I had all the context of the enterprise, I could mine that data to find what actually happened.

We’re taking a different tack. We’re saying, “Let’s see if we can consolidate all the data in the enterprise.” If we can, we can run a whole bunch of machine-learning algorithms and do all these activities on top of that.

The current startups you mentioned are trying to do what AI wrappers are trying to do around LLMs. Over time, we’re going to get better and better, and we’re going to squeeze their capabilities out over time so that you wouldn’t need them.

Yeah. And there are a few different sets of them, because there are also the ones that are just trying to automate human services associated with the security world today. Pentesting would be one example, where you often hire external consultants to help with that.

SOC may be another one, where effectively you’re looking at the Security Operations Center across all the different events that are happening and trying to automate that.

The reason you’re trying to automate the SOC from the outside in is because you’re not running 10,000 machines out at the ingestion point. Why should I first collect all the data and analyze it afterward? I should analyze the data and cross-correlate it at ingestion to make sure I understand the bad things, put them up there, and then build agents to investigate the bad things.

Well, this is my question now: the environment in a large enterprise today is still very fragmented, right? They’re just doing this pass-the-hat trick that you’re describing with all these different tools. Hopefully, they’re very dominated by yours—

But it’s all chosen by customers. “Dominated” is a bad word. You’ve worked once in a large company. You understand that in a highly competitive environment.

That’s right. Yes, of course. I was talking to a friend who runs security at a large financial institution, and he’s like, “We have 100—”

Does he want some cybersecurity?

He’s definitely got some help on it; he wants more. But he’s got 118 identity tools, right? I didn’t think there were 118 identity tools.

Identity crisis.

There we go. You’ve got to try it.

So he bought an identity company to solve that. You’re all right. Maybe the answer is just to make it all cyber AI. But I think his view is that it’s untenable for him to consolidate all of this in the near term.

Yes. And so I’m going to attach something afterward that does the human consolidation.

Yes.

Like the Silk automation thing, right?

Yes. The interesting part is that we're the youngest industry in technology because cybersecurity did not exist before connectivity came about. Nobody had to—you were in a mainframe, you sat in the office, you connected the mainframe to a pipe into the back end, and you were off to the races. Nobody was actually going to come and intercept your traffic.

Scary before the web. Yeah.

That's right. So the web and applications out there made it serious. It's a 25-year-old industry. Every time a bad problem showed up, somebody built a point solution to solve that problem.

Mhm.

So it is a fragmented architecture. It's a fragmented environment. There's a lot of data being used and analyzed multiple times by multiple vendors because they were needed for that point in time. But like any industry, that capability commoditizes over time, right? There's no genius in building a firewall. Every firewall, within plus or minus 10%, does the same thing, right? Some things do it better.

The question is, what do you add on to? What capabilities can you build beyond that? So if you believe that, sure, in a stack, 80% of the capabilities are going to be capabilities that even most companies still don't have, and they can be delivered in one platform, then on the other 20%, we can add add-ons. But over time, we will eventually gobble those up because there'll be a new 20%.

Until 1 year ago, nobody was talking about AI security.

Now there are probably more companies than you can count who all show up at Elad's house saying, “Please give me some money. I'm starting a cybersecurity company for AI. I do prompt injection. I do malware checking on models. I do model data poisoning. Agentic attacks.” None of those things existed.

Of course, you'll find people building features to protect against those because we're still too busy fixing the problems of the last 5 years, where the mass-market problems are. Over time, I think what you'll see is that the platform approach is going to eat into this feature approach. There are companies with cobalt code out there as well.

So, 118 identity vendors sounds like a lot. I didn't know there were 118 vendors, to be honest. He might have meant cybersecurity vendors, which I can believe—that's also a lot.

What new problems from AI do you actually pay attention to? What do you think is going to be a mass-market problem?

Look, if you back up and believe your own rhetoric, then I, as a bad actor, should be able to unleash agents against an enterprise, against every aspect of it, and figure out where the breachable parts are or where the holes are.

Mhm.

In a matter of minutes, or less than an hour, I should be able to point my attack toward that vector. I should be able to run simulations on how to attack this thing, and I should be getting exfiltrated data.

When I started 7 years ago, the average time to identify a target, get through it, and exfiltrate data was in the 3- to 4-day timeframe.

Yeah.

The fastest we've seen right now is 23 minutes. If the bad actor can get in and out and exfiltrate data, or shut down your endpoints with ransomware, in under an hour, then by physics your response time has to be less than an hour.

Mhm.

The average response time is still measured in days. From that perspective, the biggest threat that AI brings is that it continues to compress the timelines to shut down your business, cause a compromise, cause ransomware, or cause economic disruption. I think the pressure just went up on our customers to get their infrastructure in order.

That's the risk and the opportunity.

Yeah, I think Elad mentioned pentesting, which hasn't traditionally been a very strategic part of the security landscape.

Yeah, pentesting is just to knock down every part of your defense. I think half the companies don't do pentesting because they're scared of what they'll find. They're doing some minimum compliance level.

From a technology perspective, pentesting is trying to attack the area. There are companies like RunSybil now that do this. They can do it continuously, in the 23 minutes you describe. I'm like, that's exactly what an attack is—24/7/365 at Palo Alto. We don't hire third-party people. We run that as a default because that's our existence. If we get compromised or breached, we have a problem.

Yeah.

You mentioned email. I think it's a well-known issue that a lot of breaches happen because of social engineering, because of email, because of credential takeover.

89% of the attacks happen because of credential theft, right?

Somebody becomes you or me. People like us aren't getting any smarter, and now you have models that improve 1% a day. How concerned are you about deepfakes, generated spear-phishing, voice attacks, and all that stuff?

To the extent that they enable the act of social engineering, yes, those are concerning. I think most forms of two-factor authentication are going to be out the window. I won't say which bank, but I call them and they say, “Oh, can you please confirm your identity?” They ask me 3 arcane questions, which I'm pretty sure GPT or Gemini will be able to answer in under a second because they're only scouring the web to find public information about me and ask me questions.

I think all those forms of authenticating who you are are getting easier and easier to compromise. So the question becomes: Do you solve it their way or our way—as in, the way they're looking at it or the way we're looking at it?

At the end of the day, every one of these social-engineering attacks and credential takeovers eventually initiates some bad activity in the enterprise.

Mhm.

The bad activity in the enterprise often takes the form of what I will call anomalous behavior.

Mhm.

Suddenly Sarah decided to exfiltrate all the data in Elad's company. Even though she used to email with him every day, today she's logged in and downloading everything onto her laptop.

This actually happened last week.

Thank you. Great deal flow.

Is there nothing suspicious in that?

That sounds pretty suspicious. I can spend my time trying to make sure that nobody can take over Sarah's identity, or I can make sure that Sarah doesn't act anomalously. If she does, then I throw in a block at that point in time.

Mhm.

So I'm looking at life a different way. That's why we're buying this identity company. Identity companies today say, “Oh, I checked you in the door. You're fine.”

And now you can roam anywhere in my entire enterprise and do whatever you want because you were checked into the door. That doesn't work anymore. I have to make sure that I can now use compute and data, and AI is going to allow us to analyze all the anomalous patterns.

I can say, “That's pretty weird. She would never have done this in the last 7 years. Why is she doing this now? Does she have the rights to do it?” I can do just-in-time rights. I can stop you from accessing this stuff.

You have to change the name of the game. You can't do it the same way. So the whole idea of us buying an identity company is to think about life by saying, “Stop giving people persistent rights. Give them just-in-time rights. Give them rights that analyze for anomalous behavior.”

In fact, what I want to do is say, “I actually don't need you to give me a second-factor authentication. I can see the way you type.”

And if your identity starts typing differently, I'll block you.

So, one of the things you've done incredibly well at Palo Alto over time is start with a core set of products and then expand, really providing both the platform and the add-ons that you mentioned. Was that something you came into the company knowing you wanted to do? Is that something you ended up adopting over time? I'm curious how you thought about that puzzle.

Well, Elad, you and I have worked together before, and I remember you were at Google—a smart young man—and that hasn't changed. I came to Palo Alto and analyzed a business problem: the product.

I came with 2 things. One, I understand business. Two, you know, Larry told me many years ago that if a technology company loses sight of the product, it decimates over time. That's been true across technology. Take your pick among the tons of companies that haven't made it.

The business problem in enterprise is that if you look at an enterprise company with less than $1 billion in revenue, 50% to 65% of costs are sales, marketing, and customer support, which leaves no room for margin. If you look at the largest enterprise companies, that number goes to 30%.

So it's all about taking that 70% and bringing it down to 30%, because R&D and G&A don't change much past $1 billion to $10 billion or $100 billion. You still maintain 12% to 16% of R&D costs, and if you're efficient, like some of the large players in the market, you're at 4% G&A, or you're at 6% or 8%.

So your maximum leverage comes from sales and marketing, customer support, and marketing. And you realize what that is? It’s the ability to convince one customer that you’re really good at what you do and be able to expand in that customer’s environment with the trust that you can do more and more things for them.

So that’s the insight I came in with: Why is it that Sarah’s friend has 118 vendors in the infrastructure? Because each of them gets vetted. This is security. It’s not like buying some random thing on the side. There’s a big procurement process and a testing process, right? Because you could be a bad security actor, and it could take my whole enterprise down.

So if you go through that entire process of validation, verification, and trust, why shouldn’t I take the trust that the customer has given me, earn their trust, and expand my capabilities across the platform? So that’s the insight we came with and realized: We sell firewalls. “Hey, you want a firewall?” “No, I’m sorry. I’m good for the next 5 years.”

I had a sales guy who was focused on an account that was his target. He spent 3 months getting a meeting and going through the process. Now he doesn’t have anything to sell them. So, okay, you don’t want a firewall, you want this. You don’t want that; you’ve got this, you want this.

Eventually, enterprise salespeople have to have enough of an offering set that allows them to present something to the customers. The good news is that in cybersecurity, there’s always some transformation going on because some technology is coming to its end-of-life form, and the company hasn’t innovated. Then you’re off to the next set of companies.

So that’s the insight that came. Yeah, it’s a great insight. And if you actually look at the margin structure for some of these things that you mentioned—sales, customer success, support—a lot of those things now have AI apps that are making people dramatically more efficient. Do you view the future of those functions as being very AI-enabled and AI-heavy, or how do you think about that transformation across companies like Sierra, Decagon, Rox, and others?

Yeah, I think I’ll answer the first half of the question. The second half is your domain and Sarah’s domain. I’m going to leave you to answer that question for him because I don’t know the answer for the other companies.

But I think, look, if you fundamentally look at organizational efficiency, perhaps the best word is that people are scared of AI-based efficiency. I seriously doubt that an AI agent will convince the CIO or CISO faster than my human who goes and hangs out with them and shows them the product. So I think my sales teams are very happy in their existence. They don’t believe they’re imminently threatened by AI, so that’s a good thing.

Interestingly, on the product-development side, I think people will be—

Just to come back to that—sorry, I interrupted you—but there are other forms of sales enablement: a deck per customer that you customize, or—

Yes, sort of SDRs. Those are marginal. That’s process efficiency, which will come through it. But guess what? Before we get there, I’m probably going to need 15 AI-savvy people to build the workflow, because an AI model is not just going to spit out a Palo Alto SASE proposal by itself. It’s going to have to be trained.

Do you think that’s customer-segment-specific in terms of the leverage you can get? A lot of people think, for example, about the SDR-level seller, where you’re sending a bunch of emails, cold-calling, or doing things like that, where it’s a lower-ACV customer.

Yeah, but I think that’s only one side of it, right? If you stick to SDRs, we’ll go back to the other problem in a second, but stick to SDRs. At what point in time does my email start getting read by an agent whose job is to block all SDRs? Block all people trying to sell me, because I’m overwhelmed by the number of people who think they should write to the CEO because they have some company with 5 people automating something.

That’s interesting. Does that actually decrease the effectiveness of those sales teams over time? In other words, if you effectively have agents screening things, does that create a block for certain types of sales leads?

Well, I think the question of the sales lead isn’t the issue, right? The question is generally either I have a need, and I know it, in which case hopefully my blocking agent knows my needs and eventually says, “Ah, you know what? Actually, we’ve been looking for this thing, and here’s an email which satisfies our need. So maybe that’ll do it.”

Or, as we do in marketing, you never need a new watch and you never need a new car, but you just buy it because somebody put it in front of you. I don’t think it happens that way in enterprise. So we can’t generate demand for something when we don’t normally have a need, but sometimes you can in cybersecurity.

So, look, I think those will be marginal efficiency outcomes because how many SDRs do you have? Eventually, you do the selling. We do lead generation. We’re in a large enterprise business. We go through a large, rigorous testing process. So, yeah, I can get a phone call, but if my product doesn’t show up, then it doesn’t matter how good the lead was.

Yeah, it’s interesting because I haven’t thought of it as just becoming—if we have agents doing this sort of low-level communication first—it could just become a more efficient market for finding the problem-match, right?

Yeah, maybe. So I think if you go back to the organizational-efficiency question, I was talking to my CFO this morning. I was like, “When are you going to take a whole bunch of stuff that you’re doing with human beings and replace them with some form of at least 50%-efficient agentic analytics or apps?” I think we’re going to get there.

I think the maximum replaceability will be in, let’s call it, administrative areas. I have 200 people doing documentation. Do I really need 200 people doing documentation? If models can do 90% of the work, they probably need AI-savvy people to write the guardrails around these models and templates, and they can prompt them.

So we’ll find some efficiency. Pick your number: 200, 300, 400 basis points of efficiency. The larger you are, the better you are, because you’re going to save more money.

I think sales doesn’t change as much. I think product innovation—the better companies will innovate faster.

I have technical debt. I’d love to get rid of a whole bunch of Salesforce code or a bunch of SAP code that I have, and get it more efficient. I can’t find good people to go to it because nobody wants to work on it, right? They’re all working on AI.

So can I get some version of agentic AI apps that are going to get rid of a few hundred of those people? Great. So I can get inefficient product-development ideas out of there, but I’m not going to let go of any good product person, because I’m going to get them to move faster. That’s my competitive edge.

I think we won’t see as much attrition in the vibe-coding outcomes or the product-development outcomes. You’ll just see faster innovation.

So basically, the statement that AI is displacing all human labor—that’s very overstated from your perspective?

I think, on those 2 segments, customer support will have to go through that revolution. What I mean by that is, I always joke internally—I tell my people—customer support exists because we build bad products.

If you have great products, why would you have to have customer support? It’s complicated. It’s hard to onboard. It’s got too many dials, and that’s why it takes me so much time to make it, and then eventually it’s not efficient.

So we have most recently moved customer support closer to our product teams. I told my product teams: The day you have a bug, or the day you have a customer issue because of a product, fix that before you build a new feature.

I think, in concept, from a North Star perspective, we should be able to take 80–90% of customer support out in the next 2–5 years across the landscape. That’s what every good company should aspire to do. And when you take it out, it means your product quality should get better.

If I’m really using a good vibe-coding agent, why shouldn’t it write better code? If it’s writing better code, why shouldn’t it find flaws in my code much sooner? Why shouldn’t it run simulations?

So I’m expecting product quality to get better. I’m expecting the fixes to come faster. I’m expecting that we can diagnose the customer’s problem with data, as opposed to humans calling and asking all those questions.

Yeah, I think there’s a lot of anxiety from engineering leaders that product quality is not likely to get better. There’s just going to be way more of it—more bad-quality product? Or more—more just more product, right?

That doesn’t mean it has to be bad product.

That’s fair. Yeah. I think the combination of generated code that people are not fully understanding from an architectural point of view, fully reading and reviewing, and that volume overwhelming the processes that we have today in software development is an anxiety.

Let’s park that for a second. It is the worst right now that it’s ever going to be.

Exactly. It’s only going to get better. You’re the most optimistic security person I know. That’s great.

Am I restricted to being optimistic in security?

Well, it’s not like a super-optimistic group. I’m just saying—

Look, I think at the end of the day, being one of them, we have to do the best job we can, and then eventually life takes over. So it’s fine. But from a quality perspective, anecdotally, I have seen examples that have huge promise.

I’ve seen a coding agent find a vulnerability in security code at Palo Alto Networks that we wouldn’t have found unless it was out in the wild, which is a good thing for us. I’ve seen it take 500 lines of code and come back with 75 lines of code, which would have been much more efficient at doing the task that those 500 lines of code were doing. I’ve seen it come back with code explainability for code that was written 15 years ago. We can’t find the person who wrote it.

So there are some amazing examples of what the art of the possible is. If that’s just what we get today, I think 1, 2, 3 years from now, that stuff’s going to get better and better. So from that perspective, do I believe product quality gets better? I 100% believe that product quality gets better. I don’t think there is any debate on that topic right now.

It doesn’t look like there is a solution for stupidity in the world. So if you don’t have good people reviewing this stuff, then yes, you can end up with bad outcomes—not because AI is bad, but because you didn’t set up the right guardrails, the right process to do it. So I think we’re going to get good-quality outcomes. I think we’re going to see better and better capability.

I think the most vulnerable area in any enterprise is large numbers of humans doing repetitive tasks, which are either generic—which is the easiest to replace because everybody’s doing them; we don’t need them—or, even if they’re specific and have critical mass, if I have 2,000 people in customer support, I should be able to optimize a lot of that and hopefully deploy those people in much more meaningful things.

I imagine I have a child; you have children. Do you really want them to grow up and become customer support people and say, every time, “What do you do?” “I just pick up the phone and listen to somebody grumbling at the other end because something they bought is not working.” That sounds like a really horrible job. So I think those jobs should go away. What’s wrong with that?

And they don’t have the power to fix it.

Yes, that’s worse. It’s like getting punched in the face and not being able to punch back. Somebody’s taught them, “The customer’s always right.”

Mhm.

Can we talk a little bit about leadership? You’re a very unique leader. This is a time of at least a handful of companies growing very quickly because they create value and do trades in billions of dollars.

Google from 2004 to 2014; Palo Alto Networks, 7 years in. You’ve added, like, the size of Palo Alto originally every single year since, in terms of enterprise value. That’s wild. What makes you a great leader in terms of growth at scale? What advice do you have for some of these people who are like Guinness Book of World Records in terms of growth in the first few years?

Yeah, yeah. Well, as an optimist myself, I’d say AI wrappers or not, they’re creating a lot of value, and consumers and enterprise are buying very quickly.

Look, if you step back, it’s interesting. Every business that you’ve identified or you’ve looked at, we’ve talked about, has a much larger TAM than any of these companies are able to touch. The markets are growing. You have the opportunity to take share and grow in that market.

So I’m a huge fan of growth businesses. I hate the idea of restructuring something that’s on a declining curve. It would sort of scare me. So it’s good to find the right market from a growth perspective.

I always have this principle: Nobody wakes up in the morning and goes to work to screw up, or wakes up and says, “I went to my worst job possible.” No chance in hell. You can find people and get a group of people together. They can be innovative as hell and put a rocket into space faster than NASA.

These are all humans. They’re all people out there. There’s no difference between many of them and people who work at Palo Alto Networks or the people who work at Google or elsewhere. So what creates the difference between great companies and companies that are not as good? I’d say, within reason, you can find those people in every company.

I think it boils down to understanding the market, setting the right North Star, getting enough buy-in, talking about the why—not just the what you need to get done—getting people really excited and bought into it, and then making sure they have the resources to get their tasks done.

If you do that, then my job is to set the strategy, set the North Star, put the right people in place, and then basically act as their shield and keep blocking bad things or friction from slowing you down. If you can do all of those things, there’s a high probability you can create good outcomes. Never guaranteed.

Are there any unique structures, approaches, or tactics that you use that go against the grain? We’ve talked to Jensen a few times, and he’s pointed out, for example, that he has 40 direct reports. He doesn’t do one-on-ones. It’s a—

I actually read that. I actually expanded my staff meeting from 8 to 25 after I read that.

It’s interesting, and it solves a different problem. At least in my case, I’ve discovered that I’m not always sure that these people communicate the why to their teams. So it at least eliminates one level of confusion: Why does he want this? “Oh, actually, I heard him directly. This is what he wants to get done.”

Sometimes you have this notion that you have to be a player, you have to be a coach. Sometimes you have to be directive, sometimes you have to be encouraging. It’s like, “We’re going to climb that mountain. We are going to climb that mountain.” If you go back and say, “We’re going to climb a mountain,” I promise people end up on that one.

So it’s important for people to understand the communication part. I’ve discovered that communication is actually underrated in organizations. Usually, the way I do my—call it a 360-degree test—is I meet 50 employees every 2 weeks and ask them questions.

Mhm.

Then I discover, “Oh my God, these people are asking questions that I thought were abundantly clear: why we’re doing this, what we’re doing this for.” I discover eventually that by the time you get to the person 4 or 5 levels removed from you, they actually don’t understand exactly why we’re doing certain things.

They have fundamental questions around what we’re doing, and that causes them to do it differently or not do it. So that becomes an issue of communication: talking to people and making sure they’re all bought in.

I think from a business strategy perspective, we’ve taken a very different approach to M&A.

Right?

We bought 27 companies so far. We’re about to buy our largest one, if we get approval and get it done. I don’t call it M&A. I call it product development and research in a highly innovative market where all of you guys are kind enough to support.

Yeah. Innovation. It’s distributed R&D. Exactly right. Distributed R&D.

We’re in this service for you.

Well, you guys do reasonably well for that.

So you can say thank you and I can say thank you. I say it’s like, if you don’t win, I don’t win. If you don’t win, I don’t win. It’s fine.

We’re happy to be in a situation where you get to a certain stage and we get it past that stage and take it to scale, because I don’t believe we have all the smarts in the world. There are lots of smart people out there who are trying to solve different problems, and I don’t believe we can solve all the problems simultaneously.

Take AI. We started off saying, “Oh my God, when AI gets deployed, enterprises are going to want to make sure that their AI instances are secured and controlled and managed because they don’t want data leaking. They don’t want external input.” So we built, effectively, what we called an AI firewall.

And we discovered this company—you know what? People are actually trying to figure out whether the models that they have are hackable and have malware in them. So we weren’t doing that. We were just protecting them once they were in there.

There’s a company called Protect AI, which was actually assessing models. They were doing persistent red teaming against the AI models specifically, not just the enterprise. Going back to your comment on red teaming, models morph; their responses are unpredictable and nondeterministic.

The same model could answer the same question one way today and could answer it differently 1 week later because it learned. Now, if you start getting nonpredictable responses, you have to inspect all the responses to make sure none of them is malware.

Yeah.

Right. So from that perspective, we do persistent red teaming of models. We do scanning of models. They said, “Oh, we haven’t done it.” We found this company and we said, “Thank you very much to the VC community for delivering that from an R&D perspective,” and put them as part of our platform.

So we do rely on, like you said, R&D as a service from the VC community, and that’s been very helpful. But we always go for number 1 or number 2. We never believe that you can take 3 or 4 and spit and shine and make it look like 1 or 2, because 1 or 2 don’t go away. They’re treated as 1 or 2 for a reason.

More often than not, we make the leaders of the acquired companies the leaders of our business because we believe they've acted faster than us in a much more resource-constrained environment, shown a tremendous amount of resourcefulness and hustle, and delivered outcomes in innovation. So I think, from that perspective, we probably have a higher hit rate in the industry than most other M&A that has happened in the enterprise space. So I think we do that differently.

Yeah. At the beginning with Palo Alto, and continuing today, you have perhaps been more ambitious than any other security company.

I think that's right. How do you convince an organization to be more ambitious? My understanding of the cyber industry before was that you had endpoint businesses and firewall businesses, very sort of domain-specific, right?

I don't think you have to convince humans to be more ambitious. I think we're natively and naturally ambitious. You meet somebody and say, "Can you do more?" I've never heard someone say, "I think I'm done." Everybody says, "I want more. I can do more." We live in a consumptive society; we're taught to aspire for more.

So I don't think it's hard to make people at Palo Alto feel that we have the right to play at a bigger table on a constant basis, and people actually like the idea of ambition and aspiration and winning. Trust me, if our stock wasn't up 6 or 7 times in the last 7 years, a lot more people internally would have questions on our strategy than they have now. So I think it's a self-fulfilling prophecy. It's a good thing across the board.

More fundamentally, if you step back, our industry is not fully formed. It has 118 vendors; it is fragmented. You take a look at the CRM industry, the ERP industry, and the HR industry. These things operate on single platforms, right? Nobody has 2 Salesforces deployed in the enterprise. Nobody has 2 Workdays deployed in the enterprise. Nobody has 2 SAPs deployed in the enterprise.

Why? Because you need end-to-end visibility, a singular workflow, and a singular set of analytics to solve the problem. Our industry started off because, "Oh my God, we have a threat. Block the threat. Don't worry." So we're playing whack-a-mole.

As I said, over time, as these requirements normalize, they somewhat converge in the capabilities of vendors. Then how does it matter if you take from one versus the other? What becomes more important? All these platform companies I talked about—it's not like they have unique features on a feature-by-feature basis compared to their competitors. Over time, those have normalized.

But what they do have is end-to-end visibility and capability that integrates the functionality. That's why they're there. So if cybersecurity has to survive in the long term as a mature industry, we also have to become a singular enterprise platform.

If you believe that, we're nowhere there. We used to have 24 products when I came. We had 4 when I came; we took it to 24. We had 44 Magic Quadrant and top-right mentions. We've turned that into 3 platforms.

I say, "If you're going on a journey with us, it's going to take you 2 to 3 years to get a platform deployed with 3 right now." Had we said 1—oh my God, your friend can't go from 118 to 1. It boggles his mind. So let's take him to 3 first, or 1 or 3, and hopefully get him to the next one. We get him a third one.

So I think the idea from our perspective is, if we can become the platform of choice in the industry, that's a very big ambition, a very big North Star. But you don't get there if you don't start.

Maybe when you look forward—for both Palo Alto, cybersecurity, and AI—what keeps you up at night? What do you think most about?

I think most about AI. I'm glad we think about it. It's certainly something you do, right? I think more about AI from the vantage point that if our view of how this is going to evolve is not within the guardrails of where it's going to be, we may end up taking Palo Alto in a different direction. Remember, we exist to help you secure technological advancement in a certain direction before you fully deploy it.

Today, our conversation with some of the cloud providers was, "How is everybody thinking about agents? I'm supposed to secure agents." The problem is I can't get one person to agree with the other person's definition of an agent.

I'm like, "What's an agent?"

"Well, are you going to use MCP protocols to deploy?"

"Well, no, we just have connectors."

"What's a connector in an LLM?"

A connector is effectively an API call, a microservices call. Why are you using API calls? It used to be called an API call in the past. Why aren't you using MCP servers and clients?

"Well, we're going to get there," right? How are you going to do an inspection of identity?

"We're going to register the identity somewhere else."

How are you going to do delegation? There are so many questions from an execution perspective and from how the industry evolves that it's not quite what keeps me up at night.

We talk about this every day. We have a team of people getting together every day for 2 hours, and we read everything. We talk about it, saying, "What do you think about this? What do you think about that?" Because when you don't have an expert, then hopefully the collective wisdom of 6 or 7 smart people—those people who I bring together every week, 2 or 3 times—is probably better.

So we're constantly trying to paint a picture of how the world of AI is going to evolve. We're building our opinion, and based on that, we have to design a product.

Mm-hmm.

So that's extremely bleeding-edge, right? And if we want to be the cybersecurity partner of choice, we have to be able to go with the bleeding-edge capability and tell our customer, "Look, you have a problem. We're solving it faster than anybody else, and we can help you deploy AI securely."

So that's kind of what's exciting. It's a little bothersome because you have to keep understanding. You have to think, like, "Holy—where was I just here? What do we do with that now?"

Yeah. As you've been thinking deeply about AI, have you thought about it from a broader societal perspective—the impact on the world? Are there specific threats that you think about most, worry about most, or feel most optimistic about?

I'm going to stick with Sarah's characterization of me as one of the more optimistic people about these things. I'm going to expand that beyond cybersecurity.

I think it's exciting technology. You've been in Silicon Valley for a long time. You've been investing for so long. The intensity and the excitement are palpable, right? You can't turn around.

It's really fun again. Yeah.

It's really fun again, right? You can have dinners, you can debate all kinds of arcane topics, and I'm pretty sure you can find lots of people with different opinions. There are so many different directions you can go. You can talk about policy implications, you can talk about wrappers, you can talk about LLMs, and you can talk about infrastructure.

It's like a whole new technological wave, which has so many implications and majorly disruptive implications. From that perspective, I think it's exciting. Does every technology come as a double-edged sword? Of course it does. Every revolution in history has come as a double-edged sword, so why not this one?

You have to believe in the power. There are more good people in the world than bad people. The good people will hopefully continue to make sure that the bad things get controlled.

Now, are some bad things going to happen? Most likely. Are we going to find a way around it? Most likely, and hopefully. We powered through a pandemic, for crying out loud.

Mm-hmm. Awesome. Thank you, Nikesh.

Yeah. Thank you so much. Thank you for your time. Appreciate it.