The Exchanges

Q Ah, you try one percent, one percent a day, right? Tom and Cass. But, but you, you know, now, how concerned are you about like deep fakes and generated spear phishing and, you know, voice attacks and all that stuff?

A So to the extent they enable the act of social engineering, yes, those are concerning because I think most forms of two-factor authentication are going to be, you know, out of the window. I still won't say which bank it is going to go and call it, but I call them and they say, oh, can you please confirm your identity? And they ask me three arcane questions, which I'm pretty sure chat GPT or Gemini will be able to answer in some seconds because they're, they're only scouring the web to find public information about me and ask me questions. So I think all those forms of Authenticating who you are, are getting an easier and easier to compromise. So the question becomes, so let's, so the problem you have to figure out is, you can solve it their way or our way, as in the way they're looking at it, the way we're looking at it. At the end of the day, every one of these social engineering attacks, credential takeovers, eventually initiates some bad activity in enterprise. And the bad activity in the enterprise often takes the form, takes on the form of what I will call anomalous behavior, right? Suddenly Sarah decided to exfiltrate all the data in Ila's company, even though she used to do email with him every day, today suddenly she's logged in and she's downloading everything onto her laptop.

AI assessment note: “to the extent they enable the act of social engineering, yes, those are concerning”

Q Where are we actually given, um, your visibility into enterprises and actual adoption or value and use cases?

A So I think the, the use cases where there are two, two current major use cases, right? One, let's call it, we call it generalized or perhaps cross enterprise consistent activities, right? Generalized. So do I have a legal team? Yes, I do have legal teams. Every enterprise have a legal team? Yes. Do they have any particular proprietary knowledge compared to, you know, particular Palo Alto? Unlikely. It's more, I need them for legal advice, not for Palo Alto advice. So in that use case, yes, could we use a, You know, Harvey equivalent or whatever those are. Sure. It enhances their productivity. They get their future faster. Could I possibly in the future do some sort of AI based interpretative app or interpreted, uh, yeah, application which helps me process my accounts to see if accounts payable faster, codify them? Sure. So I could. So there's a whole bunch of repetitive generic tasks across enterprise, which I'm pretty sure could be done by some version of an AI wrapper around LLM with some particular context or my data. Sure. So to that extent, I think we're all experimenting with those things, but my caution to my team is don't try and build them. Somebody's going to build them for all of us. We're much cheaper to rent them by some, perhaps, metric of work.

AI assessment note: “there are two current major use cases, right? One, let's call it generalized”

Q Alto, seven years in, you've added, like, the size of a Palo Alto originally every single year since, in terms of enterprise value. That's wild. Like, what, what makes you a great leader in terms of growth at scale? Like, what do you, what, what advice do you have for some of these people who are like, Yanis spoke of world records in terms of growth the first few years.

A Look, if you step back, it's interesting. Every business that you've identified or you've looked at, we've talked about, has a much larger TAM than any of these companies is able to touch. The, the, the markets are growing. You have the opportunity to take share and grow in that market. So I'm a huge fan of growth businesses. I hate the idea of going restructuring something which is on a declining curve. Scare me. So it's good to find the right market from a growth perspective. I think, um, I always have this principle that nobody wakes up in the morning and goes to work to screw up. Nobody wakes up saying, oh, shit, I went on my worst job possible. No chance in hell. You know, you can find people, you can get a group of people together. They can be innovative as hell and go put, you know, a rocket into space faster than NASA. These are all humans. They're all people out there. There's no difference in many of them than people who work at Palo Alto or people who work at Google or elsewhere. So what creates the difference between great companies and companies that are not, uh, as good? Because I'd say within reason, the people, you can find those people in every company. I think it boils down to understanding the market, setting the right north star, getting enough buy-in, talking about the why, not just the what you need to get done, and getting people really excited and bought…

AI assessment note: “set the strategy, set the North Shore, put the right people in place”

Q Maybe when you look forward both, okay, Palo Alto, cybersecurity, AI, three questions. What keeps you up at night? What do you think most about?

A I think most about AI. Not, I'm glad we think about, I think more about AI from the vantage point that if our view of the world, how, of how this is going to evolve, Is not within the guardrails of where it's going to be, you may end up taking Palo Alto in a different direction. Because remember, we exist to help you secure technological advancement in a certain direction before you're fully deployed. I want to give, like, you know, today our conversation with some of the big cloud providers was, how is everybody thinking about Agenda CAD? I'm supposed to secure agents. The problem is I can't get One person to agree with the other person's definition of an agent. I'm like, what's an agent? Well, are you going to use MCP protocols to deploy? Well, no, we just have connectors. What's a connector in an LLM? A connector is effectively API call, microservices call. Why are you using API calls? There used to be called API calls in the past. Why aren't you using MCP server client and clients? Well, we're going to get there, right? Well, are you, how are you going to do the inspection of identity? Are we going to register the identity somewhere else? What's an agent? How are you going to run it? Is it going to be delegated? So there's like so many questions from an execution perspective, from how the industry evolves, that it's not quite, keeps me up in mind. We talk about this every d…

AI assessment note: “I think most about AI. Not, I'm glad we think about, I think more about AI”

Q Do they expect that to be agents or something else in terms of starting to take action?

A Yeah, we can, we can come there too, but I think because he has a search question, search is an advertising revenue question. So yes, the question is, how does the advertising revenue morph into some version of Consumption or transaction metric, which, cause that's what it's kind of, that's the intent. When I go say, what are the best blue pants in the world? It's not just not doing it for academic interests. I'm actually going to transact. So yes, maybe an agent could do this or the fastest flight to get to Rome. So the agent could do that. We'll talk about agents in a second. I think that's much more disruptive than generative AI. And to that extent, I think how the transition, the business model is going to be interesting. I don't think anyone knows what the business model is, but All I can say is that having been there and admired what they do, they do spend time getting the product adopted first. And eventually, even though there is tremendous amount of distribution for the product, you find a model emerges. I remember how the longest of years, nobody quite knew how YouTube was going to make money. And everybody was looking at Netflix as the one who were making money in streaming. YouTube wasn't. I think YouTube is a big ass business now compared to most of the streaming players in the world. So I think they'll figure out how that model transforms. I do think the agentic c…

AI assessment note: “we can come there too, but I think because he has a search question”

Q Does that actually decrease the effectiveness of those sales teams over time then? In other words, if effectively you have agents screening things, does that create a block for certain types of sales leads?

A Well, I think the question, the sales lead is the, isn't the issue, right? The question is generally either I have a need, I know it, in which case, hopefully my blocking agent knows my needs and eventually says, ah, you know what? Actually, we've been looking for this thing and here's an email which satisfies our thing. So maybe that'll do it. Or, uh, as we do in marketing, you never need a new watch and you never need a new car, but you just buy it because somebody put it in front of you. I don't think it happens that way in enterprise. So we can't generate demand for something we don't know we have a need, but sometimes you can in cybersecurity. So look, I think those will be marginal efficiency outcomes because how many STRs do you have? Eventually you do the selling. We do lead generation. We're in a large enterprise business. We go through a larger rigorous testing process.

AI assessment note: “I think those will be marginal efficiency outcomes because how many STRs do you have?”