HIGHLIGHTS: Nikesh Arora - CEO of Palo Alto Networks

Summary

In Good Company with Nikolai Tangen: Featuring Nikesh Arora, CEO of Palo Alto Networks

Podcast: In Good Company with Nikolai Tangen
Guest: Nikesh Arora, CEO of Palo Alto Networks
Release Date: April 11, 2025

In this insightful episode, Nikolai Tangen, CEO of Norges Bank Investment Management, engages in a comprehensive conversation with Nikesh Arora, the CEO of Palo Alto Networks—the world's leading cybersecurity firm. The discussion delves into the evolving landscape of cybersecurity, the impact of artificial intelligence (AI), the nature of cyber threats, and the distinctive qualities of Indian leadership.

Introduction

The episode begins with Nikolai Tangen introducing Nikesh Arora and highlighting Palo Alto Networks' significant role in the cybersecurity sector. With Norges Bank Investment Management holding a 1.2% stake in Palo Alto Networks, translating to over $1 billion, the conversation sets the stage for a deep dive into the complexities of protecting digital infrastructures.

What Palo Alto Networks Does

Timestamp: [00:42]
Nikesh Arora:
"As the world has digitized...the possibilities of bad actors getting into company systems or personal systems goes up. And our job is to protect that technology infrastructure from bad actors."

Arora succinctly outlines Palo Alto Networks' mission: safeguarding enterprise customers, governments, and individuals from cyber threats. He emphasizes the increasing vulnerability that comes with the pervasive adoption of digital technologies, from smartphones to interconnected vehicles.

The Expanding Attack Surface

Timestamp: [01:24]
Nikesh Arora:
"The attack surface is fundamentally exploding...as we create more and more technology, more and more interconnectivity, we are creating the opportunity for bad actors to get involved."

The discussion highlights the concept of the "attack surface"—the totality of points where an unauthorized user can attempt to enter data or extract information. Arora explains that as technologies like connected cars become more integrated into our daily lives, the potential avenues for cyberattacks multiply, necessitating more robust and real-time protective measures.

Challenges in Cybersecurity

Timestamp: [02:15]
Nikesh Arora:
"The most difficult part is, is the tables are unfairly stacked. The bad actor has to be right once, and we have to be right 100% of the time. That's hard to do."

Arora underscores the inherent challenge in cybersecurity: while defenders must achieve absolute security, attackers only need a single successful breach to compromise a system. This asymmetry makes the task of safeguarding digital assets exceptionally demanding.

The Role of AI in Enhancing Cybersecurity

Timestamp: [02:32]
Nikesh Arora:
"The only way to do it efficiently, effectively and in real time is to use the same technology to protect ourselves against cyber threats that we are using to make our lives convenient."

Timestamp: [03:06]
Nikesh Arora:
"AI is like having a really smart person that you can have work for you...the question is, can I train it with my information to make me more effective and helpful for me?"

Arora discusses the transformative potential of AI in cybersecurity. By leveraging AI's capabilities in pattern recognition and data analysis, Palo Alto Networks aims to detect and respond to threats more swiftly and accurately. He likens AI to an infinitely knowledgeable and diligent employee, capable of enhancing both defense mechanisms and operational efficiencies.

Evolution of Cyber Threats and Bad Actors

Timestamp: [03:57]
Nikesh Arora:
"Fifteen years ago it was people who sat playing games in their parents’ basements...but very quickly...started getting any sort of economic legs."

Arora traces the evolution of cyber threats from amateur hackers seeking recognition to sophisticated actors motivated by financial gain and geopolitical agendas. He highlights the rise of ransomware and the involvement of nation-state actors from countries like North Korea, China, Russia, Eastern Europe, and the Middle East, emphasizing the global and multifaceted nature of today's cyber threats.

Cyber Resilience and Event Risk Management

Timestamp: [05:47]
Nikesh Arora:
"If something's going to happen that impacts a certain sector of your portfolio is going to happen...demanding a certain level of quality, certain level of cybersecurity, hygiene becomes important."

When addressing concerns specific to event risk management, Arora advises focusing on "cyber hygiene"—the basic practices and safeguards that reduce vulnerabilities. He suggests that maintaining high standards of cybersecurity across portfolio companies can mitigate risks associated with unforeseen cyber incidents.

Timestamp: [06:50]
Nikesh Arora:
"There's the resilience as well...look at we powered through a pandemic...how resilient are you?"

Arora emphasizes the importance of cyber resilience—the ability to recover quickly from cyberattacks. Drawing parallels to the global resilience demonstrated during the COVID-19 pandemic, he argues that organizations must build robust systems capable of bouncing back from disruptions, ensuring continuity of operations even in the face of significant cyber incidents.

Optimism Amidst Cyber Threats

Timestamp: [07:50]
Nikesh Arora:
"I believe in the sort of goodness of humanity...we haven't seen those things...there's enough segmentation, there's enough circuit breakers...how resilient are you?"

Despite acknowledging the severity of cyber threats, Arora maintains an optimistic outlook. He trusts in humanity's capacity to innovate and adapt, as demonstrated by the collective response to global challenges. His faith in cyber resilience reflects a balanced perspective that recognizes risks while believing in the potential for recovery and improvement.

Indian Leadership Style and Common Traits

Timestamp: [08:28]
Nikesh Arora:
"We all share similar backgrounds...resourcefulness, some degree of scrappiness...strong work ethic...constant learning...ample humility."

Arora delves into the characteristics that define Indian leadership, particularly those emerging in the tech and cybersecurity sectors. He attributes their success to shared experiences of growing up in resource-constrained environments, fostering resourcefulness, resilience, and an unwavering work ethic. Additionally, he highlights the importance of continuous learning and humility, essential traits that enable leaders to navigate and excel in dynamic industries.

Maintaining Humility Amid Success

Timestamp: [10:08]
Nikesh Arora:
"Go home to the family. They'll set you right in a heartbeat...stay with your family and your friends, and they'll keep you grounded."

Addressing the personal dimension of leadership, Arora emphasizes the role of family and friends in maintaining humility. He believes that a strong support system is crucial for sustaining personal well-being and perspective, regardless of professional achievements. This grounding helps leaders remain focused on what truly matters and prevents the pitfalls of overconfidence.

Conclusion

In this episode, Nikesh Arora provides a comprehensive overview of the current cybersecurity landscape, the challenges posed by an expanding digital attack surface, and the pivotal role of AI in enhancing defense mechanisms. He offers a thoughtful analysis of the evolution of cyber threats and underscores the importance of resilience and robust risk management strategies. Additionally, Arora shares valuable insights into the characteristics of effective Indian leadership, emphasizing resourcefulness, continuous learning, and humility as key drivers of success. His optimistic perspective on humanity's capacity to overcome cyber challenges provides a balanced and encouraging outlook for the future of cybersecurity.

Transcript

[Nikesh Arora]

Hi, everybody.

[Nicola Tangen]

Tune in to this short version of the podcast, which we do every Friday. For the long version, tune in on Wednesdays. Hi, everyone. I'm Nicola Tangen, the CEO of the Norwegian Sorbonne Wealth Fund. And today I'm in really good company with Nikesh Arora, the CEO of Palo Alto Networks. Palo Alto Networks is the world leader within cybersecurity, which has never been more important than today. We own 1.2% of the company, translating into more than $1 billion. Thank you so much, Nikesh, for taking the time.

[Nikesh Arora]

Thank you, Nikolai. Lovely to see you again.

[Nicola Tangen]

Now, let's start off with the basics. What do you guys do?

[Nikesh Arora]

That's a good question. Look, as the world has digitized, as we've all adopted technology, whether it's on our smartphones or as companies make applications available to everyone, the possibilities of bad actors getting into company systems or personal systems goes up. And our job is to protect that technology infrastructure from bad actors. So we are in the business of cyber security, which is to protect our enterprise customers, governments and individuals from being hacked or attacked or coerced by bad actors.

[Nicola Tangen]

Now, the thing is that everything is digital these days, right?

[Nikesh Arora]

Yes.

[Nicola Tangen]

Your car, street lights. So what's kind of happening with the whole attack surface?

[Nikesh Arora]

Well, it's a great comment, Nikolai, because you've said it right. We call this the attack surface. And the attack surface is expanding. And I think we're not done. And as you said, if you drive around in San Francisco in a waymo, that's your car. But the car is now fully connected to some central nervous system. And if a bad actor could get their hands on that control systems to your car, they can control your car. So as we create more and more technology, more and more interconnectivity, we are creating the opportunity for bad actors to get involved and start to interfere or start to take over this attack surface. So, yes, the attack surface is fundamentally exploding, will continue to explode, which makes it more and more important for us to make sure that we are able to protect those situations faster and faster and faster in more real time as we can.

[Nicola Tangen]

What's the most difficult part of what you do?

[Nikesh Arora]

The most difficult part is, is the tables are unfairly stacked. The bad actor has to be right once, and we have to be right 100% of the time. That's hard to do.

[Nicola Tangen]

How do you do it?

[Nikesh Arora]

More and more technology. We all talk about AI, and I'm sure we'll talk about it, but we have to be able to identify things as they're happening. We have to be able to look for the needle in the haystack. And today, with the amount of data that's floating around in the world, the amount of connectivity as we talked about that is going on, the only way to do it efficiently, effectively and in real time is to use the same technology to protect ourselves against cyber threats that we are using to make our lives convenient.

[Nicola Tangen]

How has AI changed the way you work?

[Nikesh Arora]

Oh, I think AI is going to change everything. It's almost as we, you know, we are beginning to see every week there's a net new incarnation of AI. And you can see it keeps getting smarter. And the way I sort of correlate this is like AI is like having a really smart person that you can have work for you. This person doesn't forget anything. This person knows everything that's ever happened in the world. This person knows how to recognize patterns. And what's happening is that that person is over time going to become smarter than the average employee and be able to either assist the current employees in the task and possibly take over their tasks. Now that also applies to cybersecurity. Right. If you can have somebody who has infinite memory, infinite pattern recognition, then the question is, can I train it with my information to make be more effective and helpful for me? I think that's just phase one.

[Nicola Tangen]

Who are the bad guys? Where is the dark side?

[Nikesh Arora]

The dark side is interesting. It's been an evolution. I think 15 years ago it was people who sat playing games in their parents basements and who were great at technology and sort of hacking somebody or proving a point was kind of like getting a trophy. It's like, look, look at me, I'm so smart, I can hack into the system X, the system Y. And look, I showed that I can do it. But very quickly, as the world became more and more interconnected, it started getting any sort of economic legs. People said, wait, if I do that, I can actually find a way to monetize it and find a way of getting money for it, whether from the companies or individuals. And we're seeing a lot of that. There's a lot of ransomware activity, a lot of activity where people are, are scared into sharing economics with bad actors. I think we're at, we're past that too. I think nation states have started building that capability in a robust way because I think the future wars will be fought both in the digital war sort of battlefield as well as a physical battlefield. Digital battlefield is a lot less expensive from a, from a, you know, situation.

[Nicola Tangen]

Where from a casualty perspective, so if you were a bit more specific about the countries.

[Nikesh Arora]

Well, I don't think it's a state secret that there are countries which have tremendous offensive capability. Even the US has a great offensive capability. But there are people out there who spend more time building offensive capability than defensive capability because they feel that that capability would be extremely well leveraged in a adversarial situation. And we have better bad actors. We have seen groups in North Korea, we've seen groups in China, we've seen groups in Russia, various parts of Eastern Europe, some parts of Middle East. So you have, you have groups of people now. That doesn't mean the whole country is bad.

[Nicola Tangen]

If you had my job, what would you be the most worried about?

[Nikesh Arora]

Look, in your business, there's event risk, right? Although everything goes down the path, you have wonderful models that try and tell you how things going to happen. From an event risk perspective, it's very hard to model it. It's very hard to be afraid of it, because event risk is event risk. If something's going to happen to one of your portfolio companies is going to happen. If something's going to happen that impacts a certain sector of your portfolio is going to happen. I think on the flip side, what you can look for is, let's say, basic hygiene. Typically, cybersecurity is like water. It follows the path of least resistance. The companies are most vulnerable, will be the ones which will have the most problems. So demanding a certain level of quality, certain level of cybersecurity, hygiene becomes important. And you see that. You know, there are various executive orders, edicts from governments where they demand that a certain level of hygiene be maintained by critical infrastructure because that can impact nation state stability.

[Nicola Tangen]

Are you worried about the whole financial system, plumbing, like stock exchanges, that kind of thing?

[Nikesh Arora]

Look, I can scare myself every day if I want to. So I believe in the sort of the goodness of humanity. If you look around, we haven't seen those things. And I think the flip side is the resilience as well. Look at we powered through a pandemic, which is one of the biggest crises that civilization has seen in modern times. So can we overcome some plumbing breakdown? Sure we can. Will it be choppy? Possibly. It all depends on the extent and the extent of the impact and the scale of the impact. But I'm not worried. There's enough segmentation, there's enough circuit breakers in the systems where I think today we say, look, when you think about cybersecurity, think about cyber resilience. Because the possibility that you can get attacked, hacked or Brought down to your knees is reasonably high. If somebody shows up with tremendous amounts of force and computer, they can find a way into breaking into that one chink in your armor and destabilize you. The question is, how resilient are you? If somebody does destabilize you, how quickly can you come back up? How quickly can you bring your infrastructure back up and you can resume operations? That's kind of where the focus has been the last few years amongst large companies, enterprises, critical systems. And that's a good thing because I think that's the right way to think about it.

[Nicola Tangen]

I am slightly confident by the fact that you still believe in the goodness of humankind because I, I hadn't really expected that to be the case. But.

[Nikesh Arora]

As I say, hope for the best and prepare for the worst.

[Nicola Tangen]

That's what we do every day. What's the Indian leadership style like? What are the commonalities?

[Nikesh Arora]

Look, remember we all grew up with scarcity, I think. So being resourceful has to come naturally to us because if I look at some of my friends and peers in the industry, I know the backgrounds of many of them and we all share similar backgrounds. We all went to some sort of engineering school in India. We all came from lower middle class or middle class families. If you look across the board and I'm just thinking of eight or tens of people I know in our sector who are legendary CEOs right now, they all have similar backgrounds. So we all have some degree of resourcefulness, some degree of, you know, scrappiness perhaps that comes with, comes with a very strong work ethic because you can't survive in a country with one plus billion people at that point in time if you don't have the ability to put your head down and work hard. When I went to engineering school, I think 100,000 people took the exam to chose 2,000 people to go to those five schools that we wanted to go to. So there's a 2% chance that you get in to get there. It was not just going to be pure luck, it was going to be a lot of hard work and dedication. I think every one of us went through that. So there's a work ethic, there's a resourcefulness aspect. I think there's a constant learning aspect to it. None of us grew up with AI like you said, none of us grew up with the cloud, but somehow we've all managed to learn it. I didn't grow up with cybersecurity, we all managed to learn it. So there is some degree of a constant learning sort of algorithm in there. Hopefully there's a dose of ample humility across the board because we're all blessed and privileged to be able to work in this environment and be part of a larger sort of, you know, cosmos in the United States, to be able to sort of make our dreams come true. And then the rest is chance.

[Nicola Tangen]

How do you stay humble with all that success?

[Nikesh Arora]

Oh, go home to the family. They'll set you right in a heartbeat. It doesn't matter how successful you're at work, you're still part of a family unit. And I think it's consistent. And I know some of these people, I said, and their spouses, and they keep us grounded. They keep us focused on the right things. And I was chatting with somebody last night. I still hang out with my friends I knew in high school. It doesn't matter what I do for a living, and they don't really care what I do for a living for the most part. So just go back, stay with your family and your friends, and they'll keep you grounded.