Nikesh Arora

Arora’s core thesis: cybersecurity is at “the beginning. This is not a moment.” AI labs are “flexing” models that find and daisy-chain vulnerabilities, and “it’s a lot easier to attack… much harder to defend” — so bringing the world’s infrastructure “up to snuff” against a “deluge of AI attacks” requires every cybersecurity company. The load-bearing number: zero-days averaged 55 days to fix while Mythos will find them and try to attack in minutes, and at Black Hat Palo Alto Networks launched patch delivery in four hours, deployed to every customer — “from 55 days to four hours.”

The “Mythos” incident did what eight years of CEO outreach couldn’t — and it structurally favors incumbents. After being shunted to technology teams for years, Arora now has every CEO asking “Am I vulnerable?… Why can’t we get Mythos?” — and they’re asking their existing “cybersecurity partner of choice,” an advantage to big players. He also pushed back on host Molly O’Shea’s framing that labs want a slowdown: his read is that they probably want governance so they can keep developing at pace, as happened when they tried to launch “Mythos or Fable 5” and were held back because the model was not appropriately guardrailed.

He called the end of the “SaaSpocalypse” for cybersecurity six months ago, when the market “indiscriminately decided that every software company was destined to go to zero” and SaaS fell 50%. His edge-case logic: “AI can be great at 80% use cases. We live in the point one percent use case… the needle in the haystack.” But the bigger call is categorical: “None of the software in the last 20 years came with an opinion, so the entire software industry will get rewritten in the next 10 years” — with the market “possibly getting a bunch of them wrong” on which companies survive.

On the macro, he thinks demand is underestimated “across all dimensions” — compute, intelligence, capability — yet concedes the market “is pricing in perfect execution for every company.” He says it’s “highly possible that 10 to 20% of our operating spend moves more towards technology” over ten years and “I don’t buy the jobs argument,” but expects the market to get “more discerning” roughly two years out, with “stumbles and bumbles over the course of the next two to five years” — a late-’90s parallel with compressed timelines (“what you thought was gonna take five is gonna take two”).

On the market-cap rise from $18B when he joined to O’Shea’s roughly $300B figure, the playbook is to reverse-engineer market expectations of durable growth, then live in two-year paranoia. Visibility “begins to thin” past two years, which is why Palo Alto Networks bought 40-plus companies in eight years — and sometimes he defies the market outright, as with the $28B CyberArk deal the market hated until results flipped it to “Holy shit. We love it.” His M&A humility rule: “You kicked our ass. Come tell us what we did wrong. Come run this for us.”

Talent regime for the AI transition: twice-weekly “AI I/O” sessions where the top 24 technical people teach each other for two hours, plus hiring from hackathons since roughly nine months ago. The filter: “If you’re not going home and figuring stuff out yourself… where am I gonna find these people?” Overwhelm teams with AI-natives and laggards “self-select out” — explicitly rejecting an approach that assumes a third of staff “are not going to get it.”

The career wisdom is quotable and contrarian: “There’s only two days that matters: the day you get stock, the day you sell stock. Every other day, it’s a vanity number.” Masa’s investing lesson stuck — stop spending effort fixing the broken company: “You might make more money on the one that quadruples than you fixing the one that’s broken” — and he closes on Steph’s “next-play mentality” and “karmic calm” as the answer to O’Shea’s charge that his paranoia and serenity contradict: “Life is a series of contradictions.”

🔗 Original source & video: From $18B to $300B: How Nikesh Arora Rebuilt Palo Alto Networks

Airtable sold to Bending Spoons for $1.285B — $485M revenue growing 20%, roughly 2.8x sales against an $11B 2021 mark — and the real shocker per Jason Lemkin wasn’t the price but that no PE firm counterbid despite Francisco Partners raising $22B to do deals like this. Nikesh Arora’s read: PE has “a full roster of stuff they’d like to sell to Bending Spoons,” not buy against them. Jason’s warning for boards: this may trigger “a quiet wave of airtabling” — founders and investors at 20% growth quietly capitulating.

Leo [likely Aschenbrenner] was “absolutely right on trend, absolutely wrong on portfolio construction” — Nikesh’s verdict on the Situational Awareness fund’s implosion: a $225M vehicle that at one point held $45B of assets on 4x leverage, its public book bought by Ken Griffin’s Citadel for a reported $16B (Ken reportedly up ~$3B). “It’s almost like it was inevitable.” Rory’s cost-basis point: early LPs (Collisons, day one) still made money; “if you bought in in April, May or June, you’ve been wiped” — and late investors may read the docs and litigate.

Anthropic’s model breaching three companies could start a security supercycle. Nikesh: the average zero-day found in the wild takes 55 days to patch while models now find vulnerabilities “in split seconds”; the capability he predicted in six months arrived in four, and open-source distilled attacker models are 2-3 months out. “I spent eight years trying to get CEOs to talk about cybersecurity… Dario did it in one fell swoop.” Rory’s translation: last year’s security stack is wholly unfit for purpose — enterprises are about to buy a lot more.

“Average intelligence is going to be free and the average intelligence will get smarter” — exceptional intelligence (cancer cures, space data centers) gets paid for; nobody pays $6 per million tokens for customer support. The corollary: “over the next 3-4 years we won’t be paying for intelligence, we’ll be paying for compute through our nose,” and “land, permits, energy — this is the thing that is going to get priced for the next 3 to 5 years.” Even chicken-manure methane is selling to hyperscalers at a multiple.

Context, not model choice, becomes the moat. Nikesh is betting the next 3-5 years on organizational context — vector DBs, transcribed customer cases, “more people collecting context than I’ve ever had” — so any frontier model can be swapped in. The coming war: Satya wants context in a harness beside commoditized models; every model company wants it inside the model. For enterprises that can’t manage the switch: “Bending Spoons. Bending Spoons.”

Q2 was bullish for anyone selling inference: Google Cloud +82%, AWS +37% at scale, Microsoft +20-30% — roughly $100B of new annualized revenue across four companies — while Meta spent without an obvious payoff and got marked down. Palantir grew ~100% with bookings +153% off 1,049 customers. Nikesh on the ~$1T of committed capex: not a demand problem, a timing problem — “one more run at the roulette table.”

If OpenAI and Anthropic miss their 2027 numbers, that’s a dislocation, not demand destruction — “that’s called a buying opportunity.” Rory’s scenario: Moonshot (fresh $3.5B raise at $35B) becomes the model of choice on the same compute at 10-cents-on-the-dollar tokens — “Moonshot is happy, Nvidia is happy, enterprise is happy, OpenAI very very sad.”

🔗 Original source & video: Leo Aschenbrenner’s Situational Awareness Blows Up | Moonshot AI Raises $3.5B at $35B

The headline call: token prices fall, with reductions over 3-5 years, toward 1/10 of today’s level. Arora’s mechanism: compute is scarce and costs “two to three X or four X more than it used to cost 2 years ago,” half of it feeds free consumer usage that is “fundamentally loss-making,” so the pressure lands on the paying half — enterprise coding. Once frontier labs have enough post-training data, he expects them to actively constrain consumer use, and cheaper tokens then unlock consumption — which is why he won’t call whether token spend per developer settles at “3.8 or 20” percent of salaries.

The frontier model problem is breadth vs depth. Consumers are “highly tolerant” of false positives — Gemini wrote him a passable investment memo in 4 minutes — but enterprise agents making independent decisions demand zero tolerance. Waymo is his benchmark: “the biggest agentic product out there,” built on tens of billions of dollars of edge-case training on data that isn’t on the internet. “You can’t stick the next model of Anthropic into your Mercedes and say, ‘Okay, drive me home.’” Coding is the one universal enterprise use case; frontier revenue beyond it needs depth.

Memory becomes the moat — and the fight is over where it lives. Frontier models “will spend a lot more time in the next year or two building memory around consumption,” because user context creates stickiness. The risk for enterprises: memory embedded in the model makes you “model captive, not model agnostic,” and the orchestration layers that could keep you agnostic “are not as well funded as these models.”

Enterprise AI is not ready, and most buyers are doing it wrong. More than half of enterprises are bolting AI onto existing workflows for 20% gains instead of rethinking them; SaaS “has no opinion. AI applications will have opinions.” His rule of thumb: half the people in G&A functions (marketing, finance, HR) within 3 years — but more technical and more sales headcount, not fewer people overall.

Mythos is “an accelerant to cybersecurity,” not a threat to it. Pointed at Palo Alto’s own code, it found in 6 weeks what would have taken 5-6 years — but a defensive auto-patch “is going to patch 30% things which are not wrong,” so attackers get weaponized faster than defenders get automated. That asymmetry lights a fire under security budgets, and he says there is no “cloud” or OpenAI endpoint agent to displace his 150 million sensors at the gate.

The SaaS repricing is rational confusion, not oversold panic. Systems of record face workflow reimagination, the analytics layer is being absorbed by data lakes plus LLMs (Snowflake, Glean, Databricks), and nobody knows how many seats survive — “I don’t know what the right valuation is.” On Salesforce’s best days: “that depends on how they execute from here on.”

Consumer AI may not be ad-funded at today’s compute cost. From his Google CMO years: online already took 60-70% of a ~$500-600B ad pie growing only 3-5% a year, so ad dollars for AI must cannibalize existing budgets. The opportunity is transaction revenue — average conversion runs 1.5-2%, meaning “85 to 90% of marketing is wasted,” and consumer goods carry 92% distribution-and-marketing cost that AI targeting can compress.

Quick-fire alpha: FOMO has compressed diligence windows — “You had 20 years to invest in SpaceX. You had three to invest in Anthropic” — and the discipline against it is his board member’s sunk-cost walk: ignore the 3 months of effort, ask “if this walked in the door right now… would I take it or not?”

🔗 Original source & video: Nikesh Arora on the Frontier Model Problem: Breadth vs Depth | The Future of Token Costs

Arora says Mythos-level code analysis is real, compressing years of cybersecurity work into weeks. A six-week Palo Alto Networks test found vulnerabilities that normally would have taken five to seven years, for “low millions,” while persistent “ultra mode” could daisy-chain flaws into new attack paths. He believes comparable capability will be in the wild within three months, if it is not already.

Analytical SaaS is “over” because enterprises can point language models directly at their data. Jason described cutting an unused 20-seat product to three accounts, connecting its data to Slack and Claude, and reducing the bill by 90%; the next step is querying sales, productivity, and SAP inventory data together rather than buying separate analytical modules.

Infrastructure software becomes more valuable as AI destroys the analytical layer above it. Arora expects enterprises to store 10 times more data within three years, supporting databases and platforms such as Databricks, Snowflake, MongoDB, and Oracle. Systems of work and record are deeply embedded, but their interfaces and workflows could be rebuilt around agents over the next five years.

The model layer trends toward metered utility economics while applications capture the profit pools. Buyers will purchase different levels of intelligence at radically different prices, while application companies arbitrate among models and supply the harnesses, memory, and business-specific reliability enterprises need. The fastest revenue comes from replacing an existing budget or charging consumers roughly $5 per user.

Cyber risk rises asymmetrically because attack uses can tolerate errors that defensive systems cannot. Arora said the false-positive rate on MSO was about 30%—useful for finding possible attack paths, disastrous for paying claims or protecting a vehicle—whereas he wants 0.01% or ultimately 0% in his business. Meanwhile, 89% of attacks or breaches still begin with stolen credentials rather than sophisticated exploits.

Arora argues Google can become the first $1 trillion company because it combines models, assets, infrastructure, and enterprise distribution. Model quality alone does not close customers; the hyperscalers possess the sales forces required to drive adoption. Hardware also persists because low-latency, high-throughput financial-services workloads cannot simply move to the cloud without sacrificing economics.

PANW’s AI-enabled operating leverage could widen its acquisition aperture. Arora described the old playbook of buying product companies and pushing them through PANW’s go-to-market engine. He said that if PANW can run a much more efficient enterprise, what it buys matters less; Jason framed the possible economics as gross margins in the 90s and net margins in the 40s. Arora wants six to 12 months to see how enterprise AI settles. His caveat: AI transformation may require more technical employees, not fewer.

🔗 Original source & video: Palo Alto Networks CEO: “AI Found 5 Years of Bugs in 6 Weeks”

Claude Mythos has forced a rapid Washington safety U-turn by making dangerous cyber capability concrete rather than hypothetical. A rumored executive order would create Biden-like prerelease model reviews that Trump canceled on his first day back in office, after Republicans had attacked such testing as anti-innovation. Casey Newton’s verdict: the administration’s worldview “did not survive contact with reality.”

The government still lacks a coherent model-access strategy, creating policy risk across chips, contractors, China, and allied cybersecurity. The Pentagon is simultaneously fighting to designate Anthropic a supply-chain risk and installing Mythos to scan for vulnerabilities; Trump is exploring Nvidia chip access for China while the administration has not resolved whether China should get Mythos. The result is an administration “installing and uninstalling Anthropic at the same time.”

Cyber defense is being repriced from a days-long response problem into a minutes-long infrastructure race. Palo Alto Networks found 26 critical exploits covering 75 issues, versus a typical baseline below five, while Mozilla reported 423 fixes in April against a 2025 monthly average near 22. Nikesh Arora says legacy defenses were “designed for days,” so enterprises must overhaul them to “fight AI with AI.”

Mythos is powerful because sustained compute lets it chain weaknesses together, but it is neither automatic nor infallible. Arora reported roughly 30% false positives and said performance improved only after Palo Alto supplied code purpose, expected behavior, and threat intelligence from 10,000 attacks over five years. Mythos and GPT-5.5 Cyber found different issues, while Mythos’s compute-intensive “ultra mode” made persistent experimentation and “daisy-chaining vulnerabilities” more effective.

The near-term economics favor attackers, while a large remediation cycle requires scaled cybersecurity vendors and integrators. Defenders must be right 100% of the time while an attacker needs one working vulnerability; firewalls can provide “temporary scaffolding,” but open-source dependencies and unmanaged endpoints remain slow to patch. Arora expects enterprises to undergo a three-to-six-month “cleansing of the vulnerability backlog,” supported by firms including IBM, PwC, Deloitte, and Accenture.

The most exposed organizations are technology-dependent businesses whose core competency is somewhere else. Arora is less worried about well-resourced financial institutions than hospitals, small businesses, industrial operators, and medical practices—the “95% something else” companies that lack engineers. He cited the Change Healthcare breach as an example of how an incident can halt a physician ecosystem. Consumer email and telecom providers also need stronger gatekeeping before AI makes phishing materially more convincing.

AI agents enlarge the attack surface precisely by becoming useful enough to hold credentials and act autonomously. Arora called OpenClaw “a scary thing from a security perspective” because it can be given permissions and credentials to act across accounts; his segregated installation is “totally useless” because it cannot reach his calendar or email. That tradeoff—capability requiring access, access creating risk—will shape enterprise agent deployment.

Arora expects AI productivity to expand engineering output before it eliminates engineering demand. Feature backlogs already extend six to 12 months, so gains of 30% to 60% can fund more development; announced workforce reductions of 7%, 15%, or 20% may instead create room for people with newer skills. His broader call is a “decade-long transformation of business,” with functional efficiencies paying for tokens and additional AI capacity.

🔗 Original source & video: A.I. Safety Is So Back + Mythos Mayhem with Nikesh Arora + Hot Mess Express

Nikesh Arora believes Google is well positioned to transition from ranked links to synthesized answers, but monetization—not product capability—is the real uncertainty. Search democratized information; generative AI now promises a “democratization of intelligence,” while Google retains distribution, product skill, and AI capability. The harder shift is from selling leads against text links and ads to charging for consumption or “consummated transactions,” much as YouTube found its model after achieving enormous distribution.

Agents are more disruptive than generative AI because they can eliminate the interfaces through which millions of applications facilitate transactions. If an agent can book the flight or restaurant directly, many apps become APIs or MCP client-server interactions beneath an agent that sits atop them. The most vulnerable businesses have “poor loyalty to the UI”: thin front ends whose brand does little beyond presenting a transaction processor.

Arora says enterprise AI can support autonomous-work economics only if it executes precise actions with enterprise-grade accuracy. Consumers tolerate retrying a bad answer; companies cannot tolerate “I meant you to turn off that server, not this one.” He sees today’s systems as assistants with humans in the loop and imagines “AI as a service” applications gradually absorbing workflows—potentially priced by work, seats, or agentic seats—rather than immediately replacing whole functions.

Durable enterprise AI companies need proprietary context and a system of record, not merely a wrapper around a foundation model. General models resemble “the smartest PhD from the best university,” but still must learn each company’s ways and domain data. If models’ reasoning capabilities converge, wrappers that add only guardrails or presentation risk being absorbed; systems that own workflows, rules, and authoritative data have a stronger moat.

In cybersecurity, AI rewards platforms with broad sensor coverage and enterprise-wide context while threatening narrow investigation wrappers. Palo Alto’s thesis is that “I can’t stop what I don’t see”: sensors remain essential for stopping known bad activity and collecting the data needed to identify unknown bad activity. Agents that investigate isolated alerts may help today, but Arora expects integrated platforms to squeeze them as cross-domain data makes automated diagnosis more conclusive.

AI is turning cyber defense into a speed race that many enterprises are currently losing. The fastest observed path from targeting to intrusion and data exfiltration has fallen from three or four days seven years ago to 23 minutes, while average response still takes days. Arora says 89% of attacks happen because of credential theft, and favors anomaly detection, just-in-time access, and behavioral signals over trusting a user indefinitely after one successful login.

The clearest near-term operating leverage is in repetitive administration and support, while sales and strong product talent remain comparatively protected. Arora estimates large companies might find “200, 300, or 400 basis points of efficiency” and says good companies should aspire to remove 80–90% of customer support over two to five years by improving product quality and diagnosis. Coding agents should accelerate engineers rather than eliminate the best ones: Palo Alto has already seen one find a vulnerability, reduce 500 lines of code to 75, and explain 15-year-old code.

Palo Alto’s scaling playbook combines platform consolidation with acquisition-led “distributed R&D.” Arora expanded the portfolio from four products to 24, organized them into three platforms, and acquired 27 companies, generally targeting the number-one or number-two player and often retaining founders as business leaders. The ambition is to turn a fragmented, roughly 25-year-old security industry into a platform market—but uncertainty over what an “agent” even means keeps product direction under active review.

🔗 Original source & video: No Priors | With Palo Alto Networks CEO & Former Chief Business Officer of Google Nikesh Arora