Palo Alto Networks CEO Nikesh Arora on cybersecurity in the age of AI | E1806

32:00Fascinating. Well, think about it. There's 1 ,000-plus models out there in open source, right? So you can get Google to be responsible. You can get OpenAI to be responsible, Lama to be responsible. How are you going to take care of the long tail? How are you sure that any of that long tail model that's going to sit in an NVIDIA box somewhere running in some basement is going to have the guardrails you want it to? So we've been able to jailbreak them. we've been able to get them to write malware or write attack vectors, which then we run against our own products in the lab and we keep telling them how we block it.

32:33So we see how many tries it takes to eventually get through. Then we build antidotes to those and then we put them in our products. Fantastic. So it's no longer reacting to what happens at customer A to protect the next 999 customers. This is, you know, you've got patient zero here and you are doing experiments on them and you're seeing if they're inoculated or not, and it's all happening in a virtual environment, so there's, you know, no harm is coming to it. Yeah, but I think we're going to have to work hard with the industry to do that on a grand scale because, you know, we're not, I have not held the belief that Palo Alto is going to solve every problem.

33:08The good news is we are aligned with everybody in the cybersecurity space. We're all trying to make sure the bad actors don't get ahead of us. So I have no problem taking these malware antidotes and sharing them in the industry. I want to make sure that every product inoculates against them, not just mine. right uh why what why would you take that approach i mean why not give it only to your customers um and let them benefit from it so you get the revenues and then you can reinvest it and secure your customers why are you giving them out to other competitors well like i have other ways of creating a moat and other ways of creating economic advantage what i don't want to do is to hold the cure as ransom no pun intended yeah for the rest of the world have to buy my products right you could take another approach like licensing it or you know yeah but i also want the benefit of their their research and intelligence right i don't believe this is a singular problem i want to make sure that microsoft does it or crowdstrike does it or google does it that we all share in this common goal is it collaborative did you find it was collaborative when people find exploits solve for them do they quickly tell their cohorts and their compatriots hey you know we figured this out there's an attack vector or do people kind of hold it slow you know when people go for the check and they slowly go get their wallet do they kind of slow roll it before they tell you so they can get the max advantage of having it well there's two different scenarios right jason one scenario is that i've discovered a vulnerability in somebody's product right or my own product now of course there we there is a bilateral conversation we tell them listen we found this you want to fix it before we tell the world, right?

34:43Because you really don't want to, you know, you have to, right? And that's what happens in most, even public-private partnerships. There are certain nation states that won't tell you because for them, that is a future exploitable opportunity. But in most cases, let's just say 99 % of the case, that communication happens with some nuance, but people tell each other. I think the other scenario is that there is a certain attack factor. Somebody's figured out how to break into something. I think it's fair to say there's probably 10 or 15 high-quality research labs around the world, which are both private and public.

35:14And there, there's a very strong collaboration, something called the Cyber Threat Alliance, where people go and provide their solutions to everyone as quickly as they can. Because if there's an attack vector out there, you want to make sure that everybody's products are inoculated against that attack vector. How much of an impact? Yeah. Go ahead. Well, no, I get the alignment piece. And so how much impact has the SECs now kind of coming down on companies and saying, listen, they're kind of intervening, right? They gave a mandate, you have to report this stuff. And there's consequences. I know from some of the companies I've invested in, there were people who didn't report.

35:48There were CSOs who didn't report things. Maybe they had egg on their face. They slow rolled it. They tried to solve it before it came out. And now it seems like we got a lot of three-letter agencies who are now monitoring this. So what is the state of our government intervening, whether it's the SEC or others, and saying, when you have an exploit, we need to know about it? Because the incentive as a CSO or the person on the security team who messed up, if they, in fact, screwed up, if they have to go report it, self-report it, they lose their job or they could get fired. I mean, it's just, yeah.

36:25So, like, I think, let me give you a little bit of background on this. I still believe security is still broken. What happens is in 30 or 40 % of the case, I know a bad thing, I stop it. If I'm in your enterprise infrastructure, I see a bad URL you're clicking on, I see malware, I know it's bad, I stop it. When I don't know it's bad, I just find it suspicious. What I do is I give you the tools to save, and if it's suspicious, I'll send you an alert. The problem is I got organizations with 70 ,000, 80 ,000 alerts a week. They don't know what to do with them. that's the current state of affairs is most organizations get between 30 to 80 000 even 100 000 alerts from security events across their infrastructure which is like just noise and that's a function of the fact that the attackers can do very large scale attacks from computers or there's just a large number of them no it's just a function of let's just say that you know an organization that also says listen downloading one gigabyte of data is bad from our network but don't stop that download because it could be legit just send me an alert ah i got it so now i got like the rules so it's 80 000 alerts flipping around and i don't know if it's right or wrong somebody has to investigate it that was cool 20 years ago when you had 20 of these now you got 80 000 so and the reason i bring that up is what we've done is we basically said we're going to watch every bit floating through your infrastructure and we'll tell you if it's good or bad so we collect 75 terabytes a day at palo alto we analyze that we take those 80 000 alerts make them 200 events if they're real so we basically flipped it to an ai problem the reason i say that is uh i started giving a longer answer but in the industry there's something called mean time to remediate how long does it take you to fix a security event how long does that take on average yeah the average united states is four to six days four to six days yes the mean time to exfiltrate data today is 11 hours the hackers come in and steal too late yeah that's like me reporting my house got robbed like a week later in san francisco they won't care but they won't care anyway don't bother you could you could wait you can hang on to that one it's funny because it's true yes it is that's why both jokes are funny life for your in-house legal team can be so hard chasing down signatures pouring over contracts toggling between all the different tools the back and forth with the sales team it's brutal and legal stuff oh my god bane of my existence right there's just so much it's a deluge but it doesn't need to be that way all you have to do is use link squares it's the first ai powered end-to-end contract management solution what does it do it gives your legal and your revenue teams the tools they need to help sales close deals faster while delivering a seamless experience for your customers so you can create review approve and execute your contracts easily in one place while prioritizing tasks and integrating with the tools your team already knows and loves.

39:21Link Squares is where all your legal needs come full circle. Start streamlining your contract management process today and make life for those in-house legal people so much easier with just a few clicks. Learn more at linksquares.com slash twist. That's linksquares.com slash twist to start streamlining your contract management process today. And if you're not doing your contracts right, it's going to cause all kinds of downstream problems. Do it right. Linksquares.com. Back to the SEC. The SEC has put out a mandate that they must report in four days. Oh, which I think, yeah. So I think that puts the pressure on a lot of organizations because you really don't want to report.

40:02You are breached if you haven't fixed it. talk to me about this tension of the people who are responsible for reporting it are also responsible for um causing the problem in some case or not defending against it how does that tension get resolved in the industry are there groups of people who are responsible for reporting and then groups of people responsible for defending and they don't talk to each other so if something blows up they're not covering stuff up what's the best practice there i'm curious. Look, this rule is about two weeks old. I think what the SEC has done, SEC has put a gun to the head of boards and management.

40:43It's like, I don't care CEO, CFO, you are not following the rules if you haven't reported this. I think that's like no longer a debate because I think it's pretty clear to most organizations when they've been breached that they've been breached. This doesn't happen on the slide. You don't get an email saying we've locked down 10 ,000 of your desktops. You have ransomware attack going on. You owe us millions of you know when that happens and you know how to count four days from there. So I think the reporting is not the issue. I think the bigger challenge is most CEOs, most boards don't know how long does it take for them to reliably block, stop, clean out a cybersecurity event.

41:23So I think there's going to be a lot more pressure and focus in trying to get that done sooner than later, which is good for all of them. It's such an after-their security, right? People worry about it after they've been compromised, not before. and so they're reactive so generally the whole ecosystem has to get an education from boards on down and take it more seriously yeah yes and that's where i said you know four five years ago when i joined palo alto we were an 18 billion dollar company we were in one swim lane today like you said we're now 70 plus billion dollar company we play in three swim lanes and our big underpinning and our big pivot five years ago was to focus on collecting good data across enterprise and applying ai so we at any point in time we have about a thousand plus machine learning models that run underlying our ai product to solve the problem and i think you know we're going to talk about ai but we did a big analyst here on friday and we tried to distinguish uh we're trying to figure out if this term will hold i call it precision ai versus generative ai so if you're if you're in your tesla you don't want it to hallucinate i thought that was a good return that's kind of like lifetime on somebody's lawn i'm on zucks lawn that's right if you're lucky yeah you're probably a room to slow down you're wrapped around wrapped around electricity pole is a bigger problem than zucks yeah but for sure that notwithstanding so even in security you need precision ai i need to be able to block an attack i need to know it's a real attack i can't start blocking legitimate things in enterprise while all hell will break loose so there's this notion of precision AI where you cannot afford to be wrong.

42:57Then there's this notion of generative AI where there are many right answers or many possible answers. I don't know. Right. Like, you know, show me a blue bird on a black background. Well, there's probably 200 different variants from great to horrible, which are all perfectly legitimate answers. Yes. Our business is a business of precision AI. It's not a business of generative AI. Is precision AI possible today? is because generative i like you're saying i ask it for five ideas for a blog post three of them are terrible two are pretty good then i ask it to take those two refine them give me some bullet points give me some sections and then i you know i polish the last 20 and oh wow i got a two great blog posts out for my corporate blog you know in 10 of the time okay great that was a fine process that's not the process of precision ai it's not the process of making a left turn or a right turn into an intersection, nor is it blocking security.

43:48So it's precision AI here. And I guess that's very verticalized, right? You have to narrow the scope in order to get to precision AI. Well, yes, I mean, look, at the end of the day, the precision AI, as you rightfully articulate, like, it boils down to first and foremost, owning data collection and making sure first party data belongs to you, right? You know, Elon is not going to rely on you and me sending a data feed saying, here's the data feed for all the traffic information that you can have It's like, no, I'm going to have every car that's out there assess it every second and go to feed into large AI system, process it locally, and give it the response time that it needs so that you can sit there and feel safe.

44:25So, yeah, it'll be there, but it'll be very domain specific. You'll have to own the first party data. You'll have to have full control. You have to make sure the models run the way you want them to run. And you're going to determine it every second. And you probably have guardrails and safeguards against actions that are taken post-precision AI. And it'll get very, very, very specific. Like, I'm pretty sure everything that Tesla does, all the gig petabytes of data they're collecting is focused on one thing, is one thing called driving experience. Similarly for us, we're collecting 75 terabytes in our own instance at Palo Alto.

44:56We connect four petabytes a day across our customers, and we only focus on finding the anomalies to stop bad things from happening. So precision AI will come. Yeah, it's exactly how Tesla does it. Like, now if your Tesla disengages, it asks you, describe what just happened. so as a tester in fsd full self-driving you hold the button and you say oh you know a bicycle went across the middle of the road and then that is what you know they don't need people on the 280 driving perfectly they need the instances where something weird happened and that's by definition what you're doing right and yeah so but i think on the flip side i think you know what we've been seeing in the last one year with open ai and this whole jerry i think i think this is going to be This is going to be so big.

45:39It's going to transform how we do technology. Okay, so this is going to open up a big can of worms here, and I think it's the next jump-off point. I wanted to get into the 17 acquisitions and ask you how you did those, but we'll put that on the side for now because this is, I think, a more important discussion, which is this technology has captured people's consciousness for about a year. You've been at it for years. Elon's been at it for years. You know, Google's been at it for decades. It's obviously ready for prime time. And so when you look at running your organization, what are the gains like inside of the organization right now?

46:13And then what does this do for the core business that you have? Because when you were talking about data, this to me seems like the greatest moat ever. Yes. tesla has two million cars i think on the road that have the cameras in it you can't buy a car without full self-driving on it you can turn it on or off if you want to pay the 12 grand or whatever it is but they have that data i think even in the cars that are not on and they have the right to pull that data you have all this data from all your customers collected this becomes a compounding moat and advantage over time does it not so let's separate i think the data just the case of tesla and for us is a precision AI opportunity.

46:50I think you cannot do precision AI if you don't control first-party data access, right? So the fact that he's got millions of cars which are collecting the data the right way is not something you replicate just because if you're GM or Ford, you don't have the data collection going on, you have the cars in the road. Similarly, we have 62 ,000 customers with firewalls who have been analyzing their data for the last 17 years. And obviously in the last four years more so, we have customers with 14 million plus endpoints on various different technologies. So we're collecting first-party data and delivering AI outcomes.

47:20That's on the precision AI side. And I think that's hard to beat if you haven't been doing it, if you haven't been collecting data. Many of our competitors haven't. I'd say there's probably four out of 3 ,000 who have tons of data and cybersecurity. And that's going to be sort of a race between those four. And we think we're still the largest and the most comprehensive route to them. So that's one side. I think the generative AI side is a whole different ball of wax. I think there's two, if you abstract it, the two best things that Generative AI does for you is one, it is phenomenal summarization.

47:53So take my last employer, right? If you did a search for what's the best restaurant in San Francisco, it'll give you 10 links, if you're lucky, maybe 20. Now it's your job to read through those 20 links to find out and parse and say, how many times did I see a reference to A, B, or C? And you could have mentally said, okay, it looks like A is the right answer. Now, what OpenAI is doing is reading all those 20 and saying, based on everything I read, statistically, I think this one is the most mentioned. Hence, it must be number one because it's associated with the word number one everywhere. So, it's providing you phenomenal summarization capabilities.

48:25And two, it is, based on all this training, able to talk to you in natural language. I think those are the two most interesting things that it does if you abstract it. If you take that and say, what does that mean for me and my organization? One, there are many use cases in my organization where there are lots of documents where we don't have good summarization and good sort of answer extraction out of it, right? I could save hundreds of millions of dollars in every enterprise if I figured that out. Yeah, for sure. It requires, like you said, it requires us to do that Tesla thing, FSD thing. Click here and tell me what happened.

49:02I get 300 ,000-plus customer issues a year. If every issue was recorded, I'd figure out how the solution was created for that customer. Anytime those things reappear, I can fix that using some sort of generative LLM underpinning that stuff. So that's kind of like logical. We'll see that explode across every enterprise in the world. It's going to be incredible. I mean, customer support, it's already happening. That's the perfect data set, customer support reps. There's tons of enterprise use cases where this is going to be sort of brute force, perspiration work, where data cleaning will be required.

49:35You'll get efficiencies. I think the more profound impact is going to happen on product development. Now, if you think about product development, we have spent our life in technology doing phenomenally good engineering work. Then we have these guys called product managers. What do they do? They take all that wonderful engineering work and say, how do I make it easier for the customer to consume? Let's design a UI for this. Take the travel booking example. I'm pretty sure all of us are trained. We can go to any travel site. We know you want one-way, round-trip. You want to have multi-stop, single-stop.

50:12You want economy first, business. And you have to fill about 10 boxes and out pops a set of options for you to buy a ticket. We're all trained now. We have been trained to interact. We're experts in doing those searches. Yeah. Yes. But some product manager actually designed that UI. That was their job. Yeah. They took engineering backend, built UI on front, and allowed us to interface. It's like learning a new language. Yeah, all of us can always plus can can envisage a scenario which says, find me a quick, inexpensive ticket from here to New York. I want to go this evening. Are we back, you know, day after and make sure it doesn't cost me more than$1 ,000.

50:49I can say that phrase. You can all imagine a generative AI LLM looking at through all the options and popping it out and saying, here's the options. Right. And you say two. Yes. And it books it. So what did I do? What did I do? I just eliminated UI. Yeah, the UI chat window. But if you take that and abstract that to the hundreds of thousands of companies and apps that are out there, I think 50 % UI vanishes in the next 5 to 10 years. Incredible. Yeah. Talking to a computer was like going to happen, Star Trek, etc. We were just going to talk to a computer and then the task would be accomplished.

51:28And then actually we're just on the cusp of that happening. But if you think about it, you know, people say, well, I don't know. So I say, well, when I worked at Google, there was this thing called a web page. We used to all interact with a web page. This thing showed up called mobile, right? And people said, oh, yeah, guess what? We're going to have to have a mobile presence. And I'll tell you, the first wave of mobile presence for most web-oriented companies was a diminished user experience. You couldn't do everything on the mobile phone that you could do on the web page. That was your primary interface.

51:55And then you saw this wave of companies called WhatsApp, Uber, DoorDash. All these things are mobile only. there is no web interface nope so i'm telling you in five to ten years we're going to have ai generative ai only ui with no mobile or web interface if that could happen in mobile it's going to happen with this and that's going to be very interesting to watch how many companies get sort of obliterated or possibly refactored because either all or half your ui is vanished yeah i mean i am an expert at finding restaurants and i use eater and i use yelp and google local and i was explaining to somebody how i find incredible places in tokyo and that i put them all on google map and then i share them with friends and they lose their minds because i've done all the work and ai is clearly going to take that little proud process that i have of finding whatever the hip new places in tokyo are from a bunch of bookmarks and it's just going to be totally abstracted um now if you have a good data set like you're saying then you could still be the winner or if you have the network so it'd be quite nice to just take your watch out and ask for an uber and it just knows where you are it knows what your preconditions are and it just works but right now i wouldn't trust i think over you can do that i think you can order an uber through siri i just don't trust it to do that um yeah well that's that's going to be a whole different debate is you said something very interesting what you said right you know uh i'll do the jumping off point you can tell me the answer yeah uh you said you can tell ceded or an uber so is it going to be the siri chatbot or the uber chatbot you're going to talk to i have a feeling it's going to be the uber one i think it's going to have more knowledge siri sucks i mean the question the question then becomes are you going to talk to 40 chatbots wow i mean i think you're going to have to have a comp maybe maybe they're yeah that's a really great question.

53:47You could have a DoorDash chatbot, an Instacart chatbot, an Uber chatbot, a Booking chatbot, a Kayak chatbot, or pick your favorite. I think they're all being built right now. And the Four Seasons chatbot because they all want their own. So now you've basically taken the apps and exploded that into a series of chatbots. Yes. Right. Well, there could be a meta one. So I think Claude and some of these ones that people are building are supposed to be your chatbot that'll interface with the apps and the APIs that are out there. we're going to have to have a whole new episode on that Jason because I don't know I think this is a battle it's going to be a battle of APIs because it hasn't been done before today most of your Spotify's, Instacart DoorDash are not opening APIs for action because they know if they open an API for action they've lost the customer interface yeah I mean that is the scariest thing to ever happen I was talking to somebody who owns hotels and he was just talking about their relationship with like the Expedias of the world yeah or rupert murdoch had this relationship with steve jobs where he's like you can't subscribe to wall street journal i need the person's contact info and steve jobs told murdoch you don't need the contact info and murdoch like looked at him he's like yeah i'm not putting my stuff on your ipad silliness if i don't get the person's name and and and to steve's credit he caved with um he caved with rupert murdoch and let him get the contact info we'll be back there with the battle of the chatbots yeah and this is i think yeah with the interfaces i see some people like i think kayak and zillow made like little plugins already but yeah i don't think let's take your let's take your tokyo analogy right if if you went to your favorite chatbot and booked a ticket for next week to tokyo somebody knows you're going to tokyo next week if your restaurant app knew that you're going to talk to next week it could recommend recommend restaurants for you next week but the question is who's going to have what data yeah see that's why i think the data provider wins when you were saying it and you were like everybody has a chatbot i'm like there's a group of 30 people at yelp right now building that chat bot there are a group of 100 people at amazon building that yeah yeah and my view is that That's why, again, distribution becomes very interesting.

56:03If I'm a phone, if I'm Apple, I still have some degree of influence on how all these things get shared with the customer, right? Because there's got to be some semblance of control. There's got to be some control of data in here because suddenly now you've got the same problem you had with 5 million apps taking your data and running away from a data privacy perspective. You've got 5 million chatbots that are going to do worse things to it than the last set of app guys were doing. interesting if you think about it right now you can when you talk to siri they built a plug into spotify so you don't go to apple music if he said you wanted to play a song it would automatically go to apple music now you can tell it hey go to spotify and so i think that's going to be it's very interesting that apple could intercept all that information they're going to just i don't know in a very microscopic way i think you know i have a sort of home automation app and until about a few months ago it had i could play songs from spotify and sonos now it makes me go to those apps it doesn't they've sort of restricted their api to take control back it's going to be interesting to see what happens it is if you try to use questron or savant yes like uh many of us who have nice homes they they come with this it's the worst interface on the planet yes and then you just rip it all out and you put in sonos and apple tv so you actually can use your products yes and it's where everybody eventually winds up everybody i talk to is like the savant remote control sits there the$800 savant remote control sits there and then everybody immediately just picks up the apple control and they're done if it's only$800 you got a great deal exactly no having somebody come program how to make your netflix work is a really great experience at 400 an hour let me ask you a question about your time at softbank uh you got recruited to be i guess as i understood it you tell me if i'm right or wrong to be moss's right hand man and then eventually maybe the the heir apparent is number one was that reporting correct and then number two what was it like working with masa i know masa i've had a couple meetings with him he's kind of like a mad genius swing for the fences hail mary throwing visionary what was it like coming in there and experiencing masa at peak gamble like masa making peak bets i mean that must have been extraordinary yeah so like masa and i uh our sort of association began when he came to google one day with a crazy idea saying listen uh i've been left at the altar uh yahoo and and microsoft have a deal to do this thing with bing and yahoo's getting out of the search business but they kind of didn't focus in japan and i also have yahoo japan which uses it algorithm from yeah yahoo us so would Google be willing to work with me on the algorithm in Japan?

58:47Like, wait a minute, how can that be possible? We're competing with each other in Japan. How do we do this? And to Masa's credit and his crazy idea, he and I sat down and crafted a way for us to have both be powered by Google Search, but to have separate ad auctions so it would be not anti-competitive. So they had their own ad sales team, they had their own ad sales pricing. We had our own pricing, so the customer got good pricing and they got the best technology. And it was kind of unique because it was hard to construct. But we became friends then and one thing led to another and he did come to the conclusion that he wanted me to become his heir apparent when he turned 60.

59:25So he hired me when he was 58 and then, you know, he changed his mind to 60 and that's kind of, that's the story that's true. But in the meantime, those two years, I'll tell you, when I turned 40, I decided that from now on I'd look at people and see what do they do? Something that I can't do. How can they do this in a way that I cannot do it? And Masa has this amazing quality where he's untainted. What does it mean? Well, you know, we all get, look, from the time we're born, we're constantly risk minimizing ourselves. When our kids walk across the street, we're like, be careful, look left, look right.

1:00:01We're like, you know, don't do this and don't do that. What is happening? There's a constant process of risk minimization that happens. You buy a house, you get married, your risk appetite continues to go down. Masai is a guy, I think, unique in his ability to have infinite capacity for risk. Every morning. Infinite capacity for risk. Wow. Do I need to explain that? You look around it from an investor perspective. You watch him, you watch what he does, and that explains it perfectly. Yeah. And so, and the beautiful part is, there is no reinforcement learning there. No. No. It's not like. He's just going to keep doing it.

1:00:36He'll end up on Zaxlan every time. It doesn't matter. Yeah. he's going to swing for the fences and you know what it it seems like it works out uh it works out and i think the only thing you know when you do that that's fine but it kind of goes back to how you guys do investing like you got to play in your weight class right if you're constantly investing a million dollars in a million companies your math will work out but you start doing one big one here and small ones here the one big one can wipe you out and everywhere else right yes risk of ruin is what we call that in gambling that's right there we go so i think that's where it may have gotten a little more complicated for him.

1:01:12But other than that, I think he's got immense intellectual curiosity. He's got, at some level, he has immense humility. At some level, he has immense confidence. And he has, as I said, an insatiable appetite for risk, and he works hard. So all those make for great ingredients. And sometimes, you know, I was, you know, the yin to his yang. Right, you could create some structure there, maybe some downside protection. thoughtfulness around how big is this bet does this bet need to be this big yeah like you know i you know i we there's an example out there on we work which is written in the book where i was not for investing in we work multiple times but then i left and you know he became a large investor and we work and what do you think his blind spot was there i mean all of us looked at it including the early investors like benchmark probably made more money than anybody off of we work as they sold their position maybe second only to adam himself went with his buyouts what we all saw and said that is not a technology business it's a real estate business and what what didn't he see what what was his blind spot there you think look masa masa is uh as i said he's all those things also uh and he falls in love with certain ideas and certain concepts and uh you know he and that also that is where he gets his passion from right he's an extremely passionate guy he gets very excited about certain things and you know he does a reasonably good analysis most often than not um and sometimes they work against him so he can't pick anybody's one bad investment and go back and question him at the end of the day he still made billions of dollars for himself and many other people out there so i think the good swings come with the bad swings yeah i mean uh there's a very famous phrase in china no gamble no future and i think he's like i think it's probably his operating system i'm staying away from the word gamble because i know you guys like your poker but you know i think the master's an investment placing bets i mean you are placing bets in venture is the is the nature of what did you take away from that what did you take away from the time there like that added to your game and then what did you sort of file away as yeah this is something i don't need to add to my game?

1:03:32Look, I think the risk appetite, the lack of, then don't become complacent. You know, constantly be looking at seeing what's around the next corner. This desire to constantly learn. All these things are things I, you know, saw Masa do, and they have helped me at PowerAlta. Like, you know, we are constantly paranoid. We're constantly out there trying to figure out what's around the next corner. We're constantly looking at what's the next technology event that's happening in the industry. We talked about generative AI. I was on a plane to India. When OpenAI came out, I logged in. I was supposed to make a graduation speech at my alma mater, which I did.

1:04:06I rewrote my entire speech on how this is going to be the next big thing that's going to happen. And I literally called it the iPhone moment there. I think Jensen said the same thing, possibly a few hours or a few days later or at the same time. I don't know. And I've embraced it. We have hundreds of people at Palo Alto working hard towards making that a reality. Now, if I hadn't learned the lesson that you've got to embrace these technology trends as quickly as you can, because these become inflection points. Those inflection points allow you to distance yourself from competition. So you've got to grab them and run with them as hard as you can.

1:04:38Yeah, and this is something Microsoft didn't do when it came to mobile, right? They just totally missed it. They whiffed. Zuck did it. Facebook did a phenomenal. I think Facebook was one of the best pivots from the web world to the mobile world, and most people, even better than Google, I think. and he was a couple he stumbled a couple of times right the app didn't come out perfect and they you know built it with react they had to take two or three swings at that bat and then he realized it and he's like you know what i'm buying instagram and whatsapp because this is the future i mean yeah uh let's close on m &a you bought 17 companies yeah what did you learn about m &a proper way to do it and how to integrate those crazy pirates into a ship of 14 000 people and let's be honest people who are attracted to working at a big company are slightly different than the people who start companies so how do you bring in 17 founders probably more because there might be two at each one of them how do you bring in those founders and then you got this executive team here that's cranking on this you know aircraft carrier and now you got all these speed boats whipping around you know doing donuts and these are two different cultures yeah and how do you integrate it yeah so i think you know first and foremost i think most people get mna slightly wrong.

1:05:48We have some principles. One, we always look for the best in the field. I think number two and number three trade at a price for a reason. So you always try and buy number one or two because the markets get really small after the first two or three players in enterprise. It's like just there's a long tail. You want to be one or two. So you always buy and you pay for what you buy. So one, we did that. Two, I always tell my team, they kicked our ass by having less resources, working 80 hours a week, going to customers, understanding the problem. We were they're the customer we didn't understand the problem we didn't solve it so they will run that space for us we want so our people end up working for the founders wow that's that's intense bro so that's an intense approach give them our people and our resources and we double down so we didn't get it done they did we admit that they got it done and now they're in charge they're now yeah 70 70 of my product organization is run by acquired founders not by existing problems of people.

1:06:47Well, that's a way to change the culture real quick, yeah. So that's the second rule. The third rule is, once we make a deal, we spend the time between term sheet and due diligence and DA on having a joint product and resource plan. I don't do, my lawyers do the diligence, I do the product and diligence plan, and I say, before you sign the definite agreement, this is what's going to happen. This is my house, I'm going to decide what color I paint it, but you see right here, it says yellow here, blue here, green here, you sit in this box, he sits in that box, he sits in that box. If you don't have agreement, we don't have due deal.

1:07:21Right. So there's no surprises after the deal is closed. They know exactly what's going to get built, how it's going to get built, who's going to do what. So we solve all of that beforehand. We know exactly what we're going to inherit, who's not going to work in the job. We map every individual to what's going to happen. Because with our first owner in a mistake, we realized it takes three months once people have all the money to then people fight for position, fight for role, fight for strategy. you solve all of that way ahead of that that is so brilliant you know when i got acquired by aol and john miller bought the company he said to me what's important to you whatever and jim bankoff and i said well we have this earn out i got to keep my sales team because that's one of my things i'm good at i'm good at sales and i know what the customers want for blogs and for this kind of content and uh he's like well we've got a really big sales team and i was like yeah i want to keep the sales team for as long as i have an earn out and then if you take the sales team away from me the other big sales team could sell into it but my guys still get the commission for processing it so we pay double commission and to to jim bank goes credit they respected that um and i think that's what made the easy transaction for me as a founder because you have founder regret after you sell your company that founder regrets real yeah jason i don't do earnouts i don't do misaligned uh incentives objectives i i align them they all get my auto stock and they have only one incentive double or triple the palo alto stock we'll all make money see that's much better yeah you don't and we pay up it's fine maybe it's a private company at the time so they had to you know come up with a different uh incentive structure but i like the approach because you do have this founder regret moment yeah yeah and that could kill the company kill the deal all right listen this has been an amazing episode of this week in startups thanks so much for coming on the program nikesh it's amazing um i'm gonna will you come on again in a year and just catch us up on how this AI thing worked out?

1:09:09Can we book you for one year from now? Sounds like a plan. I look forward to it. Alright, we'll see you all next time on This Week in Service. Bye-bye.