Nikesh Arora - CEO of Palo Alto Networks | Podcast | In Good Company

Hi everyone, I'm Nikolai Tangen, the CEO of the Norwegian Sovereign Wealth Fund, and today I'm in really good company with Nikesh Arora, the CEO of Palo Alto Networks. Palo Alto Networks is the world leader within cybersecurity, which has never been more important than today. We own 1.2% of the company, translating into more than $1 billion. Thank you so much, Nikesh, for taking the time.

Thank you, Nikolai. Lovely to see you again.

Now, let's start off with the basics. What do you guys do?

That's a good question. Look, as the world has digitized, as we've all adopted technology, whether it's on our smartphones or as companies make applications available to everyone, the possibilities of bad actors getting into company systems or personal systems goes up.

Hmm.

And our job is to protect that technology infrastructure from bad actors. So, we are in the business of cybersecurity, which is to protect our enterprise customers, governments, and individuals from being hacked or attacked or coerced by bad actors.

Now, the thing is that everything is digital these days, right? Your car, streetlights. So what's kind of happening with the whole attack surface?

Well, it's a great, great comment, Nikolai, because you've said it right. We call this the attack surface, and the attack surface is expanding. And I think we're not done. And as you said, if you drive around in San Francisco in a Waymo, That's your car, but the car is now fully connected to some central nervous system. And if a bad actor could get their hands on that control systems to your car, they can control your car. So as we create more and more technology, more and more interconnectivity, we are creating the opportunity for bad actors to get involved and start to interfere or start to take over this attack surface. So yes, the attack surface is fundamentally exploding. will continue to explode, which makes it more and more important for us to make sure that we are able to protect those situations faster and faster and faster and more real-time as we can.

What's the most difficult part of what you do?

The most difficult part is the tables are unfairly stacked. The bad actor has to be right once, and we have to be right 100% of the time. That's hard to do.

How do you do it?

More and more technology. We all talk about AI, and I'm sure we'll talk about it. But we have to be able to identify things as they're happening. We have to be able to look for the needle in the haystack. And today, with the amount of data that's floating around in the world, the amount of connectivity, as we talked about, that is going on, the only way to do it efficiently, effectively, and in real time is to use the same technology to protect ourselves against cyber threats that we are using to make our lives convenient.

How has AI changed the way you work?

Oh, I think AI is going to change everything. It's almost as we, you know, we are beginning to see every week there's a net new incarnation of AI and you can see it keeps getting smarter. And the way I sort of correlate this is like AI is like having a really smart person that you can have work for you. This person doesn't forget anything. This person knows everything that's ever happened in the world. This person knows how to recognize patterns. And what's happening is that that person is, over time, going to become smarter than the average employee and be able to either assist the current employees in their tasks and possibly take over their tasks. Now, that also applies to cybersecurity, right? If you can have somebody who has infinite memory, infinite pattern recognition, then the question is, can I train it with my information to make it be more effective and helpful for me? I think that's just phase 1. I think phase 2, this thing's going to have a brain of a PhD, whether it can Think of unintended scenarios, things that have never been thought about. It can reason. So I think we're onto a very interesting road with AI. We're in the very early stages. It has benefits on both sides. Once again, every piece of technology can be used by bad actors and good actors. Hopefully, the good actors outweigh the bad actors. And we're working with AI to see if we can use those brains to become better security analysts, solve security problems faster.

How do you make sure that you have more compute than they have? And better algorithms and so on?

I mean, honestly, you don't need more compute than bad actors. The day bad actors end up with more compute, we'll have a real problem. Because if they have more compute, then the world is a dark place. But I think even with the compute that's out there, it can be leveraged effectively, unfortunately, from a bad actor perspective. The compute is really being used to create a faster and faster brain, a smarter and smarter brain. Once the brain exists, hopefully we'll find technologies and techniques where they can be deployed at the edge, on your phone, in many different places to be able to leverage it. So, I think the real risk is that there is infinite possibility for this technology to be used in sort of the dark side as much as it can be on the right side. So, we have to make sure as we deploy it, as we enable it, as we make it more omnipresent, We do that with the right guardrails and the right control systems in place. Otherwise, we're going to have to go— and it's very hard to put the genie back in the bottle.

Nikesh, who are the bad guys? Where is the dark side?

The dark side is interesting. It's been an evolution. I think 15 years ago, it was people who sat playing games in their parents' basements and who were great at technology. And sort of hacking somebody or proving a point was kind of like, It's like, you know, look, look at me. I'm so smart. I can hack into System X or System Y. And look, I showed that I can do it. But very quickly, as the world became more and more interconnected, it started getting any sort of economic legs. People said, wait, if I do that, I can actually find a way to monetize it and find a way of getting money for it, whether from the companies or individuals. And we're seeing a lot of that. There's a lot of ransomware activity, a lot of activity where people are scared into sharing economics with bad actors. I think we're at— we're past that too. I think nation-states have started building that capability in a robust way because, uh, I think the future wars will be fought both in the digital war sort of battlefield as well as a physical battlefield. The digital battlefield is a lot less expensive from a, from a, you know, situation where— from a casualty perspective.

If you were a bit more specific about the countries.

Look, I don't think it's a state secret that there are countries which have tremendous offensive capability. Even the US has a great offensive capability, but there are are people out there who spend more time building offensive capability than defensive capability because they feel that that capability would be extremely well leveraged in an adversarial situation. And, you know, we have bad actors. We have seen groups in North Korea. We've seen groups in China. We've seen groups in Russia, various parts of Eastern Europe, some parts of the Middle East. So, you have groups of people. Now, that doesn't mean the whole country is bad. There are people who are resident there because they have access to resources. They have It is hard to create some consequence from a fiduciary perspective against those. So that's where they are.

Could you recognize them by the way they attack?

Yes.

So tell me, what's the difference? So now I'm sitting in Palo Alto Networks, we get some red lights flashing, and how can I see that it's some Russian guys rather than some North Korean guys? How can I see that?

Well, there are attack techniques which have been— have sort of signatures in there. People are proud of their work. They embed signatures in their work. So you can recognize signatures. You can recognize that there are variants of things that people have used in the past. You can get some sense from the IP addresses that are being used. You can see where the traffic is coming from. So you get some sense, always— not always accurate because there's ways to circumvent that. So it's sort of a triangulation exercise. Between the technique used, the malware used, where the traffic's coming from, the scale of the traffic, the scale of the attack. Sometimes you see DDoS attacks, which only nation-states have the compute capability to go exercise. You can always understand from who the target is, who the adversary might be. It was pretty obvious when the Ukraine war started that the systems in Ukraine that were being attacked, they were being attacked by a certain set of people, right? You understood there was motive. So, I think triangulating motive, malware techniques, and addresses and location gives you a reasonably good idea.

Is the type of targets changing? It has.

Yes, that's a great question. The type of targets have migrated from individuals to individual companies. And now, we're in the world of supply chain. And what I mean by that is, you know, if You want to go find out what an activist is doing in their email, you try and attack the activist, trying to get access to their username and password so you can see what they're doing, which would be a very targeted attack to whether it's an individual or a company. But then he says, look, I'm going to need this capability for a very long time. Why don't I go attack the backbone of the email system? So once I am in there, I can go look at anyone. Or why don't I attack a piece of hardware that is deployed by 10,000 companies? Once I know how to break into one, I can break into the other 9,999 at will. So, you're beginning to see a lot more supply chain attacks, which effectively allow bad actors to go amplify their sort of targets over time where they want to go. So, it's kind of like we joke about this in the industry. It's kind of like there are groups that do ransomware as a service. They'll go become resident in tens of thousands of pieces of equipment based on known vulnerabilities. And offer that capability to people who want to go exploit it for their own monetary reasons.

How much money is in this industry? I mean—

Billions. Billions. Look, it's unfortunately one of the most profitable industries out there because I think by last count, there was close to $18 billion between ransomware and scams, online scams, which are another form of cyber sort of behavior. And the challenge, Nikolai, is that in each of these cases, it's very hard to prosecute people because eventually your lead ends up in some third-world country or in some other country which is very far away, and you don't have the capability to go investigate all the way across 5 different nations or multiple continents. It's very hard to go prosecute them unless these are things of significance in nature, right? If somebody made you transfer $10,000 to a bank account in Africa, it's very hard to prosecute that and reverse that. Now, if you are going to get ransom attacked or you're going to bring down critical infrastructure, you're going to block a pipeline, yes, there is prosecution that can happen in that situation because it's bigger than just monetary impact. It's kind of, oh my God, somebody's trying to sow chaos in some infrastructure capability or some utility capability. That's when— People do get engaged and get involved. But I think there's a very long tail where it's very hard to go prosecute these situations.

Why are infrastructure projects increasingly under attack? I mean, we're seeing it in water plants, telco networks, power grids, and so on. Why are the hackers going after these things?

Well, I think it's— first of all, it's easier because typically those things are— they have relatively older infrastructure for the most part because their job is to provide electricity and provide water and power, et cetera. They are not sometimes technologically as advanced as you'd like them to be. But what we're also discovering is despite their old infrastructure, for ease of use and convenience, we're putting on sort of Band-Aid systems which can connect to those things. So it's a lot easier to manage an electrical grid remotely if you can have every part of the electrical grid that is connected to some Internet of Things or IoT or operational technology. But the challenge is because that's older infrastructure, all these tools and capabilities are patched on. And that means when you patch something on, there is a possibility that bad actors can get in through the same doors, and you just exposed some old infrastructure to internet access. So, from that perspective, A, they're easy. B, as I said, when nation-states get involved, they're not looking for just monetary outcomes. They're also looking to see how do you destabilize a county, a city, a state, or a nation. And it's kind of their way of probing and getting ready in case there is a scenario where they have to leverage that. And so you're seeing a lot of that. For the most part, as you can see, there hasn't been a situation except for what we saw recently in the Middle East or in Ukraine where these things were used in the case of wars. In most other cases, this is work that they're doing to sort of flex their muscles, understand their skills, understand their capability, If you had my job, what would you be the most worried about? Look, in your business, there's event risk, right? Although everything goes down the path, you have wonderful models that try and tell you how things are going to happen. From an event risk perspective, it's very hard to model it. It's very hard to be afraid of it because event risk is event risk. If something's going to happen to one of your portfolio companies, it's going to happen. If something's going to happen that impacts a certain sector of your portfolio is going to happen. I think on the flip side, what you can look for is, let's say, basic hygiene. Typically, cybersecurity is like water. It follows the path of least resistance. So, the companies which are most vulnerable will be the ones which will have the most problems.

Hmm.

So, demanding a certain level of quality, a certain level of cybersecurity hygiene becomes important. And you see that There are various executive orders, edicts from governments where they demand that a certain level of hygiene be maintained by critical infrastructure because that can impact nation-state stability. There are financial services requirements where the regulators require tremendous amounts of cybersecurity hygiene and capability. The federal government requires a certain amount of hygiene from federal contractors. So, there are examples out there. where people do require that degree of standard care or diligence. I think you guys should be at least looking at that or demanding the same.

Are you worried about the whole financial system plumbing, like stock exchanges, that kind of thing?

Look, I can scare myself every day if I want to. So I believe in the goodness of humanity. If you look around, we haven't seen those things. And I think the flip side is resilience as well. Look at, we powered through a pandemic, which is one of the biggest crises that civilization has seen in modern times. So can we overcome some plumbing breakdown? Sure, we can. Will it be choppy? Possibly. It all depends on the extent of the impact and the scale of the impact. But I'm not worried. There's enough segmentation. There's enough circuit breakers. in the systems where I think today we say, look, when you think about cybersecurity, think about cyber resilience because the possibility that you can get attacked, hacked, or brought down to your knees is reasonably high. If somebody shows up with tremendous amounts of force and compute, they can find a way into breaking into that one chink in your armor and destabilize you. The question is, how resilient are you? If somebody does destabilize you, how quickly can you come back up? How quickly can you bring your infrastructure back up and you can resume operations. That's kind of where the focus has been in the last few years amongst large companies, enterprises, critical systems. And that's a good thing because I think that's the right way to think about it. The right way to think about it is not that I can protect myself infinitely better and nobody's going to get into my system. You have to assume it's going to happen. And when it happens, how quickly can you stand up? So I think that's all goodness.

Well, I am slightly comforted by the fact that you still believe in the goodness of humankind because I I hadn't really expected that to be the case, but—

As they say, hope for the best and prepare for the worst.

That's what we do every day. Now, compared to other sectors within technology, the cyber subsector is quite fragmented. Why is it not more consolidated?

That's a great question. And I think if you look at technology, that was our thesis 7 years ago. when I came here, our thesis was it's about a $200 billion revenue industry annually. And we were at 1.5% market share. And we were one of the top 3 players in the market. So, that is, like you said, fragmented and small. And I think you can go back and trace it. First of all, remember, cybersecurity is one of the newest subsectors of technology, right? In 1989, when I went to university, there was nothing called internet connectivity. Right. So this thing is less than 30 years old. And true widespread connectivity really came about for all consumers when mobile phones were sort of popular and people started using apps on their phones because now every company, any enterprise had to open doors for your bank account or pick your favorite activity with your company or e-commerce. So really, we have seen the interconnectedness arrive in the last 20 years.

You make it sound like we are old. We are— I thought we were super young.

We're not old. We're going to live to 150, right, with the longevity things that are going on in the world. So, we're like in the early part of our lifetime. But my point is this industry subsector is 20 years old.

Yeah.

That's when it started. So, it hasn't had time to actually consolidate in some sort of platform. If you look at workflow management, you look at CRM, you look at IT management, these things have been around 30, 40 years or 50 years. And you've seen platformization or what I like to call the consolidation of this fragmentation into more meaningful sort of technology providers. And our thesis and our bet is that over time, cybersecurity will go the same way. We're blessed that we're now about 4% to 5% of the market and possibly 8% of the product market, which is better than 1.5%. But there is no reason there is not a 20% player in this segment in the next 5 to 10 years.

Now, you previously worked with Google and then SoftBank. What did you learn there which you have brought with you to the current company?

Nikesh, I was very blessed to see the emergence of interconnectedness and the internet from a vantage point like Google. I spent 10 years there between Europe and the US, and I got to see how the world grabbed technology with both hands. And the thing which I think makes Google great and continues to is their obsession around product. Right? You can see at Google, there were so many products when I worked there which had zero monetization, and possibly even today, things like Google Maps or the Chrome browser. But Google focused on building products from a technology perspective to make it convenient for end customers. And I'm sure there's some sort of a virtuous circle that allows them to monetize that in their advertising business or their YouTube business. But, and then Larry told me once, and I think he's right.

Larry, as in one of the founders?

Larry Page. Yes. Thank you. Yes. He said to me once, look, if you look at technology companies, over time, technology companies die when they stop focusing on product and start focusing on other things. And that's true. If you look at the history of technology, there is sort of the battlefield is littered with companies whose eye was off the product. And that's what he was very obsessed about. I brought that here. I said, look, for us to win in the long term at Palo Alto, the only way we are going to win is if our products are the best in the market and the customers rely on our products. So, we brought a lot of product discipline. We had to buy 20 companies because we were sort of on the back foot or late in our innovation cycle. And we couldn't wait 4 years because, you know, I believe it takes 4 to 7 years to build a great technology product. It doesn't matter what it is.

What about SoftBank?

Well, SoftBank, you know, is yet another fascinating founder, Masayoshi Son. He, as I've always seen, is like, I think he's one person whose risk appetite increases as he gets older. And fascinatingly, when we have children, I have 2 young kids, and I realize as we bring them up, our instinct is to help them risk minimize. Don't— look on both sides of the street when you cross the street. Be careful. Don't do this. Don't do that. Be careful. We're constantly grooming people to start minimizing risk. Once you get married, make sure you don't overextend himself. Masa, at the age of 60, he's like, let's swing, let's swing harder. And I think it's just fascinating.

So where did that come from? Where does that come from?

I think it comes innately from him. I think this is who he is. And he's done that so many times. And first time or second time, it looks like a coincidence. When he does it 4 times, say, holy shit, he's got something going here which should be bottled. And he was the richest man in the world for some days. Possibly, you know.

But you are swinging pretty hard too, no?

Yes. Well, that's what I said. So you bring that from there saying, look, you know, don't worry about what you're going to break. Worry about what you can build from there. And I think that's the 2 principles we operate Palo Alto on is one, focus obsessively on the product, make sure our customers see value in our product. 2 is don't be scared of taking managed risk.

So how did it work? So when you joined Palo Alto Networks, you had little experience from cybersecurity, right? So, they call you up and say, hey, Nikesh, you want to come and join the company? Yeah, I know nothing about it. Well, great. Join anyway. And then, you became the CEO.

Yeah, I think we have to hold the board accountable for their bad decision, right? Because they were looking for a CEO for a public company. I'd never run a public company. They're looking for an enterprise CEO because we sell to enterprises. And they're looking for somebody who understood cybersecurity. Other than not having those 3 qualifications, I was a great guy. I said, you know, like, you must have really run short on potential supply of potential CEO candidates that you hired me. And I guess they knew more than I did. They said to me, we have 5,000 people who understand cybersecurity really well. So we don't need one more person who understands cybersecurity. We need somebody who can lead this company from where we are into being one of the major forces in the space. And it was a very steep learning curve, very, very steep. I won't deny that. But I had some great teachers.

What has happened to the market capitalization of the company? During your tenure?

We started 7 years ago.

And you don't have to be modest. You can just give us the numbers.

It's the numbers. It's numerical, right? 7 years ago when I started, we were approximately $18 billion in market cap. And today we're around $120, give or take.

How do you move up the learning curve? You join a firm like that. It's not your expertise. Just how do you go about learning a new field like that?

You know, it's a great question. And I said, I relied on every one of those people, 5,000+ people who understood cybersecurity. I think they probably had their ears red, their eyes were teary-eyed every time because I would pepper them with questions every time. And I would call our co-founder in the morning coming into work for an hour asking him all kinds of stupid questions because things I had read in the night. And I'd call our chief product officer on my drive home saying, I'm so confused. I learned so many different things today. Help me make sense of it. I possibly did that For, I want to say, the first 18 months. I also used that time to meet 300 individual cybersecurity companies because our industry is very, very prolific. There's 2,000 cybersecurity companies formed every year. So, you know, I could always find somebody who wanted to tell me what they were doing. And slowly, I started to build a framework in my head as to, you know, what would be interesting. And I built a few theses about how the industry operates and what needs to happen. And my plastics moment was, having been at Google, I said, look, the 2 most important things from a technology perspective would be cloud and AI. This is something we said 7 years ago when AI was not in fashion. Cloud was beginning to get into fashion. And so, we pivoted our company. We burned down our data centers. We don't have data centers. We run everything in the public cloud. We built a whole practice around cloud security. We built our entire security management stack using machine learning, which was the the normal name for AI at that point in time, 7 years ago. But it took us 7 years to build a great product. And we're delighted because some of those investments we made 7 years ago are kind of what is bearing fruit and allowing us to succeed the way we are.

Now, the founder of the company, Nir Zuk, he's still Chief Technology Officer, right?

Yes.

What does that mean? How does that work?

Well, Nir's a phenomenal brain when it comes to security. It comes innately to him. You know, he worked in Unit 8200 in Israel, He saw opportunities. He came. He worked in the security sector. He decided to spin out and start Palo Alto Networks. And some of the early product insights and decisions were driven based on what he thought was the right way to go. Now, he acts as a technology consigliere, both for our management team as well as our customers. So, he'll go out, meet customers, talk about the security stack, work with them as to what should be the greatest outcome for them. sit down with our teams and sit down and look at what they're trying to do and sort of attack problems from a first principle basis. It's very helpful.

You mentioned some of the trends that you were early to spot. What's the key to spot a trend early? How do you do it?

Look, I read something the other day from a distinguished person at Microsoft, and he was saying it in the context of, I think, Internet Explorer. He said, you can see a tipping point typically 3 or 4 years before it is going to become widespread and fundamentally obvious, right? And the key is when you look at technological trends, you have to say, what is it that I just saw and how's that going to fundamentally change things? So, take AI for now, right? There's a huge brouhaha around AI and people actually sit there and say, oh my God, this AI is going to be amazing. And you can see Nvidia, you can see infrastructure. People want to spend $500 billion building large data clusters, data centers. The question is, but what's the insight? What is that going to do? Now, you can see it. It's pretty clear. Everybody's clear that something's going to happen with AI and something's going to be fundamentally different 4 to 5 years from now. The question is, how radical is it going to be 5 to 10 years from now? You have to sit down and define your principles. Like, I fundamentally believe product development will go flip on its head. Today, 50% of technologies are deployed in product development across technology companies. You won't need to do it as much because— Product development in technology companies is us designing a way to talk to data and machines. That's what we do. Product development people say, let me take all this, make it simple. It's like you booking your airline ticket on Booking.com. That UI is called product development. Well, if I can just talk to it and say, book me a ticket and do this stuff for me. And this is a fundamentally easy example, whether it's, say, DoorDash or Instacart. You don't need to build all this amazing UI that sits in front from a product development perspective. You can start talking to data. and machines because they understand you as another human would, and that's how your interaction becomes. If you believe that's the future 10 years from now, everything fundamentally changes. Then the next question is, how do you position yourself in that future? Should you be chasing things like writing better legal briefs and investing in companies which are making marginal incremental improvements, or should you be fundamentally rethinking how that's going to impact technology? Now, we have to think like we think the future of the future of AI is going to be more agentic in nature. We're sitting saying, if that world transpires, how do we build security protection where agents don't run amok? So, we're trying to build a whole fantasy world of agents in our head. And then, we have to say, how do we protect that fancy world of agents? So, we have like a second derivative problem, not just first derivative problem. So, if you apply this thinking to the technology sector, where should you Any software business that relies on seats, that relies on humans and humans using more software, has to fundamentally rethink their strategy, right? Because if you believe this wave of AI is going to be true, we're going to be much more efficient and we're going to be using humans fundamentally differently in the enterprise environment, in the entrepreneurial environment, and you'll get a lot more done with a lot less. If that's true, then you have to focus on what the lot more is going to be because you're going to have a lot less from a people perspective. So, I think rethinking that would be interesting. I think there will be some market dislocations. I was chatting with somebody last night and we talked about, look, typically the market first doesn't realize until it gets hit. But when it gets hit, it swings too hard in the opposite direction. So, there'll be value opportunities in the market in a few years when market begins to see this. catastrophe coming in the short term. The market is not realizing that this thing is going to start taking more momentum over time as things get more and more efficient. So, I think there's going to be a rethinking on the enterprise side for seat-based businesses. And you can see all of them are very focused on AI and creating more value with AI and figuring out how to deliver AI agents instead of humans. And that's kind of a smart thing, an interesting thing. Some will make it, some won't. I think on the consumer side, I've said this before, I'll say it here, is I think the whole idea of applications on your devices is going to have to be rethought. That's going to be a sea change because do I really want 14 AI agents talking to me on my phone? I don't think so. So, we have to figure out a way of disintermediating these agents. And the question is, who is in a pole position to take that leading role in talking to those 14, 15, 200 agents behind me? And then, what does that do to economics, to customer ownership? To where the financial transactions are held. So I think it's going to be a very interesting world for the next 5 to 10 years from how AI actually gets deployed and how many sectors it impacts.

So who is going to be the winner?

If I knew that, Nikhil, I'll be doing what you do.

Who is going to be hit? Where are the big hits going to be?

I think it's early to call because these are not static things. These are not static companies who are sitting there waiting for consequences to happen. I think many of these people are well aware of this problem. They probably are more thoughtful about it than I've just told you. So, there are people who understand these challenges. There are people who are working on these. Like, you can apply that and say, there's going to be goodness. We're going to get this solved. But, on the flip side, you go back 25 years ago, we never saw the emergence of Google or Facebook or Amazon and their likes. We never saw the emergence of OpenAI at the scale it has come to it. So, I'm pretty sure there'll be 10 to 20 new players who we haven't fully comprehended are going to go run this table from first principles and from scratch. And I'm sure some of us will adapt. I mean, Walmart still exists and they've done a phenomenal job from an e-commerce perspective, right? Even though they were late to the party vis-à-vis Amazon. So, there'll be early entrepreneurs. There'll be people who will be late adapters, but they'll have tremendous assets they can bring to bear to make it work. And there's some people who fall by the wayside.

Would you mind just enlightening us a tiny bit? You mentioned first principle twice. What does it mean?

Well, first principle is you'll go back and look at it and say, eliminate all constraints. Rethink if this was from scratch. How would you do it if you didn't have any of the baggage of the present in the industry, in your category, in your sector? That usually gives you a better outcome. It's sort of like that's how true innovation gets formed, saying how to What are the tools I can bring to bear today, which never existed 20 years ago, which makes it a lot easier to build this from scratch? You know, I learned an interesting lesson, and I'll tell you an anecdote. A very dear colleague of mine at Google, he was trying to think about mobile apps in the future. And I used to work in the mobile industry before, and we were chatting about it. And he said, look, there's 200 operating systems in the world on mobile phones right now. It's impossible to build an application because we have to comply with 200 different— Operating systems. I said, what are you going to do? He's like, I'm going to focus on Android and iOS. I said, why? He said, if I look at the trajectory 5 years from now, I think the world will be 60% to 75% Android and iOS. And I don't care about the rest because they're going to be on a downward trajectory. Now, he went back, retaught it, did it, simplified it. It worked really well. And today, he's right. He was right. He was right 15 years ago. But at that point in time, it was not obvious. I remember the CEO of a very large mobile phone company calling me, or handset company calling me and yelling at me and saying we were being duplicitous. But my colleague had called the demise of their operating system before they'd seen it.

Related, and talking about a big change that you did in your company, middle of last year, you doubled down on platformization, on your platformization strategy. which was part of your long-term strategy. And it led to some short-term negative effects, certainly for your share price.

Just one of the swinging things.

Absolutely. Take us through your thinking behind it. And, and then now one year later, what's— what has it led to?

Yeah, look, you know, as I've heard in another podcast, somebody say— somebody asked one of my old bosses, you know, if you go back, what would you have done differently? And he said, I'd have made my smart decisions faster, except you don't find out until after the fact. So, if you ask me what I would have done differently, I wish I'd done it sooner. But I think there was the right time and a place, and I'll give you why. When I started 7 years ago, we were great in firewalls, and that's all we did. But there were 4 other swim lanes in our industry, which our industry used to let everybody else play. Say, hey, you do that and I'll do this. And I realized, well, why are we doing this? Why do we just give a free pass to every net new startup that shows up and wants to play in a different swim lane? Why aren't we in it? And you've discovered that over time, there's learned behavior in the industry that people have tried that and failed. They stuck to their knitting. So, we set about to say, well, let's see if we can go play theirs. And we built a phenomenal M&A strategy where, you know, we can talk about that as well if you want. But we were able to start establishing a beach, sort of a foothold in each of these other swim lanes. And over time, in the last 5 years, I'd say the first 5 years, We got to a point where in each of these swim lanes, our product was now rated number 1 or 2 in its category, right? Which is kind of like table stakes. In cybersecurity, the normal default is security professionals say, hey, if you're number 1 or 2, I won't get fired for buying you. If you're number 4 or 5, why would I buy you? You're a new player. So, we had to get the right to play and right to be at the table. We did that. But we realized we were still fighting individually against people who were great in that category. And we looked at it and said, well, we're the only people who have 24 products in the magic quadrant in the top right. Let's start showing the benefits of these things working together. So, we spent 1 year stitching them together harder and saying, look, these things are best in their category. Yet, even better, if 3 of them work together, you don't have to go do the stitching yourself. And we're in the cybersecurity world. The more disparate products you buy, the more you have to go figure out how they work together. in sort of an adversarial scenario. So, we were able to do that, which became the sort of the germination of our platformization strategy and say, let's go sell the benefit of all these together. It's lower cost of ownership, higher simplicity, better security, and actually customers might have to actually pay less instead of constantly paying more for security. So, that's taken hold. We sold over 1,000 of these deals in the last 12 months, which is great. And we believe that's the future. And if you look at— and I said this earlier— if you look at Salesforce or Workday or ServiceNow, all these are platforms. And nobody went back and said, wait, I used to have this done with 7 systems. Let me go back to those 7 because it was easier there. It never was easier. You just have to work people through their objections and through their capability, through their challenges and say, this is a much better outcome for you. So, we're on the early part of our journey. But we believe that is the future of this industry. And the good news is, since we announced that, I think It's fair to say whether they have it or not, many of the industry peers have chosen to start saying we have a platform. So clearly there's something here where they believe they need to be a platform to be able to succeed in cybersecurity.

Nikesh, let's move on to your personal journey. So you grew up in India and how did you end up in the US?

Oh, I grew up in India. I got an electrical engineering degree and I wanted to go to business school. And I applied to a few in the United States. At that time, it was very hard to get to the US for business school because there was foreign exchange regulations. You couldn't really pay. So all that stuff, you know, we overcame those hurdles. And I was privileged to be offered a place at Northeastern where they chose to pay my tuition if I taught computer science, which was a very emerging field at that point in time. It didn't— literally, 1989 was the I'd say '87, '88 was when they started using that as a specialization in India. And I actually was an electrical engineer. I was not even a computer science engineer at that time. So, I spent the summer brushing up my computer science so I could come and teach it. And that's how I came. I went to business school at Northeastern.

Why are Indian CEOs so successful in technology?

Well, I think there's a selection bias. We're looking at, you know, we're 16% of the world's population. So, that's not a bad start. But I think if you look 30 years ago, the only way for us to be here in the US was we had to go through significant, let's say, educational hurdles to make it. Like, you weren't allowed a visa in the United States if you weren't academically brilliant in your field. And given the economic disparity between India and here, a lot of us chose to look for greener pastures and we came here. So, you had a large pool. You have a large pool from a globally trained engineering population to choose from. And I think from then on, it was sort of Darwinian. Some of us kept making it through the various hierarchies of organizations and ended up with, you know, the Indian guy must know how to code. So, there are a lot of us who are in technology. And I think I'd say even the technology sector really has grown tremendously in the last 30 years. This is where all the opportunity was. So, I think it's a confluence of circumstances that allowed all of us to be here. And there's possibly something in our resilience and our sort of going down the engineering and academic path.

I mean, some of you don't really code personally anymore, but—

No, we don't.

What's the Indian leadership style like? What are the commonalities?

Look, remember, we all grew up with scarcity, I think. So, being resourceful has to come naturally to us because if I look at some of my friends and peers in the industry, I know the backgrounds of many of them and we all share similar backgrounds. We all went to some sort of engineering school in India. We all came from lower middle class or middle class families. If you look across the board, and I'm just thinking of 8 or 10 of the people, I know in our sector who are legendary CEOs right now, they all have similar backgrounds. So, we all have some degree of resourcefulness, some degree of scrappiness perhaps that comes with it. It comes with a very strong work ethic because you can't survive in a country with 1+ billion people at that point in time if you don't have the ability to put your head down and work hard. When I went to engineering school, I think 100,000 people took the exam. They chose 2,000 people to go to those 5 schools that we wanted to go to. So, there's a 2% chance that you get in. So, to get there, it was not just going to be pure luck. It was going to be a lot of hard work and dedication. I think every one of us went through that. So, there's a work ethic. There's a resourcefulness aspect. I think there's a constant learning aspect to it. None of us grew up with AI, like you said. None of us grew up with the cloud, but somehow we've all managed to learn it. I didn't grow up with cybersecurity. We all managed to learn it. So, there is some degree of a constant learning sort of algorithm in there. Hopefully, there's a dose of ample humility across the board because we're all blessed and privileged to be able to work in this environment and be part of a larger sort of cosmos in the United States to be able to sort of make our dreams come true. And then the rest is chance.

How do you stay humble with all that success?

Oh, go home to the family. They'll set you right in a heartbeat. It doesn't matter how successful you are at work. You're still part of a family unit. And I think it's consistent. And I know some of these people, as I said, and their spouses, and they keep us grounded. They keep us focused on the right things. And I was chatting with somebody last night. I still hang out with my friends I knew in high school. It doesn't matter what I do for a living, and they don't really care what I do for a living for the most part. So, just go back, stay with your family and your friends, and they'll keep you grounded. And as you know, it's not sort of roses and tons of love every day. There's a lot of grinding that is required to be successful in what you do. There's a lot of going back to the salt mine and sort of figuring out things from first principles. So I think that keeps you humble on a day-to-day basis. And especially with the enterprise world, you're constantly selling to people who are telling you you're wrong.

Do you think people underestimate what it takes to be successful in your business?

I think every role, every job, and I always try and say that, you know, there's no comparison. Your challenges and my challenges, it's not a competition. It's our ability to cope with challenges and our ability to enjoy successes is different. And I'm sure a doctor has his own set of challenges and opportunities to succeed. And I'm sure a CEO has them. So, I think that's more human than what you do, perhaps. The question is, how do you cope with it? How can you handle it? And some people can cope with it better. than the others. And over time, you'll see that people who succeed and are gravitating to those things have the personality that allows them to find the right balance between doing a high-pressure job as a CEO versus being able to be sane when they're not doing it.

If we look at the culture of Palo Alto Networks, do you celebrate success?

All the time. Look, the pandemic was a very pivotal moment in my development as a human being and the development of I'd say pre-pandemic, I was very focused on learning the industry, understanding the industry, building a brilliant strategy for the company, because we had to find a way of not becoming part of the normal decline of a cybersecurity company. If you look at cybersecurity companies, they decline after 10 to 12 years, and they sort of take a sort of glide path, which is sort of flattish over time. And our job as as a leadership team was to go change that and find a strategy that works. But, you know, the best-laid plans of mice and men. The pandemic came and gave us a wake-up call because the strategy became almost incidental. What became important is how do you survive a global crisis of that proportion? And I'd say I lucked into it. I met this person who we brought in literally in the first month to come speak to us and our team. And he said, you know, the fundamental thing you have to think about is not your cybersecurity strategy, but the mental state of the people who work with you. And I said, explain that. And he says, look, right now, people are in their heightened state of uncertainty. And when people are in their heightened state of uncertainty, Maslow's hierarchy gets disrupted. At that point in time, all they care about is certainty and predictability. And your job as a leader is to create that. Your job is not to talk about how you're going to win. Your job is to create that comfort and certainty that I am taken care of. And that really started my journey at that point in time because I did, I think, since then, I've talked to 8,000 employees in the company on a sort of small group setting basis. I still do it. I spend a lot of time with people. We put in policies in place saying, we're not going to fire anyone. We're going to make sure everybody's economically taken care of. And we didn't throughout the pandemic. Because our job was to create certainty. And that became such a fundamental basis for our success that it's pivoted into people matter. They're the backbone of the company. That's how we go win. And when people see that leadership is willing to step in and walk the talk, amazing things happen.

You mentioned learning. What are you curious about for the moment?

I'm constantly curious. And I think it goes to paranoia. Because part of the paranoia of being a leader is I have to find the right direction for the company on a constant basis. And the pace at which technology is moving, it's almost like deer-in-the-headlights syndrome right now, right? You wake up every week and there's a new development in technology. And I say that technology, but obviously we're talking about AI right now. But look, if, you know, you find out that somebody is building a $500 million data center, then you find out about agentic AI, then you find out that there's a new Chinese model, which is much more efficient and runs differently. Then you say, what happens to the $500 million data center? Is that going to have a thing to do? Then you hear about protein folding and AlphaGo. Then you hear about image generators. Then you hear about— you look on X and you'll see all these people who are experimenting 17 ways from Sunday. And they're able to recreate all these things. Your brain boggles. It's like, OK, forget about understanding it. The question is trying to sort of put your arms around the implications of this is hard.

Yeah.

And that's just, in a way, in a positive way, it's fascinating because I don't think we've seen such technological turmoil in our lives. And it is scary because you ask the questions, who's going to be the winner? Where is this going to land? Because our jobs are to find the answers in this huge amount of excitement that's going on. So, yeah. So, that's kind of fascinating. It's amazing right now.

I think it's just unbelievable. I mean, I just wake up every day, spin out of bed, and Just what happened yesterday. Yeah, I mean, oh my. I mean, you have the intersection of geopolitical upside down, accelerating technology, and oh my. What's the first thing you do in the morning?

Try not to grab my phone.

Because you think it's been hacked?

No, no, no, because you're saying, wait, I've not had any information for the last 7 or 8 hours. I need to know what's happened in the last 8 hours. And you're I'm pretty sure the first half an hour of waking up, I find my ways to my phone.

But, yeah. When do you wake up?

Around 5:30, 5:00, 5:30, something like that.

How often do you work out?

Not enough. Possibly 3 times a week if I can manage it, but I'd like to do more. But, that's always a challenge. We never grew up working out in India. So, it's an acquired skill that we have to go try and practice. Yes. If I could do one thing.

Did you have a mentor in your life?

You know, Nikesh, my answer to that question is I've had the privilege of interacting with some amazing people and I've been able to use them for different aspects of my life. There are people I can talk to about my personal life. There are people I can talk to about my professional life. There are people I can talk to about financial issues management. It's hard. And I sort of, my principle is it's very hard to hold one person on a pedestal and try and replicate their principles across every part of life because we're all human beings and we do some things better than the other things. So, I try and find somebody for a certain thing that I find amazing. And yes, so have I had people who have been able to mentor me on individual topics? Yes. Have I had a sort of an over-encompassing uber mentor? No.

How do you relax?

Play golf, hang out with my kids. They're 9 and 8. And it goes back to that humility comment and goes back to bringing you back to basics. They do that wonderfully well. We spent yesterday afternoon watching my 9-year-old play football and he was very excited. And we spent half an hour talking about his football. He and I went to watch the basketball game on Friday night. That was amazing. So, yeah.

What do you read?

I struggle to read. I'm more of a summary person than a read person because it comes from the principle, the flip side. People have asked me, would you write a book? And I'm like, why would I take 500 pages to describe what I could in 10? And I think the opposite applies. Why would I read 500 pages to distill 10?

Well, you got some— if you're a summary kind of guy, you got some pretty good tools lately to help you, right?

Exactly right. Exactly right. Look, For not trying to engage my brain a lot, I will watch a lot of Netflix shows to see what the world is doing. And some of those are nonfiction that allows me to learn. But I struggle to read 500 pages. I can't keep my attention that long.

Nikesh, what is your advice you have to your young children? Well, actually, not only young, because you also got a grown-up, but the 3 of them.

Look, at the end of the day, they're all going to have to find their own path. So, my job is to make sure I allow them to experiment and encourage their natural instincts because it's kind of bizarre. It's such a complex combination of personality traits and innate desires that come into a human being. So, it's very hard for me to tell my kids. Most likely, if I tell them what to do, they're probably going to do something totally opposite just to prove their point. So, I try and encourage their experimentation in life. I try and encourage them And what are they trying to do? My older daughter, who's 27, has alighted on venture capital as a career by watching people around me and having lots of conversations. But, it was important for it to be her decision. And she made that decision independently. And of course, she comes and spends a lot of time with me talking about companies or talking about how should she think about life and career. And we talk about it, but I try and make sure the decision in the end is in her hand. Now, of course, being a father, we're all trying to influence it. But, She's smarter than that. And same thing applies to my younger kids. They're young. They're 9 and 8. Right now, it's for them to explore and explore their passions. My son wants to be an NBA basketball player now. We'll see.

We shall see. Nikesh, it's been wonderful talking to you. And a big thanks for protecting us against the bad guys. And please keep up the good work.

Well, thank you very much, Nikhylai. It was lots of fun. And congratulations on what you guys do as well. Thank you.