Palo Alto Networks

Enterprise margins come from selling many products to the same customer. Nikesh Arora joined Palo Alto Networks in 2018, when it was an $18 billion firewall company, and studied enterprise P&Ls such as Cisco and Salesforce rather than cybersecurity. Sales, marketing and support eat about 60% of costs, and cutting that to 20% through cross-selling gives a 40% operating margin.

R&D typically runs 15 to 18% of costs and administration 6 to 10%, so sales and support are where margin is won. His image: one product means knocking on 20 doors and getting 5 yeses, while a bundle means 'a truck behind you.' In eight years Palo Alto went to more than 70 products and about 35 acquisitions, aiming for a market cap above $100 billion.

David Senra▶ 10:00

Cross-selling only works if every product is the best in its category. Customers extend trust to more products only when each one works. Arora's line: 'nobody wants to buy the second best product in cybersecurity.'

This is why the growth model leads straight to buying category leaders rather than shipping adequate in-house products.

David Senra

Buy because a good product takes four to seven years to build. Arora argues Uber, YouTube, Facebook and Google search all took four to seven years to become useful. A rival is already a year and a half ahead with 50 to 75 people, so an internal version one ships two years behind them.

He arrived at Palo Alto with a thin pipeline and could not wait that long. At Google he once pushed to buy Netflix and was told to build it on YouTube with $10 million and 20 engineers; his verdict: 'Never works like that.'

David Senra▶ 11:43

Treat M&A as a mechanism for a strategy, not the strategy itself. Arora says he has no M&A strategy: he buys when Palo Alto must win a category and his own team is behind, so he looks for a team that has it figured out. 'M&A is not a strategy.'

Because acquiring is a tool, he says Palo Alto may stop once the marginal value to customers lies in making existing products work together.

David Senra▶ 32:21

Study why acquisitions fail, then control every variable you can. Before buying, Arora reviewed past deals and sorted failures into bad market, bad idea, bad execution or bad leadership, then changed how he ran deals to control most of them. That left two risks: the wrong idea, or the market not showing up.

When Aporeto's bet on IP-based segmentation never took off, Palo Alto cut its losses quickly. He compares this to pharma, which takes many drugs to a phase and then cuts bait.

David Senra▶ 12:57

Decide on price, stage and conviction before buying into an emerging space. Palo Alto had bought Evident.io, which worked only on Amazon, then RedLock, which worked on all three clouds; Arora suspects the first was bought too early. He now asks whether the space will be big, build or buy, how long the target has existed and how expensive it will get.

Funding conditions shift the math: a company that cost a third or a quarter of today's price three years ago may be just as early but several times pricier now.

David Senra▶ 31:25

Pay up for assets that could become $5 to $10 billion businesses. At about $300 billion in value, Arora says Palo Alto should buy what it believes will be worth $5 to $10 billion in five to ten years, so a $200 million asset is worth far more to it than its price. 'If something's worth $200 million, it's worth $800 million.'

Egon Durban's view, as David Senra relays it, is that you remember a deal you lost over a few hundred million, not the premium. Arora and Durban won a 29-round auction for a London cricket team after Durban urged him to keep bidding.

David Senra▶ 32:45

Buy only category leaders, because they take most of the profits. Numbers one and two capture a disproportionate share of category profits and number three rarely catches up. Buying number two or three and polishing it while number one is alive 'never works.'

Early on the top two are hard to tell apart, each with product-market fit and 30 to 40 customers, so the pick depends on execution, fit with Palo Alto's direction, the founder's mindset and willingness to sell. Arora admits that across 35 deals number two sometimes overtook Palo Alto's pick after it botched execution.

David Senra▶ 16:26

You are buying a cohesive team, not a company. Arora sees a company as a legal construct around a team that has spent a year and a half building together, often working 80 hours a week. Corporate hires through four interviews and an HR process will never beat it.

He buys companies two to four years in, with two to three years of product work left, and won't buy from a founder who says 'I'm out.'

David Senra▶ 36:10

Don't sign until the founder agrees to a joint product roadmap. After agreeing price directly with the founder, Arora has lawyers do paperwork while the founder's team spends 30 days designing the combined product. Founders are far more flexible with a large check pending.

Founders never pulled out at this stage, but Palo Alto walked away twice: once because founders seemed to be playing along only to close, and once because combining architectures showed the substance was weaker than diligence suggested.

David Senra▶ 20:12

The rule came from six lost months arguing with an acquired founder. On his first or second deal, the founder kept chasing his original vision after selling: 'I sold the company but I still want to build what I wanted to build.' Arora spent six months debating direction before seeing alignment had to be settled before closing.

He admits he had feared upsetting the founder and had to accept 'it doesn't work like that.'

David Senra▶ 18:59

Make the acquired founder the boss over the internal team that lost. Arora puts the founder in charge of the whole category and has the internal team report to them, instead of handing the purchase to the manager who failed for years. 'You can't reward that behavior.'

Some existing staff leave, and he accepts that.

David Senra▶ 15:50

Revest founders for three to four years to keep the category lead. Palo Alto revests acquired founders for three years, ideally four, so continuity holds through the remaining product work. Product and engineering founders tend to stay; business development and go-to-market founders often fade.

Several acquired founders still work at Palo Alto; others left after three years.

David Senra▶ 22:27

Founders must shift from underdog to amplifying 6,000 salespeople. A founder who won on sheer will has eight people on the team and 6,000 in the field inside Palo Alto, and must motivate those sellers as amplifiers. Founders who can't modulate rub people the wrong way and Palo Alto loses their product leadership.

Fit with a large company is part of how Arora chooses between number one and two. 'You went from being the underdog now you're part of the overdog.'

David Senra▶ 26:17

Negotiate directly with founders and treat them as colleagues. Arora skips bankers because the founder will work for him for four years and a middleman can distort what was agreed. He tells his team not to treat the other side with disrespect.

'I cannot win if 20 people around me don't feel they're winning.'

David Senra▶ 30:42

AI raises demand for security and can't match flat-priced endpoint inspection. Arora says AI finds perimeter holes faster and wider connectivity grows the attack surface. AI charges per token, so endpoint inspection with it could cost hundreds of dollars a day, while Palo Alto charges about $25 per endpoint a year.

Palo Alto's virtual patching writes signatures around the perimeter while customers fix systems. He says its business went up after Anthropic's Mythos model arrived: 'the marginal cost of inspection of traffic and laptop by me is zero.'

David Senra▶ 57:54