Palo Alto Networks, Inc. (PANW) Earnings Call Transcript & Summary

Good afternoon, folks. We're really excited to have Nikesh Arora on stage with us, hot off the plane from Geneva. Thank you for taking the time to be with us today.

My pleasure.

Nikesh, there's a lot of noise in the market as you can appreciate. When you read and look at some of the -- fearmongering is -- may not be the right word, but some of the more...

I like fearmongering.

There's a little bit of...

I spent 8 years trying to convince people cybersecurity is important. Dario did it in 1 week. Better than me, clearly. Mythos has been more useful for me as a marketing tool than anything I did for 8 years. I hope to have new models, which are more capable than scare a lot of people.

Let's talk about the flip side of the fearmongering. Let's talk about the flip side of the fearmongering.

The flip side of fearmongering. Yes.

So you have CEOs that call you and say, I'm scared about XYZ agentic threat.

Buy a Palo Alto network.

Nikesh, please solve this for me. How do you solve that problem?

Well, first of all, I'd love to see you guys. Thank you for staying in the room. I saw a lot of people leaving as I was walking in. So I figured nobody was interested in cybersecurity or anything that needed to be said had already been said so far at this conference. Or the bar is open, any of those above. When CEOs call now recently, since Mythos, I think we've talked about 2,000 companies between CEOs, CIOs and Chief Security Officers and obviously, they want to know what is Mythos, how does it impact my life? What do I need to do about it? And I think Mythos is the first incarnation of showing us the capabilities of AI and how it can find vulnerabilities in our organization's technology stack. So what would take us weeks or months or things we wouldn't care to go look for, AI can do it pretty quickly. So you've certainly seen this peak of vulnerability finds. We found 1,200 at Palo Alto when we first tested it when Mythos came out. It took us 3, 4 months of cleaning to understand which ones are real, which ones are not, and go fix them. Now we're back to steady state. We find pretty much a few every month like we used to find before Mythos was out. But we have to go through a huge learning curve and a discovery phase and fixing it. So a lot of companies haven't been through that. And what's happened now is Mythos has become available to Defenders. So we have a service. We can go to customers and would and say, "You want us to test you. We'll test you." But what's interesting is I'd say 60% of what we found was through Mythos, 30-odd percent using OpenAI and 10% using other models. So we actually have to use a multi-model harness to find all the vulnerabilities that current AI will help you find as opposed to using any 1 single model. That's what we're doing. But very quickly, that conversation evolves, that's great. What does this mean for the future? How do I make sure that I can respond to finding vulnerabilities quicker? And what do I need to do to my tech stack to make sure that I can find attackers quickly in my infrastructure and fix it before the shit hits the fan. That's usually when the platform conversation begins and the SIM conversations begin and we start telling them stop upgrading your stack in a multi-vendor solution, try and consolidate because you need the data to be able to stitch together and make it work.

Talk a little bit about that data advantage. What are some of the things that you can do now with AI with your own road map because you have visibility across the different pieces of the platform?

Well, look, it's still true that every customer runs about 30 or 40 cybersecurity vendors in their stack. Cybersecurity is, in my mind, can be simplified as you have to stop that stop at the perimeter, right? Anything bad -- if you know it's bad, you're going to stop it. It's like stopping a bad guy wearing a mask and carrying a gun at the door. That's easy to do. If you know it's bad. Most of the cybersecurity problems are when you don't know it's bad and gets into your infrastructure, you've got to find it quickly to stop it because actually you're not a guy on a mask because but a guy wearing a suit sitting on the conference, he's about to pull out a gun. Sorry, I'm using non-cybersecurity analogies because you guys probably heard about all the agentic harnesses that [indiscernible] is building. But -- so the challenge is, how can you find that bad actor as quickly as you can? To find the bad actor as quickly as you can, you need a seamless sort of layer of data behind it, which is consistent, which can talk to each other and they understand the nuances to take any attack, right? If an attack starts at your laptop and you're running a SaaS e-vendor in your laptop, then the attack migration of laptop heads to your data center, hits your firewall in a data center. Now you're running a different vendor in data center. It goes from there to your database, which is sitting in AWS under a different firewall in AWS. So you've traversed 4 or 5 cybersecurity vendors and all of them will give you an alert saying, go figure out something bad is happening. But because they don't have the context of the other vendor, they can't stick -- stitch it together and say, "Oh shit, I found this thing. It went through these 3 different enforcement points. I control all enforcement points, I know what this bad thing is, because somebody has to collect all the data then go make sense of it. You're running 1 vendor through the entire life cycle of that particular tech vector, you can solve the problem within that vendors data lake or you can solve that problem using agents that, that vendor runs. Otherwise, let's assume that I saw something bad at the endpoint, but I don't know what it's going to do or it did something bad or not, right? Take an example. You got an e-mail, you clicked on the phishing link, you went to a bad website. The moment you left the e-mail vendor, that e-mail vendor has nothing they can do anymore. You're out of the e-mail vendor stack, you don't -- they don't have the data. You probably went through your corporate firewall that allowed you to go to a bad Internet [indiscernible]. So now the firewall has the data, but they don't have the e-mail data that you clipped on e-mail. So somebody has to collect all the data in the SIM and go make sense of it, which is done by SOC analysts. You have to be able to solve these problems in flight using agents. The only choice is if you not have a single vendor managing, at least part of your stack, each agent has to talk to other agent, which means all of us to build agents that need to talk to each other. It is a complicated solve. So you actually have to eventually start reducing your footprint of cyber vendors over time. And that's where the -- I think AI is -- the best way to say is, AI is advantage incumbents with platform stacks.

Some of your products are relatively straightforward to consolidate up and displace vendors. Other things like network security and Cortex SOC does a heavy lift. And so to your point, when customers go on this modernization journey, do you already have visibility into multi-quarter, multiyear network transformation, SOC transformation type cycles?

To solve transformations are typically 1 shot. You can do a 6-month engagement with the customer, and they'll tell you we want to and they'll do a 6-month engagement and replace somebody else. Network stack evolves over time. Like walking in here, and I hadn't seen my e-mail for the last 4 hours, and I saw 2 emails about 2 different customers who wanted to replace a certain network vendor in their stack because they already have 2 out of the 3 pieces we do with them. And the third 1 is coming up for a renewal for a sector vendor. And they said, but we already have 2 out of 3 from Palo Alto. Let's just go with Palo Alto and harmonize the stack. So that typically takes the process of evolution. There's no but he's sitting there and saying, let's take useful things and rim them out. They wait for the evolution on certain stack. The revolution is happening in the SIM because of Mythos. The revolution is happening on the observability stack because of cost, the revolution will happen on AI security stacks that are going to be built, which are also built in the market. If anybody sat here and told you they can solve the security, there's a bunch of marketing going on, but I'm sure they've said it.

Let me ask you a derivative of that question, which is we had Jensen on stage earlier talking about the commercial opportunity that may exist for the frontier models in security.

And what is that opportunity?

I would love to hear your thoughts, he could not elaborate.

[indiscernible] Jensen told you so.

The question -- I'll ask it from your industry perspective.

Jensen is wonderful. He's an amazing guy. He's benefiting the entire AI industry and everybody associated with it.

Let me ask you what role you think Frontier models play in security?

Look, the biggest value of AI over time, it's his reasoning capability. It can reason and try and look for different alternatives. All software is deterministic. Design is input and output. Traditionally, when we buy software, we ask you the question, we expect the answer to come back in a certain format in a certain way, and it follows a certain process. So if it's not doing that, either say, I have no idea, bad entry or says, I have nothing in the back to give you, I have no particular view. Well, actually reasons for it, I didn't find anything here. Let me go look over there. Let me go over look there, let me go look at it and exhaust every possibility, a human being would have tried from the outset. You literally have to tell at the outcome you want, NAI has just capture the flag mentality. It tries every technique until eventually gets to the answer or as close to the answer you can get. That makes it nondeterministic in the back. And that's the value of AI. So anywhere where tremendous amounts of human time is spent interpreting things and looking for alternatives and analyze things, AI is useful, right? So same thing. It did a wonderful job of -- that's 1 property. The second property is AI is not trained for the edge case. It is strain for the mainstream case, right? Just the way when you get in the way mill, it doesn't have every edge case figure out. Somebody has to anticipate that edge case, train Waymo for their edge case to make sure that it performs the edge case. AI has the same property today. So we take those 2 capabilities and understand the reason we've got so good at vulnerability management or volume be detection is, what is the #1 use case of AI, coding, which means we're teaching it what good core looks like. Well, guess what? It's not figured out what that core looks like because we've talked a lot hundreds of billions of dollars of ARR of coding, not figure out what that looks like. So I can tell you what bad code looks like, hence it determines a vulnerability because the core is not in the way it should be in, but has vulnerabilities. It's great. It finds the 80% mainstream, but it doesn't understand the intent of the code. For example, if you look at Par Auto Code, you will find core in our company, which is designed to attack people because we're testing people. But if it sees that outside the context of Palo Alto says that's bad code. That's fix it. No, stay away. We got this. Don't fix it, right? It doesn't understand the false positive people does not understand business context. So it needs some degree of context with it to make it useful. That's where harness is, that's where domain knowledge comes into play. To the extent that it can assist us in getting through a lot of mundane tasks or reasoning task was very helpful, but you still need the edge case on the harnesses. That's one. Two, LLM do not sit in enforcement points. You do not want it sitting in your laptop at the edge case. If you remember the cloud strike incident, you really want to open a managing the endpoints and pushing updates at the end point, they haven't built that product. So I think the long-term answer is that all cyber companies will use some form of AI in their products because it will make it faster. It will look at edge cases, it look at classification, whole bunch of stuff. And we're all working on it. I'm sure different people come talk about. They're all working on it. I don't think the economics of frontier models make it useful for AI work, for example. We sit on people's end points, so discuss [indiscernible]. The average price in the industry is probably $30 to $40 an end point. And on a day, about 160 megabytes of data goes through your laptop every day. If you put a frontier let to inspect 160 megabytes a day at the edge laptop, I suspect it's going to cost you more than $40 a year. Not the customer wants to pay $4,000 a year to predict an end point, hallelujah, go for it. I'd like to be in that business, too. But if it's $40, you want a cheap alternative. So you have to build a replacement product that only -- not only is better than the product that is currently in the market, but it has to be cheap in the full I don't think that it's going to be a huge takeover by LLM of the cybersecurity industry. I think it will work in certain categories where they'll have to work with our enforcement points to make the enforcement points faster and smarter. And that's par for the course. We will all work with them together. We probably become consumers of frontier LLM and we'll do our part and we'll train edge cases and they'll power some of our models. At Palo Alto, we spent north of $1 billion in buying cloud. We don't run our own cloud I'm done on data centers. Could I be spending a few $100 million buying tokens? Sure, I could buy them for all my customers and make their products much better over time.

Do you have a view on the right way to orchestrate tokens between leading edge and not leading edge?

So there are 2 scenarios. One scenario is where I don't need leading edge, right? If I need to run AI at your laptop, it needs to run in a 20-megabyte footprint. There's no frontier LM that runs on a 20-megawatt footprint. However, I can buy I can go get 5,000 models of hugging phase, which can be shrunk to a 20-megawatt footprint and do a very specific task at the yet. So yes, I can use what I call small language models to do task specific things in cybersecurity, which are much more efficient in doing it than using machine learning, that's where I would use it. But I wouldn't be orchestrating amongst different models. In the case of vulnerability management, I am orchestrating across 5 models because we all find different vulnerability. So I'm literally running the same thing 5x to different models to see which 1 of them finds I don't know if in the long term, we should be orchestrating across multiple models. I think it's an economic argument. It's an extremely complicated technical argument. And I don't think the frontier LLMs are sleeping at the wheel. They understand where the industry wants to do and they're building interim modes, which are called instant memory. Those moves up to instant memory, which is very stored.So you can't actually arbitrate models over time. Eventually, I think what is going to happen is, I said this differently. I think average intelligence will become free, but you will still have to pay for compute. What I mean by that is I can buy a model running a laptop trading for $5,000 to run it for free marginal cost on your compute. So I think what will happen is older models will become cheaper and cheaper over time. We use a lot more of them. But the hardest thing to find right now is compute. Even if you get yourself open source model, you want to run it for $1 billion a year, you have to go buy $1 billion of compute. So set cost to you. I think people are mistaking that front M come country LLMs come with compute plus intelligence. If you go find intelligence for free, you still have to go buy the compute, which meant to end up costing you probably more or as much as you pay for, for LLM perspective. And some of these LLMs are way more efficient than what you find in open source. It costs you a lot more money to train them. They're not as efficient, and the portability is not there. So I don't know if the economics are there in the market yet for frontier tasks to start arbitrating between models just yet, but people are trying. That's great.

Let's talk about network security?

Sure. These people want to talk about AI. But we should [indiscernible].

We can talk about AI and network security.

Sure.

The hypothesis that we're experimenting with is how an increase in network traffic impacts the firewall cycle impacts throughput going through the firewall. And I think there's a bunch of different flavors. The data point you gave on the earnings call was agentic traffic on SaaS was up times. Maybe if we just take a step back, this idea that more agentic traffic drives more network traffic drives more firewall. Where would you push back on that? Or when do you think we'll start to see it?

So I think it's important to understand if we believe that $5 trillion will be spent in the next 5 years to build compute. In the end, at the most basic level, that means more traffic. Before we get into what the traffic is used for, more data flowing between pipes and trying to get to enterprises or end consumers. So you've -- if we spend $5 trillion in the last 25 years and build traffic through this traffic is x, you expect the next 5 years traffic becomes 6x, right? So if your traffic is up 6x in the next 5 years that all that traffic has to be inspected. SAS is a form of inspection, software firewalls is a former inspection, hardware pro forma inspection. Pretty much every enterprise bit is inspected today. You can't run a bit in any enterprise without being -- without inspecting it. It doesn't matter where you live. It could be in Google Cloud, it could be in AWS, it could be in a data center, inspected. The bits that are not getting fully inspected or coding bids right now, right? That's the biggest kind of buying spot. If you say $100-plus billion of ARR being generally coating, most coating instances are not secured. So we have to go fix that first. That hasn't been fixed. But let's assume that eventually over the next 2 years that all the traffic that's going around the world is going to get inspected. It doesn't matter if it's human traffic or agenetic traffic, it's traffic. So right now, of course, the explosion is going to come from agents because humans cannot humanly consume that much traffic. So the traffic is coming from agents. But that's the second order problem. The first order problem is every bit still has to be inspected because it's coming from somewhere. So you should expect that network security has this constant tailwind as the traffic continues to grow up that form of inspection will be applied. The gap right now in the market is not all air traffic is being inspected because enough air security tools don't exist because you can't do anything beyond inspection. You don't have the tools to do it. The second layer post inspection is I'm inspecting the traffic, I run value-added software, right? What do I do on top of it? What do I expect it for? For example, I inspect traffic and do observability, great. That's a value-added service, I pay for observability on top of inspection. I take the traffic and I run a SIM on top of that, which means I get paid for running security analysis on top for which I get value-added services. In net for firewalls, I inspect the traffic I get paid for various cloud services where are on sandboxing, UR filtering, et cetera, et cetera. So the AI value-added service haven't been built. They are being built as we speak. No vendor, including us has the full stack, because if you tell me you have a full stack, Facebook announced Muse 2 days ago. Muse comes a totally different sort of security architecture than any other agent that's out there. They run the agentic action, they run central, which is an operating system, which is security. That's a new architecture. Do you expect that all of us have built security products and anticipation is foolish. It's going to take us 3 to 6 months to understand the books. In fact, most AI implementations don't have security hopes on them. You can't automatically secure cloud code because you don't have hooks that are available from anthropic. You can't secure codex yet because they haven't delivered the hooks to run in-line security from an API perspective. They are saying, we're going to build the secured debt that's not going to work. Historically, no company is going to buy a technology product from company A and this and secure it using company-based product. Typically, you will use companies best product to secure company as technology. So that industry hasn't been built. The whole entire AI secure industry has still to be built. The entire value of the service player is being built, there are 3,000 targets got fund last year with something to do with AI, of which 2,000 will not survive, but that's a different order. This is the wrong audience. That's the venture capital guys. But -- so that stack is being built. They're all rushing towards it. When that stack gets built, it will add a whole new TAM on top of existing [indiscernible] will be AI security TAM, like we did $100 million in Prisma Airs, which is real-time AI security. We've intercept traffic and inspected for prompt injection or model sort of the same model manipulation, right? But there's a whole new stack that we build for agent security over time, and it's not going to be -- customers are not going to be able to stitch it themselves. They're not going to buy agent identity from Okta and something else from somebody else in and saying, "I'm going to stitch it all together." They're going to wait for a stack that does to the entire life cycle of the agent.

You gave a 3- to 6-month data point in there on how long it takes to build the AI security.

At speed. If you get it right because remember, 3,000 companies are using 3,000 different hypotheses where the world is going to evolve to anticipate the world and build it. Some will get it right. Many will get it wrong.

So walk us through when you think we get to some sort of steady state?

You tell me when AI hit steady state, and I'll tell you we had security steady state. Remember, we're trying to secure a technology that is in flux. Every 3 months, something new happens. We thought we had LLMs. That was cool. We had it figured out. Damn, these agents showed up. We had to go figure out agents. And then the OpenAI couldn't constrain their own agents. They'll let them off to hugging phase, right. So when that industry reaches some point of stability will give you a stable security architecture. This funny analogy that they didn't invent TSA when they invented planes. TSA took a long time to torture us. So it will take a while to get to torture the AI guys.

One of the stack that's being built as we speak, is the Neocloud infrastructure stock.