00:25:46 · Aditya Agarwal, Nikesh Arora
[00:25:46] S1: Yeah. Me tell you. Yeah. [00:25:47] S0: Let me tell you. Yes. Exactly. So look, we're busy trying to figure out how agentic security is gonna work. Right? How are you gonna have control? How are going to have governance? How are you going to have the ability to intercept? So in cybersecurity, there's generally two modes. One mode is I know it's bad, I stop it. That typically happens when you click in a bad URL or you go to a bad domain. I can sit in an endpoint, see those bad things, and stop them. The problem is never the known bad. The problem is the unknown bad. Approximately 50% of the stuff that gets through your sensors, the endpoint, looks like legitimate traffic. It reconstitutes inside, and then bad things happen. Or it's misconfigurations, vulnerabilities in your code, a whole bunch of stuff which humans create. So the entire challenge in cybersecurity is how quickly can I find it? How quickly can I plug it? Or how quickly can I block it? Or how quickly can I detect it or remediate it? That's where all of cyber security. That's where three fifty billion dollars here is spent. So what AI is gonna do is gonna expose those vulnerabilities faster, make them exploitable faster, hopefully allow us to patch them and find them faster as well. [00:26:51] S1: So it's interesting. So are you... Do you find yourself in a somewhat more unique position, Nikesh? Because to your point [00:26:58] S0: My parents have always said that. [00:27:00] S1: Yeah. You're a unique guy. [00:27:01] S0: Everybody's parents have said that to them. Yes. So Yes, I do.
00:27:01 · Nikesh Arora, Aditya Agarwal
[00:27:01] S0: Everybody's parents have said that to them. Yes. So Yes, I do. [00:27:05] S1: Because this stuff is changing so quickly, in some ways, does Palo Alto Networks have to also educate all of us in terms of how what does it mean to have agentic security when we don't even know what agents are? But all of us are building agents all the time. So, how are we all going to figure this out in real time? And you have the leading security company now? Are you supposed to be in some ways leading from the front, or are you trying to take a slightly more let's wait and see approach?
00:27:34 · Nikesh Arora
[00:27:34] S0: No, no, we can't afford to take a look. People expect us to have an answer. So we did. We made three acquisitions in AI security. We built two or three of our own native products. We have obviously transformed some existing products. So we can sit in your cloud instance and intercept and monitor all traffic that go east west traffic into your cloud instance. We can sit and monitor it. That allows us to have a control pane. That allows us to intercept based on policies and bunch of rules and bunch of known techniques, so we can do that today. So typically the right answer is and we have one of our companies we bought brought HackerOne, which used to rate and understand models. So they have full pen testing capabilities and model vulnerability understanding capabilities. So we have enough sort of meat around what AI security is going look like. The next place is agents. We already made an announcement, Arora say, not far from here, a few weeks ago about having an agentic gateway. The first thing you need to understand is I need to be able to send all the agent traffic to one place. If I don't understand all the agent traffic, I don't understand their authentication, their governance, validation, and control. So this stuff we're building on the fly. Typically, of our partnerships are part design partnerships because customers are deploying it differently. It's the Wild West out there. Everybody who was selling technology transformation now selling AI transformation. I don't know how we have more AI transformation consultants in the world than AI people developing it. 100%, yeah.
00:29:00 · Aditya Agarwal, Nikesh Arora
[00:29:00] S1: But they are. Tell us about Mythos. Tell us about kind of like the how unpack do this thing that is happening in real time that obviously has a potential national security aspect to it. But how do we, as an industry, reason through the capabilities and what seem to be from real security threats to critical parts of infrastructure? So, what role are you playing in it? And how do we need perhaps like as an early stage founder, how do we need to be integrating the capabilities into our thinking about what we are building? [00:29:37] S0: Okay. First of all, this might come as news to you, but humans have been writing bad code for a very long time. [00:29:46] S1: Just saying. Not mine, but Okay.
00:29:48 · Nikesh Arora
[00:29:48] S0: Just saying. Just saying. It's never yours. But just saying, there's tons of vulnerabilities out there in the world. Now without specifically talking about Mythos but abstracting it so you can understand in a broader context, If you believe in the last eighteen months an LLM has gotten really good at coding, 90% use cases, guess what? The corollary to that is also understands how to find bad code and analyze it. It's actually possibly better at understanding bad code than creating perfect code in the first instance. It's always easier to criticize than construct. So it probably finds bad code fast. As you believe that, it will. Now if you believe that, bad code comes in various flavors. It comes in open source. Let's park that one side so we'll find whether everybody's open source. It comes in proprietary code written by me or my company, whatever my company is. That's fine too. Then it comes in a flavor, bad code written by other software companies selling you their software. So typically, in every enterprise, you'll find vulnerabilities in vendor deployed software, custom code, and open source. This thing's going find all of them. And I don't think it's about a point in time in its host. It is a future state, a future state where almost every open source model in the next three to six months who were to salt will have similar capabilities. Because as coding becomes real, as training data becomes more available, you would expect that it should be able to do that. So that's kind of point number one. Point number two, if pointed at your infrastructure, it will swiftly find misconfigurations and doors that have been left open. So it's a deployment question. It's not a vulnerability question that says, you deployed it wrong. You left the door open. I'm coming in. It's going find misconfiguration much faster than humans have ever done in the past and humans have bothered to fix in the past. And last but not the least, if you expand the horizon of a model, which I'm told is the LLM provider's choice they can have short windows and short memory or long memory. Long memory is extremely expensive to run, so it runs in beta. It doesn't get productionized yet. But if you expand the window, it is going to reason and concatenate a bunch of these vulnerabilities and define attack path.
00:32:01 · Nikesh Arora, Aditya Agarwal
Because you would expect over time, most models will have all three of these capabilities. So what that does as a corollary is that in the next six to twelve months, there is a reasonable probability that we will find vulnerabilities which should have taken us ten years to find in six months, which becomes a problem. You just have to fix them as quickly as possible because they become all points of intrusion or points of vulnerability from a nation state perspective, bad actor perspective. So that's what we're going to be faced with the next six months. That's what this whole trend is going to prove. And that's what we're going have to go contend with. [00:32:39] S1: But isn't then... It's really hard to fix code, especially if it's in the guts of some of our deeper parts of our stack, if it's beyond networking stack, core OS stack. Even after you fix it, how do you actually deploy it, [00:32:54] S0: which is ridiculous. SaaS is easy, right? If it's SaaS software, [00:32:56] S1: then [00:32:57] S0: If you do it's on device or something, it takes much longer as you have to deploy a patch. There are industry practices. The only challenge is imagine an IT department which is doing three patches a week, suddenly has to do 300 patches a week. This is a problem. So the next three to six months, there's going be a bit of a around the topic. But I'm more optimistic. We'll power through it. One of the things we have, you can imagine, the same model that's going to find the vulnerability is most likely going to be able to build a patch. [00:33:24] S1: I was going to say, yeah.