Palo Alto Networks CEO: "AI Found 5 Years of Bugs in 6 Weeks"

00:00:00One of the biggest winners right now.[music] The big daddy of thecybersecurity space. Palo Alto Networksis a now performer in the space.CEO Nikesh Arora>> This might [music] come as news to you,but humans have been writing bad codefor a very long time.>> I spent 10 years [music] at Google andyou know, Google search wasdemocratizing information. If you takethat analogy and think about what AI isdoing, AI is democratizing [music]intelligence.>> Money is a way to keep track.>> Yeah.>> It's not the goal.>> You've been a CEO of Palo Alto Networksfor 8 years?>> Coming up on 8 years this week.>> And I think when you started it was $17billion market cap if I remembercorrectly.>> There about.>> And this morning I checked it's $238billion. Which if you listen to what wesaid yesterday, now that you passed 100,you're more likely to actually 10X. Sothe first 10X was actually much muchharder. So you're on your way to atrillion dollars.>> From your mouth to God's ears.>> Well, I I think you are. Okay, so let'sjust double click into what you seebecause you aresort of in a really interesting positionto see all of it.You see the birth of AI. Maybe you seeyou've seen the rise and fall of SAS.All the models talk to you. You were oneof>> The rise again, right?>> The rise again.Uh you were one of the first and the fewthat got access

00:01:15to Mythos. So just Letme just push the button. Go Nikesh,start.>> [laughter]>> Well, uh first of all, thank you forhaving me here.I think AI is exciting.I think it's exciting to see all thestuff that's gone down in the lastpossibly 24 months.UmI think Sarah just said it. They wereright in anticipating the huge amount ofcompute that was going to be needed. Soall that stuff's going on. Butyou can seethatyou know, this this notion which wetalked about briefly last time that AIis really democratizing intelligence.What that means is I have 250 people inmarketing. They produce varied forms ofoutput. Now you can get 90% of theoutput to be consistent across those 250people. I have 5,000 people who talk tocustomers.There's My my failure mode is when 5,000people do different things, where peoplesay, "I want to talk to Joe because heknows how to solve the problem and Jimdoesn't."So now you can get 5,000 people to actalmost consistently in theirinteractions with people on the otherside. So I think it's going to have aphenomenal impact to how we runbusinesses, how we operate. It's goingto change the entire landscape.

00:02:30Now,in that context, you touched uponMythos, and you know, Dave has been veryinvolved with this.Mythos has shown us that all the badcode that humans have written over thelast 50 yearscan be assessed by AI and shown uh thevulnerabilities can be shown. We testedfor 6 weeks, and in 6 weeks we foundwhat would have taken us 5 to 7 years.>> Wow. Say that one more time.>> In 6 weeks we found vulnerabilitieswhich would have normally taken us 5 to7 years to find.>> So Mythos, but these are vulnerabilitieswhere?>> Sorry?>> These are vulnerabilities in your owncode base or in your customer or in yourown code?>> Oh, wow.>> So Mythos was not oversold. It waslegit.>> The capabilities of AI in being able toassess vulnerabilities in code are real.Not just that,if you put it on ultra mode, which ispersistent thinking, so it keeps tryinguntil it gets an answer, you canactually daisy chain vulnerabilities,i.e., finding a new attack path intoyour company into your vulnerabilities.Now, we pride ourselves as a toppercentile of companies that test ourcode because we're in cyber securitybusiness. If you take that and compoundthat across all the companies that existin the world that write their own codeor the 10 million developers write code,this

00:03:45thing is going to find stuff whichwould have taken us 10 years to find.>> How much did it cost? Like did you trackthe token cost? Was it a hundred milliondollars, ten million dollars?>> No, it was in the low millions. Butagain, you know, the cost as Sarah said,the cost curve is going to come down.Already OpenAI has got a model which ischeaper and more consistent. You know,Anthropic's come out with another model>> you buy the hype.>> It's not hype, it's true.>> It's That's the point.>> the capabilities are>> The You know that.>> The capabilities are true.>> Yes.>> I mean, you saw IBM announce a projectfor five billion dollars to fix opensource. That's the biggest problem.>> What would have happened if Claudedidn't have the restraint and they putit out in the public? Do you think itwould have been like a real attackvector and caused chaos in corporations?>> we're three months away, if not alreadythere, from this being available inthe wild.>> Okay, open source.>> Yeah, just three months.>> Yeah.>> Yeah, cuz I mean, we've been saying thatit's roughly six months away beforemythos-level capabilities are availablein Chinese models, you know, openmodels, whatever. But you're saying itcould be three months.>> Well, look, there's what, is 4.8 isalready out, 5.5 is already out. Theyhave similar capabilities. And look, youdon't need to

00:05:01crack the hardest code to crack. Justneed to find a few vulnerabilities incode that are out there. Just take anTake an old industrial system which isrunning, you know, OT code on the edge.You can find that vulnerabilityreasonably easily.>> So, so we're in a race right now betweenthe cyber defenders finding thesevulnerabilities and patching them beforethe cyber attackers do the same thing.>> Yes.>> And how do you feel like we're doing inthat race?>> So,not as well as we should be doing, whichis great for our business, but that's adifferent story.>> [laughter]>> So, like, every company has to go lookat their code base and figure out wherethe vulnerabilities are and fix them.So, if you talk to CIOs today, theirbiggest problem is all the vendors areshowing up saying, "Please patch mypiece of boxes that hardware that youhave please patch my code that you havebecause I found vulnerabilities fix it.While the CISOs are busy finding theirown vulnerabilities to fix their ownvulnerabilities and then this huge thingcalled open source which nobody knowsquite how to solve.>> So is it is it fair to say that it asmodel capabilities go upsystemic business risk of largeenterprises also goes up?>> On the cyber side, yes.There are antidotes being built bypeople like us and others where we'regoing to provide some capability

00:06:16whereyou don't have to patch everything. Butlook, cyber has done something veryinteresting around harnesses, memory andcontext. Right?The part we don't talk about here isorganizations don't have memory andcontext of everything they do every day.That's why you need to store a lot moredataenterprise-wide to learn what good lookslike and what bad looks like.>> Right. The same problem is incybersecurity.>> We need to collect We need to collect 10times the data in the enterprise from acyber perspective to be able tounderstand how todefend ourselves against the AIattackers.>> Do you think that the traditionalcompanies like the SaaS businesses thathave existedin this world, what is their place?As all this knowledge becomes morepersistent and stored, what happens toSaaS?>> Well,you see SaaS is as Bill said, SaaS isdifferent pieces, right?>> Okay.>> If you're an analytical SaaS company,it's over.>> It's over. What is an analytical SaaScompany?>> Somebody that says I'm going to collecta lot of data for you and analyze it foryou. I don't need you to analyze it forme. I can runmodels against data and analyze themmyself. So if you think about there's alot of every SaaS company has amarketplace. You can buy Salesforcemarketplace. What do they say? You haveSalesforce data, I'm a marketplace app,

00:07:31take me and I'll help you analyze thedata. I don't need you.>> You don't need that.>> I can just go run an LM against thedata. So the entire incrementality thathas been sold as incremental softwaremodules to all of usdoesn't need to be sold to us becauseI'd much rather have LLMs runningagainst that.>> Interesting you bring this up. We had aninstance with a SaaS product with 20seats.Nobody was logging in and using it, butthe data was there.>> Yes. So, we created like three accounts,got rid of 17, connected it to Slack,connected it to Claude, and noweverybody can interface it throughnatural language and we've reduced ourbill by 90%.>> Well, not just that, what are you goingto do next? TheyJason said, you're going to take datafrom different products, put them in oneplace, run the analytics against that. Iwant my data for my sales reps, myproductivity data, my you know,inventory data from SAP. I want it allin one place so I can run analyticsagainst it and say, "Who's selling alot? Where do I have less inventory?Let's build inventory in a region wheremy sales people are extremelyproductive." To run that query, you'dhave to have talked to three differentSaaS products. Tomorrow, you can put allthe data in one place. So, so that'ssort of category one.>> Analytics SaaS today. The analytics>> Okay,category one analytics dead.>> Yes. In the medium term, you

00:08:46get allthese bounces today and tomorrow that'sthese are marginally irrelevant.Infrastructure software undervalued.>> Okay, what is infrastructure software?>> Stuff that gives you databases. Youcollect data into it. Stuff that allowsinfrastructure to work, whether it's a,you know, database software.>> Databricks, Snowflake, like that.>> Databricks, Snowflake, MongoDB, Oracle,Oracle, all these things you needcore storage infrastructure, core data.You're going to need 10 times the datastored in an enterprise than we havetoday. Right, 3 years. 10 times.So, anything that helps you collectinfrastructure data, manage it, youneed.I think the category in the middle iscalled, let's call it system of workor system, you know, of record, peoplecall them.Those are deeply embedded in the waybusinesses work. I have 6,000 salespeople, they know how this works. What'sgoing to happen is step one, we willtake away UI and let agents do the work.UIenterprise software and consumersoftware UI is the worst thing we did astechnologists.>> You had a couple of examples of this.You told me this story, I don't know ifyou want to repeat it, of this onecompany they tried to hold you hostageon a license.>> Yes, that was analytical SAS, so that'sover.>> just pointed AI at it and you just>> Yes, we just got rid of them. That's adifferent issue. But, I mean, thinkabout it. Today, we spend our liveshaving product managers

00:10:02design UI so allhumans can interact with data behind theUI.>> Yeah.>> If all like if you believe agents aregoing to work, and I say, I just tell anagent, look, figure out from my salescall, figure out the key points, and gopost it intoyou know, whatever sales tracking systemI have, whether it's Oracle orSalesforce, right? An agent conceptuallyshould be able to do it. we'respending trillion dollars building theseagentic backends, we need these agentsto be able to do it. If that happens, UIgoes away.If UI goes away, I can rewire my systemof work.Right? I have sales guy should have tosay, I had the sales call, do all thepaperwork and all the that needs tohappen in the back of the company, andjustI'm done.>> Right.>> If I can change the waywork happens, which is where you willget true efficiency, where five peoplebecome one in a company,all these SAS software that does systemof work needs to be re-engineered forthe next five years.>> And it's also happening passively, whichis really interesting. It's looking atemail, it's automatically taking theZoom transcript and summary. So, thesales system of record is now like, youdon't even need to input it. It's like,I already have the Zoom call notes, Ihave the deck the deck was made, thesales deck was made by AI. It's justwe're we're all going to be looking at

00:11:17achat window and just saying, here's whatI want.>> Your audit trail becomes a lot betterbecause humans are not touching yourdata. It's always being managed byagents, so I think the whole system ofwork, system of record, gets reinventedin the next five years.>> Yeah, there's no data entry. That's aninteresting point. Yeah. Let's talkabout national security for a second. Ijust want to maybe zoom out. So,the one side of Mythos, as you said, islike the value that it has to you and toyour and to enterprises.The red team version of Mythos is whereforeign state actors or you know, canessentially create economic havoc insideof a country.>> Yes.>> As these models escalate in theircapability, what do you think shouldhappen when these models are ready?>> You know, the sad truth is, you know,here there's a few thousandbreaches or attacks that happen.They happen for pretty rudimentaryreasons. It's not because somebodycracked a hard to crack thing. Ithappens because 89% of attacks happenbecause credentials get stolen.>> Or your username and password.>> That's it.>> I bet my password is password.>> Yeah, I'm sure it is. Did you havedollar sign?>> Dollar sign password.>> Fantastic. Well done, see? You'realready ahead of everybody else. So,89% of breaches happen because of simplethings. So, I don't think we need moremodels to go crack this stuff. Now, wewill need these models can attack

00:12:32critical infrastructure and things wetry and protect from a national securityperspective. Yes, we need defensesthere. I'm not worried aboutthe national security part beingprotected because they're very on it.They're the right people. They spend 10%of their budgets on IT on security. I'mworried about the small offices acrossthe country where they're using somepiece of packaged software and you'rerunning a dentist's office or doctor'soffice. Remember when then ChangeHealthcare got breached?>> Every physician's office shut down.>> Shut down and it's ransomware.>> Because of ransomware to ChangeHealthcare. That's was the clearingsystem. That's whenUnited Health had to actually have givebillions of dollars of credits to thephysicians to be able to run theirbusinesses at that point in time.>> That's what one should worry about. It'sless about>> the big nuts will get cracked.>> about cracking some PG&E powergeneration facility. It's more economicchaos. Yes.And so, what what what do we do?>> I don't think there's a sort of a silverbullet. I think this will take time. Ithink this will basically take a whileuntil every system gets upgraded,renewed, fixed over time. I just thinkit increase the terminal value of theindustry, right?>> Do you think that there's a world inwhich these models become so good that

00:13:48you could see yourself advocating formore nationalism around how they'recontrolled andhow they're managed and how they'rewhere we point them? Or do you thinkthere should be a maybe a set of thesemodels that never see the light of daythat only the NSA and other folks gethave access to or guys like you?>> I have a slightly differentiated viewabout models and how they will evolveversus what we heard earlier from anopen AI perspective.I thinkI still believe models are going tobecome a utility layer.You'll be able to buy intelligence onthe [snorts] fly.Or you can say, "I don't need a 180 IQperson to go do this task. Give me a 120IQ and I need a 250 IQ to do this task.I'll pay $10 for this or for this I'llpay 1 cent." So, I don't know there's aone-size-fits-allgive you the most up-to-date model toanswer my customer call saying, "Sorry,sir. I have no idea how to solve yourproblem."So,I think models will get differentiatedfrom utilitarian perspective.Um so, if you look at already what'shappening in the market, right? Theprofit pools are in applications, not inmodels. More Sarah talked about Codexrunning away. She didn't sayOpen AI is running away. She just Codexis running away. Just say that's the wayI'm sure Dario says Claude code isrunning away. So, you're seeing

00:15:03that>> They're attacking profit pools.>> They're attacking profit pools becausethat's where the money's going to comefrom. The profit pools are inapplications that companies can use. Theprofit pools are not in model usage bycompanies because most companies have noidea how to use the models.>> at these companies in a way Open AI andAnthropic as the new Microsoft Officecoming in and doing all applications,all productivity software fororganizations.>> No, I see there's going to beapplication companies that are going toarbitrage between models and solve yourbusiness problem.>> So, you still think they won't go to theapplication layer? Because this is a bigdebate. Should you engage with OpenAIand train their systems to then takeyour business from you?And Anthropic keeps releasing theirlegal model, their accounting model. Andit does feel like in order for them tohit their revenue numbers, they mightneed to do what Microsoft did, which isrelease the Office product on top of theoperating system.>> See, if I'm a company, I don't want towrite every piece of software myself. Iwant my HR system software, which isagentic enabled and AI enabled to bedelivered by some application company.It'll be a new AI application company. Iwant my sales management system built bythe new agentic AI sales force of theworld, whether it's sales force orsomebody

00:16:18else. So, I want applications.Now, whatSarah said is the profit pools are inthe application layer. That's why theywant to be the application layer. So, Ithink we're still waiting for that layerof companies to be invented or createdwhere applications will sit. Because50,000 uh companies need the sameapplication. Why would I build itmyself? It's highly inefficient. It'ssilly for me to use OpenAI directly andrewrite my entire sales system becauseuh I'm smart. Right? I'm not. I wantsomebody to do it for me. So, I thinkthat layer of companies is still notfully formed.>> Or so, we're going to be waiting for it.>> control plane, a harness, and then>> That's right. They will build theharnesses and the memory into thoseapplication layers. Now, the question ishow big is the application layer? Is itone application? Is it Is one, you know,enterprise application that doeseverything? Or is it specializedapplication?>> and you kicked out this software vendor,you did it because they were beingabusive in pricing. So, that>> use a different vendor.>> What's that?>> We swapped out for a different vendor.We just took more control.>> Love it. So, it really is a pricingissue. And and that's why the SASapocalypse in some ways makes sense.They're not having pricing power becauseyou could say, "Well, I'll just put 10developers on this and I'll save $10million." Yes.>> I think the part back to what Chamathsaid about the regulation or whether youwant to regulate these higher-poweredmodels,

00:17:33the question is at some point intimewhen these newer models, which are evenmore powerful, get built, they will comeat a different price point and theymight have to go through a certainvetting process to understand what theircapabilities are. But I think we're in aglobal race.I don't think holding back our modelsfor 3 to 6 months is going to help usany. Somebody else is going to put themout in open source.I I wasI was shocked to hear when I was talkingto the CEO of one of these modelcompanies. He says, "The entire weightsof their most recent model can fit on aUSB stick.">> Say that again. The entire weights>> model weights of their newest model fitson a USB stick. That's the IP.>> Yeah.>> That's incredible because all the datacan be distilled in under 24 to 48 hoursand model comes out.>> I'm curious>> That's the IP. So, are you telling methatyou know we can hold on to that for 6months?>> Right.We we have a debate about um howdifficult it is to make a frontiermodel. Some companies are starting tothink about making frontier models usingtheir data advantage to to build theirown.Have you thought about that atPalo Alto because it [clears throat]does seem like you have proprietaryknowledge on how security works. Couldyou build your own large language modelor a VSML,

00:18:49a small language model thatwould give you some advantage in thefuture?>> nobody talks aboutis the false positive rates on themodels.What is the false positive rate on 4.8and 5.5?>> No idea.>> You guys don't talk about it. Youshould. The false positive rate on MSOwas 30%.>> Oh, wow.>> Right?>> So, it thought it found something, butit hadn't.>> Yes. So, the problem isit's great for attack, it's horrible fordefense.Cuz you find 30 times 30% of the timeyou find something that says, "I found aproblem." And you say, "Let's plug thehole." Wait, there wasn't a hole therein the first place.>> No missile inbound.>> Right.>> Yeah.>> So, now the same problem applies inenterprise. If you use a If you use amodel without the right harnesses, theright training, you could be runninginto 10 20% false positive rates. Let'suse the model to pay I don't know,insurance claims.>> Yeah.>> Oh, great. 10% 20% false positive. Ijust lost money.>> The sycophantic nature of these isridiculous, yeah.>> So, so the problem is not who wants thenewest model. The problem is how do youtake that model with 20% or 10% falsepositive and make it 0.01% falsepositive. In my business, I want 0%.>> Without losing the false negative.>> Sorry?>> Without losing the negative, the falsenegative.>> Yes, but it's

00:20:04like saying, "Hey, let'stake the new self-driving car. Mercedesis going to use Opus 4.8 and you canjust sit in the car and it's going todrive you." I'm not putting my kids inthat car with a 10% false positive rate.Are you?So, there's a lot of work that happenspost a model, which needs to happen tomake this thinguseful and effective in the businesscontext.>> Let me slightly pivot for a second. Youwere for a very long time the chiefbusiness officer at Google.You were the president of SoftBank.Now you're the CEO of Palo AltoNetworks. So, let's play armchair CEO.>> Armchair CEO.>> Armchair CEO.>> I'm still I'm still bristling from DavidFeiberg trying to create a distinctionbetween founder CEOs and non-founderCEOs. Just saying.>> [laughter]>> Just saying, David.>> By the way, false positives.>> Sorry?>> And false negatives, too.Give us what you would keep, what youwould change, and what you like aboutthe following companies.>> This is going to get recorded and putout there to say that really something Idon't know.>> thoughts. You're one of the smartestbusiness people>> don't like get to live with the glory ofthese all-in podcast sessions.>> Don't>> Okay, ready?>> people and roasting people.>> ready?>> Yeah, sure.>> Okay.>> [laughter]>> What you keep, what you change, what youlike, what you don't like. Uber.In a world of a>> it, dude. I can't talk about my>> on the board of Uber?>> I'm on the board of Uber. I'm not goingto talk about Uber.>> I didn't know that. Sorry. Okay.>> Dr. Dara,

00:21:19he's the CEO. He's a greatguy.>> Okay. [laughter]Uh Waymo.>> You're trying to get me fired.>> Waymo.>> What do I like about Waymo? The carswork. It's amazing.They should have more.In many more cities around the world,faster. I I I would say that at the ratethat I'm going to be fired.>> Google red large.>> I think Google's underrated.I think it's going to be the firsttrillion-dollar company in our lifetime.I think they have all the assets thatarethat are needed to make this successful.I think people underestimate. You can bea model company, you still need to havea sales force that convinces customersto go out there and embrace these modelsand buy them. And if you think about it,three hyper scalers have the biggestnumber of sales people out there. So,they should>> of why they're a little bit undervaluedis just the conglomerate nature is hardto understand?>> I don't know. You guys are smarter thanI am. I'm just a hired hand CEO.>> I didn't say that. Reeboks said that.Let's just be clear.>> I know. I know.>> I was I was providing a thesis onrecovery out of the SAS pack. Let's justsay.>> Okay. Okay. Got it.>> Just to be clear,there's there's a way to segment thatbasket. Okay? And you're not in thatbasket.>> I thought you were making a distinctionabout how people who are founders CEOshaveuh have the right to take more riskand are allowed to take more risk.>> saying that.And I think and I and I think you youprovide a unique

00:22:35counterpoint to that.And and there's not a lot of people likeyou. I think the same would be true ofJeff Weiner. And I think that there's afew otheruh really great CEOs, but they are likeNeo in the Matrix type anomalies. And Ithink you're one of those people. Andthere's a very rare kind of personalityprofile of someone that's willing totake risk and take ownership ofsomething that wasn't theirs in thefirst place and they make it theirs. Anduh it's a it's a extraordinarily uniquetrait. Far more unique actually thanbeing a scalable founder.>> That's an incredible save.>> You're forgiven.>> Yeah, good save. Incredible save.>> back to Armchair CEO.>> Wow, that was incredible.>> He's more sycophantic than ChatGPT.[laughter] He's like, "Actually, I'mactually I'm actually the best.">> Let's go Let's go back to Armchair CEO.>> I'm liking this. He has Open AI moreoften. Yes. [laughter]>> They do sell faster.>> Open AI.>> They should sell faster, right?>> They should sell faster.>> I mean, I I you said it. Didn't you justsay it when you were Sarah was here that>> And Anthropic seems to have improvedtheir ARR much faster than Open AI.>> I mean, that's just the statistics.>> They kind of went all in on enterprise,and including specifically.>> I think I think that's likethe the conversation right now is it's arace to take over the profit pools.If you are going to need tens and tensof billions of dollars every year to getWhat is that? 1 gigawatt is

00:23:5010 billionof revenue.>> to build you? What are the mostWhat are the most exciting profit poolsthen?>> So, what are the most exciting>> It costs 50. So, this is not a greatdeal.>> So, what are the most exciting profitpools then? So, we>> You've got coding. That's been thebreakout application over the past year.It's massive.You've got infrastructure, like yousaid, the new databases. I thinkcybersecurity is clearly one of thembecause of the threats and patchingcycles so much more dynamic.>> There's There's a slight difference inin Yes, as you can see, these models aretrying to be the the enablers of bettercybersecurity, which is good because allof us need to use them to test. Andyou're probably going to see I mean, youyou saw Anthropic is alreadyuh made their cyber capable modelavailable generally, so that everyonecan use it. And Open AI has got one. I'msure Google has one, too. But theyunderstand this is a place where CISOsor chief security officers want to useit to test the code. So, this is anotherprofit pool. Uh I think we haven't seenthe onslaught against the applicationsoftware companies yet. I mean, there'stens and tens of billions of dollars inapplication software, which is waitingto get reinvented, as we talked about. Ithink eventually you'll see these peoplesaying, "What if I took this 40, 50, 100million dollar time down, I can build awhole brand new backbone with agenerative AI, and it'd be sodifferentiated that it will causecustomers

00:25:05to move.">> We are seeing it as a playbook in theacceleratorsnow. The year zero and year onecompanies, people are coming to us withthe pitch, "This is a thousand dollar aseat per year,five hundred dollars a month seat SaaSsoftware. We can do it for less. We'regoing to charge them based onconsumption. We're going to take 80, 90%of the cost out as>> What are the two fastest places to makerevenue?>> The two fastest places to make revenue?>> Yeah.>> In enterprise a replacement apps. If youreplace something, I already have abudget, it's easy. I take something bad,I replace it something better,I get money. So, replacement apps arebeautiful. If you can replace anindustry, replace the profit pool, it'sgreat. The second place is consumerrevenue. It's a lot easier to get fivebucks from a per user on a consumerside.>> Netflix.>> So, that's where I mean, look at it. Ithink we collectively probably pay moreon subscriptions per month than we everdid historically, and you thought yourcable bill was high.>> Yeah.Do you think that you're going to end upbuilding more or less hardware in thefuture if you had to guess?>> Hardware, even today, is the cheapestway to uhmanage low latency, high throughputbits.You still need a data center.>> Yeah.>> What's a data center doing is justmanaging high throughput, low latency

00:26:21bits.>> Yeah.>> That's why if you look financialservices is the most reluctant industryto go to the cloudbecause you increase latency.If you increase latency, you reduceprofit. So, if you look at every of yourlargest financial services company,whether it's Goldman or JP Morgan,Morgan Stanley, orthese guys, they're using hardware.>> Try to get them to run their business inthe cloud, they can't because they willhave higher latency, they will losemoney.>> Right.>> So, hardware is still being made. Imean, I remember when I used to adviseSilver Lake, and I had have Dell wasdone. Nobody wanted hardware. I thinkDell's might be back to like a 3 400billion dollar market cap. So, hardwareis still going to be around. We're goingto need it. It's the fastest uh way tomove it.>> Are our hardware development cycleschanging because of AI? Like are youseeing a lot of like generative designstuff moving in silica that historicallywas manual and long cycle?>> Yeah, but the long pole in the tent istheir design, right? The long pole inthe tent is production. Today, you can'tget a box produced because everyeverypiece of hardware componentry is backordered. Everything's expensive andevery factory in the world is backordered because we're trying to buildall these GPUs based, you know, chipcards for every data center in theworld. So,>> Do you think the US is equipped to fillthat supply

00:27:36chain need?Can we do that here? Or do you thinkwe're just done?>> 10 years.>> With a with a with a firm top-downcommitment.>> Well, I mean, the good news is thatI think the hardware industryis seeing a bonanza of a lifetime.And generally, when you see a bonanza ofa lifetime, you can go commit 10, 20,50, 100 billion dollars. I mean, I'veseen a CEO on television committing a100 billion dollar plan to go build morememory.So, that's good. That means they havethe money to go put the money in theground, literally, to go build thesethings for the future. So, I think thatgets us more certain that the fact>> I think the tax incentive has a big hasa lot to do with that. The accelerateddepreciation on the the CapEx. You get a100% write-off in the first year, right?Under the under the year.>> Just a Just a final question as we wrapup. You, over the last 8 years,you've grown organically veryaggressively, but you've also beenpretty acquisitive. You'll, you know,you'll take shots and they've generallyworked. So, you have a ton of permissionin the market.When you hear what Bill Ackman saidabout how there's this kind ofover beaten companies, there's a fewthat get celebrated, that's a ripe poolfor you to pick from.But some of that would require you to gomaybe a little horizontally far afield,some would say.How do you maintain

00:28:51the discipline or doyou see yourself at some pointconsidering things that arenot nearly so much right down the middleof of cyber?>> So, I'll tell you what. Umuntil about a year and a half ago, weused to buy product companies and throwthem into our go-to-market engine.We could rewire their back end so theycan work better with our go-to-marketengine. So, for me, if I'm selling $10million to a customer, next time I go toher later if I can sell them 20, it'sthe most efficient way for me toamortize my go-to-market spend, right?So, that was the model. We played thatwe ran that playbook to north of 150billion. Then we got to a point where itsays, "Oh, we see an inflection arrivingin identity. It's going to be importantfrom an agentic perspective, securityperspective." So, we bought a $25billion company, which we closed 3months ago.Umnow it's actually a very differentopportunity has presented itself.And the different opportunity sort ofgoes like this. If you can be the bestat leveraging AI to run the mostefficient enterprise business in theworld,your operating margin can be far inexcess of the industry.And if you can if you can crack thatcode>> Gross and net, you're saying? Gross inthe 90s, net in the 40s.>> Yeah, if you can crack that code, thenit doesn't matter what you buy.>> Yeah.>> I think the problem right now is theexecution problem. Most subscalecompanies cannot afford to go optimize

00:30:07their company and run it better.So, if we can run our company muchbetter than everybody else and have ahigher operating margin, then the streetwill say, "Fine." If you take somethingat a 20% margin, make it a>> Your first M&A was really tough, no?Like they were pretty skeptical and thenyou kind of shoved it in their face.>> pretty skeptical when they found a guywho didn't know cybersecurity, didn'tknow enterprise show up, who worked atGoogle, and their you know, the trackrecord of people leaving Google andbeing successful out of Google is still>> Yeah.>> varied.>> So, basically you're saying the menu'sopen. And>> I I think we need the next 6 to 12months to figure out how this AI settlesdown and how can we use that effectivelyin enterprises? I think if you thinkabout it, uh you know, thethe the people keep hoping that lesspeople we need to run companies. Iactually have a counter view. I thinkwe're going to have more people at PaloAlto on the technology side than we'veever had before because I think AI iscausingeverything to ask for a transformation.So, I have more technical people todaythan I would have had if AI didn'texist.>> Ladies and gentlemen, CEO Palo AltoNetworks, Nikesh Arora.>> Thank you, guys.>> [applause][music]>> Thank you, sir.