All-In Podcast: Palo Alto CEO Reveals AI Found Seven Years of Code Vulnerabilities in Six Weeks, Declares "Analytical SaaS is Dead"
Nikesh Arora spoke at All-In Liquidity on June 8, 2026
Palo Alto Networks CEO Nikesh Arora delivered one of the most consequential assessments yet of AI's impact on enterprise software during an appearance at the All-In Liquidity conference, revealing that Anthropic's Claude Mythos discovered vulnerabilities in Palo Alto's codebase in six weeks that would have taken his security team five to seven years to find. The disclosure, made public by Arora despite leading a company that prides itself as top percentile in code testing, signals a fundamental shift in both cybersecurity economics and the broader SaaS landscape.
The Mythos Reality Check: Both Miracle and Menace
Arora's assessment of Claude Mythos was unequivocal. "The capabilities of AI in being able to assess vulnerabilities in code are real," he stated, adding that Palo Alto tested the system for six weeks at a cost in the "low millions" of dollars. The system not only identified basic vulnerabilities but, when put on "ultra mode" with persistent thinking enabled, could daisy chain vulnerabilities to find entirely new attack paths into systems.
The implications are stark. Arora believes similar capabilities will be available in open source models within three months, not the six months that industry observers have been estimating. "We're three months away if not already there from this being available in the wild," he said. This creates what Arora describes as a race between cyber defenders finding and patching vulnerabilities before attackers exploit them, and he was candid about the current state: "Not as well as we should be doing, which is great for our business, but that's a different story."
The CEO noted that CIOs are already overwhelmed, with vendors constantly showing up asking them to patch hardware and code while they simultaneously work to fix their own vulnerabilities. The open source software problem, he suggested, remains largely unsolved, referencing IBM's recently announced five billion dollar project to address open source security.
The SaaS Apocalypse: Three Categories, One Clear Loser
Arora delivered what amounts to a death sentence for an entire category of enterprise software. "If you're an analytical SaaS company, it's over," he declared flatly. When pressed for a definition, he explained: "Somebody that says I'm going to collect a lot of data for you and analyze it for you. I don't need you to analyze it for me. I can run models against data and analyze them myself."
The CEO pointed to the proliferation of marketplace apps on platforms like Salesforce that exist solely to analyze existing data. "I don't need to," he said. "You don't need that. I can just go run NLM against the data." His analysis was validated by a real-world example from one of the podcast hosts, who described reducing a SaaS bill by ninety percent by maintaining just three accounts instead of twenty, connecting the service to Slack and Claude, and allowing everyone to interface through natural language.
Arora's framework divides the SaaS universe into three buckets. Analytical SaaS is dead in the medium term. Infrastructure software, including databases like Snowflake, Databricks, MongoDB, and Oracle, is undervalued because enterprises will need to store ten times more data over the next three years to provide the memory and context AI systems require. "We are going to need ten times the data stored in enterprise than we have today for the next three years," he emphasized.
The middle category, what Arora calls "system of work" or "system of record" software, faces complete reinvention over the next five years. He argued that enterprise UI itself was a mistake. "UI enterprise software and consumer software UI is the worst thing we did as technologist," he said, noting that product managers have spent careers designing interfaces for humans to interact with data. If agents can do the work directly, the UI layer disappears entirely, enabling fundamental rewiring of how work happens. The audit trail actually improves, Arora suggested, because humans stop touching the data.
The Model Layer Will Become a Utility
Arora diverged sharply from the perspective presented earlier in the conference by OpenAI representatives, arguing that models will inevitably become a utility layer. "You'll be able to buy intelligence on the fly where you can say I don't need a hundred eighty IQ person to go do this task. Give me a hundred twenty IQ and I need a two hundred fifty IQ to do this task. I'll pay ten dollars for this and for this I'll pay one cent," he explained.
The profit pools, in Arora's view, sit squarely in applications, not models. He noted that even during the conference, the discussion centered on Codex running away, not OpenAI itself. The model companies understand this, which is why they're attacking profit pools directly by building applications. Arora sees them as "the new Microsoft Office coming in and doing all applications, all productivity software for organizations."
However, he believes a layer of specialized application companies will emerge to arbitrage between models and solve specific business problems. "I want my HR system software which is agentic enabled and AI enabled to be delivered by some application company," he said. "I want my sales management system built by the new agentic AI Salesforce of the world." The question remains whether this application layer consolidates into one enterprise application or remains specialized.
The False Positive Problem Nobody Discusses
In perhaps his most important technical observation, Arora called out the industry's silence on false positive rates. "The false positive rate on Mythos was thirty percent," he revealed. While the system excels at finding potential vulnerabilities for attack purposes, it's problematic for defense when nearly one in three findings turn out to be phantom issues. "It's great for attack. It's horrible for defense," he said bluntly.
This problem extends across enterprise applications. A model with a ten or twenty percent false positive rate deployed to process insurance claims would hemorrhage money. Arora used the autonomous vehicle analogy: "Let's take the new self-driving car. Mercedes is going to use Opus 4.8 and you can just sit in the car and it's going to drive you. I'm not putting my kids in that car with a ten percent false positive rate."
The CEO argued this is where real value creation happens in enterprise AI. "There's a lot of work that happens post the model which needs to happen to make these things useful and effective in the business context," he explained. In cybersecurity specifically, Palo Alto wants zero percent false positives, which requires extensive work beyond the base model capabilities.
Google Remains Underrated, Operating Leverage is Everything
When asked to play armchair CEO, Arora offered a surprisingly bullish take on his former employer. "I think Google's underrated. I think it's going to be the first ten trillion dollar company in our lifetime," he stated. His reasoning focused on distribution: even model companies need sales forces to convince customers to embrace and purchase their products, and the three hyperscalers command the largest enterprise sales organizations in the world.
On Waymo specifically, Arora kept his commentary brief given his board role at Uber, but praised the technology's effectiveness and called for faster geographic expansion. The broader theme in his remarks centered on execution and operating leverage as the next frontier. "If you can be the best at leveraging AI to run the most efficient enterprise business in the world, your operating margin can be far in excess of the industry," he argued, suggesting gross margins in the high nineties and net margins in the forties or fifties are achievable.
M&A Strategy Evolution: The Menu is Now Open
Arora described how Palo Alto's acquisition strategy has evolved over his nearly eight-year tenure. Initially, the company bought product companies and integrated them into Palo Alto's go-to-market engine, optimizing for cross-selling. "If I'm selling ten million dollars to a customer, next time I go two years later, if I can sell them twenty, it's the most efficient way for me to advertise my go-to-market spend," he explained. This playbook drove the company to one hundred fifty billion dollars in market capitalization.
The twenty-five billion dollar identity acquisition that closed three months ago represented a strategic inflection point, positioning the company for security requirements in an agentic world. Now, Arora suggested an even broader aperture. If Palo Alto can achieve industry-leading operating margins through AI-driven efficiency, acquisition targets need not be limited to core cybersecurity adjacencies. "It doesn't matter what you buy," he said, noting that subscale companies cannot afford the investment required to optimize their operations with AI.
Critically, Arora expects to employ more technical people at Palo Alto going forward, not fewer, contradicting popular narratives about AI-driven headcount reduction. "I think we're going to have more people at Palo Alto on the technology side than we've ever had before because I think AI is causing everything to ask for a transformation," he said. The company needs six to twelve months to determine how AI settles and how to deploy it most effectively across the enterprise before the M&A playbook fully crystallizes.
Arora's appearance painted a picture of an industry in violent transition, where entire categories of software face extinction while infrastructure and reimagined systems of work capture unprecedented value. His firsthand experience with Mythos, translated into frank assessments of both opportunity and risk, provided institutional investors with rare clarity on how AI capabilities are reshaping enterprise technology economics in real time. The CEO who took Palo Alto from seventeen billion to two hundred thirty-eight billion dollars in market capitalization now has his sights set explicitly on the trillion-dollar threshold, armed with a conviction that operating leverage through AI deployment will prove more valuable than any particular product market.