Palo Alto CEO: $1 Trillion in Cybersecurity Infrastructure Isn’t Ready for AI

The $1 Trillion Problem

Arora’s core argument is blunt: nearly $1 trillion in global cybersecurity infrastructure was built for a pre-AI world, and it shows. Systems deployed seven or ten years ago weren’t designed to handle threats that move at machine speed—automated, relentless, and increasingly capable of finding vulnerabilities faster than any human analyst can respond.

“You cannot deploy AI successfully if you don’t get cybersecurity right,” Arora said on Palo Alto’s earnings call.

The implication isn’t subtle. Every company racing to adopt AI is simultaneously expanding its attack surface with tools that legacy security stacks weren’t built to defend.

From “Near Death” to Feast

Earlier in 2026, the market read AI as an existential threat to traditional cybersecurity vendors—the fear being that smarter AI models would simply replace legacy security software. Palo Alto’s stock reflected that anxiety.

Then the narrative flipped. Attackers can weaponize the same AI models that defenders use, and that realization changed the calculus. Palo Alto shares have surged roughly 113% since early April, a reversal Arora described with characteristic directness: “Nine months ago, we were guilty and convicted of near death because AI was going to eat our lunch, breakfast, and dinner. It seems like that’s not the case.”

The Mythos moment was the turning point—a model capable enough to exploit software vulnerabilities that it forced companies to take modernization seriously in a way that earnings calls and analyst reports hadn’t.

What Palo Alto Is Actually Selling

The company’s response is its Frontier AI Critical Defense Program, introduced in August. The pitch: use advanced AI models to stress-test customer defenses, surface vulnerabilities, and map a path to modernized architecture.

Arora said Palo Alto has already held conversations with roughly 2,000 companies about the program—a pipeline that signals real demand, even if the spending won’t land all at once.

“Not everything’s going to happen next quarter,” he told Cramer. “But this changes the long-term growth rate and duration of cybersecurity—not just for Palo Alto, but as an industry.”

What This Means If You’re Evaluating Security Tools

A few things worth keeping in mind:

• Legacy ≠ adequate. If your security stack hasn’t been meaningfully updated in the last few years, Arora’s framing suggests it was designed for a threat model that no longer exists.
• AI-native attacks are the baseline now. Automated vulnerability exploitation isn’t a future scenario—it’s the current environment that defenses need to account for.
• The modernization cycle is early. Arora is explicit that the spending wave won’t compress into a single quarter. That’s useful context for anyone evaluating vendors making aggressive near-term promises.
• Vendor incentives are real. Palo Alto has every reason to frame this as urgent and large. That doesn’t make Arora wrong—but it’s worth triangulating against your own infrastructure assessment.

The honest takeaway: if your organization is adopting AI tools without a parallel conversation about security architecture, you’re probably building on a foundation that wasn’t designed for the environment you’re now operating in.