Palo Alto Networks CEO: “We will be the first $100 billion cyber company"

"When I began my role, in June 2018, our employees in Tel Aviv told me, 'don't come here until you fully understand what cyber is,'" chuckles Nikesh Arora, the Indian-American CEO of the cybersecurity giant Palo Alto Networks. It took four and a half years and finally, last week, Arora landed here for his first visit. And just as the humor of his employees in Israel showcases the typical Israeli arrogance, so did Arora's amused tone showcase the sardonic dismissal with which he treats that story. After all, only in Israel are they able to condescend a CEO who was previously No. 2 at SoftBank and, even before that, No. 4 at Google, and since his appointment, catapulted Palo Alto Networks from a valuation of $19 billion to $50 billion.

He recently received the appropriate appreciation for these achievements in his homeland. If, in Israel, Palo Alto Networks is Nir Zuk, the founder and CTO who founded the company 17 years ago, then in India, Palo Alto Networks is completely Arora. He arrived in Israel straight from his visit to the company's branch in Bangalore, where he received, as he describes in an exclusive interview with Calcalist, a reception that included dancers and drummers waiting for his limousine, red carpets (literally) and corridors full of flowers. At the climax, Arora was dressed in traditional clothes and adorned with flower necklaces. In the videos, his entrance into the lobby of the building looks like a groom entering his wedding ceremony in an Indian movie.

This carnival expresses more than feelings of respect. Arora (54), who still has a hint of an Indian accent in his speech, is the embodiment of the Indian-American dream: as a child he traveled around India with his family because his father was an officer in the Indian Air Force, he then completed a bachelor's degree at IIT, India's genius factory, and in 1990, he went to the United States to study business administration at Northwestern University on a full scholarship, with $2,000 in his pocket, a gift from his father.

In his last three positions—starting at Google, moving on to SoftBank, and ending in Palo Alto—he became the most highly compensated executive on Wall Street, and one of the most highly compensated employees in the world. According to estimates, his personal fortune was estimated at half a billion dollars, receiving about $50 million in one successful year at Google, and according to a report in Reuters, making around $200 million in two years at SoftBank. In Palo Alto Networks, Arora received a salary package worth $130 million, most of which consisted of options and shares. The sharp jump in Palo Alto stock since he took office has also made his equity compensation extremely valuable, making him even richer.

The fact that we are sitting in Palo Alto Networks offices in Tel Aviv indicates that you completed your cyber training?

"Well, I'm here," he laughs. "The truth is that the first person who talked to me seriously about cyber was Benjamin Netanyahu: we met in Davos, I went there on behalf of Google, he didn't stop talking about the issue, and then for the first time I linked Israel to cyber. But it seems to me that if I turned Palo Alto Networks from 'just another cyber company' , which traded at a value similar to that of Check Point and Fortinet, to the largest cyber company in the world, both in terms of market capitalization and in terms of revenue - then I understand a thing or two about cyber. Apparently Nir and the board were right when they recruited me, even though I knew nothing about cyber."

It was really not trivial to take this position, after being No. 4 in Google and No. 2 in Softbank. The choice to enter a smaller, more niche company in American terms, was even surprising.

"It's quite funny, but during my career, every time I changed jobs it was also a change of field, and I always moved to a smaller company. First I was the CMO at T-Mobile, the German telecommunications giant, and in 2004 I was approached by a small high-tech company named Google that suggested that I set up its sales activity in Europe. When I joined, Google employed 400 people in Europe, and by the time I left in 2014, that number had reached 4,500. As part of the position, I also established the Google branch in Israel, and in 2006 I recruited Meir Brand to the position of Google Israel’s first CEO." Arora pulls out his phone and shows me pictures of him with Brand and a smiling group of less than ten people around a table in a restaurant: "It was my second visit to Israel, and these are all Israeli Googlers from back in the day." Today, Google Israel employs about 2,000 people.

Why was it urgent for you to establish a Google branch in Israel?

"You don't have to be a genius to make such a decision. Google can see where searches are coming from, and the number of searches that came from Israel is disproportionate to the size of the population, because people here have a great technological inclination. This stood out very much compared to many European countries."

The founders of Google, Larry Page and Sergey Brin, noticed the European success, and in 2011 they summoned Arora to California and appointed him as Chief Business Officer (number four in the company, after both founders and the CEO back then, Eric Schmidt). But it seems that Google also grew too large, and in 2014 Arora received an offer he couldn't refuse: Masayoshi Son ("Masa"), founder and CEO of SoftBank, the Japanese high-tech holdings giant, offered Arora to be his right-hand man, with an offer to replace him as the head of the company within a few years. Less than two years later, at the beginning of 2016, Arora left and didn’t look back.

Who leaves Softbank after they raised an unprecedented $100 billion for their investment fund when you are number two in the company?

"It was simple. When Masa recruited me to Softbank he said that at the age of 60 he would retire and I would replace him as CEO. When he turned 60, he came and said to me, 'I want another ten years,' and I didn't want to wait another ten years. I, too, was growing older." Arora was 48-years-old at the time.

Do the huge losses that are now piling up at SoftBank, and an endless list of senior executives leaving, give you the satisfaction of "good thing I left"?

"My happiness is not derived from the unhappiness of others. Masa still manages SoftBank, but it seems to me that he is not very happy right now. But hey, he didn’t have to continue."

You resolutely opposed his investment in Adam Neumann's WeWork, which was valued at the time at $17 billion.

"It was documented publicly and even written in a book, you can read the whole story," laughs Arora, and immediately becomes serious: "In my view, WeWork was not a technology company, but an office space rental company. Regus (a British co-working space company) was then ten times larger in terms of space, and it was a public company traded at a value of $3 billion. WeWork was a fraction of its size."

Today, investors, even large ones such as Andreessen Horowitz, are once again showering Neumann with enormous sums: Flow, his new venture, has already raised $350 million, even though it is again a real estate dream with a technological flare. If Neumann came to you today with a cyber company, would you invest in it?

"Depends on the company, the idea and the alternatives. There are 3,000 other companies, and there is the matter of Adam's personality: he is a guy with a lot of personal charm, who managed to convince a lot of people that his idea was great."

How did you decide to accept the position in Palo Alto Networks?

"I never planned the next steps in my career. When interesting things came up, I agreed, but I also turned down a lot of offers. I liked the fact that even though Palo Alto Networks was a small company, it was the category leader, and that its market was growing tremendously. It is also a very decentralized market: in most markets, you need 20%-30% of the market to become a dominant player, but in Cyber ​​you can lead with a small percentage. This is also a public company in the full sense of the word: it does not have one large shareholder to dictate what to do. Even Nir Zuk, who is undoubtedly opinionated, only owns 1% of the company. Before I accepted the offer, I met with him twice: the first time he interviewed me, and the second time I interviewed him. He does not have a disproportionate influence on the company."

Who makes the decisions? It is probably difficult to manage alongside such a dominant founder.

"Nir is opinionated, but not dominant in a domineering sense: he has many opinions, but he does not determine outcomes. I am the CEO, he is the CTO."

He returned to Israel because you are both opinionated?

"Not at all. He was locked at home due to Covid, and came back when he realized that geographical location is meaningless. Moreover, Israel is a very important market for Palo Alto Networks. It's not just the employees, for whom the competition is fierce - there are entire, significant product lines that come from Israel. People love Nir, he is our brand, he is phenomenal for motivating employees, but he is not a businessman. He has an amazing technological mind, but sometimes you need someone to say 'this will sell and this won't', and what is the right thing in terms of the market, and that is the role of the CEO. Our relationship is symbiotic. When he just moved to Israel, we talked for hours on the phone every day."

"I tell startups, 'development is on you, marketing is on me'"

It is relatively easy to identify the roots of his connection to Zuk, who is also not very diplomatic and left a company without looking back. In Zuk’s case it was Check Point, where he was one of its first engineers but walked out due to differences of opinion with the CEO and founder Gil Shwed. Today the offices of Palo Alto Networks and Check Point in Tel Aviv are located a hundred meters from each other. This is probably a complete coincidence, but no one will be surprised if it turns out that this was a deliberate decision by Zuk, who teased his former boss quite a bit.

The number of Palo Alto Networks employees in Israel has skyrocketed in recent years, especially since Zuk himself returned to live in Israel. Many of the new employees came from the acquisition of a series of Israeli startups: of the 17 companies that Palo Alto Networks has acquired to date (14 of them under Arora), seven are Israeli, and all were acquired within eight years. To date, Palo Alto has invested an impressive amount of approximately $1.65 billion in the acquisition of startups made in Israel. In recent months, there was talk of Palo Alto acquiring Israeli company Apiiro, which developed a platform to accelerate development processes, for almost $600 million, but two weeks ago the deal fell through due to disagreements over valuation. Now Palo Alto is negotiating to buy Cider Security, which is developing a platform for the AppSec field, for $200 million.

How does the purchasing procedure work?

"We have a team that examines the market, then the CPO, Lee Klarich and I talk to the heads of the technological divisions, and in the end, I decide what we will buy."

Is your bias in favor of Israeli companies because of Nir Zuk?

"It has nothing to do with Nir, and it's not a bias for Israel - it's a bias to buy smart teams that have the right idea and the right vision. It just so happens that the teams that work on interesting things in the cyber field are here. It must be something in the water. Or in 8200."

With the series of acquisitions made here since 2014, Palo Alto Networks has become an integral part of the Israeli cyber exit strategy, and has built a reputation as a relatively generous company. Beyond that, it changed the industry: until Palo Alto, the dominant concept was that every company should specialize in its subfield - If are you in firewalls, like Check Point, Fortinet or Cisco? stay there. Perimeter protection? Try Crowdstrike and SentinelOne. Cloud protection? Zyskyler. The concept, of which Shwed was one of the leaders, was that choosing to spread out over several areas leads to mediocrity in all areas.

However, Palo Alto Networks, through a series of acquisitions led by Arora, built the most comprehensive set of cyber products, and pushed out many of the competitors in the industry. If, at first, this strategy raised eyebrows, Palo Alto's financial reports proved its success: the company recorded annual revenues of $5.5 billion (it marks the end of the year in July) and annual growth that reached 30%. The growth was also reflected in the value of the company, which has surged past the companies mentioned above, even though four or five years ago they all stood at similar valuations.

Arora and Zuk cracked the formula of buying a startup at the right stage - when the product has already proven itself to be working and there are sales. From the moment of purchase, Palo Alto puts the product into its well-oiled vending machine. "When a startup begins selling their product and reaches the marketing stage, it must choose whether to make an effort to grow the company itself, or to outsource it to someone else. Penetrating the market and transitioning to massive sales is a very difficult phase: when you look at medium-sized companies, you see that the cost of developing the product is 12%-16% of expenses, but the cost of sales is 30%-60%. You have to think about how to price your product, who to sell it to and how, these are complex problems. In Israel, you can build a good product and experiment with sales in the local market, but then you have to go out into the world, and that is not easy. We tell startups, 'Keep building your products with us, and we'll take care of selling them.'"

"Startups even contact us during negotiations with competitors"

It is more complicated than it sounds: the key to the success of the method is identifying the right products, then retaining the employees of the acquired companies so that the product continues to develop. In Palo Alto Networks they realized that the key to the success of the process is creating interest, providing independence, and money. A lot of money. Despite the rapid growth and high revenues, Palo Alto only turned a profit in the last quarter, because historically stock allocation expenses weighed on its reports. But these shares, which were generously distributed to the employees and also increased more than threefold in the last five years, greatly enriched the founders and employees of the acquired startups. The almost continuous rise of the Palo Alto stock had the employees glued to their seats: a few months ago Arora even reported to investors that recently, employees who left in favor of startups are returning to the company.

How do you decide what to buy?

"I'm not looking for a certain revenue threshold. Every year, several thousand cyber companies are established; only a handful of them will manage to become very large. Think about who are the largest cyber companies that came out of Israel, Check Point and SentinelOne? This is not an Israeli problem, but a global issue - few companies are successful in passing the sales threshold of $1 billion.

"We are looking for companies with product market fit that know what the customer wants. Such a company has 30-100 customers, and before the acquisition we will also contact them and check if the product is solving a real problem. Then we will check the founders and the management team, what their strategy is and their ability to execute. Also, an existing product requires a lot of work. The best products in history took 5-7 years to reach their optimal configuration. This is not necessarily measured in money, but in the benefit to the customer, something that solves a problem in the best possible way. This was true for both Google and Uber."

You were an executive at SoftBank which advocated the method of "pour as much money as possible to quickly skip steps and become the biggest company in the market".

"Lots of money thrown at you only distracts you, and then funds go towards bad ideas. Most companies screw up their acquisitions. Not all acquisitions have been equally successful with us either, but since I took office I have personally met 300 startups, and on this visit I will also meet Israeli startups. By the way, not everyone wants to sell, some of them just want to present what they do - they are proud of it, and are wise enough to understand that real success is not something we can copy after watching a presentation for an hour."

Still, are you planning any more acquisitions here?

"Why are you so obsessed in Israel with acquisitions? This is the fifth time you've asked this, one way or another. We still have a way to go in building our product portfolio, but our debt to innovation ratio is much smaller than it was a few years ago. I'm not planning acquisitions, but looking at products and programs to see if anyone in the market is doing something better than us. Cyber is the most innovative industry, because the bad guys are constantly looking for new solutions, every 5-10 years the paradigm changes. However, acquisitions depend on the size of the market and the quality of the target. When we bought the first 14 companies we didn't have much infrastructure; today I have to make sure I can complete the integration."

Palo Alto has become an anchor in the exit strategy of funds specializing in investing in cyber companies. They build startups with the end game of being bought out.

"This is excellent. Four years ago, no one thought of us in terms of being potential buyers. Today, we are receiving calls from companies that are already in advanced negotiations to be sold to another company, asking if we could buy them after all."

At a time of crisis purchases should be quite attractive for you.

"Valuations have decreased in the public market, but the sense of self-worth of private companies and their entrepreneurs has not yet depleted," Arora says, perhaps in regard to Apiiro. "There will be another process until it sinks in, and then there will be more opportunities. We are not in a hurry, our money is not burning in our pockets."

You don't have FOMO? Didn't you shop around just so Check Point or another competitor wouldn't acquire the same company?

"Do I seem insecure? I have other shortcomings, but not that. Four years ago I knew nothing about cyber, and since then I have personally chosen the 14 companies we have acquired."

How do you beat the statistics that say the vast majority of purchases fail?

"This happens because most buyers do not understand the value of what they are buying. We give the founders the dividends from their company. In nine out of ten companies we bought, we put the managers of the acquired companies in charge of their departments, contrary to what is customary in the market. We said, 'The managers of the acquired companies beat us: they reached more customers with less money and fewer resources, so they probably know something we don't. That's why we have to let them manage', thus making sure there will be good integration within Palo Alto."

The generous compensation - including yours, but also in general - prevented Palo Alto from becoming a profitable company until it reached revenues of more than $5 billion. Check Point, by comparison, has a profit of more than half a billion dollars with half the revenue.

"That's not true," says Arora. "Technically, we could have paid this money at the time of the purchase, and not afterwards as compensation. The value of the company is the same, and the difference here is accounting, what you call an expense. We were profitable for the first time in the last quarter, and it seems that the market attaches more importance to the flow from operations (which has been positive for several years in Palo Alto) and growth.”

"By talking about how bad it will be, this will become a self-fulfilling prophecy"

What is happening with cyber budgets? Are you already feeling the slowdown/recession?

"My fear is that by talking about how bad it will be, this will become a self-fulfilling prophecy. Everyone is constantly talking about the approaching winter. It will come, yes, the macro environment is changing, but no one knows how severe it will be. If it is short and not severe, most will deal with it. If it becomes a prolonged and difficult event, then less so. What is happening with computing budgets will affect cyber, but for now everything is marginal. Such clients prefer to work with the largest company in the field, which will obviously survive, and less with startups."

How does the geopolitical situation affect the market? Is the war in the Ukraine increasing the scope of cyber attacks?

"Cyber attacks are on the rise all the time, even if those that were attacked do not talk about it. At the same time, we actually don't see more attacks that can be attributed to countries. We thought we would see more, but apparently the conditions on the ground are so difficult that none of the parties have the energy or resources to focus on cyber attacks. However, in this war there is a lot of use of cyber information to detect troop movements, to track logistics, so cyber in this configuration has become very central to the war. But it is not over yet, we have to be ready for everything."

Now that you understand the cyber industry, what surprised you the most about it?

"Mainly how much of the responsibility for cybersecurity is transferred to the customers themselves. Each customer makes different decisions about what is allowed and what is not. I think that cyber companies should be more opinionated, because we work with 80,000 customers and know where to find the weaknesses."

Israelis have no problem being opinionated

"That's why there are many good cyber companies here."

So you are happy you took the position?

"They said that customers don't want to buy everything from one company in cyber, but we have proven that if the products are good, they do. They said that most acquisitions fail, but with us, the rate of revenue that comes from acquisitions is already close to $2 billion, and we are the leader in 11 of the 14 categories in cyber. Above all, with everything we've done, the market is so big that even at our current size we only make up 2.5% of it."

What did you bring to the position from your experience at SoftBank and Google?

"Just as I knew nothing about cyber when I joined Palo Alto Networks, I also knew nothing about selling ads when I joined Google. Google Europe's revenues were $800 million when I joined, and four and a half years later, when I moved to California, they were $5.5 billion. There I learned how to grow a business from small numbers to big numbers, looking at the market and the product. Palo Alto had the market and the leadership, but not the right product. How much money can you make from selling a firewall? Our salespeople got answers like 'I just bought a firewall from another company, we'll talk in six years when we replace it’. I was required to build a diverse product portfolio, among other things, through acquisitions, so that we would not be a firewall company but an innovative cyber company. We are still in the middle of this journey."

Can Palo Alto reach the size of Google, or is there a glass ceiling due to the size of the market?

"This is not the right comparison; the question is whether Palo Alto can still double itself. I am convinced that it can, and I have publicly stated that we will be the first $100 billion cyber company."

When will this ambitious prediction come true?

"When the market decides. It could be tomorrow and it could be in three years. What we have under our control is the ability to double revenue even from existing customers. In the last four years we tripled the revenue, so assuming conservative estimates, it is possible."

What did you take from SoftBank?

"Masa has an endless appetite for risk and a child's curiosity. That's why he always invests in new things. Thanks to his influence, I enthusiastically learned what cyber is at the age of 49. Usually, the more experienced people become, the appetite for risk actually decreases."

Taking risks with other people's money, as in the case of SoftBank, is easier.

"I don't see it that way, because you're betting on your reputation. People do things because they like to win. You're betting on yourself. The risk is that I'll always be judged by the last thing I did. And that's a bigger risk than any money you can put on the table."