Personally, I think that quantum computing is one of Silicon Valley's biggest hoaxes. It's going to turn out to be a really, really expensive hoax, where any physicist that is not working on quantum computing believes that it's not going to happen, and only those that work on quantum computing and will benefit from quantum computing think it's going to happen.
Welcome to Threat Vector, the Palo Alto Networks podcast, where we discuss pressing cybersecurity threats and resilience and uncover insights into the latest industry trends. I'm your host, David Moulton, director of Thought Leadership for Unit 42. Today, I'm speaking with Nir Zuk, founder and chief technology officer at Palo Alto Networks. Nir's journey began at the age of 16, when he developed some of the earliest computer viruses on his Dragon 64 computer. His passion for technology and innovation is evident. After serving in the military, he worked at Check Point, NetScreen Technologies, and then in 2005, Nir founded Palo Alto Networks with a vision to revolutionize network security. Today, we're going to talk about Palo Alto Networks 2025 predictions. These seven predictions cover a wide range of topics, and you can read them all on our website. For today, Nir and I are focusing on three. First, in 2025, organizations will shift toward unified data security platforms that integrate code development, cloud monitoring, and SOCs for seamless AI-driven threat analysis. The consolidation will enhance visibility, streamline operations, and dramatically reduce detection and response times, positioning organizations to better combat advanced threats. Second, established organizations with massive data sets will lead AI-driven innovations, their data volume for continuous improvement. Partnerships between incumbents and agile newcomers will drive collaborative breakthroughs. Finally, we'll talk about quantum attacks. While they're not imminent, harvest-now-decrypt-later tactics by nation states will target sensitive data. Organizations should act now by adopting quantum-resistant technologies and preparing with new cryptology standards to safeguard their systems as quantum capabilities evolve. Here's our conversation.
Nir, welcome to Threat Vector. It's exciting to have you here.
Before we get started on our conversation about 2025 predictions, I want to ask you a few questions that I saw on an interview with you from 2010 in Computerworld. I won't hit the entire interview, but there are a few that I thought could be fun to go back to. The first question was, ask me to do anything but?
How would you answer that today? Ask me to do anything but stop innovating.
What are you reading right now?
I'm reading a lot about quantum physics in order to better understand quantum computing.
And what is your favorite technology today?
My favorite technology today is YouTube. I know it's an old technology. However, I think there is some amazing content on YouTube. And it's a great resource to learn whatever you want to learn to a certain depth. After that, you need to start using things like Brilliant, which I use, and other ways to really go deep into learning a subject. There's just so many people out there that have so much to share and to teach. YouTube is my favorite technology today.
That's a great answer. I use it all the time whenever I'm trying to fix things here around the house, figure out how to cook something. So for listeners, I'll put a link to the original interview in the show. I think it's really interesting to go back and just see what was top of mind for Nir back in 2014. Today, we're going to be getting into a handful of the 2025 predictions from Palo Alto Networks. I'm really eager to hear your thoughts on these predictions, so let's get right into it.
Our first was a prediction about how the landscape will transform and the adoption of a unified data security platform that integrates code development, cloud environments, and SOCs. So how do you think that the unified data platform will revolutionize cyber infrastructure in 2025?
Sure. So it's very clear that it needs to happen. And the reason it needs to happen is because cybersecurity is becoming more and more data based, meaning more and more cybersecurity functions need a lot of data in order to do what they do versus the past, where we were just running signatures or some basic rules on whatever it was, traffic files and so on. And now that more and more cybersecurity functions need a lot of data, what we're observing is that there is a superset of that data that is, of course, shared across all of them, meaning if you look at what the SOC, the security operations center, needs in terms of data to perform its tasks of detecting and responding to attacks very quickly, that data contains pretty much everything that all the other cybersecurity functions need. And when I say other functions, I mean things like IoT and OT security, detection based on DNS, cloud security, and quite a few other functions. And then the question is, are we going to see 10 different data lakes, each containing tons of data, or are we going to see 1 data lake containing all the data? And I just don't see a good reason for the former, not a single good reason, and only good reasons why everything will be in the same data lake. It's, of course, cheaper. It is much more environmental friendly because you store once. You process once, so you need less resources. And more importantly, it works better. Probably if you have all the data in one place, our very smart engineers and data scientists will be able to use some extra data that's in the data lake to make IoT security better in ways that we didn't think about before. OK, so bringing all the data in one place just makes a whole lot of sense. Running many different cybersecurity functions off that data lake makes a lot of sense. And that was our first prediction. In 2025, we're going to see it start happening.
Nir, what are some of the potential challenges in implementing this huge data lake and a platform across really diverse organizations?
I think the main challenge is going to be, how do you do that in a multi-vendor environment if there is one data lake? And the answer is, one, you're going to have less vendors, and, two, there are going to be some strong partnerships in the industry between sets of vendors that will decide to work together. So I think that's going to be the main challenge. Other than that, it's probably going to be a political challenge, meaning convincing different parts of the organization that they maintain their data lake. And some of them like the data lake to run on top of that technology, whatever, Elastic. And some of them prefer it to run over another technology, like BigQuery or some other data lake technology. How do you convince all of them that, OK, we're taking it out of you, and we're bringing it into one data lake, and that data lake is going to be actually chosen and run by your main vendor, which is probably your SOC AI vendor. Sorry, you're just going to use that data lake. It's not something that you're going to choose and maintain anymore, which is great. It makes everything much simpler for the organization, but it causes some political challenges.
Right. The front side of any change is always fraught with some anxiety. But once you start to see the benefits of those changes, you realize that it opens you up to being able to do other things simpler because you have fewer tasks that you have to manage. Can you talk about some of the potential risks and benefits of centralizing cybersecurity into a single platform?
So I often hear about concerns from customers when we talk about those things. And the main concern that they have is vendor lock-in. And my answer to that is, sorry, that's the way the world is, meaning you have one CRM solution in your organization. So if you picked salesforce.com, you're locked in with salesforce.com. And switching from salesforce.com to another vendor as your main repository for all the data is going to be very difficult. And the same is true for your ERP and other data-driven solutions that you have. So there is going to be some vendor lock-in. Of course, we need to look at vendors that have partners that use the same data lake for different functions. And we need to make sure that that vendor lock-in can be mitigated. So that's probably the biggest risk that I'm hearing about from customers from their perspective. I think that many other risks are not as relevant, for example, customers say, hey, if I put everything in one place, what if you get hacked? And my answer is, number one, it's much easier to guard 1 data lake than 10 data lakes. And number two, there's a smaller chance of 1 data lake getting hacked versus 10 data lakes. So if you spread your data with replication across 10 different data lakes, you are at a higher risk. There is the risk of, what if I work with one vendor and that vendor misses an attack that another vendor would have found? The answer to that is usually it's not about the vendor. It's about the data, meaning machine learning and other types of AI differ from each other, not by how good your algorithms are because these algorithms are all known. They differ a little bit by how good your data models are, but that's only 10% of the picture. 90% of the difference between different AI-based solutions is the actual data, and it's really the quantity of the data. So this idea that if I worked with one vendor versus if I worked with five, I might miss something, it's actually the opposite because if you work with one vendor and you put all the data in one place and you work off five times the amount of data, you have a much better chance of detecting things versus separating them into different data lakes.
Right. The ability to look across and correlate and stitch things together happens when you're not moving from lake to lake to lake. It happens when you're looking at one big repository of data so things come together.
So, Nir, let's shift to our next prediction. And this one is about AI innovation in cybersecurity. Why do you think that the larger incumbent organizations are going to have more success in AI compared to startups in the cybersecurity field?
The main difference between AI-based systems from different vendors is the data that they have. The algorithms are well known. They've been around forever, especially the machine learning algorithms. The data science is important but is a small part of the picture in terms of the differentiation. It's all about the data. It's about the quality of the data, and it's about the quantity of the data. So in terms of quality of the data, you need to bring the right data from the network, from endpoints, from the cloud, from cloud logs, from workloads in the cloud, from applications in the cloud, including SaaS applications, from identity and access management systems, and so on. And, of course, that data will be better if the vendor has full control of the data source. So if you're buying from a large vendor that's providing you also the network, data sources which we call firewalls or the endpoints, data sources which we call EDR or your cloud security, and so on, you'll have much higher-quality data versus if you buy your AI from one vendor and different parts of the infrastructure that collect that data from other vendors. It still works if you do that, the latter, but it's lower-quality data from the perspective of AI. And in terms of quantity, that's really where the big vendor versus small vendor comes into play. As I said, the more data you have, the better your AI will be running. If you're a large vendor and you already have a lot of data, you have exabytes of data, then your AI will work better, and that creates a snowball. Because your AI works better, customers will be more inclined to buy your products because when they test your products versus a small-vendor product, yours will just work better because, again, 90% of why the AI works is the amount of data. And because your products work better, customers will more likely choose you, the larger vendor, as their provider, which will provide you even more data. So this snowball effect really shifts the advantage in AI. Bing will never be as good as Google Search. Why? Because Google has the data, and Microsoft doesn't because Google started earlier. So they have much more data about, when you search for X, which link do you click? And that's really what makes the search results much better, is knowing the correlation between what you search for and what you ended up clicking. So Google is better. More people use Google. It becomes even better, and Microsoft has no chance.
