Nikesh Arora on Securing AI Without Slowing Business

Thank you, David. Nice to see you.

Well, it's different today than it was seven and a half years ago when I started. Today, I think it's cool that we are the largest cybersecurity company in the world, which is kind of cool. You lead your sector. I think it's also cool that every day we're making thousands of customers safe from bad actors so they can go ahead and do what they need to do. So we're kind of mission-driven. We're not selling social media. We're not selling advertising like I did when I was at Google. We're actually solving real problems for our customers and our companies which is kind of great. And it's also great that we all get to work with cool people at Palo Alto.

That's a good question. There are so many to pick from, you know. I think in no particular order, we have these employee events. People bring their kids. You get to talk to them. They talk to their families. You get to see what actually makes them wake up every morning and try and come do their best because you'd be surprised how many children want to see their parents succeed. How motivated parents are in front of the children to put their best foot forward. So that's kind of inspiring in a way. It brings it back to humans. As we talk you'll see a lot of this will come down to people on a constant basis. I think it's interesting. I remember what we did in the first year I was here we did in a quarter two or three years ago. It's kind of an interesting milestone saying well what we did for 12 months now happens in 3 months. So it's just things like that or germinating an idea like XSIAM and we sat here and said oh my god our mean time to or median time to detect and remediate cybersecurity is 4 days and I like oh my god I fell from my chair when I heard that the first day somebody told me and now that we're able to bring it down to one minute it's kind of stuff you say my god you set a north star you go grind towards it you go achieve it and you go turn that into a product in the market and becomes hugely successful so all these things just are like amazing things that have happened in the last seven, seven and a half years that I've been here.

Home with my kids, my family. Clearly because we all work and this is kind of like where we spend 60, 70 hours a week, you actually get less waking time with your family. So if I wasn't here I'd spend more time with them maybe for a bit and maybe I'd want to go do something else because you know spending too much time at home is also not that exciting but no I'd probably be home spending more time with my kids. My kids are young, watching them grow up.

This is a tough one right because I have this theory that I grew up playing cricket so for me that's what I did when I was a kid. You wake up like my son's 10 years old he's obsessed with basketball. He wakes up he watches the Warriors he plays his NBA games which have basketball players he's like he's trading them he's doing all kinds of stuff so this is what he grew up with. Imagine that same thing happening when you're living in India and growing up with cricket so that still gets me excited. I could still like literally feel the passion when I watch a cricket game so towards that end today kind of the Indian cricket team would be my favorite sports team. Now in the context of where we are it'd be the Warriors.

You know the good news is it's pretty consistent every year I want to be healthy so I start off the year really well. In fact actually I started off the end of the year really well. I went into like literally after I went to Israel as part of meeting the people at CyberArk and Palo Alto Networks which I hadn't done for a few years. It was amazing. I spent four amazing days there and then I took a week off quietly. I went off to a health detox. So my resolution continues to be lead a healthier life.

Look, we have a philosophy at Palo Alto which is you call a spade a spade. You actually look at everything and see if it's achievable, you're going to get it done or not. I think the best way to get stuff done is to confront the issue, figure out what the resolution is and solve the issue. I think a lot more stuff will get solved much faster if leaders just spend the time understanding that not everything is perfect.

I think part of what is important to understand is that most technologists think about technology, not about cybersecurity. Cybersecurity is kind of like insurance. Like, you know, let's go make great things happen. Let's make sure on the way we purchase insurance or we make sure that we're not going to do it the wrong way. So cybersecurity usually ends up being an afterthought as opposed to the primary thought. I mean I just talked to a CIO this morning. He's busy trying to figure out how to deploy AI as part of the AI deployment. He's more concerned about how is that going to impact customers? Can they actually build a viable product? Can they actually train their AI to be able to solve real problems? And he didn't mention even once that I'm worried that this thing's not going to be secure. See, security is when you think something's going to work amazingly well and then you're worried that people are going to break into it. If you're still going through the motions trying to understand, can I actually make this thing work? You're not worried about security. So what if it doesn't work, why worry about security? It's kind of as much as we like to say secure by design, which is what we should do is like design it in such a way that can't be breached. Very often when new technologies arrive, people spend a lot of time trying to just deploy and make it work. So I think we're in that phase as it relates to AI and AI has become the biggest inflection point as you know in current technology. So I think we're going to see behaviors where people are too busy deploying it and security has become an afterthought and it's our job as Palo Alto and our industry to make sure as they go build these experimental ideas into real production capability that we're staying in lock step with them and say oh by the way here's something that can secure what you just built in a way that is not going to get into trouble. Funnily enough, this CIO said, 'Oh, we worked on some stuff ourselves and we're just jerry-rigged some things to make sure this happens securely.' I'm like, 'Jerry-rig, production and security don't work together as three terms.'

Look, worry is a big word. I don't think it worries me as much because I understand the psychology behind it. Like you think in our normal lives, right? When you go to the airport, what do you have to do? You have to go through a scanner. You have to take your belt off. You got to take your liquids out. You got to take your laptop out. All that is overhead, right? You wish your experience was more seamless. But you wouldn't have to do all the things. There was times when you could do that. So by definition, security causes some degree of latency or overhead. There's no way to avoid it. It's very hard to do security in a seamless frictionless manner. So I understand why the gap is people don't want to create friction when they're trying to create delight and look for acceptance. They believe the goodness of mankind. Oh my god, I'm going to design this. People can use it the right way. But then you figure out as it starts to scale, it starts to become more omnipresent that there are bad actors who can get access to it and do bad things with it. So at some point in time is the right time to think about security. Now if you're really good, you've designed security right off the bat in the beginning so that when it comes time you can go put it together and it works beautifully at scale. But I think that's the aspiration, not quite the reality. As you said, when you do design, you actually don't think about use. You think about functionality, you think about usability, you think about value. You don't think about security. So I understand the gap exists. I know that the gap needs to be bridged before things get out of hand. But I think there is a right time, right place for people to start evaluating whether they've done it in a secure fashion or not.

It's funny. I was on the phone. I was a few minutes late and I was talking to somebody because look, there's stuff going on out there, but it hasn't impacted our lives in a more aggressive fashion. It hasn't impacted our customers' life that much more aggressively. I read somewhere a few months ago where people talked about in the context of technology, you start seeing signs early and then you look around, you don't see enough impact. You say, 'Okay, maybe this is going to be just a passing shower.' But you don't realize that over time, this thing's getting more and more momentum. It's getting bigger and bigger. It's going to be more impactful. I feel the same way about AI. Like there's a $4 trillion company called Nvidia. They're selling chips. They're running out of fashion. Like they're not running out of fashion. People just buying more and more chips. And there's like hundreds of billions of dollars of infrastructure that seems to have to be built in the next few years. Or there are people looking at nuclear energy or fixing the electricity grid looking for alternate sources of power. I was with a guy at Thanksgiving he's got a methane gas company all his capacity was bought out by one of the cloud providers. I'm like oh my god these guys are really going out there. So there's a big spend happening on building the compute. I notice individual behavior and I used to never talk to ChatGPT or Gemini. Now I'm doing 10 or 15 conversations a day with these AI chat bots about anything and everything, right? How does this thing work? How do I do this? What should I do this? So I was in Tokyo. I literally Gemini was my best friend because I don't speak Japanese. I can't go scour Japanese websites to find things and boom, I was asking I want to take my kids to sumo wrestling show. Where should I go? I ranked them all. Great. That's better than me trying to go read 14 websites and pick out makes. So you can see that there's a rising consumer trend. You can see there's a rising trend in enterprise from coding etc. You can see there's a large spend coming. So this thing is going to change our lives fundamentally but we're not seeing it at scale in our customers just yet. That doesn't mean we can sit back and wait. It means we have to get ready for this future. How do we do that? Which means a lot of uncertainties. Well, if you don't see scale, how do you create scale and security? So you got to figure out, you got to make a bet. You say this is where do we think this is going to go? This is where we're going to lay our bet. This is going to go prepare so that when our customers get to a point where they actually see the need, we're there with the solution.

Well, we talked about AI, right? I think what you're seeing is a rapid adoption of the consumer use case. I think in the next 12 to 24 months it will become impossible, people will be talking to their chat bots about everything, whether it's how to deal with personal things or how to deal with whatever the topic you pick your topic. And I think things will get more and more specialized over time or you have your favorite. It kind of happened in search. I used to work at Google. There's a time there's one big search box and then say maps became a thing and then Google local became a thing. So you start seeing more and more training is going to happen in very specific categories which things are going to get good at. For example, today there's a different model that creates videos for you and there's a whole automation around how to create videos. There's a different model that has a textual conversation with you. So I think you'll see some degree of specialization and these models are going to get more and more powerful. That's going to happen. I think as it relates to automation, automation's always been around. You know, we used to do process automation, workflow automation, robotic process automation. Process automation's already been around. I think on AI first, you're going to see we're going to get more and more hungry for more data because the more data you have, the more you can train AI to solve harder problems. We'll discover that in the enterprise context. Today, any enterprise probably collects 20% of data they need to run it more efficiently. So, we're going to actually have to three to five times our consumption of data in every enterprise to get better outcome. You know, why should 3,000 sales people have to go discover the problem every time and try and solve it themselves? Why? If you had collected all the data, how this guy solved it two years ago, we should have a beautiful chatbot when you go out to the next customer, it says, boom, here's all the learning I have from the 300 interactions I've been tracking. Add your interaction and here's the best strategy I can give you to execute this problem. So we're going to become very hungry on data consumption which is why they're spending so much money and creating all these large infrastructure that is needed to be able to train these models, train the use cases, train the applications. I think on the automation front eventually people will want AI to execute on their behalf which is like instead of if you're so smart AI you can tell me why can't you do it now do it requires automation and connection to control systems. I mean think about Waymo there's no human being in the car somehow the models figured out from more machine learning than generative AI machine learning figured out what the right solution what the right response that scenario is and actually it's connected to your brake your accelerator your turning signals everything's connected to this effective brain in your car where you've given the autonomy to that brain to execute imagine that having to be applied to everything in life right? Your digger if you're in construction or something that pavers your stuff that you use in agriculture all these things could over time be trained to execute on their own behalf but it still needs a lot more training to get there. So I think that's what's going to happen in automation and AI. I think geopolitics is a different one. I think because of the humongous amounts of data involved a lot of countries will get very nervous about their data leaving their country. We've seen that in the internet scenario. I think you're just going to see this at scale where people say, 'Wait a minute, that's too much information about my employees or my citizens and I don't want this data to leave the country.' So you're going to see a lot more rigor around data sovereignty, people wanting their data in their own countries, wanting models to be built in their own countries, which I think is kind of a false argument because you know this happened again 15, 20 years ago when search came around to Google and people want to have every country run their own search engine but you don't realize that you have the scale and the capability and the competence to go build this 150 times across the world. So we'll still see large global companies solving these problems but we'll have to figure out ways that these become acceptable to nation states and I think there's going to be a whole set of social challenges if AI gets too good too soon.

Well, look, anytime there's an inflection point, there's tremendous amounts of uncertainty, right? You know what is going to become obsolete, but you don't quite know what is going to become trendy. Now, you can sit there and say, 'Well, I'm just going to wait till I figure out what becomes cool, and I'm just going to move from where I am to there.' The problem is, it's not that easy, right? You have to not just anticipate where the trend is going. You have to prepare your organization and the resources to get there. Otherwise, the risk is that Silicon Valley will go fund those people who are thinking purely about the new world and there are 10 different people who are trying 10 different ideas in your space and one of them's going to hit and then you'll be two years behind with no organization, no resources deployed against it and you'll be behind the eight ball. So part of our job is to sit there especially in times of inflection and look around corners and say hey where do you think this could be going? Where should we take our bets? But maintain the agility and flexibility of turning on a dime if things don't go in the right direction. So some mistakes will be made. Hopefully you can make less mistakes and get more things right. And you know our brains move faster than reality sometimes. So you usually have some window but you have to be ready. I think part of what you're doing at Palo Alto what leaders have to do around the world is get their organizations to be ready. Start embracing new technology understanding people who are getting good at it. People who need to be trained or people need to go out and learn again and get good at it because I think this has the property of fundamentally transforming almost everything we do.