The AI Cybersecurity Crisis Is Here | Nikesh Arora (Palo Alto Networks CEO)

AI writes code faster than the industry can secure it

Nikesh Arora runs Palo Alto Networks, and his warning is that AI is being adopted faster than it can be secured. A model that writes code is equally good at finding bad code, so the industry may uncover in six months the vulnerabilities that should have taken ten years. His answer is to buy and build AI security capability and to treat what follows as a long stretch of patching work, hardest in regulated industries and legacy systems.

Takeaways

• AI adoption is outrunning its security. Cybersecurity has to stay a step ahead of the adoption curve. Prompt injection and data poisoning are live problems. A million models are downloaded from Hugging Face daily, and Salesforce went headless after a marketplace app was hacked.
• Code models double as vulnerability finders. Arora argues a model good at writing code is also good at finding bad code, and within three to six months most open-source models will match it. In six to twelve months the industry could find in six months what should have taken ten years.
• Patching load grows, lockdown unlikely. Patching could go from three a week to 300, though the same models help build patches. Arora rejects a lockdown and expects a lot of work, with the hardest cases in regulated industries and legacy setups such as a physician's office in Nebraska.
• Palo Alto bought and built AI security. The company made three AI security acquisitions, built two or three native products, transformed existing ones, and bought HackerOne for penetration testing and model vulnerability work. It announced an agentic gateway, and concluded it would never have the compute to train its own model.
• AI lifts whole teams to the 95th percentile. Arora calls it the democratisation of intelligence. Hiring 1,000 people makes a company captive to its weakest link, while AI can bring all of them to the 95th percentile, so ten experts and ninety agents could do the work of thousands.
• Google's form came from Larry Page. Companies take on the form of their leader. Page read every hiring packet for Google's first 10,000 to 15,000 employees and rejected 10 to 15 percent, told Arora no tech company became great through go-to-market, and ignored Steve Jobs's advice to focus.

What Arora looks for in founders

• Intensity, plus a taste for hard, big problems. He says he has rarely met a bad idea and has often met bad execution.
• The ability to scale a team to 10 to 40 people, which he treats as an early test of a founder.
• The humility to pivot, and skepticism about VC advice. He has never met a successful entrepreneur who wished they had taken less risk or given away more equity.