Nikesh Arora on Cybersecurity, Quantum, and Career Pivots

TL;DR

Cybersecurity is a demand function that keeps expanding because the attack surface grows exponentially as everything gets connected, from phones to cars to future humanoids. Nikesh Arora, CEO of Palo Alto Networks, argues hacking has shifted from a hobby to a profession, with over $10 billion extorted or ransomwared yearly in the lowest-conviction criminal vertical.

Transcript

Nikesh Arora. Oh, boy, where do we begin? A boy from Ghaziabad who's now one of the highest-paid execs in the world. That's Nikesh for you. He's collected degrees like people collect Pokémon. Constantly pivoted way before it was cool, worked at Google after landing an accidental interview with Larry Page, then at SoftBank, and now leads Palo Alto N... Read More

Key Insights

• Hacking has moved from a hobby to a profession, according to Nikesh Arora. Attackers now have economic motivation rather than seeking a trophy kill, and when something is done professionally it is done right, which is why attacks happen far more often.
• Supply chain attacks emerged because targeting shared infrastructure is more efficient than attacking individuals. Rather than hacking one person's life, attackers compromise a large platform like an email service, then extract whatever they want from everyone who relies on it.
• Cybercrime is the lowest conviction vertical in the bad actor industry. You can hack someone from 5,000 to 10,000 miles away, get paid in cryptocurrency, and remain untraceable, making it low-risk compared to old-west style crime with a 50% chance of getting shot.
• Over $10 billion is extorted, ransomwared, or taken through digital-hacking Ponzi schemes every year, per Nikesh Arora. He calls it an earth-shattering problem because there is no recourse, describing the digital domain as still the Wild West.
• Future wars will be part cyber and part technology wars. Attackers seek the lowest-cost way to create instability, chaos, and destruction of life and property without heavy cost to themselves, making cyber the primary means of destabilization.
• The attack surface continues to expand exponentially as connectivity grows. You can attack 5 billion online people and every company; cars, robotic arms, and humanoids will all become connected, so the demand for security is effectively guaranteed.
• Cybersecurity did not exist as a significant industry sub-vertical until about 25 years ago. The app economy and mass connectivity emerged around 2005, and twenty years ago most people used phones only to call or send simple texts, so hacking was not a concern.
• Quantum computing will break every encryption key that exists today. Keys are codified so they require enormous compute to break, but quantum can crack them in seconds or minutes rather than days, forcing entirely new quantum-resistant protocols.

Questions & Answers

Q: Why has hacking become more common in recent years?

Nikesh Arora explains that hacking has gone from a hobby to a profession. Earlier it was a trophy kill with no economic motivation, like a kid in a basement hacking the FBI to prove he could. Now there is real economic incentive, intellectual property theft, and nation-state involvement. When people do something professionally, they do it right, so attacks happen far more frequently than before.

Q: What is a supply chain attack in cybersecurity?

A supply chain attack targets a large piece of shared infrastructure rather than a single individual. Arora explains that instead of hacking one person to find what they want, attackers hack a widely-used platform like a Gmail or email service. Then anyone utilising that infrastructure becomes fair game, letting attackers get whatever they want from whoever relies on it, making the effort far more efficient.

Q: How much money is lost to cybercrime each year?

According to Nikesh Arora, north of $10 billion is either extorted, ransomwared, or taken from individuals through some sort of Ponzi scheme based on digital hacking every year. He calls this an earth-shattering problem, not because the amount alone is huge, but because there is no recourse. It remains the Wild West, with cybercrime being the lowest conviction vertical in the bad actor industry.

Q: Why is cybercrime hard to prosecute?

Cybercrime is the lowest conviction vertical in the bad actor industry because it is low risk and hard to trace. Arora notes you can hack somebody from 10,000 or 5,000 miles away, get paid in some version of cryptocurrency, and remain untraceable. He contrasts this with old westerns where you carried guns and faced a 50% probability of getting shot; digital hacking is comparatively low impact for the attacker.

Q: How does cyber warfare play a role in modern conflicts?

Arora believes most future wars will be part cyber wars and part technology wars, as attackers seek the lowest-cost way to create instability, chaos, and destruction of life and property. He cites the Russia-Ukraine conflict, where the first thing that happened was hackers taking down Ukraine's entire logistics systems to destabilise and immobilise the army. It was not a bomb but a cyberattack that struck first.

Q: Why does the cybersecurity industry keep growing?

The industry grows because the attack surface continues to expand exponentially. Arora explains that connectivity exploded over the last 20 years, so attackers can target 5 billion online people and every company. As cars, robotic arms, and humanoids become connected, and services become useless without connectivity, the demand for security is effectively secured. He calls cybersecurity a gift that will keep on giving.

Q: When did cybersecurity become a significant industry?

Nikesh Arora says cybersecurity did not exist as an industry sub-vertical of significance until about 25 years ago. He reflects that around 2005 the app economy began and things started getting connected, which was not even 20 years ago. Twenty years ago people were not worried about getting hacked because most were using phones only to call someone or send an old-form text message.

Q: How will quantum computing affect encryption?

Arora explains that when data is sent in encrypted fashion, keys defined by an industry protocol are used to decrypt communication so nobody can intercept or read it. These keys are codified to require a lot of compute to break. With the arrival of quantum, its far greater computing power will break those keys in seconds or minutes rather than days, which is why entirely new quantum-resistant protocols and keys are needed.

Summary & Key Takeaways

• Nikesh Arora grew up in Ghaziabad in an Indian Air Force family, absorbing integrity from his lawyer father and a love of education from his mother, who held a master's in math and Sanskrit. Frequent moves brought impermanence but taught him to adapt to many situations.

• He collected multiple degrees and constantly pivoted careers, working at Google after an accidental interview with Larry Page, then at SoftBank, and now leading Palo Alto Networks. His story shows how refusing to stick to one lane worked in his favour across roles.

• Cybersecurity is framed as an ever-growing demand function driven by an expanding attack surface, professionalized hacking, nation-state cyber warfare, and looming quantum threats to encryption. Arora calls it a gift that keeps on giving as connectivity, and its vulnerabilities, spread across every service and device.