Palo Alto Networks CEO: Global Cyber Threats, Digital Safety, and Tech Leadership

0:00Hi, everyone. I'm Nikolaj Tangen, the CEO of the Norwegian Sober and Wealth Fund. And today I'm in really good company with Nikesh Arora, the CEO of Palo Alto Networks. Palo Alto Networks is the world leader within cybersecurity, which has never been more important than today. We own 1.2 % of the company, translating into more than$1 billion. Thank you so much, Nikesh, for taking the time. Thank you, Nikolai. Lovely to see you again.

0:37Now, let's start off with the basics. What do you guys do? That's a good question. Look, as the world has digitized, as we've all adopted technology, whether it's in our smartphones or as companies make applications available to everyone, the possibilities of bad actors getting into company systems or personal systems goes up. And our job is to protect that technology infrastructure from bad actors. So we are in the business of cybersecurity, which is to protect our enterprise customers, governments, and individuals from being hacked or attacked or coerced by bad actors. Now, the thing is that everything is digital these days, right?

1:17Yes. Your car, you know, streetlights. So what's kind of happening with the whole attack surface? Well, it's a great, great comment, Nikolai, because you've said it right. We call this the attack surface, and the attack surface is expanding, and I think we're not done. And as you said, if you drive around in San Francisco in a Waymo, that's your car, but the car is now fully connected to some central nervous system. And if a bad actor could get their hands on that control system to your car, they can control your car. So as we create more and more technology, more and more interconnectivity, we are creating the opportunity for bad actors to get involved and start to interfere or start to take over this attack surface.

2:00So, yes, the attack surface is fundamentally exploding. We'll continue to explode, which makes it more and more important for us to make sure that we are able to protect those situations faster and faster and faster and more real time as we can. What's the most difficult part of what you do? The most difficult part is the tables are unfairly stacked. The bad actor has to be right once. And we have to be right 100 % of the time. That's hard to do. How do you do it? more and more technology you know we all talk about ai and i'm sure we'll talk about it but we have to be able to identify things as they're happening we have to be able to look for the needle in the haystack and today with the amount of data that's floating around in the world the amount of connectivity as we talked about that is going on the only way to do it efficiently effectively and in real time is to use the same technology to protect ourselves against cyber that we are using to make our lives convenient.

3:04How has AI changed the way you work? Oh, I think AI is going to change everything. It's almost as we are beginning to see every week there's a net new incarnation of AI and you can see it keeps getting smarter. And the way I sort of correlate this is like, AI is like having a really smart person that you can have work for you. This person doesn't forget anything. This person knows everything that's ever happened in the world. This person knows how to recognize patterns. And what's happening is that that person is, over time, going to become smarter than the average employee and be able to either assist the current employees in the task and possibly take over their tasks.

3:41Now, that also applies to cybersecurity, right? If you can have somebody who has infinite memory, infinite pattern recognition, then the question is, can I train it with my information to be more effective and helpful for me? I think that's just phase one. I think phase two, this thing's going to have a brain of a PhD, where it can think of unintended scenarios, things that have never been taught about. It can reason. So I think we're on to a very interesting road with AI. We're in the very early stages. It has benefits on both sides. Once again, every piece of technology can be used by bad actors and good actors.

4:13Hopefully, the good actors outweigh the bad actors. And we're working with AI to see if we can use those brains to become better security analysts, solve security problems faster. How do you make sure that you have more compute than they have and better algorithms and so on? I mean, honestly, you don't need more compute than bad actors. The day bad actors end up with more compute, we'll have a real problem. Because if they have more compute, then the world is a dark place. But I think even with the compute that's out there, it can be leveraged effectively, unfortunately, from a bad actor perspective.

4:48The compute is really being used to create a faster and faster brain, a smarter and smarter brain. Once the brain exists, hopefully we'll find technologies and techniques where they can be deployed at the edge on your phone in many different places to be able to leverage it. So I think the real risk is that there is infinite possibility for this technology to be used in in sort of the dark side as much as it can be on the right side. So we have to make sure as we deploy it, as we enable it, as we make it more omnipresent, we do that with the right guardrails and the right control systems in place.

5:23Otherwise, we're going to have to go. And it's very hard to put the genie back in the bottle.

5:32Vikash, who are the bad guys? Where is the dark side? The dark side is interesting. It's been an evolution. I think 15 years ago, it was people who sat playing games in their parents' basements and who were great at technology. And sort of hacking somebody or proving a point was kind of like getting a trophy. It's like, look at me, I'm so smart. I can hack into the system X, the system Y. Look, I showed that I can do it. But very quickly, as the world became more and more interconnected, it started getting economic legs. People said, wait, if I do that, I can actually find a way to monetize it and find a way of getting money for it, whether from the companies or individuals.

6:13And we're seeing a lot of that. There's a lot of ransomware activity, a lot of activity where people are scared into sharing economics with bad actors. I think we're past that, too. I think nation states have started building that capability in a robust way because I think the future wars will be fought both in the digital war sort of battlefield as well as a physical battlefield. the digital battle peel is a lot less expensive from a from a you know situation where from a casualty perspective if you were a bit more specific about the countries well I don't think it's a state secret that there are countries which have tremendous offensive capability even the US has a great offensive capability but there are there are people out there who spend more time building offensive capability than defensive capability because they feel that that capability would be extremely well leveraged in an adversarial situation.

7:05And, you know, we have bad actors. We have seen groups in North Korea. We've seen groups in China. We've seen groups in Russia, various parts of Eastern Europe, some parts of the Middle East. So you have groups of people. Now, that doesn't mean the whole country is bad. There are people who are resident there because they have access to resources. They have, there is hard to create sort of, you know, some consequence from a fiduciary perspective against those. So that's where they are. Could you recognize them by the way they attack? yes uh so tell me what's the difference so hey so now i'm uh i'm uh sitting in uh in palo alto networks uh we get some uh red lights uh flashing yes and uh how can i see that it's uh some russian guys rather than some north korean guys how do i how can i see that well there are attack techniques which uh have been have sort of signatures in there people are proud of their work they embed signatures in their work.

7:57So you can recognize signatures. You can recognize that there are variants of things that people have used in the past. You can get some sense from the IP addresses that are being used. You can see where the traffic is coming from. So you get some sense, not always accurate because there's ways to circumvent that. So it's sort of a triangulation exercise between the technique used, the malware used, where the traffic's coming from, the scale of the traffic, the scale of the attack. Sometimes you see DDoS attacks, which only nation states have the compute capability to go exercise. You can always understand from who the target is, who the adversary might be.

8:34It was pretty obvious when the Ukraine war started that the systems in Ukraine that were being attacked, they were being attacked by a certain set of people, right? You understood there was a motive. So I think triangulating motive, malware, techniques, and addresses and location gives you a reasonably good idea. It's the type of targets changing. It has. Yes, that's a great question. The type of targets have migrated from individuals to individual companies. And now we're in the world of supply chain. And what I mean by that is, you know, if you want to go find out what an activist is doing in their email, you try and attack the activist trying to get access to their username, password, so you can see what they're doing, which would be a very targeted attack to whether it's an individual or a company.

9:22But then he says, look, I'm going to need this capability for a very long time. Why don't I go attack the backbone of the email system so once I end there, I can go look at anyone? Or why don't I attack a piece of hardware that is deployed by 10 ,000 companies? Once I know how to break into one, I can break into the other 9 ,999 at will. So you're beginning to see a lot more supply chain attacks, which effectively allow bad actors to go amplify their targets over time, where they want to go. So it's kind of like we joke about this in the industry. It's kind of like there's groups that do ransomware as a service.

9:58They'll go become resident in tens of thousands of pieces of equipment based on known vulnerabilities and offer that capability to the people who want to go exploit it for their own monetary reasons. How much money is in this industry? Billions. Billions. Look, it's unfortunately one of the most profitable industries out there because I think by last count, there was close to$18 billion between ransomware and scams, online scams, which are another form of cyber sort of behavior. And the challenge, Nikolai, is that in each of these cases, it's very hard to prosecute people because eventually your lead ends up in some third world country or in some other country, which is very far away.

10:45and you don't have the capability to go investigate all the way across five different nations or multiple continents, it's very hard to go prosecute them unless these are things of significance in nature. If somebody made you transfer$10 ,000 to a bank account in Africa, it's very hard to prosecute that and reverse that. Now, if you are going to get ransom attacked or you're going to bring down critical infrastructure, you're going to block a pipeline, yes. There is prosecution that can happen in that situation because it's bigger than just monetary impact. It's kind of, oh, my God, somebody's trying to, you know, sow chaos in some infrastructure capability or some utility capability.

11:22That's when people do get engaged and get involved. But I think there's a very long tail where it's very hard to go prosecute these situations. Why are infrastructure projects increasingly under attack? I mean, we're seeing it in water plants, telco networks, power grids and so on. Why are the hackers going out of these things? Well, I think it's, first of all, it's easier because typically those things are, you know, they have relatively older infrastructure for the most part because their job is to provide electricity and provide water and power, et cetera. They are not sometimes technologically as advanced as you'd like them to be.

11:57But what we're also discovering is despite their old infrastructure for ease of use and convenience, we're putting on sort of band-aid systems which can connect to those things. So it's a lot easier to manage an electrical grid remotely if you can have every part of the electrical grid that is connected to some Internet of Things or IoT or operational technology. But the challenge is because that's older infrastructure, all these tools and capabilities are patched on. And that means when you patch something on, there is the possibility that bad actors can get into the same doors and you just exposed some old infrastructure to Internet access.

12:30So from that perspective, A, there is B. As I said, when nation states get involved, they're not looking for just monetary outcomes. They're also looking to see how do you destabilize a county, a city, a state, or a nation. And it's kind of their way of probing and getting ready in case there is a scenario where they have to leverage that. And so you're seeing a lot of that. But for the most part, as you can see, there hasn't been a situation except for what we saw recently in the Middle East or in Ukraine where these things were used in the case of wars. In most other cases, this is work that they're doing to sort of flex their muscles, understand their skills, understand their capability, and be ready for a rainy day.

13:16If you had my job, what would you be the most worried about? look in your business there's event risk right uh although everything goes down the path you have wonderful models that try and tell you how things going to happen from an event risk perspective it's very hard to model it it's very hard to be afraid of it because event risk is event risk if something's going to happen to one of your portfolio companies is going to happen if something's going to happen that impacts a certain sector of your portfolio is going to happen i think the flip side, what you can look for is, let's say, basic hygiene.

13:50Typically, cybersecurity is like water. It follows the path of least resistance. So the companies that are most vulnerable will be the ones which will have the most problems. So demanding a certain level of quality, certain level of cybersecurity hygiene becomes important. And you see that there are various executive orders, edicts from governments where they demand that a certain level of hygiene be maintained by critical infrastructure because that can impact nation-state stability. There are financial services requirements where the regulators require tremendous amounts of cybersecurity hygiene and capability.

14:26The federal government requires a certain amount of hygiene from federal contractors. So there are examples out there where people do require that degree of standard care or diligence. I think you guys should be at least looking at that or demanding the same. Are you worried about the whole financial system, plumbing, like stock exchanges, that kind of thing? Look, I can scare myself every day if I want to. So I believe in the goodness of humanity. If you look around, we haven't seen those things. And I think the flip side is the resilience as well. Look at, you know, we powered through a pandemic, which is one of the biggest crises that civilization has seen in modern times.

15:06So can we overcome some plumbing breakdown? Sure, we can. Will it be choppy? Possibly. It all depends on the extent of the impact and the scale of the impact. But I'm not worried. There's enough segmentation. There's enough circuit breakers in the systems where I think today we say, look, when you think about cybersecurity, think about cyber resilience. Because the possibility that you can get attacked, hacked, or brought down to your knees is reasonably high. If somebody shows up with tremendous amounts of force and compute, they can find a way to breaking into that one chink in your armor and destabilize you.

15:48The question is, how resilient are you? If somebody does destabilize you, how quickly can you come back up? How quickly can you bring your infrastructure back up and you can resume operations? And that's kind of where the focus has been the last few years amongst large companies, enterprises, critical systems. And that's a good thing because I think that's the right way to think about it. the right way to think about it is not that I can protect myself infinitely better and nobody's going to get into my system. You have to assume it's going to happen. And when it happens, how quickly can you stand up?

16:17So I think that's all goodness. Well, I am slightly confident by the fact that you still believe that goodness is humankind because I hadn't really expected that to be the case. As you say, hope for the best and prepare for the worst. That's what we do every day. Now, compared to other sectors within technology, the cyber subsector is quite fragmented. Why is it not more consolidated? That's a great question. And I think if you look at technology, that was our thesis seven years ago when I came here. Our thesis was about a$200 billion revenue industry annually. And we were at 1.5 % market share.

17:02We were one of the top three players in the market. So that is, like you said, fragmented in the small. I think you can go back and trace it. First of all, remember, cybersecurity is one of the newest subsectors of technology. In 1989, when I went to university, there was nothing called internet connectivity. So this thing is less than 30 years old. And true widespread connectivity really came about for all consumers. And mobile phones were sort of popular and people started using apps on their phones because now every company, any enterprise had to open doors for your bank account or you pick your favorite activity with your company or e-commerce.

17:36So really, we have seen the interconnectedness arrive in the last 20 years. You make it sound like we are old. I thought we were super young. We're not old. We're going to live to 150, right? With the longevity things that are going on in the world. So we're like an early part of our lifetime. But my point is this industry subsector is 20 years old. That's when it started. So it hasn't had time to actually consolidate in some sort of platform. If you look at workflow management, you look at CRM, you look at IT management, these things have been around 30, 40 years or 50 years. And you've seen platformization or what I like to call the consolidation of this fragmentation into more meaningful sort of technology providers.

18:18And our thesis and our bet is that over time, cybersecurity will go the same way. We're blessed that we're now about 4 % to 5 % of the market and possibly 8 % of the product market. which is better than 1.5%. But there's no reason there's not a 20 % player in this segment in the next 5 to 10 years.

18:38Now, you previously worked with Google and then SoftBank. What did you learn there which you have brought with you to the current company? Nikolai, I was very blessed to see the emergence of interconnectedness on the internet from a vantage point like Google. I spent 10 years there between Europe and the U.S., and I got to see how the world sort of grabbed technology with both hands. And sort of the thing which I think makes Google great and continues to is their obsession upon product, right? You can see at Google, there were so many products when I worked there which had a zero monetization, possibly even today, things like Google Maps or the Chrome browser.

19:19But Google focused on building products from a technology perspective to make it convenient for end customers. And I'm sure there is some sort of a virtual circle that allows them to monetize that in their advertising business or their YouTube business. But the and then Larry told me once and and I think he's right. Larry, as in as in one of the founders. Larry Page. Yes. Thank you. Yes. He said to me once, look, if you look at technology companies, over time, technology companies die when they stop focusing on product and start focusing on other things. And that's true. If you look at the history of technology, the battlefield is littered with companies whose eye was off the product.

19:58And that's what he was very obsessed about. I brought that here. I said, look, for us to win in the long term at Palo Alto, the only way we are going to win is if our products are the best in the market and the customers rely on our products. So we brought a lot of product discipline. We had to buy 20 companies because we were set on the back foot or late in our innovation cycle. And we couldn't wait four years because, you know, corollary to that. I believe it takes four to seven years to build a great technology product. It doesn't matter what it is. What about SoftBank? Well, SoftBank, you know, is yet another fascinating founder, Maso Ishii San.

20:35He, as I've always seen, is like, I think he has, he's one person whose risk appetite increases as he gets older. And fascinatingly, when we have children, I have two young kids. and I realized as we bring them up, our instinct is to help them risk minimize. Don't look on both sides of the street when you cross the street. Be careful. Don't do this. Don't do that. Be careful. We're constantly grooming people to start minimizing risk. Once you get married, make sure you don't overextend yourself. Masa, at the age of 60, he's like, let's swing. Let's swing harder. And I think it's just fascinating.

21:11So where did that come from? Where does that come from? I think it comes innately from him. I think this is who he is And he's done that so many times. And first time or second time, it looks like a coincidence. When he does it four times, he's like, holy shit, he's got something going here, which should be bottled. And he was the richest man in the world for some days. For a few hours. Possibly. But you got swinging pretty hard too, no? Yes. Well, that's what I said. So you bring that from there and say, look, don't worry about what you're going to break. Worry about what you can build from there.

21:40And I think that's the two principles we operate Palo Alto on is one, focus obsessively on the product. make sure our customers see value in our product too is don't be scared of taking managed risk so how did it work so when you joined palo alto networks you had little experience from cyber security right so they call you up and say so hey nikesh you want to come and join the company yeah i know nothing about it well great join anyway and then you became the ceo yeah i think you have to hold the board accountable for their bad decision right because they were looking for a ceo for a public company i'd never run a public company they're looking for an enterprise ceo because we sell to enterprises.

22:15They're looking for somebody who understood cybersecurity. Other than not having those three qualifications, I was a great guy. I said, you know, like, you must have really run short on potential supply of potential CEO candidates that you hired me. And I guess they knew more than I did. They said to me, we have 5 ,000 people who understand cybersecurity really well, so we don't need one more person who understands cybersecurity. We need somebody who can lead this company from where we are into being one of the major forces in the space. And, you know, it was a very steep learning curve, very, very steep.

22:43I won't deny that. But I had some great teachers. What has happened to the market capitalization of the company during your tenure? We started seven years ago. And you don't have to be modest. You can just give us the numbers. It's the numbers. It's numerical, right? Seven years ago when I started, we were approximately$18 billion in market cap. And today we're around$120 billion, give or take. Wow. Wow. So how do you move up the learning curve? You join a firm like that. It's not your expertise. Just how do you go about learning a new field like that? You know, it's a great question. And I said, I relied on every one of those people, 5 ,000 plus people who understood cybersecurity.

23:24I think they probably had their ears were red, their eyes were teary-eyed every time because I would pepper them with questions every time. I would call our co-founder in the morning coming to work for an hour asking him all kinds of stupid questions because things I had read in the night. And I called our chief product officer on my drive home saying, I'm so confused. I learned so many different things today. It helped me make sense of it. I possibly did that for, I want to say, the first 18 months. I also used that time to meet 300 individual cybersecurity companies because our industry is very, very prolific.

23:55There's 2 ,000 cybersecurity companies formed every year. So I could always find somebody who wanted to tell me what they were doing. And slowly, I started to build a framework in my head as to what would be interesting. and I built a few theses about how the industry operates and what needs to happen. And my plastics moment was, in having been at Google, I said, look, the two most important things from a technology perspective would be cloud and AI. This is something we said seven years ago when AI was not in fashion, cloud was, beginning to get into fashion. And so we pivoted our company. We burned down our data centers.

24:28We don't have data centers. We run everything in the public cloud. We built a whole practice around cloud security. We've built our entire security management stack using machine learning, which was the normal name for AI at that point in time seven years ago. But it took us seven years to build a great product. And we're delighted because some of those investments we made seven years ago is kind of what is bearing fruit and allowing us to succeed the way we are. Now, the founder of the company, Nir Zook, he's still chief technology officer, right? Yes. What does that mean? How does that work?

25:01Well, Nir's a phenomenal brain when it comes to security. It comes innately to him. He worked in Unit 8200 in Israel. He saw opportunities. He came. He worked in the security sector. He decided to spin out and start Palo Alto Networks. And some of the early product insights and decisions were driven based on what he thought was the right way to go. Now he acts as a technology consigliere both for our management team as well as our customers. So you'll go out, meet customers, talk about the security stack, work with them as to what should be the greatest outcome for them. You'll sit down with our teams and sit down and look at what they're trying to do and sort of attack problems from a first principle basis.

25:41It's very helpful.

25:46You mentioned some of the trends that you were early to spot. What's the key to spot a trend early? How do you do it? Look, I read something the other day from a distinguished person at Microsoft, and he was saying it in the context of, I think, Internet Explorer. He said, you can see a tipping point typically three or four years before it is going to become widespread and fundamentally obvious. Right? And the key is, when you look at technological trends, you have to say, what is it that I just saw? And how is that going to fundamentally change? So, take AI for now, right? There's a huge ha-ha around AI.

26:26And people actually sit there and say, oh, my God, this AI is going to be amazing. And you can see NVIDIA. You can see infrastructure. People want to spend$500 billion building large data clusters, data centers. The question is, what's the insight? What is that going to do? Now, you can see it. It's pretty clear. Everybody's clear that something's going to happen with AI and something's going to be fundamentally different four to five years from now. The question is, how radical is it going to be five to ten years from now? You have to sit down and define your principles. I fundamentally believe product development will go flip on its head.

26:59Today, 50 % of technologies are deployed in product development across technology companies. You won't need to do it as much because product development in technology companies is us designing a way to talk to data and machines. That's what we do. Product development people say, let me take all this, make it simple. It's like you booking your airline ticket on booking.com. That UI is called product development. Well, if I can just talk to it and say, book me a ticket and do this stuff for me, and this is a fundamentally easy example, whether it's a DoorDash or Instacart, you don't need to build all this amazing UI that sits in front from a product development perspective.

27:30You can start talking to data and machines because they understand you as another human wit, and that's how your interaction becomes. If you believe that's the future 10 years from now, everything fundamentally changes. Then the next question is, how do you position yourself in that future? Should you be chasing things like writing better legal briefs and investing in companies which are making marginal incremental improvements, or should we fundamentally rethinking how that's going to impact technology? Now, we have to think. We think the future of AI is going to be more agentic in nature. We're sitting and saying, if that world transpires, how do we build security protection where agents don't run amok?

28:08So we're trying to build a whole fantasy world of agents in our head. And then we have to say, how do we protect that fantasy world of agents? So we have like a second derivative problem, not just first derivative problem. So if you apply this thinking to the technology sector, where should you place your bets now? Any software business that relies on seats, that relies on humans, and humans using more software has to fundamentally rethink their strategy. Because if you believe this wave of AI is going to be true, we're going to be much more efficient and we're going to be using humans fundamentally differently in the enterprise environment, in the entrepreneurial environment.

28:49And you'll get a lot more done with a lot less. If that's true, then you have to focus on what the lot more is going to be because we're going to have a lot less from a people perspective. So I think rethinking that would be interesting. I think there will be some market dislocations. I was chatting with somebody last night and we talked about, look, typically the market first doesn't realize until it gets hit. But when it gets hit, it swings too hard in the opposite direction. So there will be value opportunities in the market in a few years when market begins to see this catastrophe coming in the short term.

29:21The market is not realizing that this thing is going to start taking more momentum over time as things get more and more efficient. So I think there's going to be a rethinking on the enterprise side for seed based businesses. and you can see all of them are very focused on AI and creating more value with AI and figuring out how to deliver AI agents instead of humans. And that's kind of a smart thing, an interesting thing. Some will make it, some won't. I think on the consumer side, I've said this before, I'll say it here, is I think the whole idea of applications on your devices is going to have to be rethought.

29:51That's going to be sea change because do I really want 14 AI agents talking to me on my phone? I don't think so. So we have to figure out a way of disintermediating these agents. And the question is, who is in a pole position to take that leading role in talking to those 14, 15, 200 agents behind me? And then what does that do to economics, to customer ownership, to where the financial transactions are? So I think it's going to be a very interesting world for the next five to 10 years from how AI actually gets deployed and how many sectors it impacts. So who is going to be the winner? If I knew that, Nikolai, I'll be doing what you do.

30:28Who is going to be hit? where the big hit's going to be. I think it's early to call because, you know, these are not static things. These are not static companies who are sitting there waiting for consequences to happen. I think many of these people are well aware of this problem. They probably are more thoughtful about it than I've just told you. So there are people who understand these challenges. There are people who are working on these. Like you can apply that and say there's going to be goodness. We will get this solved. But on the flip side, you go back 25 years ago, you know, We never saw the emergence of Google or Facebook or Amazon and their likes.

31:03We never saw the emergence of OpenAI at the scale that has come to it. So I'm pretty sure there'll be 10 to 20 new players who we haven't fully comprehended are going to go run this table from first principles or from scratch. And I'm sure some of us will adapt. I mean, Walmart still exists and they're done a phenomenal job from an e-commerce perspective, right? Even though they relate to the party vis-a-vis Amazon. So there'll be early entrepreneurs. There will be people who will be late adapters, but they'll have tremendous assets they can bring to bear to make it work. And there are some people who will fall by the wayside.

31:34Would you mind just enlightening us a tiny bit? You mentioned first principle twice. What does it mean? The first principle is you go back and look at it and say, eliminate all constraints. Rethink if this was from scratch. How would you do it if you didn't have any of the baggage of the present in the industry, in your category, in your sector? That usually gives you a better outcome. It's kind of like that's how true innovation gets formed, saying what are the tools I can bring to bear today, which never existed 20 years ago, which makes it a lot easier to build this from scratch. I learned an interesting lesson, and I'll tell you an anecdote.

32:12A very dear colleague of mine at Google, he was trying to think about mobile apps in the future. And I used to work in the mobile industry before, and we were chatting about it, and he said, look, there's 200 operating systems in the world on mobile phones right now. It's impossible to build an application because we have to comply with 200 different operating systems. I said, what are you going to do? He said, I'm going to focus on Android and iOS. I said, why? He said, if I look at the trajectory five years from now, I think the world will be 60 % to 75 % Android and iOS, and I don't care about the rest because they're going to be on a downward trajectory.

32:44Now, he went back, retaught it, did it, simplified it. It worked really well. And today, he's right. He was right. He was right 15 years ago. But at that point, that was not obvious. I remember the CEO of a very large mobile phone company calling me, handshake company, calling me and yelling at me and saying we were being duplicitous. But my colleague had called the demise of their operating system before they'd seen it.

33:09Related and talking about a big change that you did in your company. Middle of last year, you doubled down on your platformization strategy, which was part of your long-term strategy. and it led to some short-term negative effects, certainly for your share price. It's part of that swinging thing. Absolutely. Take us through your thinking behind it and then now one year later, what has it led to? Yeah, look, as I've heard in another podcast, somebody asked one of my old bosses, if you go back, what would we have done differently? And he said, I'd have made my smart decisions faster, except you don't find out until after the fact.

33:52So if you ask what I've done differently, I wish I'd done it sooner. But I think there was the right time and a place, and I'll give you why. When I started seven years ago, we were great in firewalls, and that's all we did. But there were four other swim lanes in our industry, which our industry used to let everybody else play, say, hey, you do that and I'll do this. And I realized, well, why are we doing this? Why do we just give a free pass to every net new startup that shows up and wants to play in a different swim lane? Why aren't we in it? And you've discovered that over time, there's learned behavior in the industry that people have tried that and failed.

34:22They're stuck to their knitting. So we set about to say, oh, let's see if we can go play there. And we built a phenomenal M &A strategy where, you know, we can talk about that as well if you want. But we were able to start establishing a beach, sort of a foothold in each of these other swim lanes. And over time, in the last five years, I'd say, the first five years, we got to a point where in each of these swim lanes, our product was now rated number one or two in its category, which is kind of a table stakes. In cybersecurity, the normal default is security professionals say, hey, if you're number one or two, I won't get fired for buying you.

34:56If you're number four or five, why would I buy you? You're a new player. So we had to get the right to play and right to be at the table. We did that. But we realized we were still fighting individually against people who were great in that category. And we looked at it and said, well, we're the only people who have 24 products in the magic quarter in the top right. Let's start showing the benefits of these things working together. So we spent one year stitching them together harder and said, look, these things are best in their category. Yet, even better, if three of them work together, you don't have to go do the stitching yourself.

35:30And we're in the cybersecurity world. The more disparate products you buy, the more you have to go figure out how they work together in sort of an adversarial scenario. So we were able to do that, which became the germination of our platformization strategy and said, let's go sell the benefit of all these together. It's lower cost of ownership, higher simplicity, better security. And actually, customers might have to actually pay less instead of constantly paying more for security. So that's taken hold. We sold over 1 ,000 of these deals in the last 12 months, which is great. And we believe that's the future.

36:02And if you look at, and I said this earlier, if you look at Salesforce or Workday or ServiceNow, all these are platforms. And nobody goes, went back and said, wait, I used to have this done with seven systems. Let me go back to the seven because it was easier there. It never was easier. You just have to work people through their objections and through their capabilities, through their challenges and say, this is a much better outcome for you. So we're on the early part of our journey, but we believe that is the future of this industry. And the good news is, since we announced that, I think it's fair to say, whether they have it or not, many of the industry peers have chosen to start saying we have a platform.

36:34So clearly, there's something here where they believe they need to be a platform to be able to succeed in cybersecurity.

36:45Nikesh, let's move on to your personal journey. So you grew up in India. And how did you end up in the U.S.? Oh, I grew up in India. I got an electrical engineering degree and I wanted to go to business school and I applied to a few in the United States. At that time, it was very hard to get to the U.S. for business school because there was foreign exchange regulations. You couldn't really pay. So all that stuff, we overcame those hurdles. And I was privileged to be offered a place at Northeastern where they chose to pay my tuition if I taught computer science, which was a very emerging field at that point in time.

37:23It didn't literally, 1989 was the, I'd say 87, 88 was when they started using that as a specialization in India. And I actually was an electrical engineer. I was not even a computer science engineer at that time. So I spent the summer brushing up my computer science so I could come and teach it. That's how I came. I went to business school at Northeastern. Why are Indian CEOs so successful in technology? Well, I think there's a selection bias. We're looking at, you know, we're 16 % of the world's population, so that's not a bad start. But I think if you look 30 years ago, the only way for us to be here in the U.S.

38:00was we had to go through significant, let's say, educational hurdles to make it. Like you weren't allowed a visa in the United States if you weren't academically brilliant in your field. And given the economic disparity between India and here, a lot of us chose to look for greener pastures and we came here. So you have a large pool from a globally trained engineering population to choose from. And I think from then on, it was Darwinian. Some of us kept making it through the various hierarchies of organizations. And the Indian guy must know how to code. So there are a lot of us who are in technology.

38:40And I think I'd say even the technology sector really has grown tremendously in the last 30 years. This is where all the opportunity was. So I think it's a confluence of circumstances that allowed all of us to be here. And there's possibly something in our resilience and our sort of going down the engineering and academic path. I mean, some of you don't really code personally anymore. No, we don't. What's the Indian leadership style like? What are the commonalities? is? Look, remember, we all grew up with scarcity. I think, so being resourceful has to come naturally to us. Because if I look at some of my friends and peers in the industry, I know the backgrounds of many of them.

39:32And we all share similar backgrounds. We all went to some sort of engineering school in India. We all came from lower middle class or middle class families, if you look across the board. And I'm just thinking of eight or 10 people I know in our sector who are legendary CEOs right now, they all have similar backgrounds. So we all have some degree of resourcefulness, some degree of scrappiness perhaps that comes with it. It comes with a very strong work ethic because you can't survive in a country with one plus billion people at that point in time if you don't have the ability to put your head down and work hard.

40:05When I went to engineering school, I think 100 ,000 people took the exam and chose 2 ,000 people to go those five schools that we wanted to go to so there's a two percent chance that you get in so to get there it was not just going to be pure luck it was going to be a lot of hard work and dedication i think every one of us went through that so there's a work ethic there's a resource fullness aspect i think there's a constant learning aspect to it you know none of us grew up with ai like you said none of us grew up with the cloud but somehow we've all managed to learn it i didn't grow up with cyber security we all managed to learn it so there is some degree of a constant learning sort of algorithm in there.

40:41Hopefully, there's a dose of ample humility across the board, because we're all blessed and privileged to be able to work in this environment and be part of a larger sort of, you know, cosmos in the United States to be able to sort of make our dreams come true. And then the rest is chance. How do you stay humble with all that success? Oh, go home to the family. They'll set you right in a heartbeat. It doesn't matter how successful you're going to work. You're still part of a family unit. And I think it's consistent. And I know some of these people, as I said, and their spouses. And they keep us grounded.

41:15They keep us focused on the right things. And I was chatting with somebody last night. I still hang out with my friends I knew in high school. It doesn't matter what I do for a living. And they don't really care what I do for a living for the most part. So just go back, stay with your family and your friends, and they'll keep you grounded. it. And as you know, it's not sort of roses and tons of love every day. There's a lot of grinding that is required to be successful in what you do. There's a lot of going back to the salt mine and sort of figuring out things from first principles. So I think that keeps you humble on a day-to-day basis, and especially with the enterprise world, you're constantly selling to people or telling you you're wrong.

41:55Do you think people underestimate what it takes to be successful in your business? I think every role, every job, and I always try and say that there's no comparison. Your challenges and my challenges, it's not a competition. It's our ability to cope with challenges and our ability to enjoy successes is different. And I'm sure a doctor has his own set of challenges and opportunities to succeed. And I'm sure a CEO has them. So I think that's more human than what you do, perhaps. The question is, how do you cope with it? How can you handle it? And some people can cope with it better than the others.

42:30And over time, you'll see that people who succeed and are gravitating to those things have the personality that allows them to find the right balance between doing a high-pressure job as a CEO versus being able to be sane when they're not doing it. If we look at the culture of Palo Alto Networks, do you celebrate success? All the time. Look, the pandemic was a very pivotal moment in my development as a human being and the development of our culture. I'd say pre-pandemic, I was very focused on learning the industry, understanding the industry, building a brilliant strategy for the company, because we had to find a way of not becoming part of the normal decline of a cybersecurity company.

43:12If you look at cybersecurity companies, they decline after 10 to 12 years, and they sort of take a sort of glide path, which is sort of flattish over time. And our job as a leadership team was to go change that and find a strategy that works. But, you know, the best laid plans of mice and men. The pandemic came and gave us a wake-up call because the strategy became almost incidental. What became important is how do you survive a global crisis of that proportion? And I'd say I lucked into it. I met this person who we brought in literally in the first month to come speak to us and our team. And he said, you know, the fundamental thing you have to think about is not your cybersecurity strategy, it's but the mental state of the people who work with you.

43:53I said, explain that. He says, look, right now people are in their heightened state of uncertainty. And when people are in their heightened state of uncertainty, Maslow's hierarchy gets disrupted. At that point in time, all they care about is certainty and predictability. And your job as a leader is to create that. Your job is not to talk about how you're going to win. Your job is to create that comfort and certainty that I am taking care of. And that really started my journey at that point in time, because I did, I think, since then, I've talked to 8 ,000 employees in the company on one sort of small group setting basis.

44:29I still do it. I spent a lot of time with people. We put in policies in place saying we're not going to fire anyone. We're going to make sure everybody's economically taken care of. And we didn't throughout the pandemic. Because our job was to create certainty. And that became such a fundamental basis for our success that it's pivoted into people matter. They're the backbone of the company. That's how we go win. And when people see that leadership is willing to step in and walk the talk, amazing things happen. You mentioned learning. What are you curious about for the moment? I'm constantly curious.

45:04And I think it goes to paranoia. Because part of the paranoia of being a leader is I have to find the right direction for a company on a constant basis. and the pace at which technology is moving it's almost like deer in the headlights syndrome right now right you wake up every week and there's a new development in technology and i say that technology but obviously we're talking about ai right now but look if you know you find out that somebody's building a 500 million dollar data center then you find out about agentic ai and you find out that there's a new chinese model which is much more efficient and runs differently then you say what happens if i have a dollar data center is that going to have a thing to do then you hear about protein folding in alpha gold, and you hear about image generators, and you hear about when you look on X, and you'll see all these people who are experimenting 17 ways from Sunday, and they're able to recreate all these things.

45:51Your brain boggles. It's like, okay, forget about understanding it. The question is trying to put your arms around the implications of this is hard. And that's just, in a way, in a positive way, it's fascinating because I don't think we've seen such technological turmoil in our lives. And it is scary, you know, because you ask the questions, who's going to be the winner? Where is this going to land? Because our jobs are to find the answers in this huge amount of, you know, excitement that's going on. So, yeah, so that's kind of fascinating. It's amazing right now. I think it's just unbelievable.

46:25I mean, I just wake up every day, spin out of bed, and just run to the newspapers. I mean, oh, my. I mean, you have the intersection of geopolitical upside down, accelerating technology. And oh, my. What's the first thing you do in the morning? Try not to grab my phone. Because you think it's been hacked? No, no, no. Because you're saying, wait, I've not had any information for the last seven or eight hours. I need to know what's happened in the last eight hours. And I'm pretty sure the first half an hour of waking up, I find my ways to my phone. But, you know, find my phone. When do you wake up?

47:05Around 5.30, 5.00, 5.30, something like that. How often do you work out? Not enough. Possibly three times a week if I can manage it. But I'd like to do more. But, you know, that's always a challenge. We never grew up working out in India. So it's an acquired skill that we have to go try and practice. And, yes. Did you have a mentor in your life? You know, Nikolai, my answer to that question is, Because I've had the privilege of interacting with some amazing people, and I've been able to use them for different aspects of my life. There are people I can talk to about my personal life. There are people I can talk to about my professional life.

47:43There are people I can talk to about financial issues, management. But it's hard. And I sort of, my principle is, it's very hard to hold one person on a pedestal and try and replicate their principles across every part of life. Because we're all human beings and we do some things better than the other things. So I try and find somebody for a certain thing that I find amazing. And yes, so have I had people who have been able to mentor me on individual topics? Yes. Have I had a sort of an over-encompassing Uber mentor? No. How do you relax? Play golf. um hang out with my kids they're nine and eight and goes back to that humility comment and goes back to you know bringing you back to basics they do that wonderfully well we spent yesterday afternoon watching my nine-year-old play football and he was very excited we spent half an hour talking about his football and i went to watch the basketball game on on uh friday night that was amazing so yeah what do you read i struggle to read um i'm more of a summary person than a read person because it comes from the principle of flip side.

48:50People have asked me, would you write a book? And I'm like, why would I take 500 pages to describe what I could in 10? And I think the opposite applies. Why would I read 500 pages to distill 10? Well, if you're a summary kind of guy, you've got some pretty good tools lately to help you, right? Exactly right. Exactly right. Look, for not trying to engage my brain a lot, I will watch a lot of Netflix shows to see what the world is doing. And some of those are you know, nonfiction that allows me to learn, but I struggle to read 500 pages. I can't keep my attention that long. What is your advice you have to your young children?

49:25Well, actually, not only young, but because you also got a grown up, but the three of them. Look, at the end of the day, they're all going to have to find their own path. So my job is to make sure I allow them to experiment and encourage their natural instincts, because, you know, It's kind of bizarre. It's such a complex combination of personality traits and innate desires that come into a human being. So it's very hard for me to tell my kids. Most likely, if I tell them what to do, they're probably going to do something totally opposite just to prove their point. So I try and encourage their experimentation in life.

50:00I try and encourage them in what they're trying to do. My older daughter, who's 27, has alighted on venture capitalism career by watching people around me and having lots of conversations. But it was important for it to be her decision. And she made that decision independently. And of course, she comes and spends a lot of time with me talking about companies or talking about how she should think about life and career. And we talk about it. But I try and make sure the decision in the end is in her hand. Now, of course, being a father, we're all trying to influence it. But she's smarter than that.

50:28And same thing applies to our younger kids. You know, they're young. They're nine and eight. Right now, it's for them to explore and explore their passions. My son wants to be an NBA basketball player now. We'll see. We shall see. Nikesh, it's been wonderful talking to you and a big thanks for protecting us against the bad guys and please keep up the good work. Well, thank you very much, Nikla. It was lots of fun and congratulations on what you guys do as well. Thank you.