Palo Alto Networks CEO: "AI Found 5 Years of Bugs in 6 Weeks"

In this wide-ranging interview, Palo Alto Networks CEO Nikesh Arora discusses the transformative impact of AI on cybersecurity and enterprise software. The conversation opens with context on his tenure: he joined when the company was valued at $17 billion and it now sits at $238 billion market cap.

On AI and cybersecurity, Arora reveals a landmark finding: using Anthropic's Claude model (referred to as 'Mythos'), Palo Alto Networks discovered vulnerabilities in their own codebase in 6 weeks that would have normally taken 5 to 7 years to find. He notes the model's 'ultra mode' (persistent thinking) can even daisy-chain vulnerabilities to find novel attack paths. However, he tempers this with a critical caveat: Claude had a 30% false positive rate, making it powerful for offense but problematic for defense without additional refinement and harnesses.

Arora warns that similar capabilities are likely available or soon to be available in open-source and Chinese models — perhaps within 3 months — creating an urgent race between defenders and attackers. He expresses less concern about attacks on critical national infrastructure (which is well-funded and defended) and more concern about small businesses and mid-market companies running legacy or open-source software, citing the Change Healthcare ransomware attack as an example of the real economic chaos such breaches can cause.

On enterprise software and SaaS, Arora is direct: analytical SaaS is dead. Companies that collect and analyze data on behalf of customers are being made obsolete because AI models can run directly against raw data. He argues that the middle tier — 'systems of work' or 'systems of record' — will be reinvented over the next 5 years, with agent-driven workflows replacing human-facing UIs. He also predicts enterprises will need 10x more stored data to train AI systems to distinguish normal from anomalous behavior.

On the model vs. application layer debate, Arora believes models will commoditize into a utility layer where intelligence is purchased on demand at varying capability levels. He argues the real profit pools are in the application layer, which is why OpenAI and Anthropic are pushing into coding tools and vertical applications. However, he believes this application layer is still largely unformed and represents a major opportunity for new companies.

Arora also touches on hardware (still essential for low-latency use cases like financial services), M&A strategy (Palo Alto recently acquired a $25 billion identity security company), and workforce impact (he believes AI is actually increasing headcount on the technical side at Palo Alto, not reducing it).