Attacks Take 23 Minutes. Response Still Takes Days.

Sarah Guo and Elad Gil open No Priors with a guest who has run both sides of the AI argument: the business that got information onto every screen, and the company that now has to keep attackers off it. Nikesh Arora joined Palo Alto Networks in 2018, when it was still the next-generation firewall player, and has grown it six to seven times into a platform security company. Before that he was senior vice president and chief business officer at Google from 2004 to 2014, through the decade when search became a default utility.

The number he puts on the table later is the one that should follow him out of the room. When he started, the average time for an attacker to identify a target, get through, and exfiltrate data sat in a three-to-four-day window. The fastest case Palo Alto has seen now is 23 minutes. Average enterprise response time, he says, is still measured in days. If the other side can get in and out in under an hour, "by physics your response time has to be less than an hour."

A person who sold search to a skeptical world and then scaled a security company sevenfold does not talk about AI as a demo. Guo wants the future of search, the state of cyber defense, and a leadership method; Arora keeps tying all three back to the same shift. Generative models change how people ask questions. Agents change who completes the transaction. Attackers are already using that compression. The rest of the conversation is what a CEO does when both the business model and the breach clock move at once.

Guo does not ease in. Given his years growing Google, what is the future of search, and how threatened is it? Arora refuses the eulogy. For two decades the industry's job was to get the world's information onto the internet and make it reachable — what he calls the democratization of information, down to a farmer in India looking something up. The new complaint is the opposite: there is too much to sift. People want the pile interpreted. That, in his phrasing, is "democratization of intelligence." You should not have to hire someone to solve the same problem for the 10,000th time, because it has already been solved 9,999 times and the outcomes are on the internet.

On product, he thinks Google is well placed. Fifteen years ago Larry Page was already talking about answering intent rather than the string the user typed. Gemini, ChatGPT, and other models are all walking toward that destination. Distribution is the other asset: only two or three companies on earth reach billions of people — Facebook across its properties, Apple, Google — and they have product chops and AI chops. The harder question is money. Search is an advertising business built on text links shown against a query. When someone types "best blue pants in the world," they are not doing academic research. They are about to buy.

If an agent books the fastest flight to Rome or buys the pants, the ad is no longer a lead. In marketing language, most direct-response search is lead generation that precedes a transaction, and people pay more for a closed sale than for a click. "Maybe the business model transition is stop giving me leads, give me consummated transactions through agents." He does not pretend anyone knows the shape of that model yet. What he remembers from the inside is a habit: get the product used at massive scale first, and a model tends to appear. For years nobody knew how YouTube would make money while Netflix looked like the streaming winner. YouTube is now a larger business than most streaming players on earth. He expects them to figure out the shift. He also thinks the agentic challenge is much larger than the generative-AI one.

The last thirty or forty years of software, Arora says, were spent polishing user interfaces. Product managers are "glorified UI managers," translating ordinary people to the engineering algorithm behind the glass. Expedia is a set of boxes because no traveler was going to write SQL to find a flight. Generative AI already lets people talk to that UI in natural language. The next step is not a nicer form. It is skipping the form. "I actually don't need to come interact [with] the UI — my agent can go do the task for you."

He picks a number on purpose. There are more than five million apps on iPhone and Android; he guesses half are transaction-fulfillment apps whose job is to collect data and hand back a result. If those actions become agentic, the question is no longer which app wins the home screen. It is who sits on top — "who's the Uber?" Google's traditional advertising revenue is mostly direct response, not branding, so this is not a side issue for search. It is the same funnel. Before the world settles into a new stable model, he expects a messy rewrite: some consumer apps survive, others collapse into APIs, or into MCP client-server calls "we don't call them APIs anymore."

Gil asks who is most vulnerable. Arora does not hedge. The most exposed products are those with poor loyalty to the UI, "a thin front end to effectively a transaction processing system in the back." His wife is flying back from India: does anyone care which travel site issued the ticket, or which airline-branded flow, as long as she gets on the plane? Do you care who booked the restaurant? Where the end state is a transaction interface dressed up with non-product brand experiences, those businesses get hit first. Whoever ends up sitting above every agent, he suggests, is the next Uber. The industry has not even agreed on what an agent is.

Guo puts two OpenAI bets on the table: consumers paying subscriptions for intelligence, which has surprised people with how well it is working, and labs wanting to sell "work" to businesses — a unit of harder thinking, not a seat. Arora grants the consumer side and then throws cold water on the enterprise version. Consumers tolerate a bad answer and re-prompt; they assume they asked wrong. Enterprises do not. If an LLM turns off the wrong server and takes the business down, "oops, sorry" is not a pricing model. Nobody, he says, is giving autonomy to models for precision tasks or precision actions yet. They are glorified assistants, used where multiple answers are acceptable and a human stays in the loop. Charge for a unit of work when the output is accurate. Until then, he expects something closer to "AI as a service" than SaaS — AIS, he jokes, which sounds even worse than SaaS did.

Coding is the exception that proves the sequence. Developers will accept a half-baked 75 percent of the code and finish the rest; that is the job. Other professions cannot work that way, which is why labs start there and only later talk about testing, finance, or other verticals. Early on Arora called Thomas Kurian at Google Cloud about small domain models and got blunt advice: do not chase a cybersecurity model, because large models will get so much smarter that the small ones will not keep up. A competitor later announced a security-specific model; he says nothing came of the announcement, and Palo Alto stayed off that path. Reasoning capability across frontier models, he and Gil agree, is converging. Buying the smartest model is like hiring the smartest PhD on earth. That PhD still cannot work at Palo Alto on day one. Pharmaceuticals, genetics, and cybersecurity do not have public-domain data the way code does — you can get about 90 percent smart on coding from what is already online. Domain data is the scarce input.

That is also why a thin wrapper is a death sentence. If an AI-as-a-service company only enhances a model or puts guardrails around it, "your biggest risk is the model slowly expands into those capabilities and you're no longer in business." Every durable SaaS company, he says, packaged a workflow and a system of record. The HR system is not the screens; it is the locked tables that say what Nikesh gets paid, when he took holiday, what his equity looks like, and when it vests. A model will not become that system of record. The interaction may become an agent instead of a form, but the proprietary tables stay. He has already run legal contracts through ChatGPT and found it "works just fine," which is a warning to anyone whose product is "AI that reads contracts." Generic cross-enterprise work — legal, accounts payable — should be rented, not built. His instruction to his own team is blunt: somebody will build those for everyone, and it will be cheaper to buy. Before Palo Alto buys any of them, it spends half the time on security questions. Is the data mine? Are you training on it? Then they test, because FDA trial data and source code cannot sit in a multi-tenant soup helping someone else's model.

Inside the company, he is equally specific about who gets replaced. He doubts an AI agent will convince a CIO faster than a salesperson who shows up with the product, so the field force is not panicking. SDRs sending cold email may meet a new counter-agent whose job is "block all SDRs." Administrative work goes first: he has 200 people doing documentation; if models do 90 percent, a smaller set of AI-savvy people write guardrails and templates, and he will take 200 to 400 basis points of efficiency. He would love agents to chew through Salesforce and SAP technical debt that no good engineer wants to touch. He will not let go of strong product people — they should just move faster. Customer support is the function he wants almost gone. "Customer support exists because we build bad products." He moved support next to product and told teams to fix the bug before they build the next feature. The north star is taking 80 to 90 percent of support out in two to five years, across the industry, because quality should rise. He has watched a coding agent find a vulnerability in Palo Alto security code that would have stayed hidden until it was in the wild, shrink 500 lines to 75, and explain fifteen-year-old uncommented code. He adds the limiter: "there is no solution for stupidity." Without good people and guardrails, AI just produces garbage faster. And he asks a question he clearly thinks is already answered: who wants their child to grow up listening to complaints they have no power to fix — "getting punched in the face and not being able to punch back"?

Guo asks where cyber-AI is actually interesting: SOC automation, pentesting, embedding models in existing products. Arora starts one layer down. Security has always been good at stopping the known bad — a named actor, a known malware family — and useless at what it cannot see. "I can't stop what I don't see," so five years ago Palo Alto made a deliberate bet to sit at as many control points as possible, which is why it now has a SASE product and an endpoint product. Sensors still matter in an AI world. They stop the known bad and they collect the data you need to find the unknown bad, which is where most breaches actually happen.

Then he puts numbers on the new physics. If you believe your own rhetoric, a bad actor should be able to unleash agents against every surface of an enterprise, find the hole, simulate the path, and exfiltrate data in minutes or less than an hour. Seven years ago that sequence took three to four days. The fastest case now is 23 minutes. Ransomware that shuts endpoints can land inside the same window. Average response is still in days. That compression, he says, is the biggest threat AI brings: it shortens the time to take a business down, steal data, or cause economic disruption. The pressure on customers to get infrastructure in order just went up.

The front door is not better. Eighty-nine percent of attacks, he says, start with credential theft — someone becomes you. People are not getting smarter at spotting social engineering, and models now write the spear-phish, clone the voice, and generate the deepfake. Most forms of two-factor authentication are heading "out of the window." A bank called him to confirm identity with three arcane personal questions; ChatGPT or Gemini, scraping public web pages, could answer them in a second. Pentesting is being rewritten the same way. He thinks half of companies skip it because they are afraid of what they will find, and do the minimum for compliance. Automated tools can now knock on every door continuously. Palo Alto runs that against itself 7×24×365, with no third party, because a breached security company is an existential event.

His proposed defense is not a better login. Every social-engineering success eventually shows up as anomalous behavior inside the enterprise. "Suddenly Sarah decided to exfiltrate all the data in Elad's company" after years of only emailing him. Guo, deadpan: "This actually happened last week." You can spend your life trying to make sure nobody ever takes Sarah's identity, or you can stop her when she starts downloading everything onto a laptop. That is why they are buying an identity company. Today's identity products check you at the door and then let you roam. He wants just-in-time rights instead of persistent ones, and he wants the system to notice that she has not done this in seven years. He even wants to drop the second factor: watch how you type, and block you when the rhythm changes.

Gil relays a friend who runs security at a large financial firm: 118 identity tools. Arora laughs that the industry has an identity crisis, then takes the number seriously. Cybersecurity is the youngest industry in technology, about 25 years old, because it did not exist before connectivity. Every new bad thing produced a point solution, so enterprises now run dozens or hundreds of vendors, each collecting and re-analyzing the same data. Capability commoditizes. "There's no genius in building a firewall. Every firewall within plus or minus 10% does the same thing." His working split: 80 percent of capabilities belong on one platform; the other 20 percent can be add-ons until the platform gobbles them. A year ago nobody talked about AI security. Now founders pitch prompt-injection defense, malware scanning on models, data-poisoning detection, agentic-attack protection. Those features, he says, will become line items on a platform, the same way the last five years of mass-market problems are being absorbed.

The operational failure of the point-tool world is context. A phishing mail hits the gateway; the email product marks it suspicious and asks someone to investigate. The employee clicks, leaves that product, crosses the firewall, and loses credentials. The firewall has no idea what happened upstream. Customers do not want a list of 5,000 things to investigate, which is why startups are rushing to build investigation agents. Arora's bet is the opposite of after-the-fact SOC wrappers: consolidate enterprise data, run machine learning at ingestion, and reconstruct the attack chain instead of handing analysts a queue. Startups doing AI wrappers around LLMs for security, he argues, will get squeezed as the companies that already sit on the sensors get better. CRM, ERP, and HR already converged to single platforms — nobody runs two Salesforces, two Workdays, or two SAPs. Security will have to grow up the same way if it wants to be a mature industry.

That is also a P&L argument, not just an architecture one. At an enterprise software company under a billion dollars in revenue, 50 to 65 percent of cost is sales, marketing, and customer support, which leaves almost no margin. At the largest companies that number falls toward 30 percent. R&D stays in a 12-to-16-percent band and G&A in roughly 4 to 8 percent even as revenue scales, so the leverage is almost entirely in selling more to a customer who already trusts you. Larry Page's lesson, which Arora says he arrived with, is that a technology company that loses sight of the product decimates over time. The business lesson sits next to it: if a salesperson spends three months earning a meeting and the customer says the firewall is good for five years, the call is dead unless the bag has something else in it. He walked in with four products, took the set to 24, collected 44 Magic Quadrant mentions, and has now folded that catalog into three platforms. He tells customers the journey is two to three years per platform. Going from 118 tools to one would "boggle" the financial-firm CISO; three is a number a buyer can survive.

Acquisitions are the other half of the platform. Palo Alto has bought 27 companies and is waiting on approval for its largest, the identity firm CyberArk. Arora refuses to call it M&A. He calls it "distributed R&D" and thanks the venture ecosystem out loud: VCs fund the experiments, he picks up the ones that work. They built an AI firewall to sequester enterprise model instances, then realized they were not assessing the models themselves for malware or running persistent red teams against them. Model outputs are nondeterministic — the same question can get a different answer a week later — so every response has to be inspected. They bought Protect AI for that gap. The rules are consistent: only buy number one or number two in a category, because three and four do not polish into leaders; more often than not, keep the acquired founders in charge, because they already out-executed Palo Alto with fewer resources. "R&D as a service from the VC community," he says, has been very helpful. He does not believe his company has all the smarts in the world, or can solve every new problem at once.

Gil asks what actually travels from Google's hypergrowth years to a security company that has added roughly its original enterprise value every year. Arora starts with the market. Every business they have been discussing sits in a TAM larger than any one company can touch, and he is "a huge fan of growth businesses." He hates the idea of restructuring something on a declining curve. The people, he insists, are not the scarce input. Nobody wakes up intending to do a bad job. You can get a group of humans to put a rocket into space faster than NASA. The difference between a great company and a middling one is whether someone understood the market, set a north star, got real buy-in, talked about the why rather than only the what, and then gave people the resources to finish the work. His own job, as he describes it, is strategy, the right people, and then to "act as their shield and keep blocking bad things or friction from slowing you down."

The tactic he actually changed came from Jensen Huang: about 40 direct reports and no one-on-ones. Arora read that and expanded his staff meeting from eight people to 25. The problem it solves for him is translation. He is not always sure his executives communicate the why to their teams; hearing it from him removes one layer of confusion. Communication, he has decided, is underrated in organizations. His 360-degree test is to meet 50 employees every two weeks and ask questions. What he discovers is that people four or five levels down do not understand why the company is doing something, which means they do it differently or not at all. Ambition, he thinks, does not need a pep talk. Humans are natively ambitious; he has never heard someone say they are done. What quiets the strategy debate is a scoreboard. If the stock had not been up six or seven times in seven years, "a lot more people internally would have questions."

What keeps him up is not a sci-fi scenario. It is that Palo Alto exists to secure technological change before customers fully deploy it, so a wrong picture of how AI evolves sends the whole company the wrong way. The day of the taping he was in conversations with cloud providers about how to secure agents and could not get two people to share a definition. Would they use MCP? No, they have "connectors," which on inspection are API calls, the thing everyone used to call an API. Where does identity get registered? How is authority delegated? His answer to the fog is a standing working group: six or seven people, two hours a day, reading everything they did not discuss and arguing it into a picture, then designing product off that picture. If they want to be the security partner of choice, they have to show up on the bleeding edge and tell the customer the problem is being solved faster than anyone else.

Guo asks whether he thinks about AI as a societal force, not only a product roadmap. He accepts her earlier jab that he is the most optimistic security person she knows and extends it past cybersecurity. The intensity in Silicon Valley is palpable again; dinners fill up with arguments about policy, wrappers, models, and infrastructure. Every technological revolution has been a double-edged sword, "so why not this one?" You have to believe there are more good people than bad, and that the good ones will keep the bad uses contained. Some bad things will happen. We will likely find a way around them. "We power[ed] through a pandemic." Optimism does not cancel the 23-minute clock. It is the reason he thinks defense can still catch up, if companies stop running incident response on a calendar built for a slower attacker.