The Impact of AI, from Business Models to Cybersecurity, with Palo Alto Networks CEO Nikesh Arora

23:52Yeah, and there's a few different sets of them because there's also the ones that are just trying to automate human services that are associated with the security world today. And so pen testing would be one example where you often hire external consultants to help with that. SOC may be another one where effectively you have this, you know, you're basically looking at the operating center across all the different events that are happening and trying to automate that. So it's a little bit more of a human labor. So the reason you're trying to automate the stock from the outside in is because you're not running 10 ,000 machines, you're running models at the ingestion point.

24:22Why should I first collect all data, analyze it after? I should analyze the data and cross-corporate it at ingestion to make sure I understand the bad things and I put them up there and then say, I am going to, and then build agents to investigate the bad things. Yeah, yeah. Well, this is my question of, no, the environment in a large enterprise today is still very fragmented, right? They're just doing this, you know, pass the hat trick that you're describing with all these different tools. Hopefully they're very dominated by yours. But as a lot of mentioned - Chosen by customers. Yes. Dominate is a bad word.

24:52Chosen. You work once in a large company, you understand - Gently chosen. Gently chosen in a highly competitive environment. That's right, yes. Of course. But like, you know, I was talking to a friend who runs security at a large financial and he's like, we have 180. So if he wants some cybersecurity? He's definitely got some power. All right. So he wants more. Okay. But he's got 118 identity tools, right? Wow. I didn't think there were 118. There's an identity crisis. There we go. Well done. There we go. Gotta try. So he bought an identity company. He just told that. All right. Maybe the answer is just make it all CyberArk.

25:26But I think his view is like, it's like just untenable for me to consolidate all of this in the near term. Yes. And so I'm going to attach something after, which does the human consolidation, like the silk automation thing, right? The interesting part is, we're the youngest industry in technology because cybersecurity did not exist before connectivity came about. Nobody had to, like, you know, you were in a mainframe, you sat in the office, you connected the mainframe to a pipe into the backend and you're off to the races. So nobody actually was going to come and intercept your traffic. It's not scary before the web.

25:57That's right. So now the web and applications out there made it serious. It's a 25-year-old industry. So every time a bad problem showed up, somebody built a point solution to solve that problem. So it is a fragmented architecture. It's a fragmented environment. There's a lot of data being used and analyzed multiple times on multiple vendors because they were needed for that point in time. But like any industry, that capability commoditizes over time. There's no genius in building a firewall. Every firewall within plus or minus 10 % does the same thing, right? Some things do it better. The question is, what do you add on to?

26:29what capabilities can you do build beyond that? So if you believe that, sure, Nikesh, 80 % of the capabilities are going to be capabilities that even most companies still don't have, and they can be delivered in one platform. On the other 20%, we can put add-ons, but over time, you know, we will eventually come and gobble those up because there'll be a new 20 % bill. Until one year ago, nobody was talking about AI security, right? Now there are probably more companies than you can count who all show up at Eli's house and say, please give me, and you, say, please give me some money. I'm starting a cybersecurity company for AI.

27:01I do prompt injection. I do malware checking on models. I do model data poisoning, agentic attacks. None of the same thing existed. So of course, you'll find people building features to protect against those because we're too busy still fixing the problems the last five years where the mass market problems are. So I think over time, what you'll see is the platform approach is gonna sort of eat into these feature approach that's happening. And there are companies with Cobalt Court out there as well. So 118 vendors sounds like a lot. I didn't know there was 118 vendors, to be honest. He might've been cybersecurity vendors, which I can believe is just also a lot.

27:35What new problems from AI do you actually pay attention to? You say like, this is going to be a mass market problem. Look, I think if you back up and read our own doc, would believe our own rhetoric. If you believe your own rhetoric, then I, as a bad actor, should be able to unleash agents against the enterprise, against every aspect of it, and figure out where the breachable parts are or where the holes are in a quick matter of minutes or less than an hour. And I should be able to point my attack towards that vector. I should be able to run simulations on how should I attack this thing. And I should be getting an exfiltrator data.

28:17Now, when I started seven years ago, the average time to identify a target, get through it and exfiltrate data was in the three to four day timeframe. The fastest we see right now is 23 minutes. So if the bad actor can get in and out and exfiltrate data or shut down your endpoints with ransomware in under an hour, then by physics, your response time has to be less than an hour. The average response time is still in days. So from that perspective, the biggest threat that AI brings is that it continues to compress the timelines to be able to come, you know, either shut down your business, cause a compromise, cause ransomware, cause economic disruption.

28:59If that's what it is, I think the pressure just went up higher on our customers to get their infrastructure in order. So that's the risk and the opportunity. Yeah, I think Alad mentioned pen testing, which hasn't traditionally been like a very strategic part of the security landscape. Yeah, pen testing is just to knock down every part of your defense. I think half the companies don't do pen testing because they're scared of what they'll find. Yeah, they're doing some minimum compliance level. But I think from a technology perspective, to your point, like what is pen testing is trying to attack the area.

29:33There are companies like RunSybil now that do this. They can do it continuously in the 23 minutes you described. And I'm like, that's exactly what an attacker would do. We run 7x24x365 at Palo Alto. We don't hire third party people. So what you're talking about as a company, we've done that as a default because that's our existence. If we get compromised, we get breached. We have a problem. Yeah. You mentioned email. I think it's like a well-known issue that a lot of the breaches, they happen because of social engineering, because of email, because... Credential takeover. 89 % of the attacks happen because of credential theft.

30:06Right. Somebody becomes you or me. Okay. So people like us are not getting any smarter. And now you have models. Come on. Ah. You try 1 % a day, right? Tom and Katz. But now, how concerned are you about deep fakes and generated spear phishing and voice attacks and all that stuff? So to the extent they enable the act of social engineering, yes, those are concerning because I think most forms of two-factor authentication are going to be out of the window. I still won't say which bank is going to go to Coca-Cola, but I call them and they say, oh, can you please confirm your identity? and they asked me three arcane questions, which I'm pretty sure chat GPT or Gemini will be able to answer in some seconds because they're only scouring the web to find public information about me and ask me questions.

30:53So I think all those forms of authenticating who you are are getting easier and easier to compromise. So the question becomes, so the problem you have to figure out is you can solve it their way or our way, as in the way they're looking at it or the way we're looking at it. At the end of the day, every one of these social engineering attacks, credential takeovers, eventually initiates some bad activity in the enterprise. And the bad activity in the enterprise often takes on the form of what I will call anomalous behavior, right? Suddenly Sarah decided to exfiltrate all the data in Elad's company, even though she used to do email with him every day.

31:35Today, suddenly she's logged in and she's downloading everything onto her laptop. This actually happened last week. Thank you. It did. Great deal flow. Is there nothing suspicious than that? That sounds pretty suspicious. So I can spend my time trying to make sure that nobody can take over Sarah's identity, or I can make sure that if Sarah doesn't act anomalously, and if she does, then I throw it in a block at that point in time. So I'm looking at life a different way. That's why we're buying this identity company, because identity companies today say, oh, I checked you in the door, you're fine.

32:05And now you can roam anywhere in my entire enterprise and do whatever you want, because you were checked into the door. Well, that kind of, that doesn't work anymore. I have to make sure that I, now today compute and data and AI is going to allow us to analyze all anomalous patterns. And if I could say that, that's pretty weird. She would, she'd never done this in last seven years. Why is she doing this now? Does she have the rights to do it? And I could do just-in-time rights. I can stop you from accessing this stuff. So you have to chain the name of the game. You can't do it the same way. So the whole idea of us buying an identity company is to think about life saying, stop giving people persistent rights.

32:39Give them just-in-time rights. give them rights which are analyzing for non-anomalous behavior. In fact, what I want to do is I'm like, I actually don't need you to give me a second factor authentication. I can see the way you type. And if your identity starts typing differently, I'll block you. One of the things you've done incredibly well at Palo Alto over time is really starting with the core set of products and then expanding and really providing both the platform and the add-ons that you mentioned. Was that something that you came into the company knowing that you wanted to do? Is that something that you ended up adopting over time?

33:09I'm a little bit curious how you thought about that puzzle. Well, you and I have worked together before, and I remember you had Google, a smart young man, and that hasn't changed. I came to Palo Alto, and I just analyzed the business problem, the product. So I came with two things. One, I understand business. Two, Larry told me many years ago that if a technology company loses sight of the product, it decimates over time. And that's been true across technology. You can take your pick across the tons of companies which haven't made it. The business problem in enterprises eventually, if you look at an enterprise company less than a billion dollars in revenue, 50 to 65 % of cost is cost of sales, marketing, and customer support, which leaves no room for margin.

33:53If you look at the largest enterprise companies, that number goes to 30%. So actually, it's all about taking that 70 % and bringing it down to 30, because R &D, G &A don't change a lot past a billion to 10 billion or 100 billion. You still maintain 12 to 16 % of R &D cost, and you still maintain, if you're like efficient, like some of the large players in the market are 4 % GNA or you're at 6 % or 8%. So your maximal leverage comes from sales and marketing, customer support and marketing. And you realize, well, what is that? That is the ability to convince one customer that you're really good at what you do and be able to expand in that customer's environment with that trust, that you can do more and more things for them.

34:30So that's the insight it came in with saying, why is it that Sarah's friend has 118 vendors who's in their infrastructure because each of them gets vetted. We'll see, this is security. It's not like buying some random thing on the side. There's a big procurement process. And there's a testing process, right? Because you could be a bad security actor and it could take my whole enterprise down. So if you go through that entire process of validation, verification, and trust, why shouldn't I take that right that the customer has given me, earn their trust, and expand my capabilities across the platform?

35:01So that's the insight we came with and realized. We walk in, we have to sell firewalls. Hey, you want a firewall? Oh, no, I'm sorry. I'm good for the next five years. Oops, I had a sales guy. He was focused on the account. That was his target. He spent three months getting a meeting, going through the process. Now he doesn't have anything to sell them. So I'm like, you don't want a firewall? You want this? You don't want to get this? You want this? Eventually enterprise salespeople have to have enough of an offering set that allows them to be able to sort of present something to the customer. The good news in cybersecurity is always some transformation going on because some technology is coming to its end of life form and the company hasn't innovated and you're off to the next set of companies.

35:37So that's the insight that came with. Yeah, it's a great insight. And if you actually look at the margin structure for some of these things that you mentioned, sales, customer success, et cetera, or support, a lot of those things now have AI apps that are making people dramatically more efficient. What do you, do you view the future of those sort of functions being very AI enabled and AI heavy? Or how do you think about that transformation across companies like Sierra, Decagon, Rocks, and others? Yeah, I think I'll answer the first out of the question. The second out is your domain and Sarah's domain.

36:04and I'm gonna leave you to answer that question for him because I don't know the answer to the other companies. But I think, look, if you fundamentally look at it and look at organizational efficiency, perhaps the best word people are scared of AI-based efficiency. I seriously doubt that an AI agent will convince the CIO or CISO faster than my human that goes and hangs out with him and shows him the product. So I think my sales teams are very happy in their existence. They don't believe they're imminently threatened by AI. So that's a good thing. And interestingly, on the product development side, I think people will be...

36:39Just to come back to that, sorry to interrupt you, but there's other forms of sales enablement, you know, a deck per customer that you customize or... Yes, but those are... Sort of SDR or sort of... Yeah, those are marginal. That's process efficiency, which will come through it. But, you know, guess what? Before we get there, I'm probably going to need, you know, 15 AI savvy people to build the workflow because an AI model is not just going to spit out a Palo Alto SASE proposal by itself. It's going to have to be trained. Do you think that's customer segment specific in terms of leverage you can get?

37:07So a lot of people think, for example, the SDR level seller where you're sending a bunch of emails out or you're sort of cold calling or doing things like that, where it's a lower ACV customer. Yeah, but I think that's only one side of it, right? Like if you stick to SDR, we'll go back to the other problem in a second, but stick to SDR, what point in time does my email start getting read by an agent, which is called the block all SDRs, block all people trying to sell me shit. Because I'm overwhelmed by the number of people who think they should write to the CEO because they have some company which has five people who are automating something.

37:39So I think there's a... That's interesting. Does that actually decrease the effectiveness of those sales teams over time then? In other words, if effectively you have agents screening things, does that create a block for certain types of sales leads? Well, I think the question, the sales lead isn't the issue, right? The question is generally either I have a need, I know it, in which case, hopefully my blocking agent knows my needs and eventually says, ah, you know what? Actually, we've been looking for this thing and here's an email which satisfies our thing. So maybe that'll do it. Or as we do in marketing, you never need a new watch and you never need a new car, but you just buy it because somebody put it in front of you.

38:19I don't think it happens that way in enterprise. So we can't generate demand for something we don't know we have a need, but sometimes you can in cybersecurity. So look, I think those will be marginal efficiency outcomes because how many STRs do you have? Eventually you do the selling. We do lead generation. We're in a large enterprise business. We go through a large rigorous testing process. So yeah, I can get a phone call. But if my product doesn't show up, then it doesn't matter how good the lead was. It's interesting because I haven't thought of it as just like becoming, you know, if we have agents doing this sort of low-level communication first, It just could become a more efficient market for finding the problem match, right?

38:54Yeah, maybe. So I think if you go back to the organizational efficiency question, and I was talking about CFO this morning, I was like, when are you going to take a whole bunch of stuff that you're doing with human beings and replace them in some form of, you know, at least 50 % efficient agentic analytics or apps? So I think we're going to get there. I think the max replaceability will be in, let's call it, administrative areas. I have 200 people doing documentation. Do I really need 200 people doing documentation if models can do 90 % of the work? I probably need AI savvy people to write the guardrails around these models and templates and they can print them.

39:29So we'll find some efficiency, you know, pick your number, two, 300, 400 basis points of efficiency. The larger you are, the better you are because you're gonna make, you're gonna save more money. I think sales doesn't change as much. I think product innovation is the better companies will innovate faster. I have technical debt. I'd love to get rid of a whole bunch of sales or a bunch of SAP code that I have and get it more efficient. I can't find good people to go to it because nobody wants to work on it. They're all working on AI. So can I get some version of, you know, agentic AI apps that are gonna get it of a few hundred of those people?

40:01Great. So I can get inefficient product development ideas out of there, but I'm not gonna let go of any good product person because I'm gonna get them to move faster because that's my competitive edge. So I think we won't see as much attrition in the bi-coding outcomes or the product development outcomes, we'll just see faster innovation. So basically the statements of AI displacing all of human labor, that's very overstated from your perspective relative. I think on those two segments, I think customer support will have to go through the revolution. And what I mean by that is I always joke internally and tell my people, customer support exists because we build bad products.

40:39If you have great products, why would you have to have customer support? It's complicated, it's hard to onboard, It's got too many dials, and that's why it takes me so much time to make it. And then eventually it's not efficient. So we have most recently moved customer support closer to our product teams. I told my product teams, the day you have a bug, or the day you have a customer issue, because the product issue, fix that before you build a new feature. So I think in concept, from a North Star perspective, we should be able to take 80, 90 % of customer support out in the next two to five years across the landscape.

41:12That's what every good company should aspire to do. And when you take it out, it means your product quality should get better. If I'm really using a good Vibe coding agent, why shouldn't it write better code? If it's writing better code, why shouldn't it find flaws in my code much sooner? Why shouldn't it run simulations? So I'm expecting product quality gets better. I'm expecting the fixes come faster. I'm expecting that we can diagnose the customer's problem with data as opposed to humans calling and asking all those questions. I think there's a lot of anxiety from engineering leaders that the product quality is not likely to get better.

41:43There's just going to be way more of it. More bad quality product or more product? More, just more product, right? That doesn't mean it has to be bad product. That's fair, yeah. I think the combination of generated code that people are not fully understanding from an architectural point of view, fully reading and reviewing, and that volume overwhelming, like the processes that we have today in software development is an anxiety. But let's barstead for a second. it is the worst right now that it's ever going to be exactly it's only going to get better so you're the most optimistic security person i know that's great is that am i restricted to being optimistic in security well it's not like a super it's not a super optimistic group i'm just saying look i think at the end of the day being one of them we have to do best we have to do the best job where we can and eventually life takes over so it's fine but i think from a from a quality perspective, anecdotally, I have seen examples which have huge promise.

42:42I've seen an Ipe coding agent find a vulnerability in security code at Palo Alto, which we wouldn't have found unless it was out in the wild, which is a good thing for us. I've seen it take 500 lines of code and come back with 75 lines of code, which would be much more efficient in doing the task that 500 lines of code is doing. I've seen it come back with code explainability, which was written 15 years ago, we can't find the person who wrote it. So there's some amazing examples of what the art of the possible is. Now, if that's just what we get today, I think one, two, three years from now, that stuff's going to get better and better.

43:14So from that perspective, do I believe product quality gets better? 100 % believe that product quality gets better. I don't think there's any debate in that topic, right? Now, it doesn't, look, there is no solution for stupidity in the world. So if you don't have good people reviewing this stuff, then yes, you can end up with bad articles, It's not because AI is bad. It's because you didn't set up the right card rails, the right process to do it. So I think we're going to get good quality outcomes. I think we're going to see better and better capability. I think the most vulnerable area in any enterprise are large amounts of humans doing repetitive tasks, which are either generic, which is the easiest to replace because everybody's doing them.

43:54We don't need to do them. Or even if they're specific and have critical mass. If I have 2000 people and customers support, I should be able to optimize a lot of that and hopefully deploy those people in much more meaningful things. I mean, imagine, I have a child, you have children. Do you really want them to grow up and become customer support people? And say, every time, what do you do? I just pick up the phone and listen to somebody grumbling on the other end because something they bought is not working. That sounds like a really horrible job. So I think those jobs should go away. What's wrong with that?

44:18And they don't have the power to fix it. Yes, that's worse. It's like, you know, it's getting punched in the face and not being able to punch back. Because if somebody's taught them, customer's always right. Can we talk a little bit about leadership? You're a very unique leader. So this is a time of like at least a handful of companies growing very quickly because they create trades in billions of dollars. Yeah. Yeah. Well, and like, you know, an optimist myself, I'd say like AI wrappers or not, they're creating a lot of value and consumers and enterprise are buying very quickly. Yes. Google from 2004 to 2014, Palo Alto, seven years in, you've added like the size of a Palo Alto originally every single year since in terms of enterprise value.

44:59That's wild. Like what makes you a great leader in terms of growth at scale? Like what do you, what advice do you have for some of these people who are like, Guinness Book of World Records in terms of growth the first few years? Look, if you step back, it's interesting. every business that you've identified or you've looked at we've talked about has a much larger damn than any of these companies is able to touch the the markets are growing you have the opportunity to take share and grow in that market so i'm a huge fan of growth businesses i hate the idea of going restructuring something which is on a declining curve it'd be sort of scare me so it's good to find the right market from a growth perspective i think i always have this principle but nobody wakes up in the morning and goes to work to screw up.

45:46Nobody wakes up saying, oh, shit, I went on my worst job possible. No chance in hell. You know, you can find people. You can get a group of people together. They can be innovative as hell and go put, you know, a rocket into space faster than NASA. These are all humans. They're all people out there. There's no difference in many of them than people who work at Palo Alto or people who work at Google or elsewhere. So what creates the difference between great companies and companies that are not as good? because I'd say within reason, the people, you can find those people in every company. I think it boils down to understanding the market, setting the right North Star, getting enough buy-in, talking about the why, not just the what you need to get done and getting people really excited and bought into it.

46:29And then making sure they have the resources to get their tasks done. If you do that, then my job is just like, set the strategy, set the North Star, put the right people in place. and then basically act as their shield and keep blocking bad things or friction from slowing you down. So if you can do all of those things in a way, there is a high probability you can create good outcomes. Never guaranteed. Are there any unique structures or approaches or tactics that you do that go against the grain? We've talked to Jensen a few times and he's pointed out, for example, he has like 40 direct reports.

47:00He doesn't do one-on-ones. I actually read that. I actually tried. I actually expanded my staff meeting from eight to 25 after I read that about Jensen. It's interesting, and it solves a different problem. At least for my case, I've discovered that I'm not always sure that these people communicate the why to their teams. It at least eliminates one level of confusion. Why does he want this? Oh, actually, I heard him directly. This is what he wants to get done. Because sometimes, you know, you have this notion of you have to be a player, you have to be coach. Sometimes you have to be directive. Sometimes you have to be, you know, encouraging.

47:30It's like, we're going to climb that mountain. We are going to climb that mountain. And it's like, you know, if you go back, so we're going to climb a mountain. I promise people end up on that one. So it's important for people to understand the communication parts. And I've discovered that communication actually is underrated in organizations. And usually the way I do my sort of call it 360 degree test is I meet 50 employees every two weeks and ask them questions. Then I discover, oh my God, these people are asking questions, which I thought was abundantly clear why we're doing this, what we're doing this for.

48:03and discover eventually that by the time you get to the person four or five you know levels removed from you they actually don't understand exactly why we're doing certain things they have fundamental questions around what we're doing and that causes them to do it differently or not do it so that becomes sort of an issue you asked me about you know what do we do what have we done differently compared other people i think communication talking to people making sure they're all bought in but But I think from a business strategy perspective, we've taken a very different approach to M &A. We bought 27 companies so far.

48:39We're about to buy our largest one if we get approval, get it done. And I don't call it M &A. I call it product development and research in a highly innovative market where all of you guys are kind enough to support innovation. It's distributed R &D. Exactly right. distributed R &D. We're in this service for you. Well, you guys do reasonably well for that. So, you know, you can say thank you and I can say thank you and say, if you don't win and I don't win, if you don't win, I don't win. That's fine. So we're happy to be in a situation where you get to a certain stage and we get past that stage and take it to scale.

49:14Because I don't believe we have all the smarts in the world. There are lots of smart people out there who are trying to solve different problems. And I don't believe we can solve all the problems simultaneously. We take AI. You know, we started off saying, oh my God, when AI gets deployed, enterprise is going to want to make sure that their AI instance is clustered and controlled and managed because they don't want data leaking, they don't want external inputs, so we built effectively what we call an AI firewall. It's great. And we discovered this company, you know what? People are actually trying to figure out these models that they have are hackable, have malware in them, so we weren't doing that.

49:47We were just protecting them once they were in there. So this company called Protect.ai, which was actually assessing models. They were doing persistent red teaming against the AI models specifically, not just the enterprise. because, you know, going back to your comment on red teaming, models morph. Their responses are non-predictable, non-deterministic. The same model could answer the same question one way today and could answer it differently one week later because it learned. Now, if you start getting non-predictable responses, you have to inspect all the responses to make sure none of them is malware.

50:17Yeah. Right? So from that perspective, we do persistent red teaming of models. We do scanning of models. So we said, oh shit, we haven't done it. We found this company and we said, thank you very much, the VC community for delivering that from an R &D perspective and put them part of our platform. So we do rely on, like you said, R &D as a service from the VC community. And that's been very helpful. But we always go for number one or number two. We never believe that you can take three or four and spit and shine and make it look like one or two. Because one or two don't go away. They trade as one or two for a reason.

50:48We more often than not make the leaders of the acquired companies, the leaders of our business because we believe they've acted faster than us in a much more resource-focused environment, shown a tremendous amount of resource, well-versed and hustle to deliver the outcomes in innovation. So I think from that perspective, we probably have a higher hit rate in the industry than most other M &A that has happened in the enterprise space. So I think we do that differently. You, at the beginning with Palo Alto and continued today, like have been perhaps more ambitious than any other security company.

51:23Okay. I think that's right. How do you convince an organization to be more ambitious? Because my understanding of the cyber industry before is you had like endpoint businesses, firewall business, very sort of domain specific, right? I don't think you have to convince humans to be more ambitious. I think we are natively and naturally ambitious. Like you meet somebody and say, can you do more? I've never heard somebody say, I think I'm done. Like everybody says, I want more, I can do more. We live in a consumptive society. We're all taught to aspire for more. So I don't think it's hard to make people at Palo to feel that we have the right to play at a bigger table on a constant basis.

52:04And people actually like the idea of ambition and aspiration and winning. Like, you know, trust me, if our stock wasn't up six or seven times in the last seven years, a lot more people internally would have questions on our strategy than they have now. So I think it's a self-fulfilling prophecy. It's a good thing across the board. But I think more fundamentally, if you step back, our industry is not fully formed. It has 118 vendors. It's fragmented. You take a look at the CRM industry. Look at the ERP industry. Look at the HR industry. These things operate on single platforms, right? Nobody has two sales forces deployed in an enterprise.

52:40Nobody has two workdays deployed in an enterprise. Nobody has two SAPs deployed in an enterprise. Why? because you need end-to-end visibility, a singular workflow, a singular set of analytics to solve the problem. Our industry has started off because, oh my God, we have a threat block to threat. You know, don't worry. So like we were playing racamole. So the point is, as I said, over time, as these requirements normalize, they somewhat sort of, you know, what do you say, converge in the capabilities of vendors, then how does it matter if you take from one versus the other? What becomes more important?

53:14And all these platform companies I talked about, it's not like they have unique features on a feature-by-feature basis compared to the competitors over time, those have normalized. But what they do have, they have an end-to-end visibility and capability that integrates the functionality. That's why they're there. So if cybersecurity has to survive in the long-term as a mature industry, we also have to become sort of a singular enterprise platform. If you believe that, we're over there, right? We've taken, we used to have 24 products when I came. We had four when I came. We took it to 24. We had 44 magic quarter and stop right mentions.

53:47We've turned that into three platforms. And I say, you know, if you're going on a journey with us, it's going to take you two to three years to get a platform deployed. We're three right now because had we said one, oh my God, oh my God, your friend can't go from 118 to one if I can boggle his mind. So let's take it to three first, so one or three, and hopefully get him to the next one and get him to the third one. So I think the idea from our perspective is if we can become the platform of choice in the industry, that's a very big ambition a very big North Star. But it's like, you don't get there if you don't start.

54:17Maybe when you look forward both, okay, Palo Alto, cybersecurity, AI, three questions. What keeps you up at night? What do you think most about? I think most about AI. Not, I'm glad we think about, it's something you do. I think more about AI from the vantage point that if our view of the world, of how this is going to evolve, is not within the guardrails of where it's gonna be, you may end up taking Palo Alto in a different direction. Because remember, we exist to help you secure technological advancement in a certain direction before you're fully deployed. I wanna give, like in today our conversation with some of the big cloud providers was, how is everybody thinking about agent care?

55:05I'm supposed to secure agents. The problem is, I can't get one person to agree with the other person's definition of an agent. I'm like, what's an agent? Well, are you going to use MCP protocols to deploy? Well, no, we just have connectors. What's a connector in LLM? A connector is effectively API call, microservices call. Why are you using API calls? There used to be called API calls in the past. Why aren't you using MCP server client and clients? Well, we're going to get there, right? Well, are you, how are you going to do an inspection of identity? Are we going to register the identity somewhere else?

55:35Like, what's an agent? How are you going to run it? Is it going to be delegated? So there's like so many questions from an execution perspective, from how the industry evolves, that it's not quite, keeps me up in mind. We talk about this every day. We have a team of people getting together every day for two hours and we read everything. We didn't talk about it saying, what do you think about this? What do you think about that? Because we don't have an expert, then hopefully the collective wisdom of six or seven smart people, those people who I bring together every week, every two, three times, is probably better.

56:02So we're constantly trying to paint a picture of how the world of AI is going to evolve. So we're building our opinion. And based on that, or you have to design a product. So that's extremely bleeding edge, right? And if you wanna be the cybersecurity partner of choice, we have to be able to go with the bleeding edge capability and tell our customers, look, you have a problem, we're solving it faster than anybody else and we can help you deploy AI securely. So that's kind of what, it's kind of exciting, a little bothersome because, you know, you gotta keep understanding, you gotta think, holy shit, were they just here?

56:36We'll do that now. Yeah. As you've been thinking deeply about AI, have you thought about it from a broader societal perspective, impact of the world? Like there's other specific threads that you think about most or worry about most or optimistic about most? I'm going to stick with Sarah's characterization of me as one of the more optimistic people about these things. I'm going to expand that beyond cybersecurity. Like, I think it's exciting technology. You know, you've been in Silicon Valley for a long time. You've been in Silicon Valley where you've been investing for so long. The intensity, the excitement is palpable, right?

57:07Like you can't turn around. It's really fun again, yeah. It's really fun again, right? Like you're like, you can have dinners, you can debate all kinds of arcane topics. And I'm pretty sure you can find lots of people with different opinions. And there's so many different directions you can go to. You can talk about policy implications, you can talk about rappers, you can talk about LMS, you can talk about infrastructure. It's like a whole new technological wave which has so many implications and majorly disruptive implications. So from that perspective, I think it's exciting. Does every technology come as a double-edged sword?

57:33Of course it does. Every revolution in history has come as a double-edged sword. So why not this one? You have to believe in the power. There's more good people in the world than bad people. The good people will hopefully continue to make sure that the bad things get controlled. Now, is some bad things going to happen? Most likely. Are we going to find a way around it? Most likely and hopefully. We'll be powered through a pandemic, for crying out loud. Awesome. Thank you, Nikesh. Yeah, thank you so much. Thank you for your time. Appreciate it.

58:03Find us on Twitter at NoPriorsPod. Subscribe to our YouTube channel if you want to see our faces. Follow the show on Apple Podcasts, Spotify, or wherever you listen. That way you get a new episode every week. And sign up for emails or find transcripts for every episode at no-fires.com.