Go back

Nikesh Arora: Mythos is Real, Analytical SaaS is Dead, and Google can be a $10T company

31m 22s

Nikesh Arora: Mythos is Real, Analytical SaaS is Dead, and Google can be a $10T company

The conversation highlights AI's transformative impact on cybersecurity and enterprise software. Nikesh Aurora, CEO of Palo Alto Networks, explains that AI democratizes intelligence by making outputs consistent across large workforces, improving efficiency. A key example is the AI tool Mithos, which found vulnerabilities in company code within six weeks—a task that previously took five to seven years—at a low cost. However, false positive rates (30%) remain an issue. Aurora warns of a race between cyber defenders and attackers, with AI enabling both sides; the greatest risk is economic chaos from attacks on small businesses, not just critical infrastructure. He predicts the death of analytical SaaS, as AI can directly analyze data, while infrastructure software (e.g., databases) will thrive due to a 10x increase in enterprise data storage needs. User interfaces will decline as AI agents automate tasks, forcing a re-engineering of systems of work. Models will become a commodity utility layer, with profit pools shifting to AI-powered applications that solve specific business problems. Regarding regulation, Aurora notes that powerful models can be compressed onto a USB stick, making containment nearly impossible, and advocates for focusing on practical defenses rather than slowing progress. Overall, the industry faces both opportunities and heightened risks from AI-driven innovation.

Transcription

6098 Words, 33099 Characters

English
It's one of the biggest winners right now in being daddy of the cyber security space. Palo Alto Networks is an out performer in the space. Yo, Nikesh Aurora. This might come as new to you, but humans have been writing back code for a very long time. I spent 10 years at Google, and Google Search was democratizing information. If you take that analogy and think about what AI is doing, AI is democratizing intelligence. Money is a way to keep track. Yeah, it's not the goal. You've been the CEO of Palo Alto Networks for eight years? Coming up in eight years this week. Eight years. And I think when you started, it was $17 billion market cap if I remember correctly. There it is. And this morning I checked, it's $238 billion, which if you listen to what we said yesterday, now that you passed 100, you're more likely to actually 10x. So the first 10x was actually much much harder. So you're on your way to a trillion dollars. From your mouth to God's ears. Why? I think you are. Okay, so let's just double click into what you see, because you are sort of in a really interesting position to see all of it. You see the birth of AI, maybe you've seen the rise and fall of SAS. All the models talk to you. You were one of the-- The rise again, right? The rise again. You were one of the first in the few that got access to Mythos. So just, let me just push the button, go, Nikesh, start. [LAUGHTER] Well, first of all, thank you for having me here. I think AI is exciting. I think it's exciting to see all the stuff that's gone down the last possibly 24 months. I think Sarah just said it. They were right in anticipating the huge amount of compute that was going to be needed. So all that stuff's going on. But you can see that, you know, there's this notion, which we talked about briefly last time, that AI is really democratizing intelligence. What that means is, I have 250 people in marketing. They produce varied forms of output. Now, you can get 90% of the output to be consistent across those 250 people. I have 5,000 people who talk to customers. My failure mode is when 5,000 people do different things, where people say, I want to talk to Joel, because he knows how to solve the problem, and Jim doesn't. So now, you can get 5,000 people to act almost consistently in their interactions with people on the other side. So I think it's going to have a phenomenal impact to how we run businesses, how we operate. It's going to change the entire landscape. Now, in that context, you touched upon Mitzhosh, and our Dave has been very involved with this. Mitzhosh has shown us that all the bad code that humans have written over the last 50 years can be assessed by AI and shown-- the vulnerabilities can be shown. We tested for six weeks, and in six weeks, we found what have taken us five to seven years. Wow. Say that one more time. In six weeks, we found vulnerabilities which have normally taken us five to seven years to five years. So Mithos, these are vulnerabilities, where? Sorry. These are vulnerabilities in your own code base, or in your custom-- In your own code base. Oh, wow. So Mithos was not oversold. It was legit. The capabilities of AI in being able to assess vulnerabilities in code are real, not just that. If you put it on ultra-mode, which is persistent thinking, so it keeps trying until it gets an answer, you can actually daisy chain vulnerabilities AI finding a new attack path into your vulnerabilities. Now, we pride ourselves as a top percentile of companies that test our code because we're in cybersecurity business. If you take that and compound that across all the companies that exist in the world that write their own code, or the 10 million developers write code, this thing is going to find stuff which would have taken us as 10 years to five. How much did it cost? Did you track the token cost? Was it $100 million, $10 million? No, it was in the low millions. But again, the cost as Sarah said, the cost curve's going to come down already. Open AI has got a model which is cheaper, more consistent, and Tropic's come out of the other model. So you buy the hype? It's not hype, it's true. It's the capabilities. The capabilities are real. You know that. Yes. The capabilities are true. Yes. I mean, you saw IBM announced a project for $5 billion to fix open source. That's the biggest problem. What would have happened if Claude didn't have the restraint and they put it out in the public? Do you think it would have been like a real attack vector and caused chaos? I think the cooperation-- I think we're three months away if not already there from this being available in the wild. OK. Open source. Yeah. Just three months. Yeah. Yeah. Because I mean, we've been saying that it's roughly six months away before mythos, level capabilities are available in Chinese models, open models, whatever. But you're saying three months. Well, look, there's what is 4.8 is already out, 5.5 is already out. They have similar capabilities. And look, you don't need to crack the hardest code to crack. Just need to find a few vulnerabilities in code that are out there. Just take an old industrial system, which is running OT code on the edge. You can find that vulnerability reasonably easily. So we're in a race right now between the cyber defenders, finding these vulnerabilities, and patching them before the cyber attackers do the same thing. Yes. And how do you feel like we're doing in that race? So not as well as we should be doing, which is great for our business, but that's a different story. So every company has to go look at their code base and figure out where the vulnerabilities are and fix them. So if you talk to CIOs today, their biggest problem is all the vendors are showing up saying, please patch my piece of box, the hardware that you have. Please patch my code that you have, because I found vulnerabilities, fixing. While the CIOs are busy finding their own vulnerabilities to fix their own vulnerabilities. And then this huge thing called open source, which nobody knows quite how to solve. So is it fair to say that it has model capabilities go up, systemic business risk of large enterprises also goes up? On the cyber side, yes. There are antidotes being built by people like us and others where we're going to provide some capability where you don't have to patch everything. But look, Sarah said something very interesting around harnesses memory and context. The part we don't talk about here is organizations don't have memory and context of everything they do every day. That's why we need to store a lot more data enterprise-wide to learn what good looks like and what bad looks like. The same problem is in cybersecurity. We need to collect 10 times the data in the enterprise from a cyber perspective to be able to understand how to defend ourselves against the IOT hackers. Do you think that the traditional companies, like the SaaS businesses that have existed in this world, what is their place? As all this knowledge becomes more persistent and stored, what happens to SaaS? Well, you see, SaaS is, as Bill said, SaaS is different pieces, right? If you're an analytical SaaS company, it's over. It's over. What is an analytical SaaS company? Somebody that says, I'm going to collect a lot of data for you and analyze it for you. I don't need you to analyze it for me. I can run models against data and analyze them myself. So if you think about, there's a lot of, every SaaS company has a marketplace. You can buy Salesforce marketplace. What are they saying? You have Salesforce data. I'm a marketplace app. Take me and I'll help you analyze the data. I don't need you. You don't need that. I can just go run an LM against the data. So the entire incrementality that has been sold as incremental software modules to all of us doesn't need to be sold to us because I'd much rather have LM's run against that. Interesting. You bring this up. We had an instance with a SaaS product with 20 seeds. Nobody was logging in and using it, but the data was there. So we created like three accounts, got rid of 17, connected it to Slack, connected it to Claude. And now everybody can interface it through a natural language and we've reduced our bill by 90%. >> Well, not just that. What are you going to do next, Jason? Is that you're going to take data from different products, put them in one place, run analytics against that. I want my data for my sales reps, by productivity data, my inventory data from SAP. I want it all in one place so I can run analytics against and say who's selling a lot? Where do I have less inventory? Let's build inventory in a region where my sales people are extremely productive. To run that query, you'd have to have, talk to three different SaaS products. Tomorrow you can pull the data in one place. So that's category one, analytical SaaS. >> The category one analytics, dead. >> Yes, medium term. You've got all these bounces today and tomorrow that's these are marginally irrelevant. Infrastructure software undervalued. >> What is infrastructure software? >> Stuff that gives you databases. You collect data into it, stuff that allows the infrastructure to work. Whether it's a database software. >> This is like state or brick snowflake. >> Database snowflake, MongoDB, >> Oracle. >> Oracle, all these things. You need horse storage infrastructure. >> Quarty. >> We are going to need 10 times the data stored in enterprise that we have today. >> Right. >> Three years. >> 10 times. >> Okay. >> So anything that helps you collect infrastructure data, manage it, you need. I think the category in the middle is called, it's called a system of work or system, you know, a record, people call them. Those are deeply embedded in the way business is work. I have 6000 salespeople, they know how this works. What's going to happen is step one, we will take away UI and let agents do the work. UI is enterprise software and consumer software UI is the worst thing we did as technologists. >> You had a couple of examples of this. You told me this story, I don't know if you want to repeat it of this one company. They tried to hold you hostage on a license. >> Yes, that was analytical SaaS, so that's all work. >> And you just pointed AI at it and you just-- >> Yes, we just got rid of them. That's a different issue. But I mean, think about it today, We spend our life. having product managers design UI, so all humans can interact with data behind the UI. If you believe agents are going to work, and I say, I just tell an agent, look, figure out from my sales call, figure out the key points, and go post it into whatever sales tracking system I have with this Oracle or Salesforce. An agent conceptually should be able to do it. Should we spend trillion dollars building these agentech backends, we need these agents to be able to do it. If that happens, UI goes away. If UI goes away, I can rewire my system of work. I have sales guys, I have sales calls, do all the paperwork, and all the shit that needs to happen in the back of the company, and just, I'm done. If I can change the way work happens, which is where you will get true efficiency, where five people become one in a company, all these SaaS software that does system of work needs to be re-engineered for the next five years. And it's also happening passively, which is really interesting. It's looking at email. It's automatically taking the Zoom transcript in summary. So the sales system of record is now like, you don't even need to input it. It's like, I already have the Zoom call notes. I have the dec was made. The sales dec was made by AI. We're all going to be looking at a chat window and just saying, here's what I want. Get audit trail, get guns a lot better, because humans are not touching your data. It's always been managed by agents. So I think the whole system of work, system of record, gets re-enmented in the next five years. Yeah, there's no data entry. That's an interesting point. Yeah. It's not about national security for a second. I just want to maybe zoom out. So the one side of Mythos, as you said, is like the value that it has to you and to enterprises. The red team version of Mythos is where foreign state actors can essentially create economic havoc inside of a country. As these models escalate in their capability, what do you think should happen when these models are ready? Yeah, the sad truth is, in a year there's a few thousand breaches or attacks that happen. They happen for pretty rudimentary reasons. It's not because somebody cracked a heart to crack thing. It happens because 89% attacks happen because credentials get stolen. Use your name in password. That's it. I've had my password in password. I'm not sure it is. Do you have dollar sign? Dollar sign passed. Fantastic. Well done. See? You're only ahead of everybody else. So, 89% breaches happen because of simple things. I don't think we need more models to go crack the stuff. Now, these models can attack critical infrastructure and things we try and protect from national security perspectives. Yes. We need defenses there. I'm not worried about the national security part being protected because they're very on it. They're the right people. They spend 10% of their budgets on IT on security. I'm worried about the small offices across the country where they're using some piece of packet software and you're running a dentist office or a doctor's office. Remember when change health care got breached? Every physician's office shut down. Shut down and it's ransomware. Because the ransomware changed health care. That's what the clearing system. That's when United Health Act actually have given billions of dollars of credits to the physicians to be able to run their businesses at that point in time. That's what one should worry about. It's less about the big nuts will get cracked. It's less about cracking some PG&E, power generation facility. It's more economic chaos. Yes. And so what do we do? I don't think there's a sort of a silver bullet. I think this will take time. I think this will basically take a while until every system gets upgraded when you fix it over time. I just think it increased the terminal value of the industry. Do you think that there's a world in which these models become so good that you could see yourself advocating for more nationalism around how they're controlled and how they're managed and how they're where we point them? Or do you think there should be a set of these models that never see the light of day that only the NSA and other folks have access to or guys like you? I was slightly differentiated to read about models and how they will evolve versus what we heard earlier from an open AI perspective. I still believe models are going to become a utility layer. You will be able to buy intelligence on the fly. Or we can say, I don't need a 180 IQ person to go do the task. Give me a 120 IQ and I need a 250 IQ to do the task. I'll pay $10 for this. For this I'll pay one cent. I don't know if there's a one size fits all. Give me the most up-to-date model to answer my customer calls saying, sorry sir, I have no idea how to solve your problem. I think models will get differentiated from your utility layer in perspective. If you look at what's happening in the market, the profit pools are in applications not in models. Sarah talked about codecs running away. She didn't say, opening eyes running away. She says codecs is running away. Just to say, I'm sure Daria says, "Flaud code is running away." You're seeing that they're attacking profit pools. They're attacking profit pools because that's where the money is going to come from. The profit pools are in applications that companies can use. The profit pools are not in model usage by companies because most companies have no idea how to use models. They've got these companies in a way, opening eye in a throughopic, as the new Microsoft office coming in and doing all applications, all productivity software for organizations. I see there's going to be application companies that are going to arbitrage between models and solve your business problem. You still think they won't go to the application layer because this is a big debate. Should you engage with OpenAI and train their systems to then take your business from you? Atropic keeps releasing their legal model, their accounting model. It does feel like in order for them to hit their revenue numbers, they might need to do what Microsoft did, which is release the office product on top of the operating system. If I'm a company, I don't want to write every piece of software myself. I want my HR system software, which is a genetic enabled, an AI enabled to be delivered by some application company. It will be a new AI application company. I want my sales management system built by the new agentic AI sales force of the world, whether it sales force of somebody else. I want applications. What Sarah said is the profit pools are in the application layer. That's why they want to be the application layer. I think we're still waiting for that layer of companies to be invented or created where applications will sit. Because 50,000 companies need the same application. Why would I build it myself? It's highly inefficient. It's silly for me to use OpenAI directly and rewrite my entire sales system because I'm smart. I want somebody to do it for me. That layer of companies is still not fully formed. We're still going to be waiting for it. If you want to control playing a harness and then. That's right. They will build the harnesses and the memory into those application layers. The question is how big is the application layer? Is it one application? Is it one enterprise application that does everything? Or is it specialized application? You did it and you kicked out this software vendor. You did it because they were being abusive and pricing. We still use a different vendor. We swapped out for a different vendor. We just took more control. Love it. So it really is a pricing issue. And that's why the SaaS apocalypse in some ways makes sense. They're not having pricing power because you could say, "I'll just put 10 developers on this and I'll save $10 million." I think the part back to what Shema said about the regulation or whether you want to regulate these higher powered models. The question is at some point in time when these newer models which are even more powerful get built, they will come at a different price point. They might have to go to a certain vetting process to understand what their capabilities are. I think we're in a global race. I don't think holding back our models for three to six months is going to help us any. Somebody is going to put them out in open source. I was shocked to hear when I was talking to CEO of one of these model companies. He says, "The entire waste of their most recent model can fit into the USB stick." Say that again. The entire waste can fit into the model. The entire model waits off their US model, fits on the USB stick. That's the IP. Because all the data can be distilled in under 24 to 48 hours and the model comes out. I'm curious. So that's the IP. So are you telling me that we'll get hold on to that for six months? We have a debate about how difficult it is to make a frontier model. Some companies are starting to think about making frontier models using their data advantage to build their own. Have you thought about that, Palo Alto, because it does seem like you have proprietary knowledge on how security works. Could you build your own language model or a VSML, a small language model that would give you some advantage? Here is the part nobody talks about. Is the false positive rates on the models? What is the false positive rate on 4.8 and 5.5? No idea. You guys don't talk about it. We should. The false positive rate on Mythsos was 30%. Oh wow. Right? So we thought it found something, but it hadn't. Yes. So the problem is it's great for attack. It's horrible for defense. It finds 30% of time. It finds something. I found a problem and you say let's plug the hole. Wait, there wasn't a hole there in the first place. No missile inbound. Right. So now the same problem applies in enterprise. If you use the model without the right harnesses, the right training, you could be running into 10-20% false positive rates. Let's use the model to pay insurance claims. Yeah. Oh great. 10% 20% false positive. I just lost money. The sake of the nature of these is ridiculous. So the problem is not who wants a US model. The problem is how do you take that model with 20% on 10% false positive and make it 0.01% false positive? In my business, I want zero. without losing the false negative. - Sorry? - Without losing the negative, the false negative. - Yes, but it's like saying, "Hey, let's take the new self-driving car. Mercedes is gonna use Opus 4.8, and you can just sit in the car and it's gonna drive you." I'm not putting my kids in that car. - No. - With the temperature false falls in a rate. Are you? So there's a lot more than that. - And it happens post the model, which needs to happen to make this thing useful and effective in the business context. - Let me slightly pivot for a second. You were for a very long time to chief business officer at Google. You were the president of Softbank. Now you're the CEO of Paul Loughton Arbor. So let's play armchair CEO. - Armchair CEO. - Armchair CEO. - I'm still bristling from David Friedberg trying to create a distinction between founder CEOs and non-founder CEOs. Just saying, just saying, David. - By the way, false positives. - Say? - I'm a false negative, too. Give us what you would keep, what you would change, and what you like about the following companies. - This is gonna get a recording put out there. - I just wanted to tell you something. - You're one of the smartest business people. - I don't like that. - I'm being all involved. - Raps do you have to sit, don't, okay. - He's a people and grossy people. - Are you ready? - Yeah, sure. - Okay. (laughing) - Why you keep, what you change, what you like, what you don't like. - Uber. - I'm a world of bailout. - Dude, I can't talk about my-- - Are you on the board of Uber? - I'm on the board of Uber. I'm not gonna talk about it. - I didn't know that, sorry. - Talk to Dara. He's a great guy. (laughing) - Okay, Waymo. - It's not gonna be fired. Waymo. - What do I like about Waymo? The cars were, it's amazing. They should have more in many more cities than on the world, faster. I would say that a tigutor, I think she knows. - Google writ large. - I think Google's underrated. I think it's gonna be the first $1.00 in a company in our lifetime. I think they have all the assets that are needed to make the successful. I think people underestimate. You can be a model company. You still need to have a sales force that convinces customers to go out there and embrace these models and buy them. And if you think about it, three hyper-scalers have the biggest number of sales people out there. So they should be. - Part of why they're a little bit undervalued is just the goamert nature is hard to understand. - I don't know, you guys are smart of that stuff. I'm just a higher-down CEO. - I didn't say that. Rebrick said that. Let's just be clear. - I know, I know. - I was providing a thesis on recovery out of the SaaS pocket. - Okay. - Okay. - Okay. - Just to be clear, - We better not use to work together. - We need to segment that basket. Okay, and you're not in that basket. - I think you were making a distinction about how people who are founders, CEOs, have the right to take more risk and are allowed to take more risk. - I was saying that. And I think you provide a unique counterpoint to that. And there's not a lot of-- - On the full sponsor. - The same with Jeff Weiner. And I think that there's a few other really great CEOs, but they are like Neo in the Matrix type anomalies. And I think you're one of those people. And there's a very rare kind of personality profile of someone that's willing to take risk and take ownership of something that wasn't theirs in the first place and they make it theirs. And it's a extraordinarily unique trait. Far more unique actually than being a scalable founder. - It's an incredible save. - You're forgiven. - Yeah, good save, credible save. - Let's go back to our empty scene. - Wow, that was incredible. - He did really well. - He did more sicker-fendig than chat TVT. He's like, actually, I think that's the best. - I'm liking this. - He's been having more of the ass. - Yeah. - They do sell faster. - Open AI. - They should sell faster, right? - They should sell faster. - I mean, you said it. Didn't you just say it when your server was here that anthropic seems to have improved their ARR much faster than open AI? - I mean, that's just, that's statistics. - They kind of went all in on enterprise. And including specifically. - I think that's like the conversation right now is, it's a race to take over the profit pulls. - If you are gonna need tens and tens of billions of dollars every year to get one gigawatt, is 10 billion revenue? - 10 billion. - What are the cost to build you? - So what are the most exciting-- - We've got 50. - So this is our great deal. - So what are the most exciting profit pulls? And so we got coding. That's been the breakout application over past year. It's massive. You've got infrastructure, like you said, the new databases. I think cybersecurity is clearly one of them because of threats and patching cyclists so much more dynamics. There's a slight difference in, yeah. So as you can see, these models are trying to be the enablers of better cybersecurity, which is good, because all of us need to use them to test. And you're probably gonna see, I mean, if you saw, and Thropics already made their cyber capable model available generally so that everyone can use it. And Alpine I has got one. I'm sure Google has one too, but they understand this is a place where C-SOWs or chief security officers want to use it to test the code. So this is another profit pull. I think we haven't seen the onslaught against the application software companies yet. But there's 10-10s of billions of dollars in application software, which is waiting to get reinvented as we talked about. I think eventually you'll see these people saying, what if I took this $4,500 billion dollar town down? Yeah, I can build a whole brand new backbone with a genetic AI, and they'd be so differentiated that it'll cause customers to move. We are seeing it as a playbook in the accelerators now. In the year zero and year one companies, people are coming to us with the pitch. This is a $1,000 a seat per year, $500 a month seat, SaaS software, we can do it for less. We're going to charge them based on consumption. We're going to take 80, 90% of the cost out as too-- But what your mouth is doing with 80, 90%. The two fastest places to make revenue. In enterprise, a replacement town. If you replace something, I already have a budget. It's easy. I take something bad or replace something better. I get money. So replacement towns are beautiful. If you can replace an industry, replace the profit pool is great. The second place is consumer revenue. It's a lot easier to get $5 per user on a consumer set. Netflix. So that's where-- I mean, look at it. I think we collectively probably pay more on subscriptions per month than we ever did historically. And you saw your cable bill was high. Yeah. Do you think that you're going to end up building more or less hardware in the future, if you have to guess? Hardware even today is the cheapest way to manage low latency, high throughput bits. It's still in a data center. What's the data center makes? Managing high throughput low latency bits. That's why if you look financial services is the most reluctant industry to go to the cloud. Because you increase latency. If you increase latency, you reduce profit. So if you look at every of your largest financial services companies that is going in a JPMorgan, more Stanley, or these guys, they're in hardware. Try to get them to run their business on the cloud. They can't because they will have higher latency. They will lose money. So hardware is still be made. I mean, I remember when I used to buy Silverlake, and I heard Dell was done. Nobody wanted hardware. I think Dell might be back to like a $300, $400 market cap. So hardware is still going to be around. We're going to need it. It's the fastest way to move this. Our hardware development cycle is changing because of AI. Are you seeing a lot of generative design, stuff moving in Silica that historically was manual and long cycle? Yeah, but the long pull in the tent is never designed, right? Long pull in the tent is production. Today, you can't get a box produced because every piece of hardware componentry is back ordered. Everything's expensive. And every factory in the world is back ordered because we're trying to build all these GPUs based chip cards for every year or seven of the world. You think the US is equipped to fill that supply chain need? Can we do that here? We're giving you 10 years. With a firm top-down commitment. Well, I mean, the good news is that I think the hardware industry is seeing a balance of a lifetime. And generally, when you see a balance of a lifetime, you can go commit $10, $20, $50, $100, and I've seen CEO on television commit to $100,000 plan to go build more memory. So that's good. That means they have the money to go put the money in the ground literally to go build these things for the future. So I think that gets us more certain that the-- I think the tax incentive has a lot to do with that. The accelerated depreciation on the CAPEX. You get 100% right off in the first year, right? Under the-- Just the final question as we wrap up. You, over the last eight years, you've grown organically very aggressively, but you've also been pretty inquisitive. You'll take shots, and they've generally worked. So you have a ton of permission in the market. When you hear what Bill Hackman said about how there's this kind of overbeating companies, there's a few that get celebrated. That's a ripe pool for you to pick from. But some of that would require you to go maybe a little horizontally far afield, some would say. How do you maintain the discipline, or do you see yourself at some point considering things that are not nearly so much right down the middle of Cypher? So I tell you what, until about a year and a half ago, we used to buy product companies and throw them into our go-to-market engine. We could rewire their back-ends so they could work better with our go-to-market engines. So for me, if I'm selling $10 million to a customer, next time I go to a later fight, I can sell them 20. It's the most efficient way for me to amortize my go-to-market spend, right? So that was the model. We played that-- we ran that playbook to an out of 150 billion. Then we go to a point where it says, oh, we see an inflection arriving at identity. It's going to be important for an agent perspective. Security perspective. So you've got a $25 billion company which we closed three months ago. Now, it's actually a very different opportunity as presented itself. And the different opportunity goes like this. If you can be the best at leveraging AI to run the most efficient enterprise business in the world, your operating margin can be far and excess of the industry. And if you can crack that code-- Gross and net, you're saying. Gross in the '90s net in the '40s. Yeah. If you can crack that code, then it doesn't matter what you buy. >> Yeah. >> I think the problem right now is the execution problem. Most sub-scale companies cannot afford to go optimize their company and run it better. So if we can run our company much better than everybody else and have a higher opening margin, then the street will say, "Fine, if you take something "at a 20% margin and make it a. " >> Your first M&A was really tough, no? Like they were pretty skeptical, and then you kind of shoved it in their face. >> They were pretty skeptical when they found a guy who didn't know Cybersecurity and Enterprise show up, who worked at Google, and they're, you know, the track record of people leaving Google, and being successful out of Google is still varied. >> So basically you're saying the menus open. >> I think we need the next six to 12 months to figure out how this AI settles down and how can we use that effectively in enterprises. I think if you think about it, you know, the people keep hoping that less people will be needed to run companies. I actually have a count of you. I think we'll have more people at Palo Alto on the technology side than we've ever had before, because AI is causing everything to us for a transformation. So I have more technical people today than I would have had if AI didn't exist. >> Ladies and gentlemen, see you at Palo Alto Networks in the cashier. >> Thank you guys. (audience applauding) >> Thank you, sir. (upbeat music)

Podcast Summary

Key Points:

  1. AI is democratizing intelligence, enabling consistent output across large teams (e.g., marketing, customer service) and transforming business operations.
  2. Palo Alto Networks used AI (Mithos) to find code vulnerabilities in six weeks that normally take five to seven years, at a cost in the low millions.
  3. AI capabilities for vulnerability detection are real, but false positive rates (e.g., 30% for Mithos) remain a challenge.
  4. There is a race between cyber defenders patching vulnerabilities and attackers exploiting them; the risk is particularly high for small businesses and critical infrastructure.
  5. Analytical SaaS is "dead" because AI can analyze data directly; infrastructure software (e.g., databases) will grow as enterprises need 10x more data storage.
  6. User interfaces (UI) will decline as AI agents handle tasks, forcing a re-engineering of systems of work and record.
  7. Models will become a utility layer, with profit pools shifting to AI-powered applications, not the models themselves.
  8. Regulation of powerful models is debated, but open-source proliferation (e.g., models fitting on a USB stick) makes containment difficult.

Summary:

The conversation highlights AI's transformative impact on cybersecurity and enterprise software. Nikesh Aurora, CEO of Palo Alto Networks, explains that AI democratizes intelligence by making outputs consistent across large workforces, improving efficiency. A key example is the AI tool Mithos, which found vulnerabilities in company code within six weeks—a task that previously took five to seven years—at a low cost.

However, false positive rates (30%) remain an issue. Aurora warns of a race between cyber defenders and attackers, with AI enabling both sides; the greatest risk is economic chaos from attacks on small businesses, not just critical infrastructure. , databases) will thrive due to a 10x increase in enterprise data storage needs.

User interfaces will decline as AI agents automate tasks, forcing a re-engineering of systems of work. Models will become a commodity utility layer, with profit pools shifting to AI-powered applications that solve specific business problems. Regarding regulation, Aurora notes that powerful models can be compressed onto a USB stick, making containment nearly impossible, and advocates for focusing on practical defenses rather than slowing progress.

Overall, the industry faces both opportunities and heightened risks from AI-driven innovation.

FAQs

When Nikesh Arora became CEO eight years ago, the market cap was $17 billion. It has since grown to $238 billion.

He says AI democratizes intelligence, enabling consistent output across large teams like marketing or customer service, which improves efficiency and reduces failure modes.

In six weeks, Mithos found vulnerabilities that would have taken five to seven years to discover manually, at a cost in the low millions.

He estimates it's about three months away from being available in the wild, as similar capabilities already exist in models like 4.8 and 5.5.

He believes analytical SaaS is 'dead' because users can now run language models directly against their data, eliminating the need for separate analytics tools.

He predicts enterprises will need 10 times more data storage in three years, boosting demand for databases and infrastructure software like Oracle and Snowflake.

Chat with AI

Loading...

Pro features

Go deeper with this episode

Unlock creator-grade tools that turn any transcript into show notes and subtitle files.