# AI raises cyber risk but does not replace security infrastructure

Markdown copy of https://realalpha.app/s/ai-raises-cyber-risk-but-does-not-replace-security/ on Real Alpha, the best minutes from long interviews with the people building AI. Cite and link the page, not this copy.

- Speaker: [Nikesh Arora](https://realalpha.app/people/nikesh-arora/) · Nikesh Arora is chairman and CEO of Palo Alto Networks. · Chairman and CEO of Palo Alto Networks, which he grew into a $300 billion cybersecurity leader.
- Host: [David Senra](https://realalpha.app/people/david-senra/) · Host, Founders · Has read an entrepreneur's biography every week for Founders since 2016.
- Show: Founders
- Episode: [How to Win Deals & Grow a $250B Business | Nikesh Arora, Palo Alto Networks](https://realalpha.app/v/BKz2Dy-mKEM/), Nov 8, 2026
- Moment: 55:07 to 58:41 of the episode (4 min), playing on https://realalpha.app/s/ai-raises-cyber-risk-but-does-not-replace-security/; the episode from there: https://realalpha.app/v/BKz2Dy-mKEM/?t=3307

## Quote

> “AI is set up to **charge you every time** you run traffic through AI in terms of tokens.”
> — [Nikesh Arora](https://realalpha.app/people/nikesh-arora/) at [57:55](https://realalpha.app/v/BKz2Dy-mKEM/?t=3475) · Founders

## Takeaways

1. AI can uncover vulnerabilities faster than defenders can patch them.
2. Virtual patching can protect customers while underlying systems are fixed.
3. Endpoint inspection costs little per added unit of traffic.

## About this segment

Nikesh Arora explains how AI finds vulnerabilities faster and how Palo Alto responds with virtual patching. He argues that token-based AI costs make continuous endpoint inspection uneconomical to replace.

From “How to Win Deals & Grow a $250B Business | Nikesh Arora, Palo Alto Networks”, Nov 8, 2026. [Watch the full episode](https://realalpha.app/v/BKz2Dy-mKEM/)

## Transcript

Transcribed by machine (Whisper) from the episode’s audio, so a word may be off here and there.

[55:13](https://realalpha.app/v/BKz2Dy-mKEM/?t=3313) Cybersecurity is, because I don't come from that, I told you. It was two different words in my mind eight years ago. So I'm still going to treat it like that. It's somewhat straightforward, right? Cybersecurity is the idea that bad actors trying to get into your infrastructure and exfiltrate something important. Let's take that for a promise. If I know it's bad, I can stop it at the perimeter, right?

[55:35](https://realalpha.app/v/BKz2Dy-mKEM/?t=3335) Bad guy shows up at the door. You know, he looks bad. He's got a hood. He's got a gun. This is bad. We know how to stop them. So half of cybersecurity is stopping bad guys at the perimeter, bad things at the perimeter. Okay? That's half of cybersecurity. 10, 20% is analytics, how to get hygiene right once you're inside your house to make sure shit's solid. The remaining 20%, 30% is, if somebody gets in, what do I do?

[56:00](https://realalpha.app/v/BKz2Dy-mKEM/?t=3360) Things will get through your perimeter inside your infrastructure. How quickly can I find the bad guy? And how quickly can I eject them out of my infrastructure before he or she can do harm? That's cybersecurity in a nutshell. How does AI impact this? Let's start with your comment about vulnerabilities. AI says, I can find holes in your perimeter faster than anybody else in the world. It used to take days to find it, it used to take forever.

[56:24](https://realalpha.app/v/BKz2Dy-mKEM/?t=3384) I can find holes to enter your perimeter. okay, great. My perimeter just became more porous. Now, AI is not going to patch the perimeter. I have to still go look through the infrastructure, find where the porous parts are, and patch them. I could be a software company. I could be an infrastructure provider because everybody's IT stack is made up of tens of thousands of vendors. So, vulnerabilities exist in our software and software that's written by our customers themselves.

[56:49](https://realalpha.app/v/BKz2Dy-mKEM/?t=3409) So, that's kind of the step one. That's what we're seeing right now. The likes of Mythos, the likes of the new models that OpenAI has, the likes of GLM 5.3, they have immense capability of finding vulnerability, and bad actors can rent them cheap and throw them at you and find everything that they have vulnerability around. So what is the call of the hour? The call of the hour is to find a way to batch these things swiftly so these bad guys can't get it, okay?

[57:10](https://realalpha.app/v/BKz2Dy-mKEM/?t=3430) Guess who's building the service? We're building a service which is called virtual patching. We write signatures, we put Band-Aid around the entire perimeter, we know where the holes are, these people can't get it. Over time, our customers will patch the underlying systems, and they'll be fine. So that's kind of one problem. Good news is our business has gone up since Metos came in. That's what I mean. That's what I'm trying to get to.

[57:29](https://realalpha.app/v/BKz2Dy-mKEM/?t=3449) Holy shit. Can you help me? Patch it. Now, guess what? Yes, I can help you patch it. I inspect everyone's parameters. So you've got a laptop somewhere. I live on a laptop. I charge you $25 a year. And I watch 150 megabytes a day, give or take, on your laptop to make sure nothing bad's coming in. You told me you're hacking my phone calls. I was just kidding. I wouldn't know how to do it. Anyway, remember, cybersecurity is two words.

[57:52](https://realalpha.app/v/BKz2Dy-mKEM/?t=3472) So the marginal cost of inspection of traffic on a laptop by me is zero. I don't charge you more the more traffic that goes through. AI is set up to charge you every time you run traffic through AI in terms of tokens. So if AI tried to do my job at your endpoint, it'll cost you $5,000 a day. Or pick a number, right? $500 a day. You'll pick up $50 a day. They can't do what I do at $25 an endpoint. If you go back inside, and if the bad actor gets in, what happens?

[58:25](https://realalpha.app/v/BKz2Dy-mKEM/?t=3505) Yes, AI can help you analyze all the anomalous behavior quickly. But you still need harnesses, you still need security expertise, you need data ingestion, you need infrastructure. So in a nutshell, our business is not at risk.