# Cyber defense should prioritize finding and ejecting intruders

Markdown copy of https://realalpha.app/s/cyber-defense-should-prioritize-finding-and-ejecting/ on Real Alpha, the best minutes from long interviews with the people building AI. Cite and link the page, not this copy.

- Speaker: [Nikesh Arora](https://realalpha.app/people/nikesh-arora/) · Nikesh Arora is CEO of Palo Alto Networks. · Chairman and CEO of Palo Alto Networks, which he grew into a $300 billion cybersecurity leader.
- Host: [Chamath Palihapitiya](https://realalpha.app/people/chamath-palihapitiya/) · Founder & CEO, Social Capital · Led Facebook's growth team; his firm backed Slack and AI chipmaker Groq.
- Host: [Jason Calacanis](https://realalpha.app/people/jason-calacanis/) · Founder & CEO, LAUNCH · Early Uber angel; sold Weblogs Inc. to AOL; hosts This Week in Startups.
- Host: [David Friedberg](https://realalpha.app/people/david-friedberg/) · CEO, Ohalo · Founded The Climate Corporation, sold to Monsanto for about $1.1B in 2013.
- Show: All-In
- Episode: [AI Cyber Panic, Ken Griffin’s Bubble Warning, The Fall of France?](https://realalpha.app/v/6czo-C3FU7I/), Oct 23, 2026
- Moment: 24:09 to 27:12 of the episode (3 min), playing on https://realalpha.app/s/cyber-defense-should-prioritize-finding-and-ejecting/; the episode from there: https://realalpha.app/v/6czo-C3FU7I/?t=1449

## Quote

> “The question is, how quickly can I find them and **how quickly can I eject them**?”
> — [Nikesh Arora](https://realalpha.app/people/nikesh-arora/) at [26:45](https://realalpha.app/v/6czo-C3FU7I/?t=1605) · All-In

## Takeaways

1. More powerful models will keep uncovering new attack paths.
2. Aggregate infrastructure signals to catch anomalous behavior.
3. Speed of detection and ejection matters alongside patching.

## About this segment

Nikesh Arora says patching every flaw won't stop breaches as models keep improving. He advises aggregating signals to spot anomalous behavior and remove attackers quickly.

From “AI Cyber Panic, Ken Griffin’s Bubble Warning, The Fall of France?”, Oct 23, 2026. [Watch the full episode](https://realalpha.app/v/6czo-C3FU7I/)

## Transcript

Transcribed by machine (Whisper) from the episode’s audio, so a word may be off here and there.

[24:14](https://realalpha.app/v/6czo-C3FU7I/?t=1454) over at Palo Alto Networks. So I want to take you through a couple of the theories people have about AI's impact on security. You tell me if you agree with them or not. The first one is, this is going to be largely an issue of who has the most compute. And because the White Hats have access to the most amount of compute, they will be able to out-compute the Black Hats, in other words, the hackers. Is that a true statement or is that not yet a true statement? And maybe it will be in the future. In other words, Palo Alto Networks or OpenAI, whoever it happens to be, could fire up so much compute to defend systems that a bunch of hackers in North Korea, Russia, China, et cetera, just don't have the firepower and they'll be outgunned.

[24:58](https://realalpha.app/v/6czo-C3FU7I/?t=1498) True, not true. When will it be true? True, not true today, because the underlying systems are not architected or orchestrated in such a way that we can launch these, let's call it defensive swarms, because everything is sort of in disparate situations, right? If it was true, then by definition, you could send out a bunch of agents to go patch PHP if you wanted. The company's got 5,000 websites, and guess what?

[25:25](https://realalpha.app/v/6czo-C3FU7I/?t=1525) The poor IT guys are going cataloging each one of them because they've never actually aggregated everything, put it together, understood their... So I think we need to get our infrastructure to a base level of preparedness, which is where the technological debt lives. Let me take you to the next thesis and theory people have here, which is persistent computing, uh reviewing code and people taking proactive measures more seriously is going to solve this problem and right now we just have this interim period where people have accumulated technical debt you've talked about but ai is going to solve that problem because you'll have persistent tools from companies like yours and others or in-house ones that are constantly banging on systems to find these before hackers get to them is that going to be the end game here true not true short

[26:12](https://realalpha.app/v/6czo-C3FU7I/?t=1572) term true, long-term true, take us through it. True. Today, if you can see, almost every large company in the enterprise space is out there busy using Mythos or Equivalent to try and penetrate their own defenses to see where the holes are, and they're trying to patch them. The challenge that you'll appreciate is that the next model is going to be more powerful. It's going to find more ways to get into your infrastructure, so you're going to be playing this cat-and-mouse game of constantly patching.

[26:34](https://realalpha.app/v/6czo-C3FU7I/?t=1594) I think there's a slightly different sort of version of this, Jason, where, for a second, let's assume that you will get breached. because there are so many vulnerabilities out there. You can spend a lot of money patching everything. The question becomes less about how I got breached and which vulnerability is going to let people through. The question is, how quickly can I find them and how quickly can I eject them?

[26:56](https://realalpha.app/v/6czo-C3FU7I/?t=1616) Our advice to people is build the infrastructure in such a way, which is possible today, where you're aggregating all the signals, all the data in such a way that you can actually look for anomalous behavior with that white hat compute you talked about, right? Because I have more compute.