Nikesh Arora: Mythos is Real, Analytical SaaS is Dead, and Google can be a $10T company

Nikesh Arora: Mythos is Real, Analytical SaaS is Dead, and Google can be a $10T company

Palo Alto's CEO says Claude's Mythos AI found 5-7 years' worth of code vulnerabilities in just 6 weeks — and that capability will be available in open source in 3 months.

Jun 8, 2026 31:22 Difficulty: Intermediate Played

TL;DR

Palo Alto Networks CEO Nikesh Arora joins the All-In pod to break down how Claude's Mythos model found years' worth of code vulnerabilities in just six weeks, why analytical SaaS is categorically dead, and where the real AI profit pools will emerge. He argues models will commoditize into a utility layer while application-layer companies capture the value, and offers armchair CEO takes on Waymo, Google (his pick for first $10 trillion company), and OpenAI. Key takeaway: false positive rates — not raw capability — are the defining challenge for deploying AI in enterprise settings.

#AI-powered vulnerability detection #SaaS disruption #agentic enterprise software #AI false positive rates #model commoditization #cybersecurity defense vs offense #enterprise application layer #replacement TAM #AI model weights security #Google valuation thesis #Palo Alto Networks M&A #open source AI risk #Palo Alto Networks #Nikesh Arora #Claude Mythos #cybersecurity #AI vulnerabilities #analytical SaaS #enterprise software #AI profit pools #false positive rate #agentic AI #Google #OpenAI #Anthropic #M&A #infrastructure software

Palo Alto Networks CEO Nikesh Arora joins the All-In besties to discuss Claude's Mythos AI finding years of code vulnerabilities in weeks, why analytical SaaS is dead, where AI profit pools will emerge, and his armchair CEO takes on Waymo, Google, and OpenAI.

Chapter list
  • The episode opens with a montage of clips setting up Nikesh Arora as a major figure in cybersecurity, followed by Jason welcoming him to the pod. Nikesh opens with a memorable framing: Google Search democratized information; AI is democratizing intelligence. He reflects on money as a scoreboard rather than an end goal, immediately signaling the philosophical depth beneath the business conversation. The hosts flag that Palo Alto has grown from a $17 billion to a $238 billion company under his 8-year tenure, and tease that the conversation will touch on Mythos, the rise and fall of SaaS, and more.

  • This is the episode's most electric segment. Nikesh Arora drops a bombshell: Palo Alto, one of the most security-conscious companies on earth, ran Anthropic's Mythos model against its own codebase for six weeks and found vulnerabilities that would have taken five to seven years to uncover through traditional methods — all for a few million dollars in compute costs. He explains that Mythos' 'ultra mode' can chain vulnerabilities together to map entirely new attack paths, a capability that's great for offense but terrifying at scale. Even more alarming: Nikesh estimates that Mythos-level capabilities will be available in open-source or Chinese models within three months. He notes that models like Llama 4.8 and 5.5 already have similar capabilities, and you don't need to crack the hardest targets — an old industrial OT system is a much easier mark.

  • With the Mythos revelations still fresh, David Friedberg presses Nikesh on who's actually winning the AI cyber arms race. The answer is uncomfortable: defenders are falling behind. Every software vendor is now showing up at enterprise CIOs' doors asking them to patch newly discovered vulnerabilities — at exactly the same moment those CIOs are scrambling to audit their own codebases. The situation is compounded by open source, which nobody quite knows how to defend at scale, though IBM's $5 billion project signals the market is waking up. Nikesh frames this bluntly: 'Not as well as we should be doing — which is great for our business, but that's a different story.'

  • This chapter contains the episode's most sweeping strategic insight. Nikesh carves the SaaS world into three buckets with surgical precision. First: analytical SaaS — any company whose core value is collecting and analyzing your data — is finished. LLMs can now query raw data directly, making the entire middleware analytics market redundant. Jason illustrates this perfectly with a real example: his firm eliminated 17 of 20 SaaS seats, connected the data source to Claude via Slack, and cut the bill by 90%. Second: infrastructure software — databases, data platforms like Databricks, Snowflake, MongoDB, Oracle — is massively undervalued, because enterprises will need to store 10 times their current data over the next three years to train and defend AI systems. Third: systems of work (CRMs, ERPs, sales tracking) need to be reinvented for an agentic world where agents, not humans, do the data entry — eliminating the need for the UIs that trillions of dollars have been spent building.

  • The conversation turns to model economics and where value will ultimately accrue in the AI stack. Nikesh offers a vision of AI models becoming pure utilities — you buy 120 IQ for routine tasks, 250 IQ for complex ones, paying fractions of cents versus dollars. The implication: model providers won't own the profit pools. That's why OpenAI is racing to build Codex and Anthropic is building Claude Code — they're attacking the application layer, which is where enterprise software spending already lives. But here's Nikesh's key observation: the AI-native application companies that will replace legacy SaaS are not yet fully formed. Fifty thousand enterprises need the same HR system, the same sales platform — it's wildly inefficient for each to build their own on top of raw model APIs. The opportunity waiting to be captured is building that next generation of enterprise application companies, complete with harnesses, memory, and data pipelines.

  • The tone lightens as David Sacks runs an armchair CEO segment with Nikesh. He declines to rate Uber (he's on the board). On Waymo: the cars work and they should be in more cities faster. On Google — his most memorable take — he calls it 'underrated' and predicts it will be the first $10 trillion company in our lifetime. His reasoning is structurally compelling: everyone can build a model, but converting model capability into enterprise revenue requires a massive, disciplined sales force. The three hyperscalers — Google, Microsoft, Amazon — have the biggest enterprise sales organizations in the world, and that advantage is systematically undervalued by the market. On OpenAI, he notes they should be selling faster, citing Anthropic's apparently stronger ARR growth driven by an all-in focus on enterprise and coding. A brief, comedic interlude erupts when Chamath tries to walk back an earlier comment about founder vs. hired-hand CEOs — earning Nikesh's theatrical forgiveness.

  • The episode closes with Nikesh mapping Palo Alto's acquisition strategy. Phase one was elegant: buy product companies, plug them into a high-performing go-to-market engine, and increase revenue per customer at negligible incremental cost. That playbook ran the market cap from $17 billion to north of $150 billion. Phase two, signaled by the $25 billion identity security acquisition, is different in kind: it's about using AI to run the most operationally efficient enterprise in the sector. If Palo Alto can drive its operating margins far above industry norms, it becomes a universal acquisition machine — any asset bought at a lower margin can be upgraded to Palo Alto's margin profile, making the deal immediately accretive regardless of the target's adjacency to core cybersecurity. Nikesh closes with a contrarian workforce prediction: despite all the talk of AI-driven headcount reduction, Palo Alto has more technical employees today than it would have without AI, because AI-driven transformation creates demand for engineers faster than it eliminates them.

Mythos
Anthropic's advanced AI security model (built on Claude) capable of persistent, multi-step reasoning to find code vulnerabilities; used here as a red-team tool against Palo Alto's codebase.
False positive rate
The percentage of flagged findings that turn out to be incorrect; in cybersecurity, a high false positive rate means the system alerts on threats that don't actually exist, wasting resources.
Analytical SaaS
Software-as-a-service products whose primary value is collecting enterprise data and providing analysis on top of it — Nikesh Arora argues this category is made obsolete by LLMs.
Profit pools
The segments of an industry or value chain where the majority of economic profit concentrates; used here to describe where AI's financial value will ultimately accrue.
Replacement TAM
A total addressable market opportunity defined by replacing an existing product or spending category rather than creating entirely new demand; considered easier to capture than greenfield markets.
TAM
Total Addressable Market — the total revenue opportunity available if a company captured 100% of its target market.
System of work / system of record
Enterprise software categories: 'system of record' stores authoritative business data (e.g., CRM, ERP); 'system of work' describes how employees interact with that data to get tasks done.
Agentic AI
AI systems that autonomously execute multi-step tasks on behalf of users, making decisions and taking actions (like data entry or system calls) without constant human input.
Ultra mode
A persistent, extended-thinking mode in Claude's Mythos where the model keeps iterating until it reaches a solution, used to chain together multiple vulnerabilities into a single attack path.
Daisy-chain vulnerabilities
The practice of linking multiple smaller security weaknesses together to create a single, more powerful attack path into a system.
OT code
Operational Technology code — software that monitors and controls physical industrial systems (power plants, factories, pipelines) as opposed to traditional IT systems.
CISO
Chief Information Security Officer — the executive responsible for an organization's information and cybersecurity strategy.
LLM
Large Language Model — a type of AI trained on vast text datasets capable of generating, summarizing, and analyzing text; models like GPT-4, Claude, and Gemini are examples.
GenAI
Generative AI — AI systems capable of generating new content (text, code, images) rather than just classifying or retrieving existing information.
ARR
Annual Recurring Revenue — a metric for subscription businesses representing the annualized value of recurring contract revenue; used here to compare OpenAI and Anthropic's growth rates.
Hyperscaler
A company that operates massive-scale cloud computing infrastructure; typically refers to AWS (Amazon), Microsoft Azure, and Google Cloud.
SaaSp ocalypse
Informal term used in this episode to describe the anticipated collapse of traditional SaaS business models driven by AI commoditizing data analysis and enterprise workflows.
Distilled (model distillation)
A technique where a smaller AI model is trained to replicate the behavior of a larger one, producing a compact model with similar performance at much lower compute cost.

Chapter 1 · 00:00

Intro

The episode opens with a montage of clips setting up Nikesh Arora as a major figure in cybersecurity, followed by Jason welcoming him to the pod. Nikesh opens with a memorable framing: Google Search democratized information; AI is democratizing intelligence. He reflects on money as a scoreboard rather than an end goal, immediately signaling the philosophical depth beneath the business conversation. The hosts flag that Palo Alto has grown from a $17 billion to a $238 billion company under his 8-year tenure, and tease that the conversation will touch on Mythos, the rise and fall of SaaS, and more.

Chapter 2 · 00:47

Claude Mythos found years of vulnerabilities in Palo Alto's code in weeks

This is the episode's most electric segment. Nikesh Arora drops a bombshell: Palo Alto, one of the most security-conscious companies on earth, ran Anthropic's Mythos model against its own codebase for six weeks and found vulnerabilities that would have taken five to seven years to uncover through traditional methods — all for a few million dollars in compute costs. He explains that Mythos' 'ultra mode' can chain vulnerabilities together to map entirely new attack paths, a capability that's great for offense but terrifying at scale. Even more alarming: Nikesh estimates that Mythos-level capabilities will be available in open-source or Chinese models within three months. He notes that models like Llama 4.8 and 5.5 already have similar capabilities, and you don't need to crack the hardest targets — an old industrial OT system is a much easier mark.

Chapter 3 · 05:15

Are cyber defenders losing the race against AI attackers?

With the Mythos revelations still fresh, David Friedberg presses Nikesh on who's actually winning the AI cyber arms race. The answer is uncomfortable: defenders are falling behind. Every software vendor is now showing up at enterprise CIOs' doors asking them to patch newly discovered vulnerabilities — at exactly the same moment those CIOs are scrambling to audit their own codebases. The situation is compounded by open source, which nobody quite knows how to defend at scale, though IBM's $5 billion project signals the market is waking up. Nikesh frames this bluntly: 'Not as well as we should be doing — which is great for our business, but that's a different story.'

Chapter 4 · 06:50

Analytical SaaS is dead, so what survives the AI wave?

This chapter contains the episode's most sweeping strategic insight. Nikesh carves the SaaS world into three buckets with surgical precision. First: analytical SaaS — any company whose core value is collecting and analyzing your data — is finished. LLMs can now query raw data directly, making the entire middleware analytics market redundant. Jason illustrates this perfectly with a real example: his firm eliminated 17 of 20 SaaS seats, connected the data source to Claude via Slack, and cut the bill by 90%. Second: infrastructure software — databases, data platforms like Databricks, Snowflake, MongoDB, Oracle — is massively undervalued, because enterprises will need to store 10 times their current data over the next three years to train and defend AI systems. Third: systems of work (CRMs, ERPs, sales tracking) need to be reinvented for an agentic world where agents, not humans, do the data entry — eliminating the need for the UIs that trillions of dollars have been spent building.

Chapter 5 · 14:06

If models become a utility, where will the money be made?

The conversation turns to model economics and where value will ultimately accrue in the AI stack. Nikesh offers a vision of AI models becoming pure utilities — you buy 120 IQ for routine tasks, 250 IQ for complex ones, paying fractions of cents versus dollars. The implication: model providers won't own the profit pools. That's why OpenAI is racing to build Codex and Anthropic is building Claude Code — they're attacking the application layer, which is where enterprise software spending already lives. But here's Nikesh's key observation: the AI-native application companies that will replace legacy SaaS are not yet fully formed. Fifty thousand enterprises need the same HR system, the same sales platform — it's wildly inefficient for each to build their own on top of raw model APIs. The opportunity waiting to be captured is building that next generation of enterprise application companies, complete with harnesses, memory, and data pipelines.

Chapter 6 · 20:35

Armchair CEO: Nikesh rates Waymo, Google, and OpenAI

The tone lightens as David Sacks runs an armchair CEO segment with Nikesh. He declines to rate Uber (he's on the board). On Waymo: the cars work and they should be in more cities faster. On Google — his most memorable take — he calls it 'underrated' and predicts it will be the first $10 trillion company in our lifetime. His reasoning is structurally compelling: everyone can build a model, but converting model capability into enterprise revenue requires a massive, disciplined sales force. The three hyperscalers — Google, Microsoft, Amazon — have the biggest enterprise sales organizations in the world, and that advantage is systematically undervalued by the market. On OpenAI, he notes they should be selling faster, citing Anthropic's apparently stronger ARR growth driven by an all-in focus on enterprise and coding. A brief, comedic interlude erupts when Chamath tries to walk back an earlier comment about founder vs. hired-hand CEOs — earning Nikesh's theatrical forgiveness.

Business
Palo Alto's M&A Playbook and the Path to $1 Trillion

Nikesh Arora: Mythos is Real, Analytical SaaS is Dead, and … · Jun 8, 2026 Business

For years, Palo Alto bought product companies and plugged them into its sales engine — doubling revenue per customer at negligible incremental cost. That playbook ran to $150 billion. The next phase is using AI to drive operating margins far above industry norms, making any acquisition accretive regardless of the target.

Chapter 7 · 28:22

Palo Alto's M&A playbook and the path to $1 trillion

The episode closes with Nikesh mapping Palo Alto's acquisition strategy. Phase one was elegant: buy product companies, plug them into a high-performing go-to-market engine, and increase revenue per customer at negligible incremental cost. That playbook ran the market cap from $17 billion to north of $150 billion. Phase two, signaled by the $25 billion identity security acquisition, is different in kind: it's about using AI to run the most operationally efficient enterprise in the sector. If Palo Alto can drive its operating margins far above industry norms, it becomes a universal acquisition machine — any asset bought at a lower margin can be upgraded to Palo Alto's margin profile, making the deal immediately accretive regardless of the target's adjacency to core cybersecurity. Nikesh closes with a contrarian workforce prediction: despite all the talk of AI-driven headcount reduction, Palo Alto has more technical employees today than it would have without AI, because AI-driven transformation creates demand for engineers faster than it eliminates them.

No indexed bits in this chapter.

Show stoppers

Snapshots ()

Key Quotes ()

This episode

Claims & Sources

0 / 12 cited (0%)

Factual claims made this episode, and whether a source was named.

Claude's Mythos AI model found vulnerabilities in Palo Alto Networks' codebase in 6 weeks that would have taken 5 to 7 years to find through conventional security testing.

Nikesh Arora no source cited

Running Claude's Mythos model on Palo Alto's codebase for 6 weeks cost only a few million dollars.

Nikesh Arora no source cited

Mythos-level AI capabilities for finding code vulnerabilities will be available in open-source or Chinese models within approximately 3 months.

Nikesh Arora no source cited

89% of cybersecurity breaches occur due to stolen credentials, not sophisticated technical exploits.

Nikesh Arora no source cited

Claude's Mythos model had a 30% false positive rate when used for vulnerability detection at Palo Alto Networks.

Nikesh Arora no source cited

Enterprises will need to store 10 times their current data volume within the next 3 years to support AI cybersecurity defenses.

Nikesh Arora no source cited

IBM announced a $5 billion project to address open-source software vulnerabilities.

Nikesh Arora no source cited

Palo Alto Networks grew from a $17 billion market cap to $238 billion over the 8 years of Nikesh Arora's tenure as CEO.

Jason Calacanis no source cited

The full weights of a leading frontier AI model fit on a single USB stick and can be distilled in under 24 to 48 hours.

Nikesh Arora no source cited

Palo Alto Networks acquired a $25 billion identity security company that closed approximately 3 months before the episode.

Nikesh Arora no source cited

Palo Alto Networks' M&A-and-integration playbook drove the company's market cap to north of $150 billion before requiring a strategic pivot.

Nikesh Arora no source cited

Building 1 gigawatt of AI compute capacity costs approximately $10 billion.

Nikesh Arora no source cited

This episode

Cast

  • Track
  • Track
  • Track
  • Track
  • Track
  • Track
  • Track
  • Track

Stats

Episode stats

Insight Overview

insights
chapters

Insight distribution

Sub-Categories

Speaker breakdown

Talk Time