Nikesh Arora: $300B, 40 Acquisitions, Still Paranoid

This is the beginning. This is not a moment. You've seen most recently all the AI labs are flexing, showing how cool their models are and how they can basically become an attacker and attack infrastructure rapidly because of all the vulnerabilities they can find. It's a lot easier to attack. As an AI lab, it's much harder to defend. If you found a vulnerability, a zero-day vulnerability, the average time to fix it was 55 days. The average time missiles will find it and try and attack you is in minutes. As part of Black Hat, we launched a capability which allows us to deliver patches in 4 hours and deploy them to everyone for our customer, which is huge, from 55 days to 4 hours. None of the software written the last 20 years came with an opinion. So the entire software industry will get rewritten in the next 10 years.

Thank you for having me.

The hottest take right now is this is the beginning. This is not a moment. You've seen most recently all the AI labs are flexing, showing how cool their models are and how they can basically become an attacker and attack infrastructure rapidly because of all the vulnerabilities they can find. Well, guess what? That's going to become par for the course. Well, who's going to protect them? And it's a lot easier to attack. As an AI lab, it's much harder to defend. So I think all the cybersecurity companies are on a tear for that reason because the market understands that to get all the infrastructure in the world up to snuff in terms of its capabilities to be able to protect against this deluge of AI attacks that are going to be upon us. You need all the cybersecurity companies.

Really hard watching our podcast. Listen, what's fascinating, in the last two years you've seen we've been through so many iterations of AI. Started ChatGPT, OpenAI is going to go run away with it. Anthropic came from nowhere. People have written Google off and they were not going to be able to compete in like two years. Hence we're sitting here watching all the announcements from all the cloud companies, which are sort of going gangbusters because people want to use more compute, want to use more AI. And now we've gone from LLMs to agents. Agents are going to help us do a whole bunch of stuff. We've gone from agents to open-weighted models, open source, closed source. So there's so many variables because the market continues to evolve on a daily basis. In cybersecurity, you got to go make sense of these trends and see which ones of these trends is likely to catch on. So we got to go build the security infrastructure and harnesses around it. So it's kind of a bit of dancing on your toes and constantly being nimble trying to figure out where this thing is going to land. It's interesting. I think some things are beginning to emerge. I think a lot still needs to be figured out. But I think one thing is clear, the appetite for AI is huge and I don't think that trend is going to reverse itself. So, if you believe the demand is infinite, then a lot of things have to fall into place for this to be successful. And one of them clearly is cybersecurity.

I think it's, I told you, it's part of the flex. It's part of demonstrating the capabilities of the technology. I think for all practical purposes the biggest use case you've seen is coding. Everybody is using AI to code. I think that's kind of mainstream because the capabilities of AI models have sort of, it's fair to say, have surpassed humans in certain cases from a coding perspective. You still need humans to watch what's done, sort of ensure that it's the right solve, tested, run through processes. But clearly you can see that the use case has been established, the productivity case has been established and there's a huge amount of consumption in that space. Outside of that, I think people are still feeling their way how agents are going to work. How do you give agents what we call true agency? How do you let them decide? I think there's still a whole bunch of experiments going on over there and it'll take time before people get really comfortable unleashing agents into the enterprise.

Well, I guess the main question is now they're asking for a slowdown to potentially cover their tracks later on.

Yeah.

I don't know. You tell me. Look, I think it's clear from all the recent developments that these models are getting really powerful and the edge case intelligence is really strong. Like you know, it can solve some unique things. You saw some math problems being solved two days ago. You've seen that it can find cyber vulnerabilities, it can daisy chain vulnerabilities, attack infrastructure. So it's clear these models are going to be extremely powerful. They already are. I think it's important that before who we have to understand liability. You have to understand who's responsible at the end of the day. It's very easy to ascribe responsibility and liability to human beings. If you do something wrong, it's your fault. If I do something wrong, it's my fault. If I use a model and the model does something wrong, whose fault is it? Is it the model's fault? Is it my fault for using the model? So, I think all these things are going to become very thorny issues. I think a lot of the AI labs want to get ahead of it, make sure there is some governance framework around it to ensure that they can keep developing the technology at the pace at which they'd like to. So I think in a way they're probably doing the right thing. It doesn't seem like it but I think they are doing the right thing and trying to get some governance around it. So they don't get hauled back, as you saw they did get hauled back when they tried to, you know, launch Mythos or Fable 5. They got hauled back because the model was not appropriately guardrailed. So I think we're going to go through a bunch of these growing pains. Mythos was a big moment.

It still is.

You know, for eight years, I spent my career at Palo Alto trying to convince CEOs they need to pay attention to cybersecurity. Tried everything. Call them, try to talk to them and they usually send you off to their technology people. Go talk to those guys. You know what Mythos did? Every CEO wants to talk about Mythos, which is great. So the first time Mythos has every CEO, you know, sitting at the edge of their seats saying, 'Am I vulnerable? Is something going to happen because of Mythos? Do we have Mythos? We're so important. Why don't we have Mythos? Why can't we get Mythos so we can test our own infrastructure?' So I think Mythos has created a bit of a moment for cybersecurity. And what's fascinating to watch is that moment has, I think for now, it's an incumbent advantage, the big players in cybersecurity, where the customers are going back to them and saying, 'Listen, you're my cybersecurity partner of choice. What should I do? What am I supposed to do? How do I get my hands on Mythos? What have you done? How have you done your testing?' So I think it is a moment because it has got everybody's attention but I also think it's a moment because it is going to change the way cybersecurity is done in the future.

The average time missiles will find it and try and attack you is in minutes. So now you got to go get ahead of it, test all your software, tell us, test all your open source, understand the vulnerabilities and patch them before. And 55 days is too long. So this morning actually as part of Black Hat we launched a capability which allows us to deliver patches in four hours and deploy them to every one of our customers, which is huge, from 55 days to four hours. So we do have the benefits of AI from a defensive perspective which you're beginning to see. So I think what is happening is now it's become apparent to the market that the time from discovery of vulnerability to attack is going to compress tremendously, which means you have a lot less time to go fix it or find a bad actor in your infrastructure. When time gets compressed it requires our customers to modernize their infrastructure, requires our customers to start using AI in the deployment in terms of the defensive capabilities that they must have. That's good news for the cybersecurity industry.

Like every technology eventually needs the right tent poles for it to succeed. You need to make sure that things are done in a certain way so that customers feel comfortable deploying the technology. It's like, I don't know, take a Waymo or whatever.

Yeah.

No, I haven't.

I have taken a Waymo. Of course I have. I just haven't gone downhill on the rolling hills of San Francisco yet.

Look, at the end of the day, if you want the diffusion of technology in a way that everybody can use it in every shape, way, shape or form, you want to make sure that there is no constraint to innovation. And having open source, open weight, having closed weight, all these things are important parts of the puzzle to make sure that people can deploy them in different circumstances. So I don't think it's necessarily bad to hold back the development in open source or open weight for that matter. Open source will allow people to make these things available globally at the right price point for various people to be able to use. Open weight will allow a significant amount of fine-tuning to make sure that you can adapt a model to your specific use case in a way that is more effective and efficient for the task at hand. So all these are important parts of the puzzle to make sure we get innovation right. So that's the reason we signed it. I think there's an over-indexing on the model part of it. I think to make AI useful, the models are important but I think it's also important to get all the context collected and all the training data right. I think billions of dollars will be spent, my favorite example of Waymo, I think billions of dollars will be spent over the next few years training a whole bunch of use cases in enterprise or consumer to get that part right.

It's not that I like Waymo so much. I think it's the most obvious relatable example of AI getting agency where a human does not get involved and AI is allowed to make decisions which could mean life or death for human beings. And like that's it right there. And if I tell you, are you comfortable letting OpenAI make a life or death decision for you, what is your answer?

See, but you did put yourself in a way. So there's my example, my example, if you spend enough amount of money, enough guardrails, enough training, you can get comfortable in a scenario where AI can be used instead of a human who has agency. So I think that's what I mean by saying look, would you let AI prescribe medication to you and take it without asking for a second opinion?

Would you allow a doctor to do that?

You would. Now, do you believe it's possible for AI to get trained as well as your doctor and perhaps better?

Good. So, you would potentially. But you won't take the models in their current raw form and let it happen. You would still wait for a whole bunch of contextual training data that needs to be deployed, a whole bunch of edge cases to be understood, even more context about you to be understood, but then you would. And I think that's what needs to happen. We're over-indexing on the model. I think models are great, but being able to take that model, package that with all that context, all that knowledge, all that training and be able to deliver a solution to you is what the next big sort of revolution needs to be. And that needs to happen in thousands of different use cases.

Yes.

Who's counting?

Only two days it matters. The day you get stock, the day you sell stock. Every other day it's a vanity number.

You're aggressive. You go after things. You watch sport.

When you see somebody powering through the defense and trying to make a basketball shot, are they called super aggressive or are they called people who are trying to get it done?

Good. So I prefer that characterization as opposed to super aggressive. I'm going to get it done. Yes. That doesn't require to be super aggressive. But your question was different. You're talking about Hamza.

And so talk through that. You have an amazing career as both an investor and an operator. How does that come together in this role here? Well, if you look at what the markets reward, if you look at how business gets rewarded, business gets rewarded effectively in metrics like market cap perhaps. What is the market cap? The market cap is the sum total of the expectations of the world about the strategy, execution, and the potential for your business. Right? Nvidia trades at five trillion because people believe it has trends of demand that's going to happen. Jensen is a great executor and they're doing a whole bunch of stuff right.

Now the market is pretty straightforward in its expectations to some level. It says if you have a durable business that grows at a robust rate which you can run profitable and generate tons of cash flow, we like you. Now that's great, which means you have to run a good business, must have good cash flow and must grow well. But the market is sort of smart on that, it says, well not just that, I want to see the durability of it. What does durability mean? Can you grow at a rapid pace for a long period of time? Like if you're a CEO trying to deliver in that environment, which means every time you think that you've done it, the market expects you to grow again. Like you get from a dollar to $1.15, the market says, great, tell me tomorrow, can you grow 15% or 100%. So the market is expecting you to grow at a certain rate. The numbers keep getting bigger and the question is how do you keep making sure your business continues to grow in that regard. And that's kind of what the art and science of leading a business is, to make sure I don't spend all my time worrying about what happens next quarter. I worry about what happens two years from now because I can see for the next two years how my business is going to progress, what we're going to be able to sell, what do we need to go fix, how do we rally to make things work. And that's great, but after two years your visibility begins to thin. It's like, oh my god, what if the market shifts, what if competition gets stronger, what if different products come to the market. My job is to say, well all this went well, what would our business need to look like two years from now and what would the growth levers need to be for us to deliver on that business. That's kind of the paranoia I live with. And that paranoia, you see, we bought 40 plus companies in the last eight years because sometimes we're looking for interesting products, sometimes we're trying to fill gaps, sometimes we're anticipating the market and saying how can we get ahead. So all of that goes into that little thing, you shake it together and say that's what the market expects from an investment perspective. But what does that mean for our strategy and what does that mean from how we execute the business. And sometimes, you know, we disagree with the market. Sometimes say, you know what, market don't worry about it. We went and bought a $28 billion company called CyberArk. The market didn't like it for a certain period of time and they turned around, we showed them results in a short period of time. They're like, 'Holy crap, we love it.'

It is the most innovative industry in the world because the bad guys are trying to figure out how to attack you in a different way every time. The moment we figure out how they did it, they move on to find the next time. So, we're constantly trying to chase them, saying, 'Holy crap, they figured out another way to attack us. Let's go figure that out.' By the time we get to there, they move on. So, you're constantly chasing and anticipating the bad guys who are constantly looking for a new way into your infrastructure, which makes them extremely innovative. And they're all over the world, nation states, people in their basement, people with, you know, Nintendo in front of the hand or laptop. They're all trying to figure out either for trophy reasons or for economic reasons, how do I break into something. So, it requires us all to be very innovative. Every new technology that comes to the market requires a different kind of harnesses, different kind of tools, different kind of capabilities in our products. And if you don't pay attention to every new technology, the customers start buying something else. So it's almost like we have to stay on our toes on a constant basis to anticipate technologies and anticipate bad actors, which makes us the most innovative companies, most innovative sector. In that environment, it's impossible that all the innovation is going to come from us, right? Because there's always somebody else who's got a different angle. There's always somebody else who's tried something that's going to work better than what I thought about. So you just have to live in this industry with humility to understand that you may not always have all the answers. The question is however are you smart enough to anticipate who has the answers, make them part of your team, charm them, be part of Palo Alto, and when you do that can you then deploy that as quickly as you can to your customers. So I think in the last eight years, fair to say we've struck the right balance between what we build internally, what we can rapidly build internally and layer on top of our platforms, and what is unique out of the market where if we partner or acquire somebody, how can we bring them into the full fabric and deploy the capability to our customer as quickly as we can. The north star always is how do I deliver that capability to my customer as quickly as I can. And sometimes it's buy, sometimes it's build because it's too complicated to buy and integrate, sometimes we look at it and say, you know, it's not worth it, let somebody else serve that part of the market, we can find a way to integrate them with them.

Well, you know, we've done acquisitions of all shapes and sizes. Some of them have been easier because they're clear product acquisitions and categories we don't play in. So that becomes a lot easier because then all we do is we say, listen, you're going to be part of Palo Alto. We might slow you down but we're going to throw more resources at you so we can make you get more scale and more speed. And that's kind of worked well. We bought a browser company. We had to integrate it in part of our product but we were able to let them loose. We bought a bunch of AI security capability. Again, something we didn't do. We had to put more resources in there, put it together to let them loose. Now what letting them loose means is we actually make them part of our go-to-market engine. Our teams out in the field have tons of relationships. They are used to talking to their customers about unique things that we do in that context. We sort of plug these capabilities into our go-to-market pipeline. We make sure our customers are aware of the capabilities. That allows our customers to go out there and use these capabilities as fast as we can give it to them.

The biggest mistake that people make during acquisitions is underestimate the intelligence of the people who built the business that you acquired, because sometimes you take on an imperialistic attitude. I bought you hence you must work for me. Our attitude is you kicked our ass. Come tell us what we did wrong. Come run this for us because you did well without our money, our resources, our scale. So you must have figured something out. So we spend our time trying to understand what they figured out, find a way that we can make that part of our culture, absorb that capability and we let them run it. And that sometimes really makes it hard for my teams because they suddenly have a new boss in a category where they thought we were acquiring something. But it's just I said you have to approach this with humility because there are people out there who are smarter, faster, better resources, more resourceful than you in certain categories. And if you can embrace them in the right way, it allows us to build a durable business.