Palo Alto Networks ft Nir Zuk & Nikesh Arora - The Grudge That Transformed Cybersecurity

0:28Everybody thought we were crazy. find some of the most consequential companies of our time. I'm your host, Rolof Boeta. In the 1990s, as businesses rushed online, a new cybersecurity industry emerged to protect the networks powering the internet boom. Among the industry's early builders was an Israeli engineer who helped shape several of those companies, until he grew frustrated with their overly cautious cultures that stifled innovation. So, he decided to strike out on his own. Along with a small team of experts, Niruzuk built something that would change the industry. The next generation firewall.

1:10Unlike traditional firewalls, it didn't just block threats. It unified multiple layers of protection into one intelligent platform. By blending on-premise security with early cloud-based capabilities, Zook's vision redefined what modern cybersecurity could be and set the standard the industry still follows today. In this episode, we'll explore the crucible moments that turned Palo Alto Networks from a bold startup into a global leader in cybersecurity. From bringing their disruptive product to market, to scaling into a public company, and ultimately outpacing the industry again in the cloud era.

1:50This is the story of Palo Alto Networks and the people who refuse to play by the old rules. I'm Nir Zook, founder and chief technology officer at Palo Alto Networks. I was born in Israel in 1971, and as a teenager in the mid-80s, one of my hobbies was to develop viruses. some of the early computer viruses in the world, which landed me a job with Israeli intelligence as part of my military service. And there at Unit 8200 is where I met two of the three founders of Checkpoint. I joined them at building Checkpoint software in late 94. At Checkpoint, Nir worked on some of the first firewall technologies, network security systems that could monitor and control traffic between private networks and the outside world.

2:45The biggest challenge I faced at Checkpoint was that very early on, Checkpoint has decided, number one, that they're just going to be a firewall VPN company, meaning they don't want to do other things that customers required as part of their cybersecurity strategy. And second, that they want to optimize for very high operating margins. Checkpoint has always run close to 60 % net operating margins, which is very high. But it also means that there is no money to invest specifically in research and development. So for me, as someone that likes to build technology, likes to build products, like to take things forward, it was a challenge not being able to invest in R &D.

3:31and not being able to build things beyond basic firewall VPN. Nir transferred to Checkpoint's California team, hoping it would offer an opportunity to work outside of the company's VPN-only strategy. But when the team was shut down in 1999, Nir decided to leave Checkpoint altogether and forge his own path in the cybersecurity space. He wasn't shy about the fact that his former employer was now his biggest competition. I had a custom California license plate made. The license plate was C-H-K-P-K-L-R, which reads Checkpoint Killer. So I was driving around the Bay Area with that car. I had met with him and walked him out to his car and had spotted the plates.

4:18It was an example of a chip on the shoulder that Nir had developed in his time at checkpoint. My name is Jim Goetz, partner at Sequoia Capital. Setting out to compete with Checkpoint, Nir founded his first company, OneSecure, which was quickly acquired by Netscreen, which was then sold to Juniper in 2004. The first day, literally the first day after the acquisition closed in April 2004, my new boss, the CTO and founder of Juniper, told me that they were not interested in the products. and they wanted to rebuild them into their own products, which I thought was a disaster. So I left, many other people left, and I left to start Palo Alto Networks.

5:06I called a really good friend of mine called Ashim Chandna, who is a VC at Greylock, and told him I was going to start something, and he immediately brought Jim Getz as well into the picture. I knew from the beginning, they agreed from the beginning, that we're going to build something that's going to change the cybersecurity industry. And the three of us sat down and tried to figure out what it is. I remember when the company started, part of the design goal was beat NetScreen, who was an incumbent vendor at the time on performance, beat Checkpoint Software, another primary incumbent, on manageability, and then beat Fortinet and Cisco in their all-in-one architecture.

5:48I'm Ashim Channa. I'm a partner at Greylock. So Kurwan built a system where you had, you know, you beat Checkpoint Software and manageability, NetScreen and performance, and, you know, Cisco and Fortinet in terms of the all-in-one capability. And then the question was really, how do you insert into that? Greylock and Sequoia were very rigor in making sure that they have the right plan to be able to conquer the market. So that was a, I guess, nine-month project where we went through different insertion plans, different ways of getting into the market with whatever it is that I'm going to end up building.

6:25He had several ideas, but none were refined. There was energy from near, as you can expect, to do a frontal attack on the firewall market. And both Hashim and I felt like a market entry tactic that may not be frontal in nature, but would embrace a more subtle approach to the market was important. And so much of the investigative work was around product definition and market entry tactics. The team continued to brainstorm around this early crucible moment. What do you build that will set you apart in a space crowded with competitors? And how do you take that product to market? The original plan was to be based on an ASIC, a custom silicon that we were going to build that's going to make everything really cheap and really fast.

7:15And we scrapped that as not being enough. And then after one or two more iterations, we figured out that one of the features in the product, which was around being able to secure not just web browsing and email, which were the only protocols or only applications that enterprises were using at the time, but rather also secure other applications, which were considered consumer applications at the time, like ICQ and NetMeeting, if you remember, and Skype and Facebook was emerging at the time, and so on. The assumption was that these were going to become also enterprise applications. So the decision was to take something that was relatively smaller in terms of being able to secure all these applications and making it the cornerstone of what it is that Palo Alto Networks was going to do in the early days.

8:14Build network security that can secure everything, not just web browsing and email, and making that the go-to market, the insertion plan, what we sell to customers. At the time, there were dozens of appliances doing various functions that were not being done in the firewall. and Nir's ambition was to create a single-pass architecture that would allow us to integrate that into a single system. Customers really had what was called appliance fatigue. They had many appliances for different discrete functions around security. And so part of the vision around the company was to collapse all these functions into a single architecture and into a single system, but yet provide customers with scalability and manageability and performance.

9:03In addition to a single fully integrated platform that could serve all areas of an enterprise's security needs, the team decided to take a gamble on the way the platform was deployed. When I joined Sequoia and Greylock in 2005, the cybersecurity market was 100 % on-premise, meaning everything you would buy, whether it's network security or endpoint security or data security and identity and access management and so on was on premise, which means that projects were expensive. They took very long, took three years to implement whatever it is that you bought. By the time you finish implementing it, you have to go back and re-implement it because technology has changed.

9:52We used to equate it to painting the Golden Gate Bridge, where when they finish painting the bridge, they have to go back and start painting it again because the paint is already corroded. One of the things that we decided to do at Palo Alto Networks is to do more and more in the cloud. Well, there was no cloud at that time, so we did it in our own data centers, but delivered as SaaS. So the idea was to take some cybersecurity functions, and rather than trying to deliver them on-premise within the hardware that we were building, and later the software, we would deliver those as cloud-delivered security services from our data centers.

10:30Everybody thought we were crazy. Nobody would use the cloud for cybersecurity. Nobody would send cybersecurity-related data to be inspected in the cloud and so on. And when I hear something like that, I say, of course, I'm going to do it, you know, because it's the right thing. And if everybody believes it shouldn't be done or it cannot be done or nobody would want it, then, you know, it's a good reason to do it. With an ambitious plan for their novel security platform in place, the team set about bringing on talent, including an experienced head of engineering. Meeting with Ned was interesting.

11:05Obviously, he knew the security very well and very sharp, very analytical. And I felt that he was trying to do too much or basically too confident. I'm Rajiv Bhattra, the co-founder of Palo Alto Networks. But then we had the second meeting and we basically tried talking about the kind of company we wanted to create. And our vision about the company was very, very similar. He was telling all the things I knew, what went wrong in previous companies and what went right. And our vision was very, very aligned. And that got me excited. We decided that it's important for us to be proud of everything we do.

11:44Everybody will tell you they want to be proud of everything they do. In reality, in the cybersecurity market, because it is so difficult for customers to check whether something actually works or not, more than 95 % of the vendors in the industry are selling snake oil. They're selling products that look pretty but don't really do anything. So it was very important for us that whatever it is that we do, we can be proud of, actually does something, actually secures customers. It is much more expensive to do it, to develop it. Yet, we believe that if we do the right things for the customer, and we don't cut corners, and we make sure that we actually secure them despite not having to, we would be successful.

12:28We really listen to customers. From when I joined to when we shipped the first version of the product, we actually hired a salesperson whose entire job was a set of meetings for me. We had nothing to sell. And their entire job was set up customer meetings for me so I could go tell them what we were doing so I could get their feedback. Hi, I'm Lee Klarich, Chief Product Officer of Palo Alto Networks. I talked to close to 100 companies in the first year when we didn't even have a product. It was to get that feedback of, is there anything that we're missing? So that we would have the conviction such that when we launched the product, we didn't get yanked and pulled in all these different directions.

13:04The only controversial thing or the thing we had to debate in the early days of Palo Alto Networks is how do we call the product? The debate was whether we call whatever it is that we built a firewall or next generation firewall, or whether we hide the fact that it's a firewall and we call it multi cybersecurity function gateway or whatever, you know, some other name that doesn't have firewall in it. And the reason for that is that when you call it a firewall, you make it very hard for you as a young company to sell the product. Because if you call it the next generation firewall or anything that has the firewall name in it, and you go to customers and you try to sell it, the first thing they say is we already have a firewall.

13:51And then even if you are able to show them the value and you tell them, no, it's okay. It's a next generation firewall. You don't have to replace your firewall. You can deploy it behind your firewall. And then one day, if you want, you can replace it or you don't have to, which was the way we sold it. In some cases, you hear, no, we already have a firewall. It's a political issue. The firewall belongs to another department. We cannot put something that's called a firewall behind that firewall. Go away. It was hard. Like telling your customers, you're a startup and you have a firewall. Customers are like, I'm not deploying a version 1.0 firewall in my network.

14:25Like if it fails, my network goes down and then I get fired. And so the temptation was to say it was not a firewall, that it was a application visibility and control tool, or it was one time they wanted me to create a data sheet for it and call it a next-gen IPS. I would show up at customer meetings being told by the salesperson, whatever you do, don't tell them it's a firewall. And so the first words out of my mouth in every meeting like that was, hi, my name is Lee Clarich, and I represent Pile Health Networks, and we have an amazing firewall for you. And the sales teams would kick me under the table.

14:57I was paranoid that if we allowed ourselves to be positioned as anything other than a next-gen firewall, which included the firewall piece, that we would never be able to capture it again. We would get relegated to being a firewall helper as opposed to being a firewall. The decision eventually was, yeah, we're going to call it a firewall, a next-generation firewall. And the reason is that this is what we want to be. We want to be a firewall. We want to be the firewall of the organization. and even if in the beginning we have to work harder in order to sell it, it would pay off later. I used to joke with the sales teams.

15:33I said, you have to use the F word. And they're like, you have to use the F word. I said, yes, firewall. We have to be true to what we built. I am 100 % convinced that if we had been relegated to something other than a firewall in the early days, even if Kashmir didn't deploy us that way, we would have never been able to get that position back. In 2007, Palo Alto Networks launched its Next Generation Firewall, a product that could stop sophisticated cybersecurity threats at the application level using built-in intrusion prevention, malware detection, and other advanced defense systems. With this groundbreaking solution, Nirani's team burst into the cybersecurity arena.

16:20When we were selling against Checkpoint, against Juniper, against Cisco, against Fortinet, it was pretty easy, actually. What we told customers is, hey, today you are blind to anything that comes in, not via web browsing and email. Put our box on the network for a week. We had a mode in the box where you didn't even have to put it in the network. You just tapped into the network through a switch or through an optical network tap. Give us a week and let us show you what you're missing. And in most cases, customers said, fine, because it was so easy to deploy. We put a box there. We show them that their existing products are completely blind to anything that's not basic web browsing and email.

17:03They go back to their vendors. They ask for a fix. The vendors have no fix. And then they bought our product. So it was pretty easy. We knew from the beginning that if we get a POC, a proof of concept with a customer, our chances of selling the product were in the 90s, so 90 % or more. Near positioned Palo Alto Networks as the clearly superior alternative to the industry incumbents. His credibility, built from years of experience at those firms, helped fuel word of mouth among enterprise IT teams frustrated with legacy firewalls. Palo Alto Networks grew rapidly, generating$5 million in its first year alone.

17:49The company began attracting larger clients, including a$10 million deal with Citibank, a clear sign it was disrupting the cybersecurity industry. As Palo Alto Networks' next-generation firewall gained traction, rivals took notice, opening the company up to potential vulnerabilities. When you change the market, the biggest worry you have is that one of your competitors will wake up too early and deliver the same. It was interesting in terms of how competitors reacted to us. I remember Juniper actually tried to preempt us coming out of stealth mode and to say that they had sort of done what we did, which, of course, they hadn't technically, so it didn't matter too much.

18:35But it's just interesting to see them trying to position it that way. Checkpoint initially, who we sort of viewed as our biggest competitor, their initial response was to say that we didn't know what we were talking about, we were wrong. about two years later they changed from we're wrong to actually it turns out you need a next gen firewall and checkpoint invented it in retrospect by 2010 2011 time frame the market space was largely everyone was saying they had a next gen firewall near and his team faced a crucible moment they realized that if they wanted to beat out competitors and become the true industry leader, they would need to scale and scale fast.

19:22We felt the pressure to scale the company fast from the early days. We knew that there is a market out there that we have a disruptive product that we have to get to as many customers as possible. We were doing a few hundreds of millions of dollars a year in sales and we needed to go to a few billion. And that always requires a change. every time you multiply yourselves 10x things have to change they have to change in the way you market your product you have to change the way you sell the product you approach the market and so on you have to change the way you support the product you have to change many different things in the organization the company's first change was to seek out new leadership when you grow really really really fast, very quickly you get to a point that whoever it is that you hired is running the biggest thing that they've ever did.

20:18Sometimes they're able to grow with it and sometimes they're not. If you're a founder and you find yourself in a company that's doing a few million dollars in ARR or tens of millions of dollars in ARR or hundreds of millions, good for you, and you need to scale to the next level, 10x. So from few millions to few tens of millions, from few tens of millions to hundreds of millions, or from hundreds of millions to billions. If you've never done it yourself, which you probably haven't, don't be a hero. Don't try to do it yourself. Your chances are relatively low. Bring someone that's done it before and let them do it for you.

20:56So we were looking for basically the person who can take it to the next level, who already had an experience being in the public markets, the scale we need to do and how to basically make it happen. And we were looking for a great leader at that point. To me, that was very, very crucial. And actually an unusual situation in that I was offered the CEO job twice the first time in 2008. And for personal reasons, family reasons, I wasn't able to take it at that time. So I declined knowing that I would professionally regret that probably for the rest of my life. And then lo and behold, got the opportunity again in 2011, things had changed at home and I was able to say yes that time and ended up being the best professional decision ever made.

21:41I'm Mark McLaughlin. I had the privilege of being the CEO and chairman of Palito Networks from 2011 till 2018 and on the board until 2022. The company's doing very well, clearly selling well established. The next gen firewall is an important thing in the market. And so let's go scale it. The expectation was when I joined, And I mean, literally, not the expectation was pretty explicit. Okay, you're here. We're going to go public in six months. Pala Alto Networks' leadership and board believe the best way to scale and to cement its category dominance was through an IPO. Going public would send a powerful signal and give the company additional resources to grow.

22:24But upon his arrival, Mark pushed back on the idea of an imminent IPO. He wanted the team to think critically about the company's direction and ensure it was on strong footing before making this leap. What's the vision for Palo Alto Networks? It's very easy for a company to scale itself to death. And there's lots in that statement of examples you go down, which would be, you know, we have one product, the product is great, everybody loves it, and you're just late on the next one or the next one, And you just kind of, you know, you just peter off, right? The next one is hire, hire, hire as fast as you can, because, you know, we're growing so fast and you dilute or destroy the culture of the company simply by just layering in because you relax, you know, your filters right on who's going to join the company or just have too many people.

23:18there's a lot of ways to scale yourself down very quickly but it's all you folks today is if you're fortunate enough to be in a hyper growth company and Palton Networks is a hyper growth company not growth not super good hyper growth in a hyper growth company it's like trying to stand on a marble it's very very difficult to maintain balance or even get it ever the reality is if you want to go public, yeah, your product technology and that stuff really matters. But if you don't have just as much emphasis on how you're going to build and possibly innovate and scale a go-to-market machine, you're going to get creamed in the public markets.

23:58Public markets every quarter, they don't ask you if you launched a product. They ask you if you met your numbers. Mark joined and the first thing was to slow that down to make sure that we were going to be ready not to go public like that was the end state, but that was going to be the start of, you know, the rest of the company, of being a public company, what it takes to be a successful public company. And we better, we better get our stuff together and be ready for that. I think Mark wanted time to recruit a world-class team and build out the culture and make sure that we had the right talent in Europe and in Asia, but also key areas that had been, I think, underinvested early on, whether it be support or sales enablement, finance.

24:47And Mark rightfully pushed back on the board and suggested that we were financially ready to go public, but we were criminally understaffed and needed to hire a handful of leaders. And I think quickly the board recognized that Mark was correct, and we all got comfortable with giving him that time. Mark convinced leadership to slow the sprint to an IPO. Meanwhile, he went about expanding sales, support, and finance teams while carefully preserving and building on the company culture Nir and Rajiv had worked so hard to cultivate. What Mark really did was came to a company where the basic product market fit had been established and the product had begun to kind of grow in the market.

25:36But he really kind of, you know, went out and recruited a world-class executive team, worked closely with the founders and, you know, built an executive team at the company that could really take, you know, advantage of the business opportunity that had been created and help materialize that. In July 2012, with a firm roadmap for expansion and the proper systems and leadership in place, Pala Alto Networks went public at a market cap of around$4 billion, one of the largest tech IPOs of the year. The IPO gave us the money to set up the tents and buy the food at Basecamp. Yeah, like that's where we are.

26:20A lot of people never make it to Basecamp, right? But that's where we are. And we've got the resources to actually start to climb the mountain now. That was probably the most important thing in my mind to go, OK, let's get people thinking about 10 years from today. In the years that followed under Mark's leadership, revenue soared tenfold from a run rate of just over$200 million in 2012 to$3 billion in 2018. The team grew just as dramatically from around 700 employees to over 5 ,000. And along the way, the company definitively cornered the firewall market. Palo Alto Networks grew its business at a rapid pace, and a day arrived when Palo Alto passed Checkpoint and Revenue Size.

27:10When that day came, Nir changed his license plate to CHKP space KLD, killed. The CHKP killer became CHKP KLD. In 2013 or 2014, we became the largest network security vendor in the world by surpassing Checkpoint and Cisco and Fortinet. Juniper disappeared by that time. It was yet another milestone, certainly something that we always wanted to be, always wanted to be the biggest one. It was also the cue for us that it's time to move beyond network security and start implementing the bigger master plan to consolidate not just the network security market, but the entire cybersecurity market into a single platform.

28:01By 2018, Palo Alto Networks was the incumbent network security company. But Nir's ambitions stretched towards capturing every corner of the cybersecurity industry, and his first target was endpoint security. It was very clear that what I was set to do in 2005, which is turn the network security market into a, you buy one thing and everything else is delivered on top of it, has worked, and we've changed the market, and network security is done. There are only going to be a few large vendors. And we wanted to start seeing that happening in the larger cybersecurity market, which includes other things.

28:41For example, endpoint security. We wanted endpoint security to be part of a bigger thing, part of you buy network and endpoint security together, which makes a lot of sense. But it was a struggle. It was very difficult to do that. It was not growing as fast as we wanted it to. We were still mostly a network security company. While Palo Alto Networks was focused on building out capabilities for endpoint security, a new era of technology was emerging, the cloud. With its rise came a wave of cloud-first cybersecurity companies, ones that threatened to leave Palo Alto networks behind. The company really began in the on-premise era, and the company began where cloud had not still happened, right?

29:32And so the company really grew in the on-prem firewall market, on-prem network security market. And then cloud kind of began to grow, right? And so at some point, the company was at risk of basically being in a market that was an important market, the on-prem security market, but missing the new growth market, right, which could become a primary market. It was very clear by this point, very, very obvious that the cloud was going to have a huge impact. How do we go from being a next-gen firewall company? Like that is our DNA. That is what we do. That is 95 plus percent of our business to being something more.