This week, Jessica is joined by Nikesh Arora, the chairman and CEO of Palo Alto Networks. When he joined the company in 2018, Nikesh had no cybersecurity experience, but he explains how he brought a bold vision, nonlinear thinking, and a relentless belief in culture as the foundation for growth.
In this conversation, they discuss how Nikesh inspires people, what makes culture stick, and how trust, fairness, and curiosity have shaped his leadership style. He shares his approach to listening — including the surprising habit of hosting Zoom calls with 50 randomly selected employees every week — and how that access to unfiltered feedback has helped him lead with more clarity and empathy.
They also talk about cybersecurity as a culture issue, how to manage acquisitions without diluting your values, and what it means to be a leader who constantly challenges others to become better versions of themselves.
About Nikesh Arora
Nikesh Arora joined as chairman and CEO of Palo Alto Networks in June 2018. Before joining Palo Alto Networks, Nikesh served as president and chief operating officer of SoftBank Group Corp. Prior to that, he held a number of positions at Google, Inc. during a 10-year span, including senior vice president and chief business officer, president of global sales operations and business development, and president of Europe, the Middle East and Africa. Prior to joining Google, Nikesh held the role of chief marketing officer for the T-Mobile International Division of Deutsche Telekom AG. He was chief executive officer and founder of T-Motion PLC, which merged with T-Mobile International in 2002.
LinkedIn: https://www.linkedin.com/in/nikesh-arora-02894670
https://www.paloaltonetworks.com
Jessica Kriegel:
Website: https://www.jessicakriegel.com/
LinkedIn – https://www.linkedin.com/in/jessicakriegel
Instagram: https://www.instagram.com/jess_kriegel/
Culture Partners:
Website: https://culturepartners.com/
LinkedIn: https://www.linkedin.com/company/culturepartners/
TRANSCRIPT
Dr. Jessica Kriegel: This week on Culture Leaders, I had the opportunity to sit down with Nikesh Aurora, CEO of Palo Alto Networks, and one of the most fascinating minds in leadership today. Nikesh doesn’t come from a traditional cybersecurity background. In fact, when he stepped into the CEO role at Palo Alto Networks, he had no experience in the industry at all. What he did have was a bold vision, non-linear thinking, and a relentless belief in culture as the foundation for growth. In this conversation, we talk about how he inspires people, what makes culture stick, and how trust, fairness, and curiosity have shaped his leadership style. He shares his approach to listening, including the surprising habit of hosting Zoom calls with 50 randomly selected employees every week, and how that access to unfiltered feedback has helped him lead with more clarity and empathy. We also talk about cybersecurity as a culture issue, how to manage acquisitions without diluting your values and what it means to be a leader who constantly challenges others to become better versions of themselves. This one is packed with insight, not just about building companies, but people. And so here is my conversation with Nikesh Aurora, welcome so much. I am really, I have been looking forward to this. I’ve listened to a lot of your interviews, so I feel like I already know a lot about you. So I’m curious. One thing I did not hear you get asked about is what is your why?
Nikesh Arora: You don’t start soft? Well, first of all, thank you for having me on this podcast. Look, I want to make a difference. I want to leave a legacy. I want to inspire people. That’s my why. So every morning I wake up and I try and do something that I’m proud of, and I try and make a difference to what is around me. I want to make sure when I’m done that people go back and say, that was interesting, that was inspirational. He did something I aspire to do.
Dr. Jessica Kriegel: What is the Palo Alto Networks? Why? What’s your purpose statement?
Nikesh Arora: Well, look, we live in a very complex technological world, and as our technological world sort of continues to expand with all the new stuff that keep you hearing about us is not going to stop. Security is a very important topic because that’s what allows everybody to go on and do what they need to do. So from that context, and a, we want to be that evergreen, cybersecurity partner of choice that you have that allows you to do what you want to do, and B, you want to make tomorrow more secure than today.
Dr. Jessica Kriegel: That’s beautiful. I mean, that’ll inspire someone to wake up in the morning and want to put the work in, right?
Nikesh Arora: Yeah. I worked atGoogle. I worked at SoftBank and invest in a lot of newer companies. I think there is no clear mission than making things better for people around you. We’re not selling widgets. We’re not trying to pitch you food. We’re not trying to relate you to consume more or engage more digital. We’re just trying to make sure that we do something that makes your life better and easier and take the stress out of it.
Dr. Jessica Kriegel: How do you inspire people in your work? Is it through customers? Is it with your employees? Is it all of the above?
Nikesh Arora: I think inspiration for people is deeper than that. I think inspiration for people is by watching something happen and want to be a part of that. Inspir for people is something that makes them want to do better every morning when they wake up. I don’t think it’s that simple as I solve the problem and I’m inspired, I think it is, I want be that person. I want to be do it that way, or I want to be part of that. It’s usually inspiration comes from aspiration. If I aspire to something, I’ll be inspired to do it. And if they both match, then the sky’s the limit. So the question is how do I role model things for people around me by either showing them or encouraging them or facilitating them and way shapes or form. So I think it’s deeper than just saying, I solved this today. Let’s go get it done.
Dr. Jessica Kriegel: It’s the way you show up and role model.
Nikesh Arora: Yeah, it’s the way you show up.
Dr. Jessica Kriegel: Behaviors. Yeah.
Nikesh Arora: It’s what you achieve collectively. Look, everybody, I was having a conversation with somebody the other day and I said, look, everybody wants to win and to win is not a constant definition. Everybody has their own definition of winning. To me, winning could be getting, I got a hug from both my kids this morning because their mother’s traveling, and that was a win for me. I came with a warm heart to work. That’s a win. So winning means many different things to people in that context. I don’t think anybody ever wakes up wanting to lose. So if I can be part of winning, somehow I’m inspired.
Dr. Jessica Kriegel: And the way that people go about winning can be very different. I’ve heard you talk about, could you tell the story? I loved hearing you tell the story about Larry Page meeting with Steve, jobs coming back and the difference of opinion they had about how to go about winning.
Nikesh Arora: Yeah. I think part of where I live in Silicon Valley is amazing because you get to see all these amazing inspirational people on a constant basis. You get to interact with them in some way, shape, or form. These are directly or indirectly. And in the early days of Google, earlier than today, about 14 years ago or maybe longer, Larry walked back and he said he’d met Steve Jobs and he was telling a story in a meeting and he said, look, Steve is all about focus on one particular thing. Do it really well get it right and don’t get distracted. And Larry’s perspective was, we want to make a difference to the world. We want to change the world and the way we’re going to do it by doing a lot of things, and some of ’em are going to work, some of ’em not going to work. So they both had a very different perspective on innovation, what winning meant, and Steve was more towards perfection, and Larry was more towards managed chaos, but they both had the same sort of end goal, which is to create amazing products. But how they went about it is fundamentally different. And that’s why you see today, Google is a sort of a bouquet portfolio of capabilities, and Apple is very focused in the integrated ecosystem. And I’d say they’ve both been very successful in their own right.
Dr. Jessica Kriegel: I’ve heard you admire non-linear thinking as an aspirational approach to leadership. Can you tell me what that is? And then do you consider yourself a nonlinear thinker?
Nikesh Arora: Yeah, look, I think it’s, what’s interesting is if you look at our current role models in the world, Mr. Musk, and you look at him, what he’s done, he’s put rockets into space and he’s put cars, which are, I could say he was the first one also into space that’s possibly true. He’s putting cars on the road, which hopefully will self-drive. Mine does partially self-drive. He’s done building a boring tunnels. He’s doing Neuralink, he’s put satellites up there and give us connectivity. So this is all examples of non-linear thinking where he said, this should be done fundamentally differently and we can get it done. And then he persists, he learns, he persists. And you can see that. You can say the same thing with almost any successful Silicon Valley company or possibly a drug company where somebody decided one day we can solve this problem.
And it takes a while. It takes persistence, it takes trial and error. But once you get there, the joy of solving that problem is so much more than improving something incrementally on a daily basis. Now of course, there’s a tore choice in the hair, and you can say, well, you can still get to great heights by constantly improving every day. That too. But I think non-linear thinkers create revolutionary concepts, allow us to step change the outcomes for ourselves, and that’s what we have to nurture. If you see where we grow up, we spend our lives getting de-risked, right? When we grow up, we’re telling our, I have 9-year-old, 8-year-old, constantly telling them, don’t do this and don’t do that. That’s dangerous. Don’t do that. Don’t carry a knife on your hand. You’re not ready for it. That’s the subliminal process of de-risking an individual because we care for them so much that we try and make sure they don’t take risk.
I come from India, the traditional wisdom was study, find a wife, marry her, get a house. Don’t take too many loans live within your envelope. That’s risk management. That guaranteed you a certain trajectory for a good life. And I think as we get risk managed over life, that non-linear capability starts to diminish because you’ve never been encouraged to take non-linear risk. So yes, I’m a huge fan of non-linear thinking. I’m a huge fan of putting yourself into situations where less variables are under your control. You build dexterity, you build capability, you build possibly some solutions and let’s say anything with high standard deviation as high risk of success and high risk of failure. But in the end, it’s high return if you have high success. So I’m a huge fan of long linear thinking. I’m a huge fan of people who say, I’m going to break the mold. I’m going to change this. Fundamentally less exciting to have somebody say, I’m going to make the small change. It’s going marginally better tomorrow.
Dr. Jessica Kriegel: So when you joined Palo Alto Networks, you had no experience with cybersecurity or enterprise?
Nikesh Arora: Yes.
Dr. Jessica Kriegel: Was that a risk?
Nikesh Arora: I never run a public company before, which is a whole different, and that by the way.
Nikesh Arora: I think you should blame the board. It’s their fault. They clearly didn’t do their job. They should have a checklist that says, let’s find somebody who done this thing before.
Dr. Jessica Kriegel: They forgot to vet you. I guess somehow it’s worked out for them though.
Nikesh Arora: Or somebody saw something right, or connectively, they saw something. I think what’s fascinating is I say, you only have to convince one set of people at any point in time to get a job in order to convince the rest of the world. So I somehow managed to work with those eight people, and there must have been, I was in the room, so I don’t know, but somebody must have been a champion who said, we want a nonlinear thinker. We want somebody who’s not cut from the mold of our industry because our industry has struggled to get past a certain level. The largest company at that time in the space was 18 to 20 billion market cap. And that’s kind of where companies got to and decided to settle down. And I think somebody must have said, we need to break the mold into something different. They found somebody knew nothing about nothing and decided.
Dr. Jessica Kriegel: Harm. Yeah. So did it feel like a risk to you? I mean, did you have any imposter syndrome?
Nikesh Arora: There always is an element of that because I think there’s the underbelly of Silicon Valley as you kind of fake it till you make it a lot of startups, but they don’t call it that. They call it like, I’m going to go persist. I have a strong belief. So I had a strong belief. One thing I’ve not lacked ever in life is, which surprises my family and my wife. And she asked me, it’s like, I love how you have so much confidence in yourself, and I guess it’s a character flaw. I walk in and say, yes, if somebody can do it, why can’t I do it?
And it just requires some amount of persistence. I’m not fool party. I’m not going to jump in the cockpit of a plane saying, if somebody flew it, I can fly it too. I’m going to have to go figure the ropes out. So the analysis the board did was we had 5,000 plus people. They said, we have 5,000 people who understand cybersecurity. We need a leader who can guide them to how to win in the future. So I had effectively the support and capability around me. I just had to be careful and humble enough that I was going to leverage the expertise around me as opposed to try and figure it out myself. I did. I used to call the founder every morning when I came to work and I used to call my head of product every evening one of my rental home saying, he said this, what do you think?
And this happened, what do you think? And I think I must have burned tons of people’s ears by the time it was done in the first six months because all I did was call people and ask questions. And that allowed me to get to a place where I learned that was very important and I, that’s what helped get us where we are. But yeah, it was a risk. And the rule I sort of apply is when I take a new job and I took a risk when I left my job many years ago in 2004 when I joined Google, I’m like in the first year, swing hard and swing big, create the highest standard deviation because that gives the maximum opportunity for upside. If you screw it up, move on. So I swung hard and I swung big. We bought 19 companies in the first three and a half years I was there because we had technical debt to pay and I don’t want to keep doing it forever. So I said, let’s go hard in the beginning, reconstitute the chess table, and then we see how we get from there.
Dr. Jessica Kriegel: So how would you describe the culture that you’ve developed as the leader there over the last, what is it? Seven years now?
Nikesh Arora: Yeah, almost. It’s a long time. Yes. Well, I was blessed. My predecessor was an amazing guy. Mark McLaughlin, he’s an ex Best Point graduate. He did an amazing job setting the tone for the company around integrity, around the values of the company. But when I came, the first thing I did is we interviewed all 5,000 employees through electronic mechanism and asked him to write about the culture and somewhat free form with some guided questions. I got 11,000 responses and I read them all and I came up with saying, look, this is a culture which favors collaboration favors integrity, favors inclusion, favors customer focus. And we came up with five values and disruption and said, these are going to be our cultural values. But at the end of the day, I realize companies have two, the culture has got two fundamental sort of pillars. One is the leader, whether you’re like it or not, the organization takes on the form of the leader.
If you look at Google, there are elements of Larry and Sergei in it. If you look at Facebook, mark Zuckerberg is all over it. If you look at, I’m sure Tesla, there’s a lot of Elon Musk in there because that’s what the culture is. So people see what you do and think the right way to win is to do what you do. So whether you like it or not, you can say whatever you want. If you don’t role model it, they won’t do it. So I think a lot of that relates to how I conduct myself, how I conduct myself with various parts of the organization, what I prioritize, what I deem as important. People do that. But I think that says one part of it. I think the bigger part of it is how every individual absorbs that and does their own role modeling. There’ll be parts of the organization I never see, they see me once a year or four times a year in my quarterly calls. Actually they see them more than that because I do twice a week, I do 50 employees at random and I do a Zoom call for an hour with each of them.
Dr. Jessica Kriegel: No way. Did you come up with that or did you see that somewhere else?
Nikesh Arora: No, I came up with that because I’ve evolved as a leader. I used to be more deterministic and more outcome oriented. And I’ve realized part of my job is to get people to do their best work, not tell them what to do. And that requires the whole conversation we had around inspiration. So when I was in the pandemic, we read about Apple, said, oh, we’re going to send people home for two weeks. And we all sat down and said, what do we do? They just sent people home for two weeks and we were lucky. We invited this behavioral psychologist to come and speak to our teams because people are going through all kinds of intellectual trauma and personal trauma and oh my God, I’m going to have to work from home. What does this mean to my life? It’s a pandemic. I’m scared for myself and the family. And he said to me, he said, you want a business school? You learned all about Maslow’s hierarchy and behavioral dynamics of people. He said, this is a Maslow’s hierarchy moment. People don’t care about what project you want to get done. They don’t care about how great your product’s going to be. They are concerned about their personal safety, they’re concerned about their personal situation. So everything else gets blanked out by them. They just think you’re talking head.
So that was a moment. The first thing we announced, you are going to go back home and come what may We will not fire anybody from Palo Alto. It was a very simple statement. There were all kinds of rumors that, oh my God, demand is going to be down, revenues are going to be down, companies are going to shrink. They’re not going to, they’re going to cut costs. Like I said, don’t worry about it. We’re profitable enough. They have enough money, we will make sure we stand by our employees. That kind of like, oh my God. Suddenly people were very happy about that. And then everybody was working from home. I had no idea what the company was feeling. I had no idea what people thinking about. So I started in the pandemic doing, at that time I was doing 50 to a hundred once every second day. And I just talked to them. I said, how are you feeling? What’s going on? And people would talk about somebody wanted internet free. Somebody wanted their babysitter was an issue, they’d talk about their personal issues. They wouldn’t talk about Palo Alto.
And that just gave me such an understanding of how people were feeling and the pulse of the organization that I carried that on. I did one yesterday. I had 50 people and they tell me all kinds of fun things. And part of, as I said, part of the consistency of behavior that builds a culture. I’ve been through 8,000 employees at Palo Alto. They know they’ve talked to me on Zoom, they know, then I stand up on stage and say, I care. I care about Duke. They’ve experienced me on a oneone basis in 50 people at a time, and they’ve had me answer all kinds of questions. So I think part of that, that was what kind of helped me to do that.
Dr. Jessica Kriegel: So it’s listening. I mean, we talk about that all the time. I mean culture, the way we define it is how people think and act to get results. And to shape a culture, you have to create experiences that will drive the right beliefs, that’ll get people to take action, which will get you the results. It’s not rocket science, but a lot of the time you see leaders thinking, oh, there’s so many people. I don’t have time to listen to all of them, so I’m just not going to listen to any of them. And then they just charge forward towards results with this singular focus.
Nikesh Arora: I think culture for me is that, and that’s the way to build a culture. I think in addition to that, to me culture is about if faced with a choice, what would I prioritize? And I have a saying which says, culture, values and friendships are only tested in adversity,
Otherwise it’s all good and nice. What’s your culture? Oh, we like inclusion. We like diversity. We treasure our customers. We like disruption. The question is, at some point in time, I don’t know how to test it. I don’t know what becomes more important really when it comes push comes to shove, are you going to prioritize profits over customer happiness or when it push comes to shove, are you trying to prioritize friend A versus friend B? Your culture, values and friendships are tested in adversity. The question is, how would you respond? How would you rank order things? And we force that. We force that conversation.
Dr. Jessica Kriegel: Any notable stories of when you were facing adversity and had to make a choice?
Nikesh Arora: I think there are choices you have to make on a constant basis. There are choices you make, which at that point in time are important. But in hindsight, they become sort of obvious. For example, we will not slag any competitors ever. That’s our motto. We don’t do that. Right?
And you will find people come from different places and they’ll say, you know what? They’re not doing this. I’m like, listen, there’ll be a day when we’ll be in the wrong or we’ll not have done something. Well, it’s good time. Why would we just focus on the customer, get them to get stepped out? So there are issues where our industry, as you’ll appreciate, there are a lot of bugs that get happen from a security perspective. Bad actors are constantly trying to get into our systems because we hold the keys to the kingdom in many cases. And there’s a question, do you tell the customer at the moment, do you find something wrong? And you take the punch in the face, and I think you saw one of our industry competitors happen to them. They took the punch in the face. We do the same like, look,
Customer trust and integrity is always more important than profits because, and by the way, at some level, they are at odds in the moment. But if you step back and think about it from a long-term perspective, they’re not at odds. Because if you make a short-term decision because you’re maximizing something eventually and long-term, it’s better to be transparent. It’s better to be more radically have radical candor. It’s better to be, you don’t want to lose trust. You lose trust and all kinds of bad things happen. So short-term optimization choices would impact your ability to be trusted, end up hurting you in the long term.
Dr. Jessica Kriegel: Well, and you have an acquisition strategy, so I mean, they could also be part of your company one day, so you don’t want to flag them off either.
Nikesh Arora: It always don’t work for us. We have no problem with that.
Dr. Jessica Kriegel: Yeah. So how do you manage culture or the merging of two firms or the acquisition of one firm over another?
Nikesh Arora: Well, it’s interesting. So luckily our acquisitions have been smaller groups of people relative to our large cohort of now we have 15,000 people. The largest acquisition we did possibly had 300 people at best. So it’s always better when you’re absorbing a smaller team because then they get to see people around them. And unfortunately they get set up in teams which are already doing the same thing. But the good news is they have a lot of teachers and mentors, and you hope the teachers, mentors, partners, colleagues, are all very, very consistent. And that way they get into the culture. We do acquisitions very differently than most companies. And I think it’s safe to say, I believe we’ve had a much better success rate than a lot of the acquisitions in the world that are out there. We bought 19 companies. We do some things differently from the day we talk to the company.
We try and take middleman out of it. I say, listen, we’re going to have the conversation directly. And I have a rule which I tell my team in any acquisition situation, every conversation you have to imagine this is a colleague, not somebody requiring, because acquiring creates a cultural imperative. It’s like, I am the master. You’re the acquired. It’s like there’s a whole bunch of materialistic tendencies that come into place and say, oh, we bought your company. We own you now. Well, you didn’t buy our company. These guys beat us in the market. And before getting fully beaten up, we decided to make them part of our team. And that’s very important to set the bid right at the beginning. And I literally had conversations with our team saying, these people are going to be part of our team. So treat them like you’re part of your team from day one.
Even when you start discussing it, not even from, because otherwise people has tendency, well, I’m going to be inquisitive. I’m going to audit you. I’m going to get inside your business to understand you, to see if you’re worthy. And that becomes a whole judgmental conversation. Well, I am judging you because I’m trying to see if you’re worthy of being at Palo Alto. I’m like, you’re not judging them. We got to them because they’re doing something amazing. Now we’re trying to figure out if there’s a fit that’s different than judging them if they’re worthy. So we do that. And in many cases, what we’ve also done is we actually had those leaders come and run our teams instead of making them work for our teams. Because I’m like, look, they had limited resource. They ran a small business, they got out of the gate, they persisted, they worked really hard, and they’ve done it better than we did, so we should learn from them and let them run our company.
They’re part of a team. So some of those things allow us to be more culturally receptive to other people. Look, it’s still harder for them because they’re taking the little baby that they spent years building against all odds, and they’re sort of giving you their baby or having or partnering in that it doesn’t matter what the value is. It doesn’t matter whether they fully succeed or not. It’s still something they dedicated four or five, seven years of their life. They sacrifice family. They sacrifice economics, they sacrifice all kinds of things. So this is very emotional for them. And you have to meet them at their emotion to get them to fit in your culture. And they have to believe that being part of this larger team, they’re going to win better together.
Dr. Jessica Kriegel: You financially incentivize the founders to stay longer.
Nikesh Arora: You give them some lucky. We’re lucky a lot of them have. And what we do is we say, listen, we appreciate what we’ve built so far, but honestly, for us to win, we need you to keep driving this train for the next two, three years. How do I make sure when we make the acquisition that you’re going to be part of the journey, not just leave us by the wayside, take your money and run. Now there are instances where there were three of them, one or two have had to go for different reasons from our perspective, their perspective, but we’ve been very lucky that we’ve been able to tell them, listen. And they said, listen, we’ll take your equity back. What you’ve got left, we’ll give you 50% more if you stay. It’s three years, which is substantial for many of them.
Dr. Jessica Kriegel: Yeah, and Do you see the impact beyond them to the teams that they bring with them as well? Or do you think that matters to people?
Nikesh Arora: Sure, because we don’t do just for them. We look with them at the key people who are required to make that successful. It’s just not about the founder, it’s about the team that they have to get the key people are. So we send those key people in a very similar fashion. We don’t make things different for the founder versus the key people. And we’re lucky because a lot of their teams stay Now, some of them have DNA that they want to go start another company in two, three years, and they do that. Some of them don’t like it after year and a half, and we have a conversation with ’em. But I’ll just say we’ve had more success than less in that regard. So we’re blessed with that.
Dr. Jessica Kriegel: I’m curious about brand management. I believe that culture and brand are one and the same more and more so than ever before, probably because of the multi-directional nature of information sharing. When something happens inside your company, a lot of people outside the company can hear about it. So have you noticed culture management and brand management merging? Have you thought about that consciously?
Nikesh Arora: As you might know, I used to be a chief marketing officer in my first major C-level job.
Dr. Jessica Kriegel: I do know that.
Nikesh Arora: You hit the nail on the head because what is a brand? Brand is your name. We have a brand, you have a brand, I have a brand. Your podcast is a brand, but the brand attributes that fill the name are effectively your values and your culture, what your values are. Become transparent in every exhibition, every conversation, every podcast is we understand what makes you tick, what you stand for. People are very smarter than that. They understand what you stand for based on every external communication you make. So every external communication, Palo Alto makes people attribute that to our culture and our values.
Dr. Jessica Kriegel: How?
Nikesh Arora: I deal with customers, they understand if you’re customer obsessed or not, how my products work. They understand if we’re innovative or not, or disruptive or not. So you can stand on the rooftop and claim I am the following five things. But the question is, can you fill those brand attributes with proof points? So you can’t have culture and values independent from your brand aspiration, right? You can’t say, I’m customer obsessed and none of your values has the word customer in it. You can’t say, I’m the world’s most innovative company and say, well, we don’t value innovation or disruption within ourselves. So I think it’s fully intertwined. And I think actually my view is that brands get built based on consistency and execution of value and culture.
Dr. Jessica Kriegel: Totally.
Nikesh Arora: Yes.
Dr. Jessica Kriegel: I agree. We talk about beliefs. I mean, you’re using the same language, right? Values and beliefs and what you stand for. These are all kind of the same term, and I can say, here are my beliefs. I believe in this and y and Z and a alpha, and then you’re going to have experiences with me which are either going to reinforce that.
Those are the beliefs I have or not. And people can see through it, even if it’s not a conscious realization. It’s a sixth sense that people can see in authenticity. One of the things that we have leadership teams do when there’s some kind of drama or tension or politics or whatever, is we ask someone, what are the beliefs that you would like your team to hold about you? And then they’ll say, well, I want them to see me as this and that and that. And then we ask the rest of the team, well, are those the beliefs that you hold about that person? Usually the answer is no, because we were digging in for a reason and we say, well, what experiences would you need to see from this person in order to hold those beliefs? And if you saw those experiences, would it be enough to shift your beliefs? And that, I mean, at a corporate level, that’s what brand is, right? I mean, what beliefs do you have about this company and what experiences have you had with this company that either reinforced those beliefs or not? So when you think about your legacy and inspiring people, which we started, what beliefs do you hope people have about you once you’re gone?
Nikesh Arora: Look, I would hope people would say that he was constantly challenging us for us to do better. So we disrupt ourselves, we innovate, and he was always making us become a better version of ourselves by doing more and delivering great outcomes. I grew up in a military family. My father was all about integrity, discipline, and values, and I hold fairness very high in my mental models. So for me, I want them to say I was fair. I’m tough, I’m not easy to work with, but that’s what it takes to get great stuff done. I’m not confrontation, but I’m challenging. So I’d want them to believe that I made them do their best work. I want ’em to believe that I was fair. I want ’em to believe that I was willing to roll up my sleeve and jump in and do it with them at any point in time to help them win. And I want ’em to believe that we were all part of one team, which allows us to win and we’re better together.
Dr. Jessica Kriegel: That’s beautiful. So I’m going to ask you a question that may be going down a rabbit hole that isn’t useful, and if it is, we’ll cut it. Who cares? Right?
Nikesh Arora: Right, exactly.
Dr. Jessica Kriegel: I was thinking about something when you were talking about cybersecurity and how unsophisticated it can be and how effective unsophisticated attacks can be. You told the story of the SB keys being dropped in the parking lot. Will you tell that story to set the stage for my question?
Nikesh Arora: Yeah, look, I think part of the point is that in a broader context, many of the cybersecurity hacks are not very complex. The activity they undertake once they get in are complicated because they get through multiple systems and get to your crown jewels and try and exfiltrate them. And that stuff is complicated from a technical perspective. But the initial, what we call attack vector is very simplistic because the initial attack vector is more often than not, the weakest link is a human being.
Nikesh Arora: Eventually all of our systems are accessed by people, and you can take over somebody’s identity by sending them a phishing link. You can take somebody’s identity by people, use the same password across multiple things. You’ll be surprised if I did a search on your name and your email, which I probably have because you’ve reached out for a podcast I could possibly find on the dark web, at least 10 passwords you’ve used out there.
Because many of us have 50 or 60 passwords. Everybody wants you to open an account and start a password. So there are 10 passwords you’ve used, which are companies that have been hacked, and the passwords are on the dark web. You don’t even know where else you’ve used them. Use them once for some subscription, you forgot about it, it’s out there. But I can build a pattern on your password psychology and anticipate your next password. Now, we told the story, somebody told me, look, we can get into your company, and this wasn’t us somewhere else. It’s like somebody said, we can get into your company. And to prove the point, that threw a bunch of USBs suggesting there was some interesting content on the USB on a little tape that was stuck in the USB saying Mike’s personal videos and threw 20 of them in the parking lot, and within nine and a half minutes, a few of them had stuck it in the SB ports, their laptops they were in. So it’s all it takes.
Dr. Jessica Kriegel: So that’s all it takes. That’s interesting because where I saw the intersection of your world and my world is there is a culture element to cybersecurity. You can have the greatest tools on the background running, but you also need the people to think and act in a certain way so that they don’t pick up the USB key in the parking lot and plug it in so that they don’t fill out the form. You told another story about, we have a pet contest, upload your pet pictures.
Nikesh Arora: I literally thrown my head of HR saying, are we doing this? People are being asked to upload their pet pictures or National Pet Day and the winning pet is going to get a bonusly award of a thousand dollars. That’s crazy. What’s wrong with us? And my cat is security sitting side says, we’re not doing that.
Dr. Jessica Kriegel: They’re not. Yeah,
Nikesh Arora: Yeah, but you know what? That’s so easy. There’s somebody who loves their dog. Their cat is so personal. Oh my God, I want to put my cat’s picture on National Pet Day. It’s going to win an award. There we go.
Dr. Jessica Kriegel: Totally. It’s emotional. I mean, I’m a dog person. I would jump at that opportunity. Or you get at our company, everyone I’m sure gets these too, the CEO texts you and says, Hey, it’s Joe. I need you to go to the store and buy five cards and send them to me immediately. And then if you have a culture where you could question the ceo, you’re maybe more likely to overcome that than one where you feel like, oh, Joe, I’m scared of Joe. I’ve got to do whatever he says. Right. Okay. So do you do anything in the culture element of cybersecurity or do you help your customers taken those cybersecurity compliance tests? Right, and it’s just like click, click, click gag me. I mean, who cares, right.
Nikesh Arora: Well, I think people here are possibly more attuned to the notion that you can get hacked or you can have phishing attacks happen to you. So we do have a lot more internal controls and prompts to encourage people to not do silly things. Obviously, we have people go through training and remember, we’ve got 6,000 engineers. They build cybersecurity products. They’re building products to detect these problems from happening, and what happens consequently, we have this constant philosophy called zero trust, and zero trust means you can’t trust anything or anyone around you from a cybersecurity product perspective. So there’s too much, A lot of our terminology and a lot of our development is fundamentally built on the fact that if there’s a way a bad actor is going to get in.
Dr. Jessica Kriegel: So.
Nikesh Arora: That’s kind of like the psychology of everybody in the company here.
Dr. Jessica Kriegel: But you’re probably targeted more too, because it’s like the crown jewel. I bet if people can hack into you, they’re going to be superstars.
Nikesh Arora: We’re a trophy hack. If I can get to Palo Alto, how the securities, so we’re paranoid on a constant basis that we can’t be hacked, we shouldn’t be hacked, and we work really hard towards making sure that, but I think part of what we all said to Jessica, if you believe the premise, which you just so well articulated about, that’s all it takes. Then you have to say what happens next? You say, it’s so easy for me to get in. How do you make sure that once you get in, I have tons of checks and balances that make sure that I can’t cause damage? So a lot of our work actually concentrates on the assumption somebody’s going to get in. How quickly can we figure it out? How quickly can we stop? How quickly can we put a blanket on the infrastructure that protects bad things from happening when somebody gets in?
Dr. Jessica Kriegel: Okay, so that answers my question. You’re basically accounting for human behavior and human error and saying, we got you. Even though your employees are never going to take the compliance training seriously.
Nikesh Arora: Well, even if they do, look, there’s an extreme case, right? Let’s assume you’re very good about everything. You’ve done a good job. You’re not going to compromise your password. Always. We call physical, the hybrid attack. A hybrid attack. Is it electronic plus physical? You’ve seen all the movies that show how and put a gun to your head and say, log into your computer. I cannot build any cybersecurity tool that can stop that from happening. Now, of course, thankfully that doesn’t happen. But there is that possibility that that’s the way somebody gets. So you have to assume there is a way somebody could get in. So our work has to be at the front, but also under the assumption that something bad has happened, somebody’s got in. The question is how do you restrict what we call the blast radius of that individual or that attack?
Dr. Jessica Kriegel: Yeah, okay. So it’s ultimately there’s human behavior, which can only go so far. Then there’s extra security layers, and you’re constantly looking for who is beating us so we can buy them so that we can be the best.
Nikesh Arora: Well, I think take a look at what’s going on. I think 18 months ago, if you and I had this podcast, we wouldn’t talk about AI. Thankfully, we haven’t talked about it yet, but everybody else in the world is.
Dr. Jessica Kriegel: Thankfully being the operative word.
Nikesh Arora: Oh my god. There’s so much conversation about it, and a lot of people have partially informed opinion versus leave it there. But having said that, I think that’s a topic jour. Everybody wants to talk about it, and all I will say is I’m pretty sure with ai, the attacks are going to come faster, and I know that when the attacks come faster, we’re going to have to come up with some counter AI that protects customers As fast as AI is trying to attack them, this is not going to be left on the wayside. So now our job is to be paranoid to anticipate what AI is going to cause, because we’ve got to start building the antidotes now before they show up, because you can’t have people show up and say, I got nothing to protect you with. So it’s almost like we have to sort of go do a bunch of blue sky stuff. And that’s the reason I say cybersecurity is the most innovative industry in the world, because a bad guy is always looking for a net new way of getting in. So you’ve got to go build protections against what’s coming in the future, not spend your time selling the past.
Dr. Jessica Kriegel: That’s why industry is why the non-linear thinking was the reason they placed a bet on a guy with no cybersecurity experience.
Nikesh Arora: That’s right. Stop. A lot of our companies would say, great. I built a really cool tool. I’ve sold it to five customers. Let’s go sell it to 50,000. They all need it. But the problem is you’re selling the past, but you got to anticipate the future. So you got to do both, right?
Dr. Jessica Kriegel: Scenario planning, which I’ve been in the room with leaders who are trying to figure out scenario planning 25 years down the line, what does the future look like and how can we create satellite strategies? In the case of those things, actually last night I was at dinner and I was talking about ai, and when I started this podcast, we had a different producer and we would do these long intros for people that we interviewed. And one time I was on vacation and I didn’t record the intro and it had to go live. So they used AI to have me say the script.
And when I listened to the podcast, I was like, I never recorded that, right? So they found my voice and I thought, that’s the next scam that I’m going to fall for this really you? Yeah, no, this is really me, but how would you know? Don’t know. So I was talking to my boyfriend last night at dinner, I’m like, we need a code word dude, where If you call me and ask me to transfer you money, we have some kind of secret code to make sure it’s not ai.
I mean, that’s just a tip. And who am I? I’m a nobody. No one’s coming after me. But I can’t imagine a cybersecurity company, not to mention the CEO, I mean a high net worth individual. You probably have thousands of crazy securities just for your personal life, right?
Nikesh Arora: So funny, the meeting before this was just that.
Dr. Jessica Kriegel: Really?
Nikesh Arora: We live in a world which is more and more transparent, more and more information out there, which is very publicly available, more and more social engineering that happens more and more social media that tells people where you are, what you’re doing. So there’s a lot of people out there in the world who have more information about you than they ever did.
Dr. Jessica Kriegel: Yeah. And then you have the UHC killer going out there, and now everyone is talking about CEO security. I mean, did that give you panic?
Nikesh Arora: Well, we work in the security space. So as you appreciate, we’re constantly paranoid. Our job is to fight bad actors on a constant basis. So we work with the presumption that there are bad actors out there. We work with the presumption that our job is to protect our enterprise customers, and we worry sometimes if we piss off a bad actor too much, they might think about other ways of impacting us, whether they’re trying to hack us or compromise lots of information about our executives, et cetera. So we’re constantly paranoid just not just for our customers, but for all these scenarios, as I said. So it’s unfortunate what happened. I think it’s horrible. It’s a reflection of where we are and hopefully, but the problem is one of the risks that is always there is you can’t take one isolated incident and then start building a whole global strategy around that.
Everybody’s not going to do everything. I’m still taking over my shoes at the airport after, I don’t know, 15 years of somebody, and it costs, I don’t know, billions of dollars for the whole world to take off shoes and put them in the tray. I think they’ve come up with new ones, which your shoe doesn’t beep your fine. So the problem is we’re programmed as society to solve for what happened, which is the same process as selling the past, because that’s tangible. You can put your arms around it. As I always said, you got to think about what could happen, and you got to prepare for what could happen, not what happened. What happened is the easy part as in to prepare for what happened is the easy part, and that goes back to our conversation about how do you run a company? How do you think about life? And at some point in time, I’m Hindu, I’m the fundamental principle on which one of the fundamental principles on which some of this survives is fatalism your destiny. So destiny will strike when destiny will. So at some level, you work hard, you prepare for it, you’re cognizant of it, you’re paranoid of it, but at the end you say the last few percent of probability, if it was meant to be, it’ll happen.
Dr. Jessica Kriegel: Yeah. I always say, I’m responsible for the effort. God’s responsible for the outcome.
Nikesh Arora: There we go.
Dr. Jessica Kriegel: Maybe it takes a little bit of the fear out of the paranoia.
Nikesh Arora: That’s right.
Dr. Jessica Kriegel: Well, thank you so much. This has been such an interesting conversation. I’m very, very grateful that you took the time. I know you’re very busy. I will ask you my last question, which is my favorite, which is what is something that you don’t get asked about very often in these types of interviews that you do that you wish you were asked more often?
Nikesh Arora: Oh, Jessica, I’m going to tell you this one is a very different one because most of my podcasts, interviews are more professional about work outcomes and more sort of execution action. What did you see? What did you do? This one was more about what do you think? What do you believe? What makes you tick? So this is the stuff I don’t get asked very often. So thank you for doing that because you asked me everything I’d never been asked for the most part. So actually it wasn’t just one thing. You’ve asked me a lot of things, which I don’t talk about much often, so I appreciate you going down this path.
Dr. Jessica Kriegel: Well, then I’ve done my job. I mean, we don’t care about the action trap and what you did. We care about what do you believe, because that’s what culture is all about. So we got to see a little bit of the insight into your world, and so thank you so much for being vulnerable.
Nikesh Arora: Well, thank you for having me on this podcast.