This might come as news to you, but humans have been writing bad code for a very long time. No company knows how many models they have in place right now. Nobody has any idea how safe those models are, how secure they are, if they are back doors or not.
In every enterprise, you'll find vulnerabilities in vendor deployed software, custom code, and open source. This thing's going to find all of them. We will find vulnerabilities which should have taken us 10 years to find in 6 months.
What does it mean to have agentic security when we don't even know what agents are, but all of us are building agents all the time? In cyber security there's generally two modes. One mode is...
Welcome everyone to SPC. Very excited to have all of you here. Obviously very excited to have Nikesh here to tell us about his own minus one journey, and also to get a window into what I think are bound to be really interesting times in our industry but also in cyber security in particular. I guess just rewind a little bit. You were telling me before the talk here about some of your incredible origin story.
I don't know about incredible, but sure.
And I think what I found really interesting was, you know, the audience at SPC, a lot of them are here trying to figure out what to work on next, trying to figure out that in between phase that we call minus one. How to really step on the gas in terms of ambition and find that interesting spot between being patient and impatient and letting the bigger idea come to you. So you've had a number of incredible transitions in your own career, right? Leading to some incredible opportunities. How have you navigated some of those times? How have you found inspiration? How have you really taken your time to find the big thing because you have an incredible success rate?
Well, first of all, thank you for having me here. Appreciate it and thank you all for braving the rain and showing up here. I hope this is useful for you. I think in terms of inspiration and in terms of how to bide your time until the right thing hits you. One of the challenges with extremely smart people is they can apply themselves to any problem and put their heart and soul into it and do a great job for it. Like many people, I'm guessing everybody in this room believes they're smarter than the average person. That's why you're here.
Okay. Well, don't forget they're here eventually. If everybody believes they're smarter than the average, there's a problem. But that's a different mathematical problem. We'll do that later. Like if you were to apply yourself to something and if I said here are three options, one, two, and three, you could say I could do all of them, right? I can start the world's best restaurant, I can start the world's best airline, I can build the best video model beating Sora, LMS, etc. So the question really becomes is what can you connect with and how tractable the problem is and how patient are you? I think to your point about patience, impatience, you said earlier when we were talking there are too many companies being started.
I think we sometimes get waylaid or trapped by the idea that somebody else is getting traction so quickly therefore I must get traction quickly. And then the risk is then you end up building a feature. You end up building a part solution to the problem. You're not solving the real problem. And in our times we can always point to Elon Musk and say look he didn't take an easy problem, said we're going to go to Mars. Sounds like a hard problem or he said I'm going to build an electric vehicle or go build an autonomous vehicle or Waymo did that. Those are hard problems. They're 10, 15, 20 year horizon problems requiring tons of capital. You almost feel like, holy, how am I going to even get started in that direction and solve something that big? That's at one extreme. And the other extreme, you think you can go program something really quickly and in 6 months you'll have product market fit. In 12 months, you'll have 100 million ARR. So the answer is somewhere in the middle, right? I'm not sure that there's a mode for a company that built 100 million ARR in the first 17 months or 20 months. Maybe that mode may exist, may not exist, may get obliterated by the next person or maybe it becomes a competitive advantage because you got out first and you captured all the market and you became the winner in that space.
You know it's interesting Nikesh if I look at for instance when you joined Google it must have been 30 billion in market cap.
18 exactly so it's obviously close to what 3 and a half, four trillion today something like that and then when you joined Palo Alto Networks.
18 coincidentally 18 on its way to the big one. So in some ways when you joined them they were kind of a fraction of the size that they are now. But they had some scale. So were you joining them for what they already had? Were you joining them for in some ways the latent potential energy, some combination? And what was your version of patience and impatience kind of as you got to those? Maybe Palo Alto Networks, you've talked a little bit about this. You kind of came in as not knowing a ton about cyber security. What did you see kind of before you joined?
Well, I think Google I joined because I needed a job. And it turned out into an amazing company and it's gone to $4 trillion in market cap or thereabouts and there was no more genius. I can in hindsight I can justify it. I can tell you all the great things but at that point in time I need to get out there get myself a real job and that was a great job I got and it was amazing. I think it had a market opportunity bigger than most at that point in time. Digital advertising was 2% of advertising. Today is probably 60 to 70% of all advertising. So you could see that there's going to be huge opportunity. You could see consumption, you could think about commerce, etc. And I think we're at the beginning of a similar trend with AI. I think for the next 15 years, every industry will get transformed with AI. So whatever you're thinking of is not big enough. Whatever you're thinking of is too small and too specific. There's tons and tons of opportunity. I think that's the parallel you can draw. I think it just had tremendous amount of tailwinds and then I think Google's secret sauce was they were able to execute in multiple dimensions across the board. In Palo Alto similarly when I started we were 1% market share in our sector and generally if you have 1% market share in your sector and your sector is going to grow at 10% a year for the next foreseeable future then you have the opportunity getting from 1% to something bigger and if you do the math of enterprise for those of you who are interested in enterprise companies the math of enterprise generally tells you that if you get critical mass, you get escape velocity, you get to be big enough, then you get a field force that is big enough that allows you to have a larger and larger share of wallet of a customer. So we went from 1% approximately 6 or 7% now. And there's no reason why we shouldn't be 20, 30% market share in our segment. And if that's true, that makes us a much larger business.
Perhaps to come back to Google for a second before we inevitably turn to AI and cyber security. It's interesting, you know, I always believe that the best antidote for any kind of organizational problem is winning. If you're winning, it kind of solves and papers over all cracks. And it's often hard to know what an organization is from the outside in. Most of the external narratives, they're not wrong. They just kind of it's very hard to capture the zeitgeist of a company internally. But from your benefit of the amazing run that you had there, what are some non-obvious, non-externally talked about reasons why Google continued to be so good for so long? Like the longevity in terms of innovation is also quite rare, right? Like often times you can build a good thing, you can milk it for a long time, have a good company, but they kept on building good things. And what lessons can you draw from that for entrepreneurs? If you abstract and you think about all the companies you admire and you know like pick your favorite whether you like Facebook or you worked there you worked at Waymo you worked at Google or you worked at Tesla where you did most companies take on the form of the leader.
I think hard. Company culture especially where there are dominant founders or prominent founders a lot of the company's values are closely aligned with the way the founder behaves, the founder thinks and it's normal because you know what everybody in the company is trying to impress the founder or their management to try and make them feel that they understand them and they work like them. So over time the cultural values of companies become very consistent with the founders or CEOs if they're long tenure CEOs. So in that context I think what was amazing at Google was Larry was product obsessed and nothing else mattered. But he said to me I still remember my first meeting with him then he became CEO. He says so you run business. I'm like, guys, it's like I'm told by the board, you're doing a really good job. I had a whole PowerPoint deck ready. I was ready to walk him through all the amazing things we were doing in the team, all 18,000 of us and flipping through every page in painstaking detail. He didn't want any of it. It's like, you know, I'm sure if I had two hours, I could make you do your job 10 or 20% much better. I just don't have two hours. I'm too busy doing product. So, I just bit my tongue saying, hey, let me know when you have two hours. So he didn't care about most things other than product because he said no company in tech became great because they had great go to market. They became great because they had amazing products. And if you think of the history of technology, a lot of the car wrecks or the mishaps or companies that are no longer relevant, they became irrelevant because their product no longer mattered. And it's blindingly obvious. It stares you in the face. Yet technology company after technology company ends up at a certain point in time just declining and dying because somehow they're trying to do everything else as well as the product part. But your product's commoditized. Everybody else has the same product and somebody else goes out and discovers something amazing. So what Google has consistently done is been able to be really good at great products. And coupled with that, Larry was obsessed with hiring the right people. I remember I'm trying to think back. I want to say the first 10 or 15,000 employees, Larry read every hiring pack himself and he would throw 10 to 15% of the recommendations out of the window and there was no appeal. You couldn't go back and get the same person hired if Larry rejected that person. And he read every packet to the first 15 to 20,000 hires by himself. Eventually, he ran correlation tests with my decisions and other periods of mine. And depending on who had above 95% hit rate, you got the right to hire more people yourself. I hit 98% because we used to model his behavior. And we try and say he's going to reject these following five, he's going to get these 15. Sometimes you could say the five that he rejected, we already knew he was going to, but you need the five to get the 15. So, but that was him. He was product obsessed. He was obsessed with getting the right people in the company. I think that shows that Google has always been that place which hired really great people and built really great products. There's sorry one last story.
He went to see Steve Jobs and Steve said to him, Larry, I have one piece of advice for you is focus. Forget us. We focus. We build great products, but we build very few products at one point in time. Larry took the opposite. He says, we're going to do a lot of them and we're going to build great products. And remember even today Gmail does not have other than the enterprise version doesn't have consumer monetization except for perhaps paying for storage or Google Maps doesn't have that good a monetization model but they build products or Google build products without monetization or business insight and that's why I said to somebody earlier it's like the word business does not factor in the brains of some of the most obsessed entrepreneurs they get obsessed about product. I don't think Elon knew when Tesla was going to break even. I don't think Travis knew when Uber was going to break even. So, think about it. These people just burned the ships, went out there, I'm going to build something amazing, and if I build something amazing, amazing things going to happen. I know there's a selection bias in my comment. I'm sure there are other people try to do that. They're still at the bottom of the river. That's a whole different conversation, right?
I mean yeah for what it was this is the same lesson that a lot of us learned at Facebook which was that if you build something that it is a sufficiently high number of people signing up coming back spending 20 minutes a day you'll figure out some way to make money from it right and so to this day and I probably take this to a fault when an early stage entrepreneur seed stage pre-seed stage is talking about making money or a go to market action my only question that's going through my head is who is using it how much do they want to use it do they want to use it more tomorrow than they do today and everything else is just premature kind of optimization. So Nikesh perhaps in that same vein of kind of organizations being modeled on their leaders. What does Silicon Valley not understand about Masa that you can tell us about because I find him to be a fascinating individual that nobody in Silicon Valley seems to truly deeply understand I think. So what can we learn as entrepreneurs from him? Because he's kind of like this crazy enigmatic guy who floats in and out of our imagination funding some of our companies and going boom and bust but eventually doing just fine. So what can we learn from him?
Well Masa like you said is one of the more interesting characters in this space. I think the best way to think about him and probably you've probably heard me say this before. First of all Masa is a romantic. He falls in love as if it is the first time every time. Well, he falls in love with ideas and then he pursues them to the nth degree and that's his persistence. But he's one person. I've said this before, so I apologize if you guys have heard this before. You know, as humans, we're conditioned to derisk our children. If those of you have children or those of you who were children not too long ago that sort of must be some 18-year-old, right? So anyway, so every time look on both sides of the road before you cross the road or don't do that, you're going to hurt yourself. Don't carry a knife in your hand like that. Carry it from the other end. So we're constantly that's all derisking. It's the protective instincts in us which say don't take risks because you could hurt yourself. And over time, if you're from my culture or your culture, like it's like oh it's time you're 24 years, you should settle down. What does settle down mean? Get married, have kids, have a house, have a mortgage, buy a car, and don't take too much risk. So this is like the whole training is to derisk yourself. Masa didn't have those kind of parents. The guy swings hard every time. Every time he swings to the fences. He has zero concept of risk management. He says, Master, let's just put a billion dollars. Let's put $10 billion. But you don't have it. That's all right. Japanese banks 0% interest rates. No problem. We'll borrow. Right. So that's him. You know, it's incredible because the conditioning runs so deep. I look back at least at my own life and I'm like, man, I wouldn't I don't know if I would tell my kids to do the kind of things that I did because now looking back, it just like batshit crazy, right? Like take on as much risk as...
Where did you go to school?
Okay, that sounds like an average institution.
You know, top three in the world as they say.
There we go. See, he did not take risk. He went to the top three. Why would he go to a country bumpkin school like me?
Well, you know, my mom and dad went to your school, so just saying.
Okay. Like I said, country bumpkins.
But I don't know. It's interesting. So, do you think the lesson that you're trying to tell entrepreneurs is they should maximize risk? They need to, right?
I have never met a successful entrepreneur who wished they hadn't taken more risk, not given as much equity to the VC and held out longer. So you have to play to win.
If you're not going to play to win, don't do this because nobody walks out saying I am going to manage the fact that I could fail. Everybody in the room who starts a company, everyone who starts a company plays to win. If you're going to play to win, go to the end of it as long as it's above board and legal.
So you spend a couple of years at SoftBank and then you move on to Palo Alto Networks. How do you assume moral authority of a company when you're not kind of the founder, especially Palo Alto Networks, which is a pretty product-driven company. So how do you come in as a business guy and assume like moral authority and not make it into a straight-up go to market machine?
You know there is a fallacy which is true at Google. Sometimes I get people get confused. I went to engineering school like the rest of you guys had you know country bumpkin school. Yeah.
Exactly right. Yeah. Exactly. Yeah.
So the fact that you can be good at market doesn't mean you have engineering savvy. So you have to walk in with engineering savvy but the first six months were terrifying. I walked into a domain. I thought cyber security were two different words. Now we write it as one word. So that's how much I knew about it. And I said to the board, you're hiring me. I wonder what the spec looked like. So you're going to hire a guy who never sold enterprise, who doesn't understand cyber security, never ran a public company. Let's make him the CEO of a public company. That sounds like a really good board because you know you fiduciary response.
Yeah. Exactly. Yeah. Fiduciary responsibility well executed.
So look, the first 6 months is like full-on imposter syndrome. Like I was there, I don't understand cyber security. I'm trying to make decisions and tell 5,600 people what to do. But I always contend you bring half your you're really good at certain things. That's half the job you bring them with you. The other half you learn on the job. If every job we knew 100% then a nobody else would get a new job in their life because you'd need to have 100% experience and b it'd be boring as... So I walked in. I used to call the founder either in the morning on my way in ask him all the questions that people had poisoned me with in the night and then the evening I'd call the head of product and ask him a lot of questions. So those two were my sort of technical crutches. Even today I call one of them because every time I'm confused. So I don't have to be a technical expert to know all the inner workings. I have to know enough to know which bets are going to work because I was joking this morning with somebody that they asked me how do I allocate my time. I actually don't have a job. Everything that happens in my company somebody else has a real job with the title which says this is what they do. I'm not the chief product officer. I'm not the CFO. I'm not the chief marketing officer. I'm not the chief legal counsel. I have people who do all these things. So my job is to constantly flit about, prioritize, think about long-term strategy, help them jump in and execute in certain areas, but my job is also to make sure the right people in the right place. So that's what I did. I did that at Google for 10 years.
I've done that here for eight years now.
Mhm. Almost. So that's been interesting. So 8 years obviously we had kind of the ChatGPT moment coming up on four years now. So what was the overall AI slash obviously you guys had a ton of machine learning at Palo Alto Networks. It was a key part of your overall kind of technology stack. What was your AI posture like prior to kind of generative AI coming into the larger consciousness? Was that something you were working on in a more research setting?
Mostly it was machine learning.
Okay. I think you know could you talk a little bit about your stack there?
So what's fascinating is I still believe that many labs whether it's Google or perhaps I don't know if Meta or not but other labs many labs had the capabilities that ChatGPT had when it came out. I think most of them didn't believe this was a real product because it was hallucinating 20 to 30% of the time how could you make something useful come out of it. I think they didn't anticipate or understand the consumer use case where we as consumers would make our own judgment and we could tell how much of that was hallucination and some cases we didn't care because you know writing a Shakespeare sonnet in Eminem style is cool it doesn't matter it was right or wrong and they didn't quite understand the value of that product and I think that's what Sam Altman did with ChatGPT and came out and that's kind of flipped the bit and that is why we're all here trying to start companies as quickly as we can think that's kind of what gave the impetus to generative AI at least until then because of the hallucinatory nature or the non-deterministic outcomes, none of us in real business applications were comfortable deploying that technology where we couldn't predict what it was going to do. I think subsequently everyone is gingerly at least I'll call it the incumbents which are us versus the new companies you guys are going to build. All of us are gingerly infusing LLMs into certain use cases where we believe they'll do a better job than what we were using in the past. Perhaps not as much as we need to. I think all of us are slowly rethinking workflows in businesses to see how business is going to be conducted in the future. And in the short term it's slow going. I do believe longer term it's going to get better and probably more than any of us can imagine.
