Nikesh Arora: Mythos is Real, Analytical SaaS is Dead, and Google can be a $10T company

0:00One of the biggest winners right now. The big daddy of the cyber security space. Palo Alto Networks is an outperformer in the space. CEO Nikesh Arora. This might come as news to you, but humans have been writing bad code for a very long time. I spent 10 years at Google and, you know, Google search was democratizing information. If you take that analogy and think about what AI is doing, AI is democratizing intelligence. Money is a way to keep track. It's not the goal.

0:29Jason Calacanis:You've been the CEO of Palo Alto Networks for eight years? Coming up in eight years this week. Eight years. And I think when you started, it was$17 billion market cap, if I remember correctly. And this morning I checked, it's$238 billion, which if you listen to what we said yesterday, now that you passed 100, you're more likely to actually 10x. So the first 10x was actually much, much harder. So you're on your way to a trillion dollars. From your mouth to God's ears. Well, I think you are. Okay, so let's just double click into what you see because you are sort of in a really interesting position to see all of it.

1:02Jason Calacanis:You see the birth of AI. Maybe you've seen the rise and fall of SaaS. All the models talk to you. The rise again, right? The rise again. You were one of the first in the few that got access to Mythos. So just let me just push the button. Go, Nikesh, start. Well, first of all, thank you for having me here. I think AI is exciting. I think it's exciting to see all the stuff that's gone down in the last possibly 24 months. I think Sarah just said it. They were right in anticipating the huge amount of compute that was going to be needed. So all that stuff's going on. But you can see that there's this notion, which we talked about briefly last time, that AI is really democratizing intelligence.

1:52What that means is I have 250 people in marketing that produce varied forms of output. Now you can get 90 % of the output to be consistent across those 250 people. I have 5 ,000 people who talk to customers. My failure mode is when 5 ,000 people do different things where people say, I want to talk to Joe because he knows how to solve the problem, and Jim doesn't. So now you can get 5 ,000 people to act almost consistently in their interactions with people on the other side. So I think it's going to have a phenomenal impact to how we run businesses, how we operate. It's going to change the entire landscape.

2:30Now, in that context, you touched upon Mythos, and I know David's been very involved in this. Mythos has shown us that all the bad code that humans have written over the last 50 years can be assessed by AI and shown, the vulnerabilities can be shown. We tested for six weeks, and in six weeks we found what would have taken us five to seven years. Wow. Say that one more time. In six weeks we found vulnerabilities which would have normally taken us five to seven years to find.

3:00Jason Calacanis:So Mythos, these are vulnerabilities where? Sorry? These are vulnerabilities in your own code base? In our own code base. In our own code base. Oh, wow. So Mythos was not oversold. It was legit. Yet the capabilities of AI in being able to assess vulnerabilities in code are real. Not just that, if you put it on ultra mode, which is persistent thinking, so it keeps trying until it gets an answer, you can actually daisy chain vulnerabilities, i.e. finding a new attack path into your vulnerabilities. Now, we pride ourselves as a top percentile of companies that test our code because we're in cybersecurity business.

3:38If you take that and compound that across all the companies that exist in the world that write their own code or the 10 million developers write code, this thing is going to find stuff which would have taken us 10 years to find. How much did it cost? Did you track the token cost? Was it$100 million,$10 million? No, it was in the low millions. But again, the cost, as Sarah said, the cost curve is going to come down already. OpenAI has got a model which is cheaper, more consistent. Anthropics come out with another model.

4:07Jason Calacanis:You buy the hype. It's not hype, it's true. That's the point. The capabilities are real. You know that. The capabilities are true. Yes. I mean, you saw IBM announce a project for$5 billion to fix open source. That's the biggest problem. What would have happened if Claude didn't have the restraint and they put it out in the public? Do you think it would have been like a real attack vector and caused chaos in corporations? I think we're three months away, if not already there, from this being available in the wild. Okay, open source. Yeah. Just three months. Yeah. Yeah, because we've been saying that it's roughly six months away before Mythos-level capabilities are available in Chinese models, open models, whatever.

4:52But you're saying it could be three months. Well, look, there's, what, it's 4.8 is already out, 5.5 is already out. They have similar capabilities. And look, you don't need to crack the hardest code to crack. You just need to find a few vulnerabilities in code that are out there. Just take an old industrial system which is running OT code on the edge. You can find that vulnerability reasonably easily. So we're in a race right now between the cyber defenders finding these vulnerabilities and patching them before the cyber attackers do the same thing. Yes. and how do you feel like we're doing in that race?

5:30So not as well as we should be doing, which is great for our business, but that's a different story. So look, every company has to go look at their code base and figure out where the vulnerabilities are and fix them. So if you talk to CIOs today, their biggest problem is all the vendors are showing up saying, please patch my piece of boxes, the hardware that you have, please patch my code that you have because I found vulnerabilities, fix it. while the CIOs are busy finding their own vulnerabilities to fix their own vulnerabilities. And then this huge thing called open source, which nobody knows quite how to solve.

6:01Jason Calacanis:So is it fair to say that as model capabilities go up, systemic business risk of large enterprises also goes up? On the cyber side, yes. There are antidotes being built by people like us and others where we're going to provide some capability where you don't have to patch everything. But look, Sarah said something very interesting around harnesses, memory, and context. The part we don't talk about here is organizations don't have memory and context of everything they do every day. That's why you need to store a lot more data enterprise-wide to learn what good looks like and what bad looks like.

6:37The same problem is in cybersecurity. We need to collect 10 times the data in the enterprise from a cyber perspective to be able to understand how to defend ourselves against the AI attackers.

6:49Jason Calacanis:Do you think that the traditional companies, like the SaaS businesses that have existed in this world, what is their place? As all this knowledge becomes more persistent and stored, what happens to SaaS? Well, you see, SaaS, as Bill said, SaaS is different pieces, right? If you're an analytical SaaS company, it's over. It's over. What is an analytical SaaS company? Somebody that says, I'm going to collect a lot of data for you and analyze it for you. I don't need you to analyze it for me. I can run models against data and analyze them myself. So if you think about, every SaaS company has a marketplace.

7:26You can buy Salesforce Marketplace. What are they saying? You have Salesforce data. I'm a marketplace app. Take me and I'll help you analyze the data. I don't need you.

7:34Jason Calacanis:You don't need that. I can just go run an LLM against the data. So the entire incrementality that has been sold as incremental software modules to all of us doesn't need to be sold to us because I'd much rather have LLMs run against that data. you bring this up we had an instance with a SAS product with 20 seats nobody was logging in and using it but the data was there yes so we created like three accounts got rid of 17 connected it to slack connected it to Claude yes and now everybody can interface it through a natural language in we've reduced our bill by 90 % well not just that what are you gonna do next day Jason is that you're gonna take data from different products put them in one place run the analytics against that.

8:16I want my data for my sales reps, my productivity data, my inventory data from SAP. I want it all in one place so I can run analytics against it and say, who's selling a lot? Where do I have less inventory? Let's build inventory in a region where my salespeople are extremely productive. To run that query, you'd have to have talked to three different SaaS products. Tomorrow, you can put all the data in one place. So that's sort of category one, analytical SaaS is dead.

8:42Jason Calacanis:Okay, category one, analytics dead. Yes. In the medium term. You've got all these bounces today and tomorrow. These are marginally irrelevant. Infrastructure software, undervalued. Okay, what is infrastructure software? Stuff that gives you databases. You collect data into it. Stuff that allows the infrastructure to work, whether it's a database software. This is like Databricks, Snowflake, like that? Databricks, Snowflake, MongoDB, Oracle, all these things. You need core storage infrastructure, core data. We are going to need 10 times the data stored in enterprise than we have today. Right. In the next three years.

9:1410 times.

9:15Jason Calacanis:Okay. So anything that helps you collect infrastructure, data, manage it, you need. I think the category in the middle is called, let's call it system of work or system, you know, a record, people call them. Those are deeply embedded in the way businesses work. I have 6 ,000 salespeople. They know how this works. What's going to happen is step one, we will take away UI and let agents do the work. UI, enterprise software and consumer software UI is the worst thing we did as technologists. You had a couple of examples of this. You told me this story, I don't know if you want to repeat it, of this one company.

9:50Jason Calacanis:They tried to hold you hostage on a license. Yes, that was analytical SaaS, so that's over. And you just pointed AI at it and you just... Yes, we just got rid of them. That's a different issue. But I mean, think about it today. We spend our lives having product managers design UI so all humans can interact with data behind the UI. Yeah. If you believe agents are going to work, and I say, I just tell an agent, look, figure it out from my sales call, figure out the key points, and go post it into whatever sales tracking system I have at this Oracle or Salesforce. An agent conceptually should be able to do it.

10:21Shit, we're spending a trillion dollars building these agentic backends. We need these agents to be able to do it. If that happens, UI goes away. If UI goes away, I can rewire my system of work. Right? I have sales guy shows up and says, I had the sales call, do all the paperwork and all the shit that needs to happen in the background of the company, and just, I'm done. If I can change the way work happens, which is where you will get true efficiency, where five people become one in a company, all these SaaS software that does system of work needs to be re-engineered for the next five years. And it's also happening passively, which is really interesting.

10:59It's looking at email. It's automatically taking the Zoom transcript in summary. So the sales system of record is now like, you don't even need to input it. It's like, I already have the Zoom call notes. I have the deck. The deck was made. The sales deck was made by AI. It's just, we're all going to be looking at a chat window and just saying, here's what I want. Your audit trail comes a lot better because humans are not touching your data. It's always been managed by agents. So I think the whole system of work, system of record gets reinvented in the next five years. Yeah, there's no data entry.

11:31Jason Calacanis:That's an interesting point. Let's talk about national security for a second. I just want to maybe zoom out. So the one side of mythos, as you said, is like the value that it has to you and to enterprises. The red team version of mythos is where foreign state actors can essentially create economic havoc inside of a country. As these models escalate in their capability, what do you think should happen when these models are ready? You know, the sad truth is, in a year, there's a few thousand breaches or attacks that happen. They happen for pretty rudimentary reasons. It's not because somebody cracked a hard-to-crack thing.

12:10It happens because 89 % of the attacks happen because credentials get stolen.

12:15Jason Calacanis:Username and password. That's it. My password is password. Yeah, I'm sure it is. Do you have dollar signs? Dollar sign password. Fantastic. Well done. See, you're only ahead of everybody else. So 89 % of the breaches happen because of simple things. I don't think we need more models to go crack the stuff. Now, these models can attack critical infrastructure and things we try and protect from a national security perspective. Yes, we need defenses there. I'm not worried about the national security part being protected because they're very on it. They are the right people. They spend 10 % of their budgets on IT on security.

12:47I'm worried about the small offices across the country where they're using some piece of packet software and you're running a dentist office or a doctor's office. Remember when change healthcare got breached, every physician's office shut down. Shut down and it's ransomware. Because of ransomware to change healthcare. That was the clearing system. That's when UnitedHealth Act actually gave billions of dollars of credits to the physicians to be able to run their businesses at that point in time. That's what one should worry about. It's less about the big nuts will get cracked.

13:17Jason Calacanis:It's less about cracking some PG &E power generation facility. It's more economic chaos. Yes. And so what do we do? I don't think there's a sort of a silver bullet. I think this will take time. I think this will basically take a while until every system gets upgraded, renewed, fixed over time. I just think it increases the terminal value of the industry. Do you think that there's a world in which these models become so good that you could see yourself advocating for more nationalism nationalism around how they're controlled and how they're managed and where we point them? Or do you think there should be maybe a set of these models that never see the light of day, that only the NSA and other folks could have access to, or guys like you?

14:05I have a slightly differentiated view about models and how they will evolve versus what we heard earlier from an OpenAI perspective. I still believe models are going to become a utility layer. You'll be able to buy intelligence on the fly, or you can say, I don't need a 180 IQ person to go do this task. Give me 120 IQ, and I need a 250 IQ to do this task. I'll pay$10 for this, and for this, I'll pay one cent. So I don't know if there's a one-size-fits-all giving the most up-to-date model to answer my customer calls saying, sorry, sir, I have no idea how to solve your problem. So I think models will get differentiated from a utilitarian perspective.

14:47So if you look at already what's happening in the market, the profit pools are in applications, not in models. Sarah talked about codex running away. She didn't say OpenAI is running away. She said codex is running away. Just the way I'm sure Dario says cloud code is running away. So you're seeing that - They're attacking profit pools. They're attacking profit pools because that's where the money is going to come from. The profit pools are an application that companies can use. The profit pools are not in model usage by companies because most companies have no idea how to use the models. So you can look at these companies in a way, OpenAI and Anthropic, as the new Microsoft office coming in and doing all applications, all productivity software for organizations.

15:27No, I see there's going to be application companies which are going to arbitrage between models and solve your business problem. So you still think they won't go to the application ladder because this is a big debate. Should you engage with OpenAI and train their systems to then take your business from you. And Anthropic keeps releasing their legal model, their accounting model. And it does feel like in order for them to hit their revenue numbers, they might need to do what Microsoft did, which is release the office product on top of the operating system. See, if I'm a company, I don't want to write every piece of software myself.

16:02I want my HR system software, which is agentic enabled and AI enabled to be delivered by some application company. It could be a new AI application company. I want my sales management system built by the new agentic AI sales force of the world, whether it's sales force or somebody else. So I want applications. Now, what Sarah said is the profit pools are in the application layer. That's why they want to be the application layer. So I think we're still waiting for that layer of companies to be invented or created where applications will sit. Because 50 ,000 companies need the same application. Why would I build it myself?

16:38It's highly inefficient. It's silly for me to use OpenAI directly and rewrite my entire sales system because I'm smart, right? I'm not. I want somebody to do it for me. So I think that layer of companies is still not fully formed. We're still going to be waiting for it.

16:50Jason Calacanis:You want a control plane, a harness, and then... That's right. They will build the harnesses and the memory into those application layers. Now, the question is, how big is the application layer? Is it one application? Is it one enterprise application that does everything? Or is it specialized application? When you did it and you kicked out this software vendor, You did it because they were being abusive in pricing. We still use a different vendor. What's that? We swapped out for a different vendor. We just took more control. Love it. So it really is a pricing issue. And that's why the SaaSpocalypse in some ways makes sense.

17:21They're not having pricing power because you could say, I'll just put 10 developers on this and I'll save$10 million. Yes. I think the part back to what Shamath said about the regulation or whether you want to regulate these higher powered models, the question is at some point in time, when these newer models, which are even more powerful, get built. They will come at a different price point, and they might have to go to a certain vetting process to understand what their capabilities are. But I think we're in a global race. I don't think holding back our models for three to six months is going to help us any.

17:50Somebody else is going to put them out in open source. I was shocked to hear when I was talking to the CEO of one of these model companies, he says the entire weights of their most recent model can fit on a USB stick.

18:02Jason Calacanis:Say that again, the entire weights? The entire model weights of their newest model fits on a USB stick. That's the IP. That's incredible. Because all the data can be distilled in under 24 to 48 hours when the model comes out. I'm curious. So that's the IP. So are you telling me that we're going to hold on to that for six months? Right. We have a debate about how difficult it is to make a frontier model. Some companies are starting to think about making frontier models, using their data advantage to build their own. Have you thought about that, Palo Alto? Because it does seem like you have proprietary knowledge on how security works.

18:46Could you build your own large language model or a VSML, a small language model that would give you some advantage? Here's the part nobody talks about, is the false positive rates on the models. What is the false positive rate on 4.8 and 5.5? No idea. You guys don't talk about it. You should. The false positive rate on Mithos was 30%. Oh, wow. Right? So it thought it found something, but it hadn't. Yes. So the problem is, it's great for attack. It's horrible for defense. Because it finds 30 % of the time it finds something. I found a problem. And you say, let's plug the hole. There wasn't a hole there in the first place.

19:26No missile inbound. Right. Yeah. So now the same problem applies in enterprise. If you use a model without the right harnesses, the right training, you could be running into 10, 20 % false positive rates. Let's use the model to pay, I don't know, insurance claims. Yeah. Oh, great. 10%, 20 % false positive. I just lost money. The sycophantic nature of these is ridiculous. So the problem is not who wants the newest model. The problem is how do you take that model with 20 % or 10 % false positive and make it 0.01 % false positive. In my business, I want 0%. Without losing the false negative. Sorry?

20:02Without losing the negative, the false negative. But it's like saying, hey, let's take the new self-driving car. Mercedes is going to use Opus 4.8, and you can just sit in the car and it's going to drive you. I'm not putting my kids in that car with a 10 % false positive rate. Are you? So there's a lot of work that happens post the model, which needs to happen to make this thing useful and effective in the business context.

20:24Jason Calacanis:Let me slightly pivot for a second. You were, for a very long time, the chief business officer at Google. You were the president of SoftBank. Now you're the CEO of Paul Alton Airbog. So let's play armchair CEO. Armchair CEO. Armchair CEO. I'm still bristling from David Friedberg, trying to create a distinction between founder CEOs and non-founder CEOs. Just saying. Just saying, David. By the way, false positives. Sorry? False negatives, too. Give us what you would keep, what you would change, and what you like about the following companies? This is going to get recorded and put out there. We're just getting your thoughts.