Facebook Ruined Democracy, Says Palo Alto’s Nir Zuk

Nearly two decades have passed since Nir Zuk, 48, the founder and chief technology officer of leading cybersecurity company Palo Alto Networks Inc., left rival Check Point Software Technologies Ltd., slamming the door behind him. Zuk was Check Point's third employee and later led development in the U.S., before leaving in 1999. "None of this is personal, it's just business," Zuk would later clarify, after a long and expansive interview. Still, talking to Zuk, one is left with a feeling that whether overtly or covertly, Palo Alto operates according to one simple rule: whatever Check Point does, do the opposite.

Palo Alto and Check Point are the two global leaders of their domain, and Zuk is well-acquainted with Check Point's founders Gil Shwed, Marius Nacht, and Shlomo Kramer. Kramer left Check Point years ago, Nacht is its chairman, and Shwed—whom Zuk first befriended while on reserve duty in the Israeli military's Unit 8200—has been its dominant CEO for a quarter of a century. Shwed's name does not pass Zuk's lips once during our conversation. Check Point is mentioned once, as Zuk recalls his tech origin story. But in many ways, Shwed is the man who shaped Zuk's professional life, a man who indirectly dictated many of his actions, including Zuk's decision to remain the chief technology officer of his own empire instead of becoming CEO.

"As far as I'm concerned, managing people is a waste of time," Zuk said. "I'm not good at it, I don't like it, and I think that tech people need to choose early in their career what they really want—to manage people or to manage technology. Those who opt for people become chief product officers, and those who love technology become chief technology officers."

And some choose to become CEOs. As far as Zuk is concerned, that is a mistake for tech entrepreneurs. "When the company succeeds, the CEO needs to be a sales and marketing person," he explained. "At the end of the day, any hour I spend dealing with shareholders, analysts, or human resource concerns is an hour I am not investing in the company's future. I'm much better with technology."

Sharp minds might see that statement as a subtle critique of Shwed, a software developer and CEO, who throughout his career faced criticism for straddling that line.

This is the first full-length interview Zuk has given to Israeli media. He seems more settled, not the man who used to, years ago, drive a car bearing the license plate CHKPKLR, or Check Point killer. Palo Alto, too, has matured beyond its youthful, prankster stage. Six years ago, Palo Alto hung a giant billboard over Tel Aviv's main Ayalon highway, adjacent to Check Point's offices, with the slogan "You Just passed Check Point. So did we" to celebrate the fact that it was crowned the best cybersecurity company in the market. Since then, it has settled into its role as a market leader.

"Contrary to popular opinion, that wasn't me," Zuk said. The license plate was hatched up by the marketing division of NetScreen Technologies—the company that bought the first company Zuk founded, OneSecure Inc., for $45 million—and the billboard was the brainchild of Palo Alto's marketing team.

In the Israeli tech industry, rumors abound regarding Zuk's sudden split from Check Point. Some have said in the past that he left his position as chief engineer when Shwed refused to increase the development budget. Zuk has said in the past that he grew disillusioned with the company culture at Check Point.

"I believed, and I still believe, that the popular approach in cybersecurity--that every problem necessitates a solution from a different company--is illogical," Zuk said. "You can't stop and say, 'I'm the largest company in my field, clients like me and will always buy from me, so why should I expand to other product lines when I can reach 50% operating profit?' As far as we are concerned, there needs to be a balance between profitability and providing customers with solutions for all their problems, meaning you need to continue development even when it cuts into your profits."

Incidentally, that is one criticism that is lobbied at Shwed repeatedly: that Check Point does not invest enough in development.

"When I was at Check Point, I thought it should grow, that customers should not need to go to another company every time a new security problem pops up. A company like Check Point has both the duty and the ability to solve these problems," Zuk said.

Palo Alto is ahead of Check Point in terms of market share and number of clients. In 2015, it surpassed its Israeli rival in terms of market capitalization as well, now boasting $24 billion compared to Check Point's $18 billion. The difference in attitude towards profitability and development can be seen in the companies' bottom line: Check Point has one of the highest profitability rates in the global tech industry, ending 2018 with a net profit of $821 million. Palo Alto ended it with a loss of $81 million.

Zuk is unbothered. The most critical parameter is free cash flow, which for Palo Alto is $1 billion a year, he said. "On our analyst day held recently in New York, we predicted our free cash flow would be $4 billion over the next three years. Calling that a loss? I wish everyone saw losses like ours." He does acknowledge that shareholders want to see a profit, not just cash flow and development, but while he says the company will reach that point as its revenues grow, he declines to commit to a time frame.

Check Point also has a free cash flow of $1 billion a year, and no debt. Palo Alto, on the other hand, has a $1.4 billion debt. Check Point has $4 billion in cash and cash equivalents, while Palo Alto has $2.8 billion. So while Palo Alto may have pulled ahead, it is a complicated victory. The market, at least, likes Zuk's cybersecurity more than Shwed's, as can be seen by its valuation. Zuk has a reputation of a visionary, someone who leverages insight into fast growth. Shwed, a true industry pioneer, is thought of as being curbed by his conservative approach, which makes Check Point a very profitable company, if also a bit stagnant.

"Our losses are mainly a result of stock-based compensation accounting," Zuk said, referring to Palo Alto's reputation as one of the most generous companies in the industry as far as employee compensation goes—and not just for its senior executives.

Zuk himself received wages worth $35.7 million last year, mostly as stock. Overall, the company paid its top five executives $170 million in total, $161 million of it in securities. CEO Nikesh Arora is ranked fifth among the top-earning managers of U.S.-listed companies, just after the CEOs of Disney and Apple, with a base annual salary of $1 million and another $129 million in securities.

When asked, Zuk says he currently holds a stake of slightly less than 2% in Palo Alto, including his options. "That is how we hired good people, and as far as I am concerned, it is better to own 2% of $20 billion than 20% of nothing," he said. "Palo Alto grew very quickly and wants the best employees on the market, and for that, we need to give them stock. A lot of our rivals don't do that, don't compensate their employees enough but just the CEO, and that's why they don't have the best employees. A lot of people in other companies have more money than they need."

Back to Check Point. Shwed's fortune was estimated at over $3 billion by Forbes earlier this year. He also receives his salary in the form of stock—coincidently, for 2018, his annual wage was worth $35.8 million. In the Israeli tech industry, Check Point is considered rather stingy as far as employee compensation goes. As Zuk said, "they may have profit, but they don't have the best talent. Those eventually leave."

Asked whether Palo Alto, now in the process of expanding its Israeli research and development center, is in the habit of poaching employees from Check Point, Zuk's answer is short but pointed: "we didn't find a lot worth hiring."

After over two decades in the U.S., most of them in American companies, Zuk’s professional ties to Israel are now strengthened by Palo Alto's growing R&D center in Tel Aviv. Over the past five years, the company acquired six local startups for a total of $1.5 billion, three of them just in the past year. Most employees remained with Palo Alto following the acquisitions, leading the company's local center to number 500 people. That is a significant move for a company that has "two and a half development centers," as Zuk said: a 1,000-strong center in Santa Clara, California, the one in Israel, and another small one in Bangalore, India, a remnant of an acquisition Palo Alto once made. For Zuk, it is an expression of the emphasis he puts on constant development.

Palo Alto's first Israel acquisition was Tel Aviv-based end-point cybersecurity company Cyvera Ltd., five years ago, for $220 million. Palo Alto wanted to enter Cyvera's sector via the acquisition, but it was partly also to enter Israel, Zuk said. "There are many cyber companies in Israel, so it is logical to create our second development center here," he said. LightCyber Ltd. was bought for over $100 million in 2017, Secdo Ltd. for a similar sum in 2018. This year, Palo Alto paid $560 million for Demisto Inc., and another half a billion dollars in total for Twistlock Ltd. and PureSec Ltd. All those are pretty generous valuations.

"Those are not made up numbers," Zuk said. "It's the market price, maybe a bit more. In some of those companies, we saw a return on the acquisition very quickly. Generally, we prefer to make smaller acquisitions, but the measurement is not how much we pay but the stage at which the company is: it is better to buy a company with fewer customers because then the integration is easier. The money comes later."

All acquisitions are made according to a road map, Zuk said, adding that while Palo Alto develops its own technology, if there is already a company developing something Palo Alto needs with a team that lives its products, he prefers to buy. "A small company will do it better. And a startup needs to already have sales, to have market experience and know what works and what doesn't."

Israeli cyber is something special, he said, with the company's local employees being much more effective. "A few months ago we told our Israeli development team to take the management systems of several different products and combine them into one, while adding another 25 features. They did it in three months—it wouldn't have happened anywhere else in the world."

The Israeli tech sector is already used to high wages, especially following the entrance of companies like Amazon into the local ecosystem. Palo Alto pays a lot, Zuk says, if one considers the stock options, but theirs are not the highest wages. "We get employees that are a bit different from those who go to companies that ruin the world," he said.

What does he mean by that? "Some companies corrupt the world and the market," he said. "Facebook, for example, is a company that ruined democracy. There are people that, on principle, refuse to work for such a company. They prefer working at a company that pushes the world forward, not backward." Palo Alto, he said, has a different attitude. “We identify the bad guys."

Zuk does not have a Facebook profile. Or a profile on any social network barring Twitter, for which he doesn't even have the password. "The marketing division has it," he explained, before adding that Facebook is not a Palo Alto customer nor will it ever be. 

The question of public network services is one that takes up a lot of his attention. "We always say that the hacker only needs to succeed once, and we need to succeed 100% of the time," he said. "You need to understand that the entire economy of the internet is at risk. We are not far from the day when consumers will lose their trust in this e-commerce concept, because that trust is eroded with every breach that makes the news. When there were cyberattacks against Home Depot, I needed to change my credit card three times."

He went back, he said, but made sure those companies are now his clients. "We believe that there are many things in cyber that if we, as Palo Alto, won't do, no one will," Zuk said. "No one, for example, looks at cloud cybersecurity as something very big, and we do. That's why we made acquisitions in the sector and already announced a sales turnover of $100 million a year."

Check Point also entered the cloud sector recently, paying $175 million in October 2018 for Dome9 Security, the biggest acquisition it made to date. "We also looked at that company, but those we bought were much better,” Zuk said. “We indeed paid $500 million for Twistlock and PureSec, but you get what you pay for."

When asked about competitors, Zuk says he no longer considers Check Point a rival. "In firewall they disappeared from the market," he said. "They are number four. We are number one, followed by Cisco and Fortinet."

Relying on the fact that a customer likes you is not a strategy, Zuk said. "That was once the strategy of the American car companies, and the Japanese showed them.”

He does have a few good words for the company where he made his first professional steps. "Check Point is still one of the few Israeli companies that can build both a technology and a product. It wouldn't have happened without me, and without a lot of others. The first ten, with the founders, were a group of people who created both a technology and a product and that's pretty unique."

Is he still in touch with Shlomo Kramer? "He was one of the first investors in Palo Alto, and was on its board. He does very good things in the cyber domain." What about Marius Nacht? "I'm not in touch with him. I think he founds banks now."