Nikesh Arora runs Palo Alto Networks, one of the biggest security companies on the planet. He was on the All-In podcast last week (episode of 23 October, “AI Cyber Panic”), and around the 38 to 41 minute mark he said a few things every board in Australia should hear. Here they are, with my take on each.
“The phones keep ringing every day and the conversation always is now, how do I get out of this? Because I’m tired of getting punched in the face every morning when I wake up.”
Nikesh Arora, All-In, ~38:17
That’s the CEO of a company that sells to the biggest organisations in the world, and that’s what their security teams are telling him. If the people with the biggest budgets feel like that, a 300-person company with one stretched IT manager is not in a better spot. It’s just not getting the phone calls yet.
“Typically, if your IT budget… the cost is somewhere in the four to 10% range for cyber.”
Nikesh Arora, All-In, ~39:28
He said the 10% end is banks and federal government, and the 4 to 5% end is mostly cloud-heavy businesses where the hyperscaler carries some of the load. He also agreed with the hosts that the number has to go up. Do the maths on your own IT budget. If you’re spending well under 4% on security, that isn’t efficiency, it’s a gap you haven’t found yet.
“We haven’t built the AI security harnesses that are needed.”
Nikesh Arora, All-In, ~40:34
“We need to build all the security harnesses for AI. And that’s not even started yet.”
Nikesh Arora, All-In, ~41:03
This is the one that matters. His example was simple: the boss says deploy AI, but make sure it’s secure, and the first question is “how do I find all the agents that are running?” Most companies can’t answer that. He compared it to the Wright brothers: nobody invented airport security the week planes were invented. It came after things went wrong.
I agree with him, and I’d go further. You can’t buy the whole harness off the shelf yet, but most of it isn’t new. Know which AI tools and agents you’ve got. Decide what each one is allowed to touch. Make sure an agent can suggest an action but can’t quietly carry out anything that moves money, changes records or sends data out the door. Log what they do. That’s governance, and you can start it this month without waiting for a vendor to sell it to you.
The other thing he said, which I liked, is that we spend too much time on the doom side of AI. Same. I’m not here to scare anyone off using it. Your staff are already using it. The job is to put rails around it so the good stuff keeps happening and the bad stuff gets caught.
If the CEO of Palo Alto Networks says the harnesses haven’t been built yet, don’t assume someone has built yours.
Quotes are my transcription of the episode; timestamps are approximate. Nikesh Arora and Palo Alto Networks have no connection with McAlpine Cyber and AI and don’t endorse it.