Claude Mythos 5, Anthropic\u2019s frontier AI model for advanced coding and cybersecurity work, was so effective at hacking into systems that the U.S. government has sought to limit its release. It even temporarily imposed export controls on Mythos and a related model called Fable in June, a move that forced Anthropic to disable the model for all users. The government subsequently allowed the company to restore access to Mythos for a small number of vetted U.S. users, and later allowed Anthropic to make it available to select users in 15 other countries.<\/p>\n
At Palo Alto Networks, the results of the controlled test were troubling. Mythos surfaced weaknesses in Palo Alto\u2019s systems at a speed and scale that Arora immediately knew would change cybersecurity permanently. He also realized that Mythos\u2014and competing models from Anthropic rival OpenAI\u2014had created \u201cthe best marketing moment for the cybersecurity industry in history.\u201d<\/p>\n
The model\u2019s capabilities made tangible a nightmare scenario where attackers could, almost instantly, find the sorts of vulnerabilities that could be used to cripple the infrastructure that runs our lives, from banks and corporations to hospitals, airports, and governments. That realization\u2014along with several recent incidents involving AI agents \u201cgoing rogue\u201d and rising concerns about an AI-driven doomsday scenario for humankind\u2014has led several leading AI vendors, including Anthropic, to call for a coordinated slowdown among the companies building AI systems, to allow the safety measures to catch up.<\/p>\n
In short: For cybersecurity, AI is likely to be an unprecedented driver of growth as well as an existential challenge. The exigencies of the moment are placing Arora, Palo Alto Networks\u2019 straight-talking chief executive, at the center of a widening reckoning in tech\u2014and are making him a sought-after counselor to the leaders of AI companies and other CEOs.<\/p>\n
Prior to Mythos, Arora says, when he called a company to discuss cybersecurity, the answer might as well have been, \u201cSure, stand right by the insurance guy.\u201d Now, he says, \u201cfor the first time, CEOs want to see Mythos, they want to talk about it.\u201d<\/p>\n
At the same time, Mythos and its ilk have created some powerful new competitors for Palo Alto Networks, as leading AI companies are looking to directly sell their own models as cyber defense solutions. Lee Klarich, chief product and technology officer at Palo Alto Networks, doesn\u2019t see this as a major threat. \u201cI don\u2019t believe companies will trust the big AI labs to provide their cybersecurity,\u201d Klarich says. \u201cSo, in that context, I think Nikesh\u2019s voice rises above all others.\u201d<\/p>\n
Interestingly, one of the leaders who has turned often to Arora for advice in recent years is Sam Altman. The OpenAI CEO is the first to admit that the powerful capabilities of the models his company is building have changed the risk equation for companies everywhere. <\/p>\n
\u201cJust a crazy amount of work has to happen to avoid major cybersecurity problems,\u201d Altman tells\u00a0Fortune<\/em>. \u201cI think it\u2019s going to be hard to patch every bug on the internet. We need a new model of cybersecurity here.\u201d<\/p>\n That\u2019s exactly what Arora is trying to build at Palo Alto Networks, which was cofounded by the Israeli cybersecurity entrepreneur Nir Zuk in 2005. A firewall provider originally, the company has always sold products that prevent and remediate cyberattacks. Under Arora\u2019s leadership, the company has grown and focused intensely on security in the AI era.<\/p>\n \u201cJust a crazy amount of work has to happen to avoid major cybersecurity problems. We need a new model of cybersecurity here.\u201d<\/p>\n OpenAI CEO Sam Altman<\/cite><\/p><\/blockquote>\n<\/figure>\n These days, Palo Alto Networks is a sprawling platform spanning areas including network, cloud, identity, endpoint, and observability. The company\u2019s customers include some 95% of the Fortune 500. Tyson Foods and Colgate-Palmolive use the service, as do the National Hockey League and Major League Baseball. Palo Alto Networks even secures the Sphere in Las Vegas, one of the most targeted digital spaces in the world.<\/p>\n No one wholly agrees on what the total addressable market for cybersecurity is, though all estimates of its worth are in the hundreds of billions. Jonathan Ho, partner and tech equity research analyst at William Blair, believes AI is an unmitigated tailwind and \u201ccumulatively, probably doubles the size of the market.\u201d Palo Alto says it currently controls 6% of that market, and Arora is confident it can grow its footprint.<\/p>\n Indeed, for whoever can solve the cybersecurity conundrum of the AI era, it\u2019s a moment of generational opportunity. But Arora is also clear about the risks in this landscape, where assumptions of the past can evaporate and the baseline is crisis. \u201cYou can\u2019t solve the crisis,\u201d Arora notes. \u201cThe consequences are already in motion. So you have to be in consequence management mode.\u201d<\/p>\n Arora, 58, comes across as equal parts stoic and mischief-maker. He retains an outsider\u2019s streak\u2014an immigrant to the U.S., previously a chief marketing officer, chief business officer, and investor before landing in cybersecurity\u2014though few are as connected in Silicon Valley as he is now. And he\u2019s known for telling employees, CEOs, and luminaries the unvarnished truth.<\/p>\n \u201cThere are few people who have his depth and breadth, and he tells you what you don\u2019t want to hear,\u201d says Dara Khosrowshahi, CEO of Uber, where Arora is a board member. \u201cSometimes, as a CEO, it\u2019s a lonely job. There are lots of people manufacturing their paragraphs to you, and Nikesh isn\u2019t a guy who\u2019s manufactured in any way.\u201d<\/p>\n Altman says he has been turning to Arora since around 2023. \u201cI think it\u2019s hard to get direct, actionable advice,\u201d Altman notes. \u201cMost people aren\u2019t sure, aren\u2019t confident, are busy, or aren\u2019t going to spend enough time. Maybe they don\u2019t want to offend you.\u201d<\/p>\n \u201cI call him the CEO whisperer,\u201d says Divesh Makan, a partner at Iconiq Capital and co-owner of the London Spirit cricket team with Arora. \u201cSome people don\u2019t like him being as direct as he is. \u2018Who the hell are you, telling me this won\u2019t work!\u2019 He will tell you kindly, but he\u2019ll sit you down and say, \u2018Look, I think you\u2019re wrong, and here\u2019s why.\u2019 I think that\u2019s the secret.\u201d<\/p>\n When Arora took the Palo Alto Networks CEO job in 2018, cybersecurity was in a weird spot: The cloud had become the key battleground, with cyberattack volumes rising, but an overall winner in the sector wasn\u2019t yet crowned. Cybersecurity has long been a space of fragmented businesses stacking atop each other, a process Klarich half-jokingly calls \u201cthe conga line.\u201d You protect your laptops and phones through an endpoint security provider, your cloud infrastructure through a cloud security provider, and so on. Eventually, you have an awkward group dance.<\/p>\n \u201cNo cybersecurity company in 2018 had ever gone from being a leader in one major category to being a leader in multiple categories,\u201d adds Klarich, who\u2019s been with Palo Alto Networks for over 20 years. \u201cSymantec never really got out of endpoint security. McAfee, same thing, even though they tried to acquire their way into other spaces. Cisco, I wouldn\u2019t call them a leader in other categories. Go down the list, it didn\u2019t really happen.\u201d<\/p>\n Arora quickly realized that in a world where chief information security officers were looking for reliable partners, Palo Alto needed to take control and lead the dance. His answer was a \u201cplatformization\u201d strategy that blended in-house R&D with acquisitions, and under his tenure Palo Alto Networks has done more than 25 deals, including this year\u2019s $25 billion acquisition of identity security startup CyberArk. Some deals didn\u2019t work, but the point is to build a cutting-edge one-stop-shop cybersecurity platform that could dominate the sector.<\/p>\n \u201cIf you look at most industries or most categories, No. 1 and No. 2 get a disproportionate share of the profit pool, and No. 3 and 4 don\u2019t,\u201d says Arora. \u201cDo you know a third search engine? Do you know a third social network?\u201d<\/p>\n \u201cIf you ain\u2019t first, you\u2019re last,\u201d as the\u00a0Talladega Nights<\/em>\u00a0mantra puts it. And the approach has worked, at least so far. The full-stack approach is Palo Alto\u2019s differentiator, says Matt Hedberg, managing director of software research at RBC Capital Markets. CISOs don\u2019t want to buy dozens or hundreds of different point solutions, he says, so they\u2019re \u201cmaking a platform bet on Palo that they have the wherewithal, whether it\u2019s partnerships, integrations, strategic M&A, [or] organic product development, to help uncover what the next unknown threat is.\u201d<\/p>\n When Arora took the helm, Palo Alto was an $18.51 billion company with $2.27 billion in annual revenue and about 5,300 employees. Throughout the writing of this story, the company\u2019s market cap fluctuated between $270 billion and over $300 billion in a volatile market. The company\u2019s revenue for fiscal year 2026 was $11.48 billion. Palo Alto Networks joined the Fortune 500 in 2025 and is the only pure-play cybersecurity company on the list. AI is set to make Palo Alto even bigger.<\/p>\n \u201cThere\u2019s obviously no precedent for [cybersecurity] companies getting to the size of Palo Alto,\u201d says William Blair\u2019s Ho. \u201cPrior-generation leaders like Symantec, McAfee, and Cisco didn\u2019t maintain innovation. And eventually, they got so big they couldn\u2019t keep the plates spinning in the air. Palo Alto\u2019s done a better job of that.\u201d<\/p>\n Arora has come a long way since his first night in the U.S., in 1990, when he found himself in the dim back booth of an Indian restaurant in Cambridge, Mass., two suitcases stashed under his seat and $200 to his name. <\/p>\n Born in Ghaziabad, India, the son of a lawyer in the Indian Air Force, Arora moved often as a child and attended at least five different schools before earning a degree from one of India\u2019s prestigious public Indian Institutes of Technology programs at Banaras Hindu University.<\/p>\n At 22, he\u2019d arrived in Boston to start his MBA at Northeastern\u2014the only program that offered to cover his tuition. An alum had picked him up from the airport and dropped him at the restaurant, Oh Calcutta, owned by the son of one of his mother\u2019s friends. After a night crashing at the family friend\u2019s place, Arora opened the\u00a0Boston Globe<\/em>\u00a0and saw an ad: \u201cfour Indians, fifth room free.\u201d He took that fifth room and wouldn\u2019t eat at another restaurant for over a year. He worked a series of odd jobs through grad school\u2014Burger King, night-class instructor, research assistant for a finance professor, note-taker for disabled students that paid top dollar, and campus security guard.<\/p>\n Now a billionaire, he still remembers checking IDs with formative clarity. \u201cNothing matters,\u201d Arora says. \u201cI can live the most opulent life, and I can live the most basic life.\u201d<\/p>\n Out of school, he got a job as an advisor to the CEO of T-Mobile, then eventually joined Google in 2004 as VP overseeing Europe, a month after the IPO. He rose through the Google ranks precipitously, becoming chief business officer in 2009.<\/p>\n \u201cAI can keep probing cheaply, relentlessly, hour after hour at machine speed, until it finds a way in. \u201cIt\u2019s like bringing a battering ram to your front door, bought from Home Depot.\u201d<\/p>\n Palo Alto networks CEO Nikesh Arora<\/cite><\/p><\/blockquote>\n<\/figure>\n After Google, Arora had a brief and trying tenure as Masayoshi Son\u2019s would-be successor at SoftBank, which ended in 2016. He was accused of conflicts of interest by unnamed SoftBank backers\u2014allegations found to be without merit after an internal investigation\u2014and then he left anyway, as Son chose to stay at the helm.<\/p>\n By the time he was in the mix for the CEO job at Palo Alto Networks, he was known as a prescient and connected executive, though not a cybersecurity expert. Eric Schmidt, the famed Google CEO, worked with Arora for 10 years, and says that Arora was \u201chard-charging\u201d and had a knack for foresight. He offers an example from when Arora was based in London: \u201cIn March 2008, I got this message from Nikesh saying, \u2018Something\u2019s going on, and I\u2019m sending someone to talk to you,\u2019 \u201d Schmidt recalls. \u201cSo his two analytical deputies flew in and said, \u2018Something\u2019s happened. In the U.K., there\u2019s been a shift yesterday that we cannot explain in our revenue monetization\u2019 \u2026 That day, we knew about the Global Financial Crisis, and we knew it a month before anyone else. It\u2019s my best story about Nikesh, because the value of that early sentinel was incalculable.\u201d<\/p>\n At Google, Arora developed a reputation for tear-inducing toughness, and he doesn\u2019t deny it. \u201cIf people show up in this room unprepared, they\u2019ll leave the room knowing they were unprepared,\u201d he says. \u201cI say to the people who come into this room, \u2018If you have a lot going on, give it to me, and I\u2019ll deal with it\u2014but don\u2019t show up here looking dazed.\u2019\u201d An exacting attitude is necessary, Arora says, when the work has such high stakes. \u201cWould you want to get on that rocket that was built by somebody who was hungover and decided to not tighten the screw?\u201d he asks rhetorically. \u201cWould you ever excuse the person who didn\u2019t do all the checks on a plane before it took off with 200 lives at stake? You expect that from these people. You expect them not to screw up. So why is it tough that I expect my team to not screw up? In every business we work, there are life-threatening or life-ending things that can happen if people don\u2019t pay attention.\u201d<\/p>\n The approach ties back to Arora\u2019s father and his military discipline. \u201cMy dad would tell me: \u2018Wake up in the morning and do the best you can. And if you\u2019re not up doing your best, go back to sleep,\u2019 \u201d says Arora. \u201cIf you\u2019ve got to show up, show up the best way possible.\u201d<\/p>\n When ChatGPT came out, Arora was on a plane to India to give a convocation address to 30,000 people at his alma mater, Banaras Hindu University. While changing planes in Dubai, he opened ChatGPT, and he knew: AI had gone from research curio to world-altering technology.<\/p>\n \u201cI rewrote my speech on the flight between Dubai and Varanasi to talk about ChatGPT,\u201d he recalls. \u201cI said: \u2018AI is like the invention of the iPhone. This is version zero of this technology; the moment you got your first app on your phone. If you play that movie forward, in about 10 years the whole world will turn upside down, and this is the first day of that event.\u2019 \u201d<\/p>\n He was, of course, right\u2014and he points out that he used the phrase \u201ciPhone moment\u201d months before Nvidia\u2019s Jensen Huang popularized the concept. But perhaps no one could have predicted the seriousness and speed with which AI brought about a reckoning for cybersecurity.<\/p>\n The widely reported dangers of Mythos were soon followed by another AI-cybersecurity end-of-days-sounding scenario: In July, some OpenAI agents escaped from an internal sandbox and attacked open-source startup Hugging Face. The agents coordinated themselves, and the incidents showed what happens when AI agents together chase one common goal. AI doesn\u2019t understand morals, it understands tactics, Arora says.<\/p>\n Kevork Djansezian\u2014Getty Images<\/p>\n<\/figure>\n \u201cUnconstrained agents, trained on the intelligence of all the content out there without setting their North Star, will do whatever it takes,\u201d says Arora. \u201cIf I said, \u2018Your task is to capture the flag,\u2019 remember it\u2019s been trained on every good thing and bad thing on the internet \u2026 It won\u2019t know morals. It just has information saying, \u2018Sometimes if you can\u2019t go in from the door, you break the window.\u2019 \u201d<\/p>\n In his April test, Mythos didn\u2019t perform flawlessly. Some 30% of the vulnerabilities the model flagged were not real, by Arora\u2019s estimate. \u201cIf you were a skeptic, you\u2019d say that Mythos doesn\u2019t get it right,\u201d Arora says. \u201cBut the problem is getting seven out of 10 right\u2014that\u2019s pretty good for the attacker. It\u2019s not good for the defender.\u201d<\/p>\n The average window to find and fix a breach in cybersecurity is three days, Arora says, but an AI-fueled cyberattack can unfurl in 12 minutes. AI can keep probing cheaply, relentlessly, hour after hour at machine speed, until it finds a way in. \u201cIt\u2019s like bringing a battering ram to your front door, bought from Home Depot,\u201d Arora says.<\/p>\n Together, the Mythos and OpenAI\u2013Hugging Face incidents are bringing into focus a future where AI systems that work this way can both discover vulnerabilities and decide to use them\u2014at speed and at scale. We haven\u2019t yet seen our generational cyberattack, but we know the frightening possibilities, even before the AI boom: In Ukraine, the 2017 NotPetya attack, among other things, saw radiation-monitoring computers go dark in Chernobyl and notched $10 billion in losses. Arora\u2019s approach to this high-stakes moment, this tightrope, is linked to his overall philosophy. In the conference room next to his office, there\u2019s a whiteboard filled with Arora-isms, from rules like \u201cSell what\u2019s on the truck\u201d to reminders of the silly arrogance we can fall into if we\u2019re not careful: \u201cOur innovation is genius. Theirs is dumb luck.\u201d<\/p>\n John Donovan, former CEO of AT&T and a current Palo Alto Networks board member, says Arora is completely focused on the challenge ahead. \u201cIf you were to open his brain and look in, it always would be like Santa\u2019s elf shop three days before Christmas,\u201d he says. \u201cHe wants to arrive at the most important thing first.\u201d<\/p>\n Michael Grimes, chairman of investment banking at Morgan Stanley, has worked with Arora on multiple deals, and says Arora\u2019s push for clarity is singular: \u201cPeople use this phrase \u2018see around corners\u2019 \u2026 In his case, it\u2019s like he can engineer a city without corners.\u201d<\/p>\n The next AI security threat could come from anywhere, Arora says\u2014even your vacuum cleaner.<\/p>\n \u201cSomeone sent me this robotic vacuum,\u201d he muses. \u201cAnd I thought: \u2018That\u2019s an attack surface that could be hard to catch.\u2019 Imagine this thing has a camera, and the camera\u2019s helping it walk around your house? Imagine it has a microphone, so it can listen to you? All that has to happen: \u2018Hey, let\u2019s take over the listening device and camera in your Roomba-like vacuum. Let\u2019s get pictures of your entire house while we\u2019re at it.\u2019 That sounds like a cyberattack.\u201d<\/p>\n As the surface area for possible cyberattacks spreads and the sheer amount of AI traffic on the internet explodes, Arora has become a key shaper of the conversation in AI and cybersecurity, publicly and behind the Silicon Valley scenes. Where that all leads has never mattered more, for Arora and Palo Alto Networks, but for all of us facing an uncertain, AI-powered future.<\/p>\n I ask Arora what he\u2019d want to know about the future, and he declines to speculate. \u201cThat would make life so boring,\u201d he says. \u201cIt defeats the purpose of the future. The whole point of the future is that it\u2019s amazing, optimistic, and unknown. If we already knew the future, it wouldn\u2019t be called the future.\u201d<\/p>\n This article appears in the October\/November 2026 issue of\u00a0<\/em>\u00a0Fortune with the headline \u201cNikesh Arora: The man shaping a defense against AI\u2019s darks side.\u201d<\/em><\/p>\n<\/div>\n #Palo #Alto #Networks #Nikesh #Arora #building #defense #dark #side<\/p>\n","protected":false},"excerpt":{"rendered":" In April, Nikesh Arora applied… <\/p>\n","protected":false},"author":1,"featured_media":6210,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[9322,9324,941,494,9325,450,3053,756,392,9323,770,9321,8908,4134],"class_list":["post-6209","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-finance-news","tag-alto","tag-arora","tag-building","tag-chatgpt","tag-dark","tag-defense","tag-fortune-500","tag-fortune-500-companies","tag-networks","tag-nikesh","tag-nvidia","tag-palo","tag-palo-alto-networks","tag-side"],"yoast_head":"\n\n
\n
\n\n
\n![\"\"](\"https:\/\/fortune.com\/img-assets\/wp-content\/uploads\/2026\/09\/PAN_Nikesh-Arora-and-Eric-Schmidt-1-e1789742692145.jpg?format=webp&w=1440&quality=75\"\/)
<\/div>
\n