Key Takeaways

  • Palo Alto Networks scaled from an $18 billion firewall specialist into a broad security platform under Nikesh Arora by targeting enterprise software perimeters.
  • AI expands corporate attack surfaces by discovering software vulnerabilities in seconds instead of days, forcing companies to deploy automated virtual patching from incumbents.
  • Token pricing destroys the economics of replacing dedicated endpoint software with LLMs; inspecting machine traffic with general AI models costs between $500 and $5,000 a day per endpoint.
  • Dedicated cybersecurity agents inspect endpoint traffic at an effective marginal cost of zero, charging predictable flat rates around $25 per seat.

Token Economics Protect Specialized Software

Every startup founder currently wonders whether foundation models will eat specialized enterprise tools. Nikesh Arora, who grew Palo Alto Networks from an $18 billion hardware firewall specialist into an enterprise software giant, points to math that AI evangelists ignore: unit inspection costs.

When security software monitors a laptop or a server, it scans streams of network packets and background processes. Arora points out that his marginal cost for this inspection is near zero. Palo Alto Networks charges an enterprise roughly $25 per endpoint.

General models do not run on flat infrastructure economics. They charge per token. If a company tried to push raw endpoint network traffic into a frontier model to spot malicious behavior, the invoice would explode. As Arora puts it: "The marginal cost of inspection of traffic and laptop by me is zero, right? I don't charge you more the more traffic that goes through. AI is set up to charge you every time you run traffic through AI in terms of tokens. If AI tried to do my job at your endpoint, it'll cost you $5,000 a day or pick a number, right? $500 a day. You have become $50 a day. They can't do what I do at $25 an endpoint."

Specialized agents win on high-volume, low-margin data pipelines. Foundation models cannot compete where every byte parsed adds to an API bill.

Faster Attackers Make Perimeters More Porous

If AI cannot replace endpoint protection on cost, what does it actually do to enterprise security? It accelerates the offense.

Arora draws a clean line across tech history. Twenty-five years ago, cybersecurity barely existed as an industry: “You had a mainframe, you logged in, it was secure. There's no problem. The problem is now David can log in from here into his bank account. Now that becomes an attack vector.” (play from 41:35)

Connectivity created the first attack surfaces. Distributed work and cloud access multiplied them. Now, generative models democratize automated vulnerability research. Where a human hacker once spent two weeks probing an enterprise network for an unpatched port or an exposed API, an automated script powered by an LLM tests thousands of entry points in seconds.

“AI says, I can find holes in your perimeter faster than anybody else in the world,” (play from 56:13) Arora explains. “It used to take days to find days take forever. I can find holes to enter your pyramid. Okay, great. My perimeter just became more porous.” (play from 56:19)

When an attack happens in seconds, human security analysts cannot react in time. Enterprises cannot wait for an engineering team to write, test, and deploy a software patch over a three-week sprint. They need virtual patching: software shields that detect the attack probe at the network edge and block the exploit path instantly. That dynamic turns AI into a tailwind for incumbent platforms. The more porous the corporate perimeter becomes, the more urgent real-time perimeter protection becomes.

What to Do With This

Audit your software architecture for token leakage on high-frequency pipelines this week. If your product processes continuous data streams like event logs, telemetry, or network calls, do not route them through a frontier LLM prompt. Use deterministic code or lightweight, self-hosted models for detection, and reserve paid LLM calls strictly for rare exceptions that require human-like reasoning.