21 Nov 2024 · 21m · Alison Beard, Nikesh Arora · 18 quoted facts
Nikesh Arora, CEO of Palo Alto Networks, argues that generative AI makes cybersecurity a race of speed. As everything becomes connected, attackers have more places to strike and are using AI to move faster. Defenders must answer with their own AI, applied in real time. He says this is easier when customers use one integrated security platform instead of dozens of separate vendors.
The central tension is between AI's promise and the risk of handing it control. Arora sees AI as a productivity tool that removes repetitive work. He also warns that giving AI authority over critical systems, without ways to intercept it, is dangerous. His biggest worry is not exotic AI attacks. It is that attackers now get in and out within hours while many companies cannot respond or recover that fast.
Arora says most recent hacks are simple, such as unlocked doors or stolen credentials. What AI changes is how fast attackers act once inside, with dwell time shrinking from weeks to hours and heading toward under an hour.
Attackers only have to succeed once, while defenders must succeed every time. Arora cites tools like Worm GPT on the dark web and says the only counter is real-time, AI-driven blocking.
The company has acquired about nineteen companies in six years. Arora says acquired teams get more resources and lead the product, after hours of upfront agreement on strategy.
Arora argues customers should not build and integrate thirty separate security tools themselves. He compares this to how CRM, HR and finance moved from many systems to single platforms.
Asked about budget limits, Arora advises focusing on detecting events and recovering fast, since breaches will happen. Whatever money is left should go toward strong defenses.
Arora says AI helps attackers move faster, and more connected devices give them more places to attack. He says dwell time, the period an attacker sits inside a network, has dropped from weeks to hours.
It is the name Arora gives to Palo Alto's mix of machine learning, neural networks and reinforcement learning. It analyzes data from security systems in real time to spot unusual behavior and stop it mid-attack.
Arora defines it as treating everyone who accesses your systems the same way, wherever and however they connect. He advises using a single vendor rather than juggling several security tools.
Arora says standards are hard, and attackers would target the weakest link if not everyone adopted one. A kill switch could also cause harm, for example if it stopped AI running a power plant. He thinks the larger issue is who gets control of critical processes.
Arora says to focus on detecting security events and on being able to remediate and recover quickly. After that, spend what you can on strong defenses, because a breach can be very expensive.
Stated by the speakers. Each quote matches the transcript, which shows what was said, not that it is true.
Nikesh Arora had served as CEO of Palo Alto Networks for about six years at the time of this conversation, during which he expanded and reorganized the company.
“Over his six-year tenure, Nikesh has expanded and reorganized the business to meet the full suite of enterprise and government client needs”
Nikesh Arora says that as more devices become connected, the cybersecurity 'attack surface' grows, letting bad actors attack in more places.
“So that means bad actors can attack you anywhere, impact your connectivity, impact your technology and create unwanted outcomes.”
Nikesh Arora says attackers need to succeed only once while defenders must succeed every time, so defenders must work much harder.
“they only have to be right once. We have to be right every time, so we have to try a hundred times harder.”
Palo Alto Networks packages machine learning, neural networks and reinforcement learning into what it calls 'precision AI'.
“we have packaged a whole bunch of AI slash machine learning and neural networks and reinforcement learning into what we we we politely call precision AI”
Nikesh Arora says Palo Alto Networks connects to a company's security systems and analyzes the data in real time with machine learning and precision AI.
“We are connected to every security system that exists in a company. We analyze that data real time using machine learning and precision AI.”
Palo Alto Networks acquired about nineteen companies in roughly six years, according to CEO Nikesh Arora.
“So we've bought about nineteen companies in the last six years with the premise that somebody else has figured out a way”
Nikesh Arora says Palo Alto Networks puts the leaders of acquired companies in charge of the related product areas, with Palo Alto teams working for them.
“we make our teams work for them. That's rule number one, you know, take the smarter people, take the people who are really passionate about this, get them to lead these things.”
Nikesh Arora says Palo Alto Networks gives acquired startups more resources so they need not worry about fundraising or hiring.
“we actually double down and give them more resources because we say, listen, the whole point of getting you to come be part of our fold”
Nikesh Arora says early in his career he worked at a company whose customer relationship management system was made up of twenty-five separate systems.
“I started my technology career thirty plus years ago, and I used to work for a company where twenty five systems made up our customer relationship management system.”
Alison Beard states that Nikesh Arora holds an electrical engineering degree from IIT BHU, a master's from Boston College and an MBA from Northeastern University.
“you have a degree in electrical engineering from the Indian Institute of Technology, B H U, as well as a master's from Boston College and an MBA from Northeastern.”
Nikesh Arora defines zero trust as treating everyone who accesses an organization's infrastructure the same way, regardless of where or how they connect.
“fundamentally what zero trust means is that you know, you have to be able to treat everybody who's accessing your infrastructure the same way, wherever and however they come from.”
Nikesh Arora advises budget-constrained companies to prioritize detecting security events and remediation and recovery over preventive security controls.
“my view is focus on remediation, fake focus on detecting security events, don't focus as much on, you know, security controls”
Nikesh Arora says a tool called Worm GPT, found on the dark web, helps attackers study known vulnerabilities and build ways to attack companies.
“there's something called Worm GPT, there's something, you know, on the dark web that goes and helps you take a look at CVs and build capabilities that can attack companies.”
Nikesh Arora says an AI kill switch could have unintended consequences if it interrupted a critical process such as a nuclear power plant.
“if you put a kill switch in AI and it's running a nuclear power plant and you kill it, then there's a risk that you inter intercept a process which can have unintended consequences.”
Nikesh Arora predicts AI regulation will focus on transparency, understanding how models work and how guardrails are applied.
“most of the regulation is going to be around transparency, around understanding how these models work, around how guardrails are put around them”
Nikesh Arora says most recent hacks are not technically complicated and happen because companies have not secured basic entry points.
“a lot of the hacks, if you look in the last six months or last twelve months, are not complicated. They're just hacks that happen because companies haven't bolted their doors and windows carefully”
Nikesh Arora says that when he started about six years earlier, attackers' dwell time inside a victim's infrastructure was measured in days, with a lag of forty-seven days cited.
“six years ago when I started, I used to hear about things and took eight days or ten days, and the lag was forty seven days of dwell time for somebody to come in and be in your infrastructure”
Nikesh Arora says attacks now play out in hours rather than days and predicts they will soon take under an hour.
“Now I hear about hours. I think that's going to go down under an hour.”
Arora explains that more connected devices enlarge the target for attackers, and that faster attackers force faster defense.
“the attack surface magnifies or amplifies”
He describes how Palo Alto gathers data from all security systems and uses AI to block bad behavior as it happens.
“needle in the haystack, look for bad behavior, block it when we find it”
Arora explains why Palo Alto acquires startups and how it keeps their teams in charge.
“if you can't build it, embrace it and buy it”
He argues that fragmented security tools leave customers doing too much work, and points to platforms in other business areas.
“Why not let us do it once and then you can deploy it 2,000 times?”
Arora says leaders must understand their product, and that AI should be treated as a productivity tool that removes repetitive work.
“The key is the leaders have to be product savvy.”
Answering an audience question, Arora advises consolidating vendors and prioritizing recovery over controls.
“focus on remediation and recovery to make sure that's sort of stitched up”
He discusses attackers' use of AI, the risk of giving AI control of critical systems, and where regulation is heading.
“there's something called Worm GPT”
Arora closes by saying the main threat is that attackers now operate in hours while enterprises are not ready to respond that quickly.
“The biggest threat is that large enterprise is not ready to react”
Welcome to the HBR IdeaCast from Harvard Business Review. I'm Alison Beard. Throughout this month, we've been sharing conversations with CEOs and founders about artificial intelligence and other critical issues facing leaders today. We wrap up our Future of Business series with Nikesh Arora, CEO of Palo Alto Networks, the leading global cybersecurity company. Over his six-year tenure, Nikesh has expanded and reorganized the business to meet the full suite of enterprise and government client needs, including safely incorporating gen AI into all of its products.
I was excited to speak with him at our recent virtual Future of Business conference about how he's managing new opportunities and risks and his strategy for innovation when new technologies are developing so rapidly. Here's our conversation, which includes a few questions from the audience. Let me just start with talking about the threat and the opportunity of AI in the world of cybersecurity. Um, you said that the only way to fight AI from bad actors is with AI from good ones.
So what tools are corporate cyber attackers developing, and what tools are you building to stop them? How do you stay ahead?
If we all believe, which I think we do, that this is going to have some sort of transform transformative power, uh, how, when it fully sort of manifests itself still remains to be seen. But I've never seen a technology trend move so fast and there'd be so much excitement around it. And at the most fundamental level, we expect that things will happen faster. Um, as development accelerates, we will end up creating more and more connectivity across the entire landscape.
Our cars will be connected, our homes will be connected, our street lamps will be connected. You know, you'll have technology everywhere. In that scenario, in that environment, you know, when everything gets connected, in our cybersecurity parlance, we call that the attack surface magnifies or amplifies. So that means bad actors can attack you anywhere, impact your connectivity, impact your technology and create unwanted outcomes. In that scenario, and as that speed of connectivity, as that speed of development increases, you have to increase the base of defense from a cybersecurity perspective.
And we're already noticing that bad actors are trying to figure out ways of entering into people's infrastructure, trying to get in and out, extract data, use it for economic purposes. And their speed is increasing, which means the only way to fight them back is to increase our speed of defense. And you know, and for the the sad truth is that they only have to be right once. We have to be right every time, so we have to try a hundred times harder.
So I think there's a lot of effort that needs to go into fighting these, uh, potential bad attacks. Bad actors are using generative AI recently, trying to figure out how to get into people's infrastructure. You know, we're all we're all arming up to do the same.
You've now incorporated gen AI across your entire suite of products. It is such a new technology. So how did you manage to incorporate it so quickly? Just talk us through the process of investigating and then applying use cases, and again, at a speed faster than the bad actors.
In our business, we have to get it right. So what we have done is we have packaged a whole bunch of AI slash machine learning and neural networks and reinforcement learning into what we we we politely call precision AI. Uh, we've been working in it for longer than the last few years. I think the whole fundamental premise where it sort of sort of rests is that we've been working on a project to collect all the data in the enterprise, collect all the behaviors, understand all the data.
We are connected to every security system that exists in a company. We analyze that data real time using machine learning and precision AI. Based on the analysis, we can tell anomalous patterns, and if you believe the anomalous pattern is a bad actor, we stop it mid-flight. So the whole idea is to make security more real time. So we we take large amounts of data, needle in the haystack, look for bad behavior, block it when we find it.
Uh, but this needs to happen for every company, every entity, every piece of critical infrastructure over the next few years for us to live in a new environment where bad actors are going to move faster and faster.
So under your tenure, um, Palo Alto Networks has developed this full suite of solutions. You've been on a massive acquisition spree to do it. So how do you look at the balance between that and organic growth?
When you're building a business, um, and as as we just discussed, we are one of the most innovative businesses in the world. Cybersecurity is something where people are constantly trying to find a new way of getting into your infrastructure. Now, to protect against that, we have to make sure we always are one step ahead. We're always thinking ahead. If this new technology arises, what's going to be the potential backdoors into it, or ways to attack it, or ways to misuse it?
You know, we cannot be the most only innovative company in the world. There are other people who are innovating in cybersecurity. And Harold Teeses is we have to be humble, we cannot be too proud. We have to believe that innovation will come from everywhere. And if you can't build it, embrace it and buy it. So we've bought about nineteen companies in the last six years with the premise that somebody else has figured out a way to find a new solution to a potential upcoming cyber threat, cyber attack.
Let's embrace them, let's make them part of Palo Alto so we can actually stitch it together and provide that real time, at base, at high innovation capability to our customers.
And so then once you've found those innovative companies that you want to bring into the fold, what is the secret to effectively integrating them? Especially when you have sort of small startup cultures that are coming into this much larger organization.
That's a great question. Uh, so look, I think, uh, M and A is an oft talked about area and a lot of lot of people get it wrong. When we acquire these companies or we partner with them, we say, listen, you've done so well, come do this for us. What we do is we make our teams work for them. That's rule number one, you know, take the smarter people, take the people who are really passionate about this, get them to lead these things.
Two, we actually double down and give them more resources because we say, listen, the whole point of getting you to come be part of our fold is because we might be bigger, slightly slower, but we have more resources. So we actually give them more resources, which means they get they don't have to worry about raising money, they don't have to worry about going, you know, hiring people and thinking about their budgets. It's like, here's more people, you drive this thing.
The only thing we do is we make sure we sit down and spend hours and hours and hours about what the north star and the product strategy needs to be. We do that before we buy these companies because we want to make sure that the people who are leading these are fully aligned with our view of the world. And we, of course, will listen to their view of the world and trying to find a happy middle ground, which actually means that we can go solve a customer's problems together in a much more effective, fast fashion.
If the end goal is to make Palo Alto this one stop shop cybersecurity platform, you know, to have everyone using everything of yours, how are you bringing your clients on board? What are those customer conversations like?
I I look at it slightly differently and it may result in a one stop shop, but I think the the the motive is slightly the other way around. I think about it saying, listen, if the bad actor is going to move at this pace, and they're going to go, and we have to analyze things in real time. We have to handle, have a handle on all that's happening in the organization. To have a handle on that, we have to be at every sensor to understand what behavior is happening, what data is coming in.
We have to be the analytical engine to understand how to analyze that behavior. And we have to be able to connect back to the enforcement points and stop bad behavior from happening. Now, if you fragment that across thirty different security companies, then the risk is that you, the customer, have to build all that capability. I just think it's it's unfathomable that in in today it hasn't been done yet, that our customers are going to get all this right and get it right 2,000 times.
Why not let us do it once and then you can deploy it 2,000 times? So we're trying, you know, slowly consolidating, driving in that direction. And by the way, this is not new news. Like, you know, I started my technology career thirty plus years ago, and I used to work for a company where twenty five systems made up our customer relationship management system. That was the that was the way the world worked. Today, you go buy an Oracle, Salesforce, Microsoft, they do all of it for you end to end.
So it's not it's not like this hasn't been done before. Platforms exist, they exist for HR planning, HR, they exist for finance, they exist for, you know, IT services. It's time that we one exist for cybersecurity.
You've talked so much about the pace of change, how quickly you need to adapt. So how do you, as the leader of the whole enterprise, then think about short term versus long term planning? Can you do long term planning anymore?
Well, of course, look, uh, all good things take more time, all good things take a lot of considered effort. Whether you're trying to make bake a cake, a beautiful one, a wonderful one, or you're trying to build a product or you're trying to run a company. You have to think about what the North Star is, you have to think about what you're trying to get. You have to be constantly learning, be paranoid to understand how this thing's going to happen, and you have to take bigger bets.
Like we we used to, you know, you guys uh, teach this in finance theory, higher risk, higher return. The question is, as a leader, our job is to figure out how to manage risk. But there's very little sort of possibility that there is you take no risk and you get a lot of return. So our job, me and my team, the leadership team here, our job is to think about how do we get to something which is differentiated from everybody else.
How do we do that in a managed risk fashion? How do we make sure that we don't compromise for the short term to achieve the long-term goal? Our long-term goal is to make our customers more secure.
Let's talk a little bit more about leadership and talent. Um, so you got some recent press, uh, for clapping back at someone on social media who questioned your engineering bona fides.
That's just not in the cards.
For the record, you have a degree in electrical engineering from the Indian Institute of Technology, B H U, as well as a master's from Boston College and an MBA from Northeastern. Um, so talk about the rise of the engineer CEO and how you balance oversight of both the technical and the business sides of Palo Alto Networks.
Business aside, at the end of the day, we're all product companies, right? We all solve a problem, we all deliver either a product or a service. And if you don't understand your product, you don't understand your service. It's very hard to build a great business around it. The key is the leaders have to be product savvy. They have to have a point of view and a vision for the product, where the product is going and what the product future looks like.
And if you can do that, then you can build a business, great business around it. I think if you get too focused on efficiently running a current product portfolio, the risk is that you miss the train or the boat or whichever form of transportation you'd like to pick in terms of where your product needs to be. And and a leader's job is not just to execute on the current strategy, it's also to define the next strategy for the future or build new products.
So there is a war for talent in Silicon Valley and technology in general. So how do you think about recruiting and retaining the best people? And then also, you know, as AI evolves, the human tech mix.
We're lucky, uh, we're a mission driven business. We exist to make our customers safer. Being mission driven helps because there are people in the world who actually want to go work for a mission driven company versus a social media company. You know, being the largest cybersecurity company helps that. If you're if you have an aspiration to build a career in cybersecurity, we are one of the better places to come work for because we have proven through our track record that we're on the bleeding edge of innovation.
Customers like us, we're working on very, very cool stuff. So I think the the demand function's there, we we attract good people. I think once they come here, the key is do they like how we work, do they like our culture? So we work, we spend a lot of time making sure that our culture is a place where people have the autonomy, have the sort of alignment from a communication and North Star perspective. People feel like this is a comfortable workspace from them, wherever they come from.
So we're lucky we get great people who come work for us, so hopefully they're all happy over here. In terms of how AI and humans are going to in sort of, uh, evolve in the future, I mean, to me, AI is a productivity tool, and we've had productivity tools in the past. You know, we've used email, some some argue email may not be a productivity tool, it may take away from it, but that notwithstanding, we've had productivity tools which have made us better and better at what we do, whether it's automation, whether it's industrialization, now it's AI.
So, yes, will the nature of people's work change because AI will do some part of it? Definitely sounds like it, but my early sort of belief is that it's going to be net positive. It's going to be useful because the first thing that AI is going to do is take away the boring, repetitive tasks, which I'm pretty sure none of us could get out of Harvard or college to go out and say, I'm going to go and do repetitive tasks for the rest of my life because that's really cool.
No, I want AI to do it, take care of it, take the repetitive tasks away. So I think the quality of work is going to increase and the quality of the organizational chart or the shape of the organizational chart might have to change. In the future, we'll see how it works.
So I do want to get to some audience questions, uh, because we have a lot coming in. First, Nuno asks, what are the key elements of a successful zero trust security framework, and how can companies, especially small to medium sized businesses, balance the need for strong cybersecurity with budget constraints?
There's two parts, like the zero trust question, and fundamentally what zero trust means is that you know, you have to be able to treat everybody who's accessing your infrastructure the same way, wherever and however they come from. So, uh, we have products, I'm sure other people in the market have products that deliver that capability, but the key is, uh, it goes back to what we talked about. Do not fragment your infrastructure on the network side from a security perspective, because if you do, you have to manage multiple security panes of glass in industry parlance, and that just makes comes more complicated and hard to do.
So, try and find a single vendor that satisfies that problem for you. Now, as it relates to budget and and managing, I know it's a tough question. Because if you are in a digital business, there's a possibility and you're dealing with end customer data. You have to be careful because there's a possibility if you leave the door open, somebody's going to walk in. And it's going to be, you know, very expensive for your business in the future if you're not secure.
From that perspective, uh, uh, my view is focus on remediation, fake focus on detecting security events, don't focus as much on, you know, security controls, focus on making sure that if something happens, you have the ability to remediate as quickly as you can. You have the ability to bring it back up as quickly as you can. So focus on remediation and recovery to make sure that's sort of stitched up. Do not compromise on that because bad stuff can happen, and then spend whatever else you can to make sure that you have robust defenses.
Okay, so we have a couple questions about bad actors and gen AI. So Cam asks, How would you differentiate between a bad actor, a person, a human, versus a gen AI model taking control of decisions and acting as a bad actor? And William asks, Are you more concerned about cyber attacks or the misuse of gen AI resources?
So far, and the way I think about gen AI is they're all building a brain, right? They're trying to create reasoning and inferencing so this thing can even think on its behalf. Now, if you think about it, if you if you hire a really smart person to work with you, the first thing you do is you give them a lot of context, what you do, how you do it. You give it your own information to make that brain adaptable to your business.
I think the world of and law where these people build these large brains, these large LLM models, and all of us are spending time explaining our domain to them and trying to get them to understand what we do. So that they can be smarter about our work, not just generally smart. Now, if you have that, then there are two questions. Do you use that brain in a consultative capacity where it tells you things, but the doing is done by you, or do you give this brain control of the doing part?
I think the fear right now is when you talk about the misuse or the abuse of by gen AI, it's what if I give it the controls and it misbehaves, what happens then? So good news is we haven't given control to LLMs or AI models just yet about things, but if you do, the risk is that they could do bad things. So if you get a very smart brain, you explain cybersecurity, explain all the bad techniques, yes, could it develop superior hacking techniques, for sure.
And if you let it go at it, it will. And we've seen early evidence that, you know, there's something called Worm GPT, there's something, you know, on the dark web that goes and helps you take a look at CVs and build capabilities that can attack companies. Yes, we are seeing that bad actors are going to be using these tools just the way the good actors are. So, as so, as I said right at the beginning, it's incumbent upon us to make sure we build defenses that block these things as real time as we can, because people will use gen AI for these things.
In terms of, you know, gen AI models being abused, we have to be careful. Uh, a, the abuse will happen in places where we give it control. So whether it's a, you know, your LLM driving your car, which we all all of us are sort of robotaxis and Waymo and and you know, Tesla, we've seen that that's giving control to AI to drive your car. So you got to make sure that a, whatever's driving your car is smart and you've got a lot of guardrails and controls to make sure that it can't go rogue on you.
B, you have to make sure that nobody can hack into it and make it do different things. So, you know, we're going to see lots of lots of interesting work happen in blocking hackers from getting into LLMs and making sure that these LLMs are have enough guardrails that they can't go off, uh, off.
So this is a follow up question from Rava Shantar. I hope I'm pronouncing that right. Should we agree on a universal standard for a kill switch for AI if something goes off script, um, in the way that we're all thinking about? Are Silicon Valley honchos meeting to discuss this?
Well, look, uh, for uh, first of all, standards are hard. Uh, most likely, bad actors will follow the form of uh, least resistance. So the risk is if everybody doesn't implement it, then your weakest link is your biggest problem. The flip side also is that if you put a kill switch in AI and it's running a nuclear power plant and you kill it, then there's a risk that you inter intercept a process which can have unintended consequences.
So I think there's a big debate. I think the bigger question, and you know, my personal views, and is that as we as we march towards AGI, we have to be very careful of who gets control or which model can get control of a critical process. I think that's where the discussion's going to be is yes, you can build all the AI you want, but let's make sure that we are giving it control of critical processes that we understand, uh, how you're managing it, how you're regulating it.
Because we really don't want, you know, AGI or a superior intelligence taking control of critical systems, which we cannot intercept. Or perhaps, uh, to use the the listener's words, have a kill switch for it.
As a global company, how are you working with regulators, uh, around the world to make sure that they're educated on all of these issues, which can seem difficult because they're not trained engineers, and then that they're formulating the right policies.
We're all very aware of AI. I think we're all debating the pros and cons of AI. I think there isn't a regulator in the world who's or or possibly nation state in the world who's not debating how to build, use AI for progress and B, how to make sure that it cannot be misused for bad acts. We are going to see some regulation arrive. I think, uh, most of the regulation is going to be around transparency, around understanding how these models work, around how guardrails are put around them, around how these models are going to get or or not get control of critical processes.
And I think we're going to have some great steps and possibly some steps we have to revisit in some time.
What is the biggest cybersecurity risk on your radar right now? Is it gen AI or AGI?
You know, it's fa- fascinating, Alison. Uh, a lot of the hacks, if you look in the last six months or last twelve months, are not complicated. They're just hacks that happen because companies haven't bolted their doors and windows carefully, or there's an insider whose credentials have been hijacked because they weren't careful in keeping their password. So hacks are not complicated. The complication the the real challenge with gen AI or AI is once I get in, the actors are moving way faster.
You know, six years ago when I started, I used to hear about things and took eight days or ten days, and the lag was forty seven days of dwell time for somebody to come in and be in your infrastructure, take the data out. Now I hear about hours. I think that's going to go down under an hour. Then the question becomes the biggest threat is speed. The biggest threat is that large enterprise is not ready to react, to be able to block bad things quickly, recover in under an hour.
So we are going to see possible business interruptions if we don't get our act together.
That was Nikesh Arora, CEO of Palo Alto Networks, at our recent virtual Future of Business Conference. That's it for the Future of Business series, but I hope you go back and listen to all four of the episodes. You can also check out all of the episodes we have on the HBR IdeaCast about leadership, strategy, and the future of work. Find us at hbr.org slash podcasts, or search HBR on Apple Podcasts, Spotify, or wherever you listen. And if you don't already subscribe to HBR, please do.
It's the best way to support our show. Go to hbr.org slash subscribe to learn more. And finally, look out for more HBR events in 2025. Thanks to our team, senior producers Anne Sanni and Mary Do, associate producer Hannah Bates, audio product manager Ian Fox, and senior production specialist Rob Eckert. And thanks to you for listening to the HBR IdeaCast. I'm Alison Beard.