Palo Alto Networks CEO Nikesh Arora on Buying Number One, the 30-Day Founder Test and Why AI Makes Cybersecurity More Valuable

On David Senra's podcast, Nikesh Arora, chairman and CEO of Palo Alto Networks, explains how he grew the company from an $18 billion market cap firewall business to more than 70 products through about 35 acquisitions. He shares his rules for buying companies, how he handles founders after a deal, why he thinks AI makes cybersecurity more valuable, and stories from Google, his family and an almost-investment in Oculus. The video runs about 62 minutes.

Disclosure: the episode includes sponsor messages (Ramp, Deel, WorkOS and AppLovin). We have left those out of this summary.

This article is our own summary, with short quotes and timestamps from the video's automatic transcript. Watch the full conversation above for everything that was said.

The short version

• Why buy. Arora says it takes four to seven years to build a good technology product, so with a one-product company he chose to acquire (11:44).
• The economics. A typical enterprise spends 15% to 18% of revenue on product development and 6% to 10% on administration, and the rest sits in sales, marketing and support. His aim was to cut those from about 60% of costs to 20% to reach a 40% operating margin, by selling many products to each customer (9:04).
• Number one or number two. The top two companies in a category take a disproportionate share of profits, and he buys number one (16:21).
• Founders run the category. The acquired founder becomes the head of that product area, not a report of an existing executive (14:33).
• The 30-day test. After agreeing a deal directly with the founder, with no bankers in the middle, they spend 30 days designing a joint product roadmap before signing. Palo Alto Networks walked away twice (19:30).
• Keep the founders. Founders' equity is re-vested for three to four years for continuity (22:32).
• AI and security. More connectivity expands the attack surface, and he says Palo Alto Networks' business has gone up since AI vulnerability-finding models arrived (42:00 to 58:31).

What he said, by topic

An Oculus deal that almost happened (0:00 to 6:00)

Arora recalls meeting investor Egon Durban when Durban moved to Europe, and an informal group of angel investors that included Marc Andreessen. He tells how he and Durban nearly invested in Oculus after visiting the founders in an industrial park outside Los Angeles, only to learn the company had been sold to Facebook before the paperwork arrived.

Staying challenged in one place (6:00 to 9:04)

He explains that even at one company he kept changing problems: Google grew from about 2,000 to 60,000 employees and from about $2 billion to $63 billion in revenue while he was there, and Palo Alto Networks went from a firewall company to a platform. He joked that he used to think cybersecurity was "two words."

The enterprise economics behind the strategy (9:04 to 12:00)

Rather than studying cybersecurity, he studied enterprise companies. He argues the biggest expense is acquiring customers, so a company with one product to sell has a hard time. His picture: knocking on 20 doors with one product, and 15 say no, versus arriving "with a truck behind you" full of options. To sell more to each customer, you must earn trust and be best in class, because nobody wants the second-best security product.

Why buy instead of build (12:00 to 14:33)

Because good products take four to seven years, he acquires. He studies patterns of why acquisitions fail, controls the variables, and accepts that some bets will miss, like a pharma portfolio: one acquisition was based on a market direction that never arrived, and they cut losses quickly. Building is hard because the winning competitor is already a year and a half ahead with a team of 50 to 75 people, and he says "never works like that" about the idea of simply hiring engineers instead.

Why the acquired founder becomes the boss (14:33 to 16:21)

He says the common failure is giving an acquired company to an executive who has spent years failing at the same thing. Instead, the founder who built something with product-market fit should lead the area, and others can learn from them. He also says CEOs fail by buying number two or three and trying to polish them.

Why only number one or two (16:21 to 19:30)

Number one and number two take disproportionate profits. Buying number two while number one still exists will likely slow what you buy, since people from finance and HR arrive to "help." He admits one and two can be hard to tell apart and that sometimes they bought what they thought was number one and the other company overtook it.

The 30-day test (19:30 to 24:05)

After a deal, he says founders often want to keep building their own vision. So now he agrees the deal with the founder himself, without bankers, then gives the founder 30 days to design the joint product roadmap with his product team while lawyers do paperwork. He does not sign definitive documents until the founder signs the joint roadmap. Founders are "night and day" more flexible before closing. They withdrew twice, once because the product substance was weaker than diligence suggested. He re-vests founders for three to four years because buying a company means buying a team.

Founders in a bigger company (24:05 to 31:33)

Some founders have the "will" to win, but need a reset when they go from underdog to "overdog" with, in his example, 6,000 people in the field. He contrasts his view of treating the acquired team as first-class colleagues with another founder's "conqueror" attitude. They also discuss tennis rankings and how small gaps between one and two can hide big differences.

M&A is not a strategy (31:33 to 36:00)

Acquisitions are a mechanism to execute a strategy, not a strategy. He says that if something is worth $200 million, he will pay as if it's worth $800 million when it can become a $5 to $10 billion asset, because nobody remembers the extra price. He recounts Durban's advice during a 29-round auction for a London cricket team to keep bidding. He describes a company as "a construct" around a team that executes well.

Will acquisitions stop? (36:00 to 38:30)

Asked about Henry Singleton, who stopped acquiring for years, he says it is possible and that acquiring is not existential. At some point the best value may come from making existing products work together.

How AI changes work (38:30 to 41:00)

Arora calls AI "democratizing intelligence," compared with Google democratizing information. He expects it to become as reliable as a human expert within a few years and says product development split across eight specialized teams may collapse, as one person with capable assistants could do 90% of the work. The shape of organizations will be "fundamentally different" in five years.

Why AI makes cybersecurity more valuable (41:00 to 58:31)

More connectivity creates more attack surface, so more technology means more need for security. On the AI threat, he says AI can find holes in a perimeter faster, and attackers can rent such models cheaply. His answer is "virtual patching": writing signatures to protect the perimeter while customers patch underlying systems. He also argues AI is a poor substitute for inspecting traffic at the endpoint because tokens are priced per use while his marginal cost of inspection is near zero (he gave $25 a year per endpoint versus hundreds of dollars a day in AI cost), and he says the business has gone up since the new vulnerability-finding models arrived. These are his claims as a CEO and should be read that way.

Fatalism, Google and family (42:00 to 55:00)

He describes a Hindu-influenced fatalism: do your best, accept uncertainty and sleep well, which he says he found in the last five years. He tells of selling Google ads without being able to quote price or volume, doing ROI math with customers instead. On parenting, he doesn't pressure his kids, wants them healthy, happy and balanced, and warns against reminding children they should be grateful for having grown up better off.

Staying current and posting on X (58:31 to the end)

He spends four or five hours a week with AI founders and talks to 10 to 15 cybersecurity startups a month. He started posting on X after a fellow podcaster's advice, writes the posts himself and says he won't feel pressure to post daily.

Chapter guide

• 00:00 The Oculus deal he almost did with Egon Durban
• 08:45 "I thought cybersecurity was two words"
• 11:44 Why he buys instead of builds
• 14:33 Why the acquired founder becomes the boss
• 16:21 Why he only buys number one or number two
• 19:30 The 30-day test before every acquisition
• 33:38 Egon Durban and the 29-round cricket auction
• 42:32 Why nothing at work stresses him out
• 44:28 Selling Google ads without knowing the price
• 49:42 Coming to America with $200
• 51:58 Raising kids who didn't grow up poor
• 54:46 Why AI hacking has been good for Palo Alto

What it means for your business

1. Decide build or buy by speed. If a competitor is a year and a half ahead with a working team, hiring engineers won't catch up.
2. Buy the leader. Number one and two capture most profit in a category.
3. Test the fit before you sign. A 30-day joint roadmap exposes disagreement while the founder still has a reason to be flexible.
4. Keep the builders. Re-vest founders for several years so the product keeps its momentum.
5. Treat acquired teams as colleagues. You need them to win, and they need to feel they are winning.
6. Sell more to the customers you have. Customer acquisition is the costliest line, so expand within trusted accounts.

Video details

• Title: Building a $250B Cybersecurity Giant | Nikesh Arora, Palo Alto Networks
• Host: David Senra
• Guest: Nikesh Arora, chairman and CEO of Palo Alto Networks
• Published by: David Senra on YouTube, November 8, 2026
• Length: about 63 minutes
• Watch: youtube.com/watch?v=BKz2Dy-mKEM
• Note: quotes and figures come from the video's automatic transcript and the guest's own statements, and are lightly cleaned. Check the video for exact wording.

Want to put this to work?

We help owners turn AI trends into a plan, a product and a launch. Book a free call or see our services.