Hi everyone, I'm Nicolola Tangan, the CEO of the Norwegian Sovereign Wealth Fund and today I'm in really good company with Nikesh Aurora, the CEO of Palo Alto Networks.

Palo Alto Networks is the world leader within cyber security which has never been more important than today.

We own 1.2% of the company translating into more than $1 billion. Thank you so much Dash for taking the time.

Thank you Nikolai. Lovely to see you again.

Now, uh let's uh start off with the basics. What do you guys do?

That's a good question. Look, as the world has digitized, as we've all adopted technology, whether it's on our smartphones or as companies make applications available to everyone, um the possibilities of bad actors getting into company systems or our personal systems goes up and our job is to protect that technology infrastructure from bad actors.

So we are in the business of cyber security which is to protect our enterprise customers, governments and individuals from being hacked or attacked or coerced by bad actors.

Now the thing is that everything is digital these days right your car uh you know street lights uh so what's kind of happening with the whole attack surface.

Well it's a great great comment Nikolai because uh you said it right. We call this the attack surface and the attack surface is expanding and I think we're not done.

And as you said you know if you drive around in San Francisco in a Whimo that's your car but the car is now fully connected to some central nervous system and if a bad actor could get their hands on that control systems to your car they can control your car.

And if a bad actor could get their hands on that control systems to your car they can control your car.

So as we create more and more technology, more and more interconnectivity, we are creating the opportunity for bad actors to get involved and start to interfere or start to take over this attack surface.

So yes, the attack surface is fundamentally exploding but continue to explode which makes it more and more important for us to make sure that we are able to protect those situations faster and faster and faster and more real time as we can.

What's the most difficult part of what you do?

That's hard to do. How do you do it?

Uh more and more technology. You know, uh we all talk about AI and I'm sure we'll talk about it, but uh we have to be able to identify things as they're happening.

We have to be able to look for the needle in the haststack. And today with the amount of data that's floating around in the world, the amount of connectivity as we talked about that is going on, the only way to do it efficiently, effectively, and in real time is to use the same technology to protect ourselves against cyber threats that we are using to make our lives convenient.

How has AI changed the way you work?

Oh, I think AI is going to change everything.

Uh it's almost as we you know we beginning to see every week there's a net new incarnation of AI and you can see it keeps getting smarter and the way I way I sort of correlate this is like AI is like having a really smart person that you can have work for you this person doesn't forget anything this person knows everything that's ever happened in the world this person knows how to recognize patterns and what's happening is that that person is over time going to become smarter than the average employee and be able to either assist the current employees in the task and possibly take over their tasks.

And what's happening is that that person is over time going to become smarter than the average employee and be able to either assist the current employees in the task and possibly take over their tasks.

Now that also applies to cyber security, right? If you can have somebody has infinite memory, infinite pattern recognition, then the question is, can I train it with my information to make be more effective and helpful for me?

I think that's just phase one. I think phase two, this thing's going to have a brain of a PhD where it can think of unintended scenarios, things that have never been thought about. It can reason.

So, I think we're on to a very interesting road with AI. We're in the very early stages. uh it has benefits on both sides.

Once again, every piece of technology can be used by bad actors and good actors. Hopefully, the good actors outweigh the bad actors and we're working with AI to see if we can use those brains to become better security analysts, solve security problems faster.

How do you make sure that you have more compute than they have and better algorithms and so on.

I mean, honestly, uh you don't need more compute than bad actors. the day the day bad actors end up with more comput we'll have a real problem because if they had more compute then the world is a dark place.

But I think even with the compute that's out there uh it can be leveraged effectively unfortunately from a bad actor perspective the compute is really being used for to create a faster and faster brain a smarter and smarter brain.

Once the brain exists hopefully we'll find technologies and techniques where they can be deployed at the edge on your phone in many different places to be able to leverage it.

So I think the real risk risk is that uh there is infinite possibility for this technology to be used in in sort of the dark side as much as it can be on the right side.

So we have to make sure as we deploy it as we enable it, as we make it more omnipresent, we do that with the right guard rails and the right control systems in place. Otherwise, we're going to have to go and it's very hard to put the genie back in the bottle.

Nash, who are the bad guys? Where is the dark side?

You know, the dark side is interesting. It's been an evolution. Uh I think 15 years ago, it was people who sat, you know, playing games in their parents' basements and who were great at technology and sort of uh hacking somebody or proving a point was a was kind of like getting a trophy.

It's like, you know, look, look at me. I'm so smart. I can hack into the system X, the system Y, and look, I showed that I can do it. But very quickly as the world became more and more interconnected it started getting an sort of economic legs.

People said wait if I do that I can actually find a way to monetize it and find a way of getting money for it whether from the companies or individuals.

And we're seeing a lot of that. There's a lot of ransomware activity a lot of activity where people are are scared into sharing economics with bad actors.

I think we're at we're past that too. I think nation states have started building that capability in a robust way because uh I think the future wars will be fought both in the digital war sort of battlefield as well as a physical battlefield.

Digital battlefield is a lot less expensive from a from a you know situation where from a casualty perspective if you were a bit more specific about the countries look I don't think it's a state secret that there are countries which have tremendous offensive capability even the US has great offensive capability.

We've seen groups in China. You've seen groups in Russia, various parts of Eastern Europe, some parts of the Middle East.

So you have you have groups of people. Now that doesn't mean the whole country is bad. There are people who are resident there because they have access to resources. They have there's hard to create sort of you know some consequence from a fiduciary perspective against those.

So that's where they are. Could you recognize them by the way they attack?

Yes. Uh so tell me what's the difference?

So, hey, so now I'm uh I'm uh sitting in uh in Polo Alto Networks. Uh we get some uh red lights flashing and uh how can I see that it's some Russian guys rather than some North Korean guys. What how do I how can I see that?

Well, there are attack techniques which have been have sort of signatures in there. People are proud of their work. They embed signatures in their work. So, you can recognize signatures.

You can recognize that there are variants of things that people have used in the past. you can get some sense from the IP addresses that are being used. You can see where the traffic is coming from.

So you get some sense always not always accurate because there's ways to circumvent that. So it's a it's sort of a triangulation exercise between the technique used, the malware used, the where the traffic's coming from, the scale of the traffic, the scale of the attack.

Sometimes you see DOS attacks which only nation states have the compute capability to go uh exercise.

uh you can always understand from uh who the target is, who the adversary might be. You know, it was non it was pretty obvious when the Ukraine war started that the systems in Ukraine that were being attacked, they were being attacked by a certain set of people, right? That you understood there was motive.

So I think triangulating motive, malware techniques and and addresses and location gives you a reasonably good idea.

Is the type of targets changing?

Uh it has. Yes, that's a great question. the type of targets have migrated from individuals to individual companies and now we're in the world of supply chain and what I mean by that is you know if you want to go uh find out what an activist is doing in their email you try and attack the activist trying to get access to their username password so you can see what they're doing which would be a very targeted attack to whether it's an individual or a company but then he says then said look I'm going to need this capability for a very long time why don't I go attack the backbone of the email system.

And what I mean by that is you know if you want to go uh find out what an activist is doing in their email you try and attack the activist trying to get access to their username password so you can see what they're doing which would be a very targeted attack to whether it's an individual or a company.

But then he says then said look I'm going to need this capability for a very long time why don't I go attack the backbone of the email system. So once I have end there, I can go look at anyone.

Or why don't attack a piece of hardware that is deployed by 10,000 companies once I know how to break into one, I can break into the other 9,999 at will.

So you're beginning to see a lot more supply chain attacks, which effectively allow bad actors to go amplify their their sort of, you know, targets over time where they want to go.

So it's kind of like we we joke about this in the industry. Uh it's kind of like you know there's groups that do ransomware as a service.

They'll go become resident in tens of thousands of pieces of equipment based on known vulnerabilities and offer that capability to people who want to go uh exploit it uh for their own monetary reasons.

How much money in this industry?

I mean billions. Billions. Look, it's it's unfortunately one of the most profitable industries out there because I think by last count there was close to $18 billion uh between ransomware and scams, online scams, which are another form of cyber sort of behavior.

And the challenge, Nikolai, is that in each of these cases, it's very hard to prosecute people because eventually your your lead ends up in some third world country or in some other country which is very far away and you don't have the capability to go investigate all the way across five different nations or multiple continents.

It's very hard to go prosecute them unless these are things of significance in nature. Right? If somebody made you transfer $10,000 to a bank account in in Africa, it's very hard to prosecute that. and reverse that.

Now, if you are going to get ransom attacked or you're going to bring down critical infrastructure, you're going to block a pipeline. Yes, there is prosecution that can happen in that situation because it's bigger than just monetary impact.

It's kind of oh my god, somebody's trying to, you know, so chaos in some infrastructure capability or some utility capability. That's when people do get engaged and get involved. But I think there's a very long tale where it's very hard to go prosecute these situations.

Why are um infrastructure projects increasingly under attacks? I mean we're seeing it in water plants, telco networks, power grids and so on. Why are the hackers going after these things?

Well, I think it's uh first of all, it's easier because typically those things are, you know, they have relatively older infrastructure for the most part because their job is to provide electricity and provide water and power etc. They're not sometimes technologically as advanced as you'd like them to be.

But what we're also discovering is despite their old infrastructure for ease of use and convenience, we're putting on sort of band-aid systems which can connect to those things.

So you know it's a lot easier to manage an electrical grid remotely if you can have every part of the electrical grid that is connected through some internet of things or IoT or operational technology.

But the challenge is because that's older infrastructure all these tools and capabilities are patched on and that means when we patch something on there is the possibility that bad actors can get in through the same doors and you just exposed some old infrastructure to internet access.

So from that perspective, a they're easy. B, as I said, when nation states get involved, they're not looking for just monetary outcomes. They're also looking to see how do you destabilize uh a county, a city, a state, or a nation.

And it's kind of their way of probing and getting ready in case there is a scenario where they have to leverage that. And so you're seeing a lot of that.

Um, for the most part, as you can see, there hasn't been a situation, except for what we saw recently in the Middle East or in Ukraine where these things were used uh in the case of wars. In most other cases, this is work that they're doing to uh sort of flex their muscles, understand their skills, understand their capability, and be ready for a rainy day.

If you had my job, what would you be the most worried about?

Uh look in your business there's event risk right uh although if everything goes down the path you have wonderful models that try and tell you how things going to happen from an event risk perspective it's very hard to model it it's very hard to be afraid of it because event risk is event risk if something's going to happen to one of your portfolio companies is going to happen if something's going to happen that impacts a certain sector of your portfolio is going to happen.

From an event risk perspective it's very hard to model it it's very hard to be afraid of it because event risk is event risk if something's going to happen to one of your portfolio companies is going to happen if something's going to happen that impacts a certain sector of your portfolio is going to happen.

I think on the flip side what you can look for is uh I say basic hygiene You know typically cyber security is like water it follows the path of least resistance.

So the companies which are most vulnerable will be the ones which will have the most problems. So demanding a certain level of quality certain level of cyber security hygiene becomes important.

And you see that you know there are various executive orders edicts from governments where they demand that a certain level of hygiene be maintained by critical infrastructure because that can impact nation state stability.

There are uh financial services requirements where the regulators require tremendous amounts of you know cyber security hygiene and capability. The federal government requires a certain amount of hygiene from federal contractors.

So there are there are examples out there where people do require that degree of you know standard care or diligence. I think I think you guys should be at least looking at that or demanding the same.

Are you worried about the whole financial system plumbing like stock exchanges that kind of thing?

Look, um I can scare myself every day if I want to. So I believe in the sort of you know the goodness of humanity. If you look around, we haven't seen those things.

And I think the flip side is the resilience as well. Look at you know we we powered through a pandemic which is one of the biggest crisis that civilization has seen in modern times.

So can we overcome some you know plumbing breakdown? Sure we can. Will it be choppy? Possibly. Uh it all depends on the extent and uh the the extent of the impact and the sort of the the the scale of the impact.

But I I I'm not worried. There's enough segmentation, there's enough circuit breakers in the systems where I think today we say look when you think about cyber security, think about cyber resilience because the possibility that you can get attacked, hacked or brought down to your knees is reasonably high.

If if if somebody shows up with tremendous amounts of force and compute, they can find a way into breaking into that one in your armor and destabilize you.

The question is how resilient are you? If somebody does destabilize you, how quickly can you come back up? How quickly can you bring your infrastructure back up and you can resume operations?

And that's kind of where the focus has been the last few years amongst large companies, enterprises, critical systems. And that's a good thing because I think that's the right way to think about it.

The right way to think about is not that I can I can protect myself infinitely better and nobody's going to get into my system. You have to assume it's going to happen and when it happens, how quickly can you stand up? So, I think that's all goodness.

Well, I am I am slightly confident by the fact that you still believe in the goodness as humankind because I uh I hadn't really expected that to be the case. But,

As I say, hope for the best and prepare for the worst. That's what we do every day.

Now um compared to other uh sectors within technology the um cyber sub sector is uh is quite fragmented. Why is it not more consolidated?

That's a great question and I think uh if you look at technology uh that was our thesis 7 years ago uh when I came here our thesis was it's about a $200 billion revenue industry annually and we were at one and a half% market share.

we were one of the top three players in the market. So that's that is like you said fragmented in the small and I think you can go back and trace it first of all remember cyber security is one of the newest subsectors of technology.

Right in 1989 when I went to university there's nothing called internet connectivity right so this thing is less than 30 years old.

And true widespread connectivity really came about for all consumers and mobile phones were sort of popular and people started using apps on their phones because now every company any enterprise had to open doors for your bank account or you pick your favorite activity with your company or e-commerce. So really we have seen the interconnectedness arrive in the last 20 years.

You make it sound like we are old.

We are. I thought we were super young.

We're not old. We're going to live to 150, right? With the longevity things that are going on in the world. So we're we're like an early part of our lifetime.

But my point is this this industry subsector is 20 years old. Yeah. That's when it started. So it hasn't had time to actually consolidate in some sort of platform.

If you look at you look at workflow management, you look at CRM, you look at you know uh IT management, these things have been around 30 40 years or 50 years and you you've seen platformization or what I like to call the consolidation of this fragmentation into more meaningful sort of technology providers.

And our thesis and our bet is that over time cyber security will go the same way. We're blessed that we're now about four to 5% of the market and possibly 8% of the product market which is better than one and a half percent.

But there's no reason there's not a 20% player in the segment in the next 5 to 10 years.

Now you previously worked with um Google and then SoftBank. What did you learn there which you have brought with you uh to the current company?

Uh Nicola I was very blessed to see the the sort of the emergence of interconnectedness and the internet from a vantage point like Google. You know, I spent 10 years there between Europe and the US and I got to see how the world sort of grabbed technology with both hands.

And sort of the the thing which I think makes Google great and continues to is their obsession on product, right?

You can see at Google there were so many products when I worked there which had a zero zero monetization and possibly even today things like Google Maps or the Chrome browser.

But Google focused on building products from a technology perspective to make it convenient for end customers and I'm sure there's some sort of a virtual circle that allows them to monetize that in their advertising business or their YouTube business.

But uh the and then Larry told me once and uh and I think he's right Larry Asen as in one of the founders Larry Page. Yes. Thank you. Yes. He said to me once, look, if you look at technology companies over time, technology companies die when they stop focusing on product and start focusing on other things.

And that's true. If you look at the history of technology, there is there is sort of the the battlefield is littered with companies who whose eye was off the product. And that's what he was very obsessed about. I brought that here.

I said look for us to win in the long term at Po Alto the only way we are going to win is if our products are the best in the market and the customers rely on our products. So we brought a lot of product discipline.

We had to buy 20 companies because we were we were sort of on the back foot or late in our innovation cycle and we couldn't wait four years because you know corollery to that I believe it takes four to seven years to build a great technology product. It doesn't matter what it did.

What about soft bank?

Well Soft Bank you know is uh yet another fascinating founder Maso Shian. uh he as I've always I've seen is like I think he has he's one person whose risk appetite increases as he gets older and you know fascinatingly when we have we have children I have two young kids and I realize as we bring them up our instinct is to help them risk minimize don't look on both sides of the street when you cross the street be careful don't do this don't do that be careful we're constantly grooming people to start minimizing risk but you get married make sure you don't overextend himself.

And you know fascinatingly when we have we have children I have two young kids and I realize as we bring them up our instinct is to help them risk minimize don't look on both sides of the street when you cross the street be careful don't do this don't do that be careful we're constantly grooming people to start minimizing risk.

But Masa at the age of 60 is like let's swing let's swing harder and I think it's just fascinating.

So where did that come from? Where where does that come from?

I think it comes innately from him. I think this is who he is. And he's done that so many times and you know first time or second time it looks like a coincidence when he does it four times like holy he's got something going here.

Uh which should be bottled and and he was the richest man in the world for some days possibly you know.

But you are swinging pretty hard too you know.

Yes. Well that's what I said. So you bring that from there saying look you know what don't worry about what you're going to break worry about what you can build from from there.

And I think that's the two principles we operate paddle alto on is one focus obsessively on the product make sure our customers see value in our product two is don't be scared of taking managed risk.

So how did it work so when you joined um Palo Alto Networks you had little experience from cyber security right so they called up and say well so hey Nikash you want to come and join the company yeah I know nothing about it well great join anyway Okay. And then you became the CEO.

Yeah. I think you have to hold the board accountable for their bad decision, right? Because uh they were looking for a CEO for a public company. I'd never run a public company.

They're looking for an enterprise CEO because this we sell to enterprises. And they're looking for somebody who understood cyber security. Other than not having those three qualifications. I was a great guy.

I said, you know, like you must have really run short on potential supply of potential CEO candidates that you hired me. And I guess they knew more than I did. They said to me, "We have 5,000 people who understands cyber security really well. So we don't need one more person who understands cyber security. We need somebody who can lead this company from where we are into being one of the major forces in the space."

And you know it was a very steep learning curve. Very very steep. I won't deny that. Uh but I had some great teachers.

How what has happened to the market capitalization of the company during your tenure?

Uh we started seven and and you don't have to you don't have to be modest. So you can just give us the numbers. It's the numbers. It's numerical.

Right. 7 years ago when I started, we're approximately $18 billion in market cap. And today we're around 120 give or take.

How do you uh move up the learning curve? You join a firm like that. Uh it's not your expertise. Just how do you go about uh learning a new field like that?

You know, it's great question and I said uh I relied on every one of those people, 5,000 plus people who understood cyber security. I think they probably their ears were red, their eyes were teary eyed every time because I would pepper them with questions every time.

You know, I I I would call our co-founder in the morning coming into work for an hour asking him all kinds of stupid questions because things I had read in the night.

I also used that time to meet 300 individual cyber security companies because our industry is very very prolific. There's 2,000 cyber security companies formed every year.

So, you know, I could always find somebody want to tell me what they were doing. And slowly I started to build a framework in my head as to you know what would be interesting uh and I built a few thesis about how the industry operates and what needs to happen.

And my plastics moment was you know having been at Google I said look the two most important things from a technology perspective would be cloud and AI.

This is something we said seven years ago when AI was not in fashion cloud was beginning to get into fashion and so we pivoted our company we burned down our data centers we don't have data centers we run everything in the public cloud.

Uh we built a whole practice around cloud security uh we built our entire security management stack using machine learning which was the the the normal name for AI at that point in time seven years ago.

But it took us seven years to build a great product and we're delighted because some of those investments we made seven years ago are is kind of what is bearing fruit and allowing us to succeed the way we are.

Now the founder of the company Neil he's still chief technology officer right.

Yes. What um what does that mean how does that work.

Well's a phenomenal brain when it comes to security it comes innately to him you know he worked in in unit 8200 in Israel uh he saw opportunities.

He came He worked in the security sector. He decided to spin out and start bal networks and some of the the early product insights and decisions were driven uh based on what he thought was the right way to go.

Now he acts as a technology consiliary both for our management team as well as our customers. So he'll go out meet customers talk about the security stack work with them as to what should be the greatest outcome for them.

He'll sit down with our teams and sit down look at what they're trying to do and sort of attack problems from a first principal basis. was very helpful.

You mentioned some of the trends that you were early to spot. What's the key to spot a trend early? How do you do it?

Uh look, uh I read something the other day from a distinguished person at Microsoft and uh he was saying it in the context of I think internet explorer. He said you can see a tipping point typically three or four years before it is going to become widespread and fundamentally obvious right.

And the key is when you look at technological trends you have to say what is it that I just saw and how's that going to fundamentally change things.

So take take AI for now right there's a huge brew of haha around AI and people actually sit there and say oh my god this AI is going to be amazing and you can see Nvidia you can see infrastructure people want to spend $500 billion building large data clusters, data centers.

The question is, but what's the insight? What is that going to do? Now, you can see it. It's pretty clear. Everybody's clear that something's going to happen with AI and something's going to be fundamentally different four to five years from now.

The question is how radical is it going to be 5 to 10 years from now? You have to sit down and define your principles.

Like I fundamentally believe product development will go flip on its head. Today, you know, 50% of technologies are deployed in product development across technology companies. you won't need to do it as much because product development in technology companies is us designing a way to talk to data and machines. That's what we do.

Product development people say let me take all this make it simple. It's like you booking your airline ticket on booking.com. That UI is called product development.

Well, if I can just talk to it and say book me a ticket and do this stuff for me and this is a fundamentally easy example. Whether it's say Door Dash or Instacart, you don't need to build all this amazing UI that sits in front from a product development perspective.

You can start talking to data and machines because they understand you as another human would and that's how your interaction becomes. If you believe that's the future 10 years from now, everything fundamentally changes.

Then the next question is how do you position yourself in that future? Uh should you be chasing things like you know writing better legal briefs or you know and investing in companies which are making marginal incremental improvements or should be fundamentally rethinking how that's going to impact technology.

We have to think right like we think their future of the future of AI is going to be more agentic in nature. We're sitting saying if that world transpires how do we build security protection where agents don't don't run a mock.

So we're trying to build a whole fantasy world of agents in our head and then we have to say how do we protect that fancy world of agents. So we have we have like a second derivative problem not just first derative problem.

So if you apply this thinking to the technology sector, where should you place your bets now?

Any software business that relies on seats, that relies on humans and humans using more software has to fundamentally rethink their strategy, right?

Because if you believe this wave of AI is going to be true, we're going to be much more efficient and we're going to be using humans fundamentally differently in the enterprise environment and the entrepreneurial environment and you'll get a lot more done with a lot less.

If that's true, then you have to focus on what the lot more is going to be because you're going to have a lot less from a people perspective. So I think rethinking that would be interesting.

I think there will be some market dislocations. I was chatting with somebody last night and we talked about look typically the market first doesn't realize uh until it gets hit but when it gets hit it swings too hard in the opposite direction.

So there'll be value opportunities in the market in a few years when market begins to see this uh catastrophe coming in the short term the market is not realizing that this thing is going to start taking more momentum over time as things get more and more efficient.

So I think there's going to be a rethinking on the enterprise side uh for seedbased based businesses and you can see all of them are very focused on AI and creating more value with AI and figuring out how to deliver AI agents instead of humans and that's kind of an smart thing and interesting thing.

Some will make it some won't. I think on the consumer side I've said this before I'll say it here is I think the whole idea of applications on your devices is going to have to be rethought.

That's going to be sea change because do I really want 14 AI agents talking to me on my phone? I don't think so. So we have to figure out a way of disintermediating these agents.

And the question is who is in a pole position to take that leading role in talking to those 14 15 200 agents behind me and then what does that do to economics to customer ownership to where the the financial transactional health be very interesting world for the next 5 to 10 years from how AI actually gets deployed and how many sectors it impacts.

So who is going to be the winner?

If I knew that Nicole I'll be doing what you do.

Who's going to be hit? Where are the where are the big hits going to be?

I think it's early to call because you know these are not static things. These are not static companies who are sitting there waiting for consequences to happen in them. I think many of these people are well aware of this problem. They probably are more thoughtful about it than I've just told you.

So there are people who understand these challenges. There are people who are working on these. Like you can apply that and say there's going to be goodness. We're going to get this solved.

But on the flip side, you go back 25 years ago, you know, we never saw the emergence of Google or Facebook or Amazon um and their likes. We never saw the the the emergence of open AI at the scale that has come to it.

So, I'm pretty sure there'll be 10 to 20 new players who we haven't fully comprehended are going to go run this table from first principles from scratch.

And I'm sure some of us will adapt. I mean, Walmart still exists and they've done a phenomenal job from e-commerce perspective, right? Even though they were late to the party visa v Amazon.

There'll be, you know, early sort of early entrepreneurs. There'll be people who will be late adapters, but they'll they'll have tremendous assets they can bring to bear to make it work. And there's some people who fall by the wayside.

Would you mind just enlighten us a tiny bit? You mentioned first principle uh twice. What does it mean?

Well, the first principle is, you know, you go back and look at it and say eliminate all constraints. Rethink if this was from scratch.

How would you do it if you didn't have any of the baggage you know of the present in the industry in your category in your sector that usually gives you a better outcome.

It's kind of like that's how true innovation gets formed saying how what are the tools I can bring to bear today which never existed 20 years ago which makes it a lot easier to build this from scratch.

You know I learned an interesting lesson and I'll tell you anecdote uh very dear colleague of mine at Google. uh he was trying to think about mobile apps in the future and I used to work in the mobile industry before and we were chatting about it and he said look there's 200 operating systems in the world on mobile phones right now it's impossible to build an application because we have to comply with 200 different operating systems.

And I used to work in the mobile industry before and we were chatting about it and he said look there's 200 operating systems in the world on mobile phones right now it's impossible to build an application because we have to comply with 200 different operating systems.

I said what are you going to do? He's like I'm going to focus on Android and and iOS. I said why? He said, "If I look at the trajectory five years from now, I think the world will be 60 to 75% Android and iOS, and I don't care about the rest because they're going to be on a downward trajectory."

Now, he went back, rethought it, did it, simplified it. It worked really well. And today, he's right. He was right. He was right 15 years ago, but at that point in time, it was not obvious.

I remember the CEO of a very large mobile phone company calling me, handset company, calling me and yelling at me and saying we were being duplicitous. But my colleague had called the demise of their operating system before they seen it.

Related um and talking about uh a big change that you did in your company uh middle of last year you doubled down on platformization on your platformization strategy which was uh part of your long-term strategy and um it led to some short-term negative effects uh certainly for your share price.

Just that swinging thing. Absolutely. take us through your thinking behind it and and then now one year later what's uh what has it led to?

Yeah, look um you know as I've uh heard in another podcast somebody say somebody asked one of my old bosses you know if you go back what would you have diff done differently and he said I'd have made my smart decisions faster uh except you don't find out until after the fact.

So you know if you ask what I've done different I wish I'd done it sooner but I think there was the right time and a place and I'll give you why.

When I started seven years ago, we were great in firewalls and that's all we did. But there were four other swim lanes in our industry, which our industry used to let everybody else play.

Say, hey, you do that and I'll do this. And I realized like, well, why are we doing this? Why do we just give a free pass to every net new startup that shows up and wants to play in a different swim lane?

Why aren't we in it? And you discovered that over time there's learned behavior in the industry that people have tried that and failed. They stuck to their knitting.

So, we set about to say, well, let's see if he can go play theirs. And we built a phenomenal M&A strategy where you know we could talk about that as well if you want.

But we were able to start establishing a beach sort of a foothold in each of these other swim lanes and over time in the last five years I'd say the first five years we got to a point where in each of these swim lanes our product was now rated number one or two in its category right.

Which is the which is kind of the table stakes in cyber security the the the normal default is security professionals say hey if you're number one or two I won't get fired for buying you if If you're number four or five, why would I buy you? You're you're a new player.

So, we had to get the right to play and right to be at the table. We did that, but we realized we were still fighting individually against people who were great in that category.

And we looked at and say, well, we're the only people who have 24 products in the magic port in the top right. Let's start showing the benefits of these things working together.

So we spend one year stitching them together hard hated and say look these things are best in that category yet even better if three of them work together you don't have to go do the stitching yourself.

And we're in the cyber security world the more disparit products you buy the more you have to go figure out how they work together in in in sort of an adversarial scenario. So we were able to do that which became the sort of the germination of our platformization strategies.

And say let's go sell the benefit of all these together. It's lower cost of ownership, higher simplicity, better security, and actually customers might have to actually pay less instead of constantly paying more for security.

So that's taken hold. We sold over a thousand of these deals in the last 12 months, which is great. And we believe that's the future.

And if you look at, and I said this earlier, if you look at Salesforce or Workday or Service Now, all these are platforms. And nobody goes went back and said, "Wait, I used to have this done with seven systems. Let me go back to those seven because it was easier there."

It never was easier. You just have to work people through their objections and through their capabil through their challenges and say this is a much better outcome for you.

So we're we're on the early part of our journey but we believe that is the future of this industry. And the good news is since we announced that I think it's fair to say whether they have it or not many of the industry peers have chosen to start saying we have a platform.

So clearly there's something here where they believe they need to be a platform to be able to succeed in cyber security.

Nikash let's move on to your personal uh journey. So you grew up in India. Um and how did you end up in the US?

Oh uh I grew up in India. I got an electrical engineering degree and um I wanted to go to business school and I applied to a few in the United States.

Uh at that time it was very hard to get to the US for business school because there was foreign exchange regulations. You couldn't really pay. So all that stuff you know we we overcame those hurdles.

And I was privileged to be offered a place at Nor Eastern where they chose to uh pay my tuition if I taught computer science uh which is very emerging field at that point in time it didn't so literally 1989 was the I say 8788 was when they started using that as a specialization in India and I actually was an electrical engineer I not was not even a computer science engineer at that time so I spent the summer brushing up my computer science so I could come and teach it that's how I came I went to business at Nor Eastern.

Uh which is very emerging field at that point in time it didn't so literally 1989 was the I say 8788 was when they started using that as a specialization in India and I actually was an electrical engineer I not was not even a computer science engineer at that time so I spent the summer brushing up my computer science so I could come and teach it that's how I came I went to business at Nor Eastern.

Why are Indian CEOs so successful in technology?

Well, I think there's a selection bias. We're looking at, you know, we're 16% of the world's population. So, that's not a bad start.

Uh but I think if you look 30 years ago the only way for us to be here in the US was we had to go through significant let's say educational hurdles to make it like you weren't allowed a visa in the United States if you weren't uh academically brilliant in your in your field.

And uh given the economic disparity between India and here a lot of us chose to look for greener pastures and we came here so you had a lot of large pool you have a large pool from a globally trained engineering population to choose from.

And I think uh from then on was Darin sort of Darinian some of us kept making it through the various hierarchies of uh of organizations and ended up with uh you know the Indian guy must know how to code so a lot of us who are in technology.

And uh I think uh I'd say even the technology sector really has grown tremendously in the last 30 years is where all the opportunity was so I think it's a it's a confluence of uh circumstances that allowed us all of us to be here.

And there's possibly something in our resilience and our our sort of um going down the engineering and academic path.

I mean some of you don't really code personally anymore but uh um no we don't.

What's uh what's the Indian leadership style like what are the commonalities.

Look um remember we all grew up with scarcity I think uh so being resourceful has to come naturally to us because uh if I look at some of my friends and peers in the industry I know the backgrounds of many of them and we all share similar backgrounds.

We all went to some sort of engineering school in India. We all came from lower middle class or middle- class families. If you look across the board and I'm just thinking of eight or 10 of the people I know in our sector who are legendary CEOs right now, they all have similar backgrounds.

So we all have some degree of resourcefulness, some degree of uh you know scrappiness perhaps that comes with it. uh it is a comes with a very strong work ethic because you can't survive in a country with one plus billion people at that point in time if you don't have the ability to put your head down and work hard.

Uh when I went to engineering school I think 100,000 people took the exam and chose 2,000 people to go to those five schools that we wanted to go to. So there's a 2% chance that you get in.

So to get there it was not just going to be pure luck. It was going to be a lot of hard work and dedications. I think every one of us went through that. So there's a work ethic, there's a resourcefulness aspect.

I think there's a constant learning aspect to it. You know, none of us grew up with AI like you said. None of us grew up with the cloud, but somehow we've all managed to learn it.

I didn't grow up with cyber security. We all managed to learn it. So there is some degree of a constant learning um sort of algorithm in there.

Um hopefully there's a dose of ample humility across the board because we're all blessed and privileged to be able to work in this environment and be part of a larger sort of you know uh um cosmos in the United States to be able to sort of make our dreams come true and then the rest is chance.

How do you stay humble um with all that success?

Oh uh go home to the family. They'll they'll set you right in a heartbeat. You know it doesn't matter how successful you're at work. you're still part of a family unit.

And I think I think it's consistent and I know some of these people I said and their spouses and you know they keep us grounded they keep us focused on the right things.

And I was chatting with somebody last night you know I still hang out with my friends I knew in high school you know it doesn't matter what I do for a living and they don't really care what I do for a living for the most part.

So you just go back stay with your family and your friends and they'll keep you grounded and as you know it's it's it's not not sort of you know um roses and and and and tons of love every day.

There's a lot of grinding that is required to be successful what you do. There's a lot of, you know, going back to the salt mine and and and sort of figuring out things from first principles.

So, I think that keeps you keeps you humble uh on a day-to-day basis and especially with the enterprise world, you're constantly selling to people or telling you you're wrong.

Do you think people underestimate what it takes to be successful in your business?

I think uh every role, every job, and I always try and say that, you know, there's no comparison. your challenges and my challenges. It's not a competition.

It's our ability to cope with challenges and our ability to enjoy successes is different. And I'm sure a doctor has his own set of challenges and opportunities to succeed. And I'm sure a CEO has them.

So I think that's more human than than what you do. Perhaps the question is how do you cope with it? How can you handle it?

And some people can cope with it better than the others. And over time, you'll see that people who succeed and are gravitating to those things have the personality that allows them to find the right balance between doing a high pressure job as a CEO versus, you know, being able to be sane when they're not doing it.

If we look at the the culture of uh Palo Alto Networks, do you celebrate success all the time?

Look, you know, the pandemic was a very pivotal moment in my sort of development as a human being and the development of our culture.

I'd say pre- pandemic I was very focused on learning the industry, understanding the industry, building a brilliant strategy for the company because we had to find a way of not becoming part of the normal decline of a cyber security company.

If you look at cyber security companies, they decline after 10 to 12 years and they sort of take a sort of glide path which is sort of flattish over time.

And our job as a leadership team was to go change that and find a strategy that works. you know the best laid plans of mice and men. Uh the pandemic came and gave us a wakeup call because the strategy became almost incidental.

What became important is how do you survive a global crisis of that proportion and I'd say I lucked into it. I met this person um who we brought in literally in the first month to come speak to us and our team.

And he said you know the fundamental thing you have to think about is not your cyber security strategy is but the mental state of the people who work with you.

I said explain that and he says look right now people are in their heightened state of uncertainty and when people are in their heightened state of uncertainty masslo's hierarchy gets disrupted.

At that point in time all they care about is certainty and predictability and your job as a leader is to create that your job is not to talk about how you're going to win your job is to create that comfort and certainty that I am taking care of.

And that really started my journey at that point in time because I I think I think since then I've talked to 8,000 employees in the company on one sort of small group setting basis. I still do it. I spent a lot of time with people.

I spent we we put in policies in place saying we're not going to fire anyone. We're going to make sure everybody's economically taken care of and we didn't throughout the pandemic because our job was to create certainty.

And that became such a fundamental basis for our success that it's pivoted into people matter. They're the backbone of the company. That's how we go win.

Uh and when people see that leadership is willing to step in and walk the talk, amazing things happen.

You mentioned learning. Uh what are you curious about for the moment?

I'm constantly curious, you know. Uh um and I think it goes the paranoia because part of the paranoia of being a leader is I have to find uh the right direction for a company on a constant basis.

And the pace at which technology is moving, it's almost like deer in the headlight syndrome right now, right? You wake up every week and there's a new development in technology.

And I say that technology, but obviously we're talking about AI right now. But look, you you know, you find out that somebody's building a $500 million data center. Then you find out about agentic AI.

Then you find out that there's a new Chinese model which is much more efficient and runs differently. Then you say, what happens to $500 million data center? Is that going to have a thing to do?

Then you hear about, you know, protein folding and alpha go. Then you hear about image generators. and you hear about you look on X and you'll see all these people who are experimenting 17 ways from Sunday and they're able to recreate all these things.

You're brain boggles. It's like okay forget about understanding it. The question is trying to sort of put your arms around the implications of this is hard and that's just you know in a way in a positive way is fascinating because I don't think we've seen such technological turmoil in our lives.

And uh it is scary you know because you ask the questions who's going to the winner where is this going to land because our jobs are to find the answers in this huge amount of sort of you know excitement that's going on so yeah so that's kind of fascinating is is amazing right now I think it's just unbelievable.

I And I just wake up every day, spin out of bed and just run. What happened yesterday? I mean, oh my. I mean, you have the intersection of uh geopolitical upside down.

Yes. Uh accelerating technology and uh Oh my.

What's the first thing you do in the morning?

Uh try not to grab my phone because you think it's been hacked.

No, no, no. Because you're saying, "Wait, I've not had any information for the last seven or eight hours. I need to know what's happened in the last eight hours." And you know I to I'm pretty sure the first half an hour of waking up I get find my ways to my phone.

But uh when do you when do you wake up?

Around 5:30 5 5:30 something like that.

How often do you work out?

Not enough possibly three times a week if I can manage it but I'd like to do more but you know that's that's always a challenge. We never grew up working out in India.

So it's an acquired skill that we have to go try and practice and yes if I could do one thing. Did you have a mentor in your life?

You know, Nichol, uh, my answer to that question is I've had the privilege of interacting with some amazing people and I've been able to use them for different aspects of my life.

There are people I can talk to about my personal life. There are people I can talk to about my professional life. uh there are people I could talk to about financial issues, management, but it's hard.

And I I sort of my principle is it's very hard to hold one person on a pedestal and and try and replicate their principles across every part of life because we're all human beings and we do some things better than the other thing.

So I I try and find somebody for a certain thing that I find amazing and yes. So have I had people who have been able to mentor me on individual topics? Yes.

Have I have a sort of an over-encompassing uber mentor? No.

How do you relax?

Play golf. Um, hang out with my kids. They're nine and eight. And goes back to that humility comment and goes back to, you know, bringing you back to basics. They do that wonderfully well.

We spent uh yesterday afternoon watching my 9-year-old play football and he was very excited and we spent half an hour talking about his football. He and I went to watch the basketball game on on uh Friday night. That was amazing. So, yeah.

What do you read?

Uh, I struggle to read. Um I'm more of a summary person than a read person because uh it comes from the principle of flip side. People ask me would you write a book and I'm like why would I take 500 pages to describe what I could in 10?

Uh and I think the opposite applies you know why would I read 500 pages to distill 10.

Um so well you got some uh if you're a summary kind of guy you got some pretty good tools lately to help you. Right.

Exactly right. Exactly right. Look I I you know for for not trying to engage my brain a lot. I will watch a lot of Netflix shows to see what the world is doing and some of those are uh you know non-fiction that allows me to learn.

But I struggle to read 500 pages. I can't keep my attention that long.

Dash what is the what is your advice you have to your young children? Well actually not only young but because you also got a grown-up but the three of them.

Look um at the end of the day they're all going to have to find their own path. So my job is to make sure I allow them to experiment and encourage their natural instincts because uh you know it's kind of bizarre.

This is such a complex combination of personality traits and and innate desires that come into a human being. So it's very hard for me to tell my kids there's most likely if I tell them what to do they're probably going to do something totally opposite just to prove their point.

So you know I try and encourage their their experimentation in life. I try and encourage them in what are they trying to do.

My older daughter who's 27 has a lighted on venture capital as a career by watching people around me and having lots of conversations but it was important for it to be her decision and she made that decision independently.

And of course she comes and spends a lot of time with me talking about companies or talking about how should she think about life and career and we talk about it but I try and make sure the decision in the end is in her hand.

Now, of course, being a father, we're all trying to influence it, but she's smarter than that. And same thing applies to my younger kids.

You know, I they're young. They're nine and eight. Right now, it's for them to explore and explore their passions. My son wants to be an NBA basketball player now. We'll see. We shall see.

Nash, uh, it's been wonderful talking to you and a big thanks for protecting us against the bad guys and, uh, please keep up the good work.

Well, thank you very much, Nick. It was lots of fun and and congratulations on what you guys do as well. Thank you.