Nikesh Arora
Chairman and CEO of Palo Alto Networks, former chief business officer at Google
Where to hear and read about Nikesh Arora1 episode or test
Nikesh Arora is chairman and CEO of Palo Alto Networks, which he took from an $18 billion firewall company to 70-plus products in eight years, after running Google's European ad business and serving as its chief business officer. The lesson most worth taking from him is a repeatable acquisition method: buy the category leader, settle a joint product roadmap with its founder before signing, and then put that founder in charge.
M&A is not a strategy. M&A is a mechanism to validate or to amplify your strategy or to execute your strategy.
How to Win Deals & Grow a $250B Business | Nikesh Arora, Palo Alto Networks
Nikesh Arora: the story and the lessons
1Nikesh Arora's path from $200 to Google to Palo Alto Networks
Arora built his own path with almost no help from his parents. His father did not know how he got into university or a US business school. Arora asked for $2,000, his father did not have it, and he arrived in the US with $200.
His father later sent $2,000 toward tuition, "and that was it." Arora says his drive came from inside.
At Google, Arora's job was removing friction, not creating demand. He joined at 34 to run Google Europe and found European advertisers paying with American credit cards in US dollars. Google grew from 2,000 to 60,000 employees and from about $2 billion to $63 billion in revenue while he was there.
Every morning brought more searches and more advertisers, so the work was scaling and smoothing the path to buy.
He sold ads with no control over price or volume by doing ROI math. Bidders set the price and searchers set the volume, so he sat with customers to work out a lead's value from their conversion rate and set a maximum bid.
His pitch was to take as much as they could while it stayed below that bid. When it rained in France, revenue rose because people stayed home and searched.
Arora invested alongside Egon Durban for about 15 years. Durban recruited him as an informal adviser when Durban moved to Europe for Silver Lake, and Arora put in his own money. They nearly invested in Oculus before it sold to Facebook.
The rule was simple: Arora gives his view and Durban still makes his own call. The two later won a 29-round auction for a London cricket team they own equally, after Durban called at 6:00 a.m. to say "Don't stop bidding."
He stays at a company as long as the problems keep changing. At Google he moved across search, YouTube and DoubleClick. At Palo Alto he went from a firewall company to 70-plus products in eight years.
His test is how many different problems your brain can get pulled into.
2Why Nikesh Arora rebuilt Palo Alto Networks by buying, not building
Arora arrived with an enterprise growth model, not a cybersecurity plan. He joined in 2018 aiming to move an $18 billion company above $100 billion in market cap, and studied enterprise P&Ls at companies like Cisco and Salesforce.
He joked he thought cybersecurity was two words, and saw Palo Alto's market as too narrow for the goal.
Enterprise margin comes from selling many products to one customer. R&D runs 15 to 18% and admin 6 to 10%, so sales, marketing and support at about 60% of costs is the lever. Cutting that to 20% gives a 40% operating margin.
One product means knocking on 20 doors for 5 yeses; a bundle means "a truck behind you." It only works if every product is the best, since nobody wants the second best product in cybersecurity.
He buys because a good product takes four to seven years to build. Uber, YouTube, Facebook and Google search all took that long. A rival is already a year and a half ahead with 50 to 75 people, so a late build ships two years behind.
At Google he once pushed to buy Netflix and was told YouTube could build it with $10 million and 20 engineers. "Never works like that."
Arora treats M&A as a tool for strategy, never the strategy itself. He buys when Palo Alto must win a category and its own team is behind. He says Palo Alto could stop once the value to customers lies in making existing products work together.
David Senra compared him to Henry Singleton, who stopped buying for about 15 years; Arora says stopping is possible.
He only buys the number one or two in a category. Those two take a disproportionate share of category profits and number three rarely catches up. Buying number two and polishing it while number one lives "never works."
Early on the top two look alike, each with 30 to 40 customers. He once bought what he thought was number one and number two overtook it after a Palo Alto execution mistake.
He studied why acquisitions fail before doing them. He sorted past failures into bad market, bad idea, bad execution or bad leadership, then changed how he ran deals to control most of them.
That left two risks: picking the wrong idea, or the market not showing up.
Arora cuts losses quickly when a market fails to arrive. Palo Alto bought Aporeto betting on IP-based segmentation, which never took off, and moved on fast.
He compares it to pharma companies that run many drugs to a phase and then cut bait.
He weighs price, stage and conviction, and pays for future scale. Evident.io, bought before he arrived, worked only on Amazon, so he then bought RedLock, which covered all three clouds. At about $300 billion, Palo Alto looks for assets that can be worth $5 to $10 billion in five to ten years.
"If something's worth $200 million, it's worth $800 million" to Palo Alto. Durban's lesson from the WME IMG deal: you won't remember the extra $400 million, only that you lost the deal.
3How Nikesh Arora runs an acquisition
He negotiates price directly with the founder, with no bankers. The founder will work for him for years, and a banker in the middle can distort what was agreed.
He tells his negotiators never to treat the other side with disrespect.
No deal is signed until the founder agrees a joint product roadmap. While lawyers do paperwork, the founder and product team spend 30 days designing the combined product. Founders are far more flexible with a large check pending.
Founders have never pulled out at this stage, but Palo Alto walked away twice, once when combining architectures showed weaker substance than diligence suggested.
That rule came from six lost months on an early deal. After his first or second acquisition, the founder kept pursuing his own vision and Arora spent six months arguing product direction.
The founder's view: "I sold the company but I still want to build what I wanted to build." Arora admits he feared upsetting him and learned alignment must come before closing.
The acquired founder runs the category, not the internal team that lost. The internal leader had resources and failed, so Arora has that team report to the founder. Some staff leave and he accepts it.
"You can't reward that behavior by giving them a prized asset and risk them destroying it."
Arora is buying a cohesive team, not a company. A founding team spends a year and a half aligning, often working 80 hours a week and living in the same house; corporate hiring cannot catch up.
He calls the company a legal shell around the team and its IP, and tests whether this team can execute better than others.
He revests founders for three to four years and skips founders who want out. He buys companies two to four years in with two or three years of product work left, so losing a founder mid-build could cost the number one spot.
Product and engineering founders tend to stay; business development and go-to-market founders tend to drop off.
Founders must shift from underdog to overdog. A founder with eight people on the team now has 6,000 in the field and must treat them as amplifiers. When two targets tie, he picks by which founder fits.
Founders who cannot modulate rub people the wrong way, and Palo Alto loses their product leadership.
He treats acquired founders as colleagues, not the conquered. Hock Tan advises making clear on day one that the acquirer is the conqueror; Arora tells his team the opposite.
"I cannot win if 20 people around me don't feel they're winning."
4How Nikesh Arora thinks about AI, security and staying calm
Arora argues AI raises demand for security. AI finds perimeter holes fast and more connectivity widens the attack surface. Palo Alto's business went up after Anthropic's Mythos model arrived.
Its virtual patching writes signatures around the perimeter until customers fix the systems underneath. He says products to secure AI do not fully exist yet.
Flat-priced inspection beats AI's per-token cost. Palo Alto charges about $25 a year per endpoint and inspects about 150 MB a day at zero marginal cost; by his rough numbers AI would cost $50 to $5,000 a day.
He expects AI to reshape how companies build within five years. Product work is split across about eight teams such as docs, testing, coding and UI; with assistants doing 90% of the work, one person could master all eight.
He learns AI from young founders because nobody is an expert yet. He spends at least four or five hours a week with AI founders and meets 5 to 15 cyber startups a month.
He also reads a lot on X, where he writes his own posts and tweets only when he has something to say.
Arora does his best, then lets go of what he cannot control. When a widely used PHP vulnerability surfaced, his teams patched their own systems, built a fix overnight, announced it alongside the vendor's and phoned affected customers.
He roots this in Hindu fatalism and found the calm only in the past five years: "stressing is not going to change the outcome."
He wants his kids driven but not lectured about past poverty. His one parenting goal is healthy, happy, balanced kids, and he calls building their drive the hardest part.
Citing Sam Walton, he says kids learn from watching you, not from being forced to copy you.
How to Win Deals & Grow a $250B Business | Nikesh Arora, Palo Alto Networks
Nikesh Arora turned an $18 billion firewall company into a 70-plus product platform by buying the number one company in each category and making its founder the boss. The deals worked because he tied them to enterprise economics, a joint product roadmap before signing, and founder retention.
Arora built his own path with almost no help from his parents. His father did not know how he got into university or a US business school. Arora asked for $2,000, his father did not have it, and he arrived in the US with $200.
His father later sent $2,000 toward tuition, "and that was it." Arora says his drive came from inside.
At Google, Arora's job was removing friction, not creating demand. He joined at 34 to run Google Europe and found European advertisers paying with American credit cards in US dollars. Google grew from 2,000 to 60,000 employees and from about $2 billion to $63 billion in revenue while he was there.
Every morning brought more searches and more advertisers, so the work was scaling and smoothing the path to buy.
He sold ads with no control over price or volume by doing ROI math. Bidders set the price and searchers set the volume, so he sat with customers to work out a lead's value from their conversion rate and set a maximum bid.
His pitch was to take as much as they could while it stayed below that bid. When it rained in France, revenue rose because people stayed home and searched.
Arora invested alongside Egon Durban for about 15 years. Durban recruited him as an informal adviser when Durban moved to Europe for Silver Lake, and Arora put in his own money. They nearly invested in Oculus before it sold to Facebook.
The rule was simple: Arora gives his view and Durban still makes his own call. The two later won a 29-round auction for a London cricket team they own equally, after Durban called at 6:00 a.m. to say "Don't stop bidding."
He stays at a company as long as the problems keep changing. At Google he moved across search, YouTube and DoubleClick. At Palo Alto he went from a firewall company to 70-plus products in eight years.
His test is how many different problems your brain can get pulled into.
Arora arrived with an enterprise growth model, not a cybersecurity plan. He joined in 2018 aiming to move an $18 billion company above $100 billion in market cap, and studied enterprise P&Ls at companies like Cisco and Salesforce.
He joked he thought cybersecurity was two words, and saw Palo Alto's market as too narrow for the goal.
Enterprise margin comes from selling many products to one customer. R&D runs 15 to 18% and admin 6 to 10%, so sales, marketing and support at about 60% of costs is the lever. Cutting that to 20% gives a 40% operating margin.
One product means knocking on 20 doors for 5 yeses; a bundle means "a truck behind you." It only works if every product is the best, since nobody wants the second best product in cybersecurity.
He buys because a good product takes four to seven years to build. Uber, YouTube, Facebook and Google search all took that long. A rival is already a year and a half ahead with 50 to 75 people, so a late build ships two years behind.
At Google he once pushed to buy Netflix and was told YouTube could build it with $10 million and 20 engineers. "Never works like that."
Arora treats M&A as a tool for strategy, never the strategy itself. He buys when Palo Alto must win a category and its own team is behind. He says Palo Alto could stop once the value to customers lies in making existing products work together.
David Senra compared him to Henry Singleton, who stopped buying for about 15 years; Arora says stopping is possible.
He only buys the number one or two in a category. Those two take a disproportionate share of category profits and number three rarely catches up. Buying number two and polishing it while number one lives "never works."
Early on the top two look alike, each with 30 to 40 customers. He once bought what he thought was number one and number two overtook it after a Palo Alto execution mistake.
He studied why acquisitions fail before doing them. He sorted past failures into bad market, bad idea, bad execution or bad leadership, then changed how he ran deals to control most of them.
That left two risks: picking the wrong idea, or the market not showing up.
Arora cuts losses quickly when a market fails to arrive. Palo Alto bought Aporeto betting on IP-based segmentation, which never took off, and moved on fast.
He compares it to pharma companies that run many drugs to a phase and then cut bait.
He weighs price, stage and conviction, and pays for future scale. Evident.io, bought before he arrived, worked only on Amazon, so he then bought RedLock, which covered all three clouds. At about $300 billion, Palo Alto looks for assets that can be worth $5 to $10 billion in five to ten years.
"If something's worth $200 million, it's worth $800 million" to Palo Alto. Durban's lesson from the WME IMG deal: you won't remember the extra $400 million, only that you lost the deal.
He negotiates price directly with the founder, with no bankers. The founder will work for him for years, and a banker in the middle can distort what was agreed.
He tells his negotiators never to treat the other side with disrespect.
No deal is signed until the founder agrees a joint product roadmap. While lawyers do paperwork, the founder and product team spend 30 days designing the combined product. Founders are far more flexible with a large check pending.
Founders have never pulled out at this stage, but Palo Alto walked away twice, once when combining architectures showed weaker substance than diligence suggested.
That rule came from six lost months on an early deal. After his first or second acquisition, the founder kept pursuing his own vision and Arora spent six months arguing product direction.
The founder's view: "I sold the company but I still want to build what I wanted to build." Arora admits he feared upsetting him and learned alignment must come before closing.
The acquired founder runs the category, not the internal team that lost. The internal leader had resources and failed, so Arora has that team report to the founder. Some staff leave and he accepts it.
"You can't reward that behavior by giving them a prized asset and risk them destroying it."
Arora is buying a cohesive team, not a company. A founding team spends a year and a half aligning, often working 80 hours a week and living in the same house; corporate hiring cannot catch up.
He calls the company a legal shell around the team and its IP, and tests whether this team can execute better than others.
He revests founders for three to four years and skips founders who want out. He buys companies two to four years in with two or three years of product work left, so losing a founder mid-build could cost the number one spot.
Product and engineering founders tend to stay; business development and go-to-market founders tend to drop off.
Founders must shift from underdog to overdog. A founder with eight people on the team now has 6,000 in the field and must treat them as amplifiers. When two targets tie, he picks by which founder fits.
Founders who cannot modulate rub people the wrong way, and Palo Alto loses their product leadership.
He treats acquired founders as colleagues, not the conquered. Hock Tan advises making clear on day one that the acquirer is the conqueror; Arora tells his team the opposite.
"I cannot win if 20 people around me don't feel they're winning."
Arora argues AI raises demand for security. AI finds perimeter holes fast and more connectivity widens the attack surface. Palo Alto's business went up after Anthropic's Mythos model arrived.
Its virtual patching writes signatures around the perimeter until customers fix the systems underneath. He says products to secure AI do not fully exist yet.
Flat-priced inspection beats AI's per-token cost. Palo Alto charges about $25 a year per endpoint and inspects about 150 MB a day at zero marginal cost; by his rough numbers AI would cost $50 to $5,000 a day.
He expects AI to reshape how companies build within five years. Product work is split across about eight teams such as docs, testing, coding and UI; with assistants doing 90% of the work, one person could master all eight.
He learns AI from young founders because nobody is an expert yet. He spends at least four or five hours a week with AI founders and meets 5 to 15 cyber startups a month.
He also reads a lot on X, where he writes his own posts and tweets only when he has something to say.
Arora does his best, then lets go of what he cannot control. When a widely used PHP vulnerability surfaced, his teams patched their own systems, built a fix overnight, announced it alongside the vendor's and phoned affected customers.
He roots this in Hindu fatalism and found the calm only in the past five years: "stressing is not going to change the outcome."
He wants his kids driven but not lectured about past poverty. His one parenting goal is healthy, happy, balanced kids, and he calls building their drive the hardest part.
Citing Sam Walton, he says kids learn from watching you, not from being forced to copy you.