Interview
“If Wiz is worth $6 billion, Palo Alto is worth more than a trillion"
Unicorns are galloping into the abyss, Israel's cybersecurity infrastructure is broken, and offensive cyber companies are doing business with criminals. Palo Alto may have entered the Nasdaq-100, but that is not going to hold back founder Nir Zuk
This gloomy prediction belongs to Nir Zuk (50), founder and CTO of Palo Alto, the largest cybersecurity company in the world. While in recent months many technology stocks such as SentinelOne, which lost about 35% from its peak price, have suffered from negative sentiment, Zuk’s Palo Alto marches on. The company, which Zuk founded in 2006, now trades at a $55 billion market cap, an all-time high.
Palo Alto founder Nir Zuk. Photo: Palo Alto In early December, it entered the prestigious Nasdaq-100 index, ironically taking the place of Check Point, where Zuk was among the first employees before angrily leaving in the mid-1990s following disagreements with the founding team, especially with his eternal nemesis, Gil Shwed.
During the long years when Check Point dominated the cyber market, invented at a time when no one knew what to do with this new thing called the Internet, Zuk was considered the sector’s wild child. However, it seems he has done something right, with Palo Alto’s market cap overtaking that of Check Point in 2015 and increasing the gap ever since. Shwed's company is worth $14 billion today, about a quarter of Palo Alto. When the Covid-19 crisis began and Wall Street dropped, the two companies almost had the same valuation. However, Palo Alto has since almost tripled in value while Check Point is staggering.
Despite the differences between Shwed and Zuk, they have one thing in common: they are elders of the industry who lead massive organizations. In recent years, an entire sub-ecosystem of young and brash startups has emerged around them, startups that are quick to raise hundreds of millions from American funds at valuations that Check Point and Palo Alto reached only after many years of Sisyphean work on Wall Street.
When the correction you mentioned will come, will profit return to be the parameter to look at, and not just growth?
"Already now there are signs of a return to normalcy, of looking at financial fundamentals that are also sales and growth, as well as profit. Investors are starting to evaluate according to this, and not just according to a future vision. I founded Palo Alto in 2006 just before the financial crisis and it helped us because good companies are built during difficult times. In a good period, like the one we are in now, wasteful companies are built, and organizational culture of waste cannot be changed."
You speak of a correction in the public market, on Wall Street, however, there is no end in sight to the “celebration” taking place in the private rounds. There are new unicorns every day, and even decacorns (companies worth $10 billion or more) are no longer a rare sight in Israel.
"I don’t understand how this is happening, but I know who will lose in the end: savers in pension funds, widows, and orphans who lost in the crises of 2000 and 2008. Investment fund managers are not the ones who lose, only the average investor."
For Palo Alto, such a correction would be great news, no? You grow through an extensive acquisition campaign. You bought 13 companies for more than $3 billion, but six months ago you announced a pause. Have you decided to wait for sale prices? Are companies like Wiz, which 18-months since its inception has raised funds at a $6 billion valuation, or Claroty, which is already worth $2 billion, becoming too expensive?
"What Wiz sells in a year, Palo Alto sells in a week in the same market, so they are not of much interest to us. If they are worth $6 billion, Palo Alto should be worth more than a trillion dollars," Zuk said, showing signs of the bad boy with the big mouth of a decade ago when he drove around the Bay Area with a CHKPKLR license plate ("Check Point killer"). "But speaking to the point, we are constantly looking at companies, but our considerations are not where the market is and what the value levels are, but the roadmap of developing our products: if there is a possibility of shortening R&D processes by buying a company that already sells good technology, we will do it."
But the price tag is significant. Certainly when two-day-old companies are worth billions.
"To date, most of our acquisitions have been for less than half a billion dollars, and most have already paid back on the investment, except for those that were acquired very recently. The increase in sales reflects the Palo Alto multiplier, not the multiplier given to the company at the time of acquisition."
Wiz CEO Assaf Rappaport. Photo: Orel Cohen In the end, both Wiz and SentinelOne are one-product companies. As good as it may be, how can such valuations be justified?
"Ask their investors," Zuk smiled. "I don’t believe that a company that sells for $20 million is worth $6 billion. I don’t know how it happens. If there are investors who are willing to do it, please. The world is a little crazy right now: You don’t even need a business plan. A big dream and hope are enough. That is why the end will be the same as it was in the 1990s."
What would such a violent correction do to Israel’s economy, which is a kind of option on Nasdaq? Anyone who was here in 2000 remembers Comverse and Amdocs, the giants of the time, ordering ambulances to offices during mass layoffs.
"Israel is becoming less and less an option on the Nasdaq because the high-tech industry is less of an option on the Nasdaq. But there will be a job for everyone because there is a huge shortage of high-tech workforce in Israel. Even if there will be companies that will lay off employees, other companies will recruit them. I’m less worried about people. I’m also not worried because there are many good Israeli companies that are already selling real products profitably and they will continue to be strong. So for a while, it might be a little harder to sell. It will take a little more time to complete an exit, but the big money will continue to flow here.”
"Wages in Israel are rising faster than in Silicon Valley”
Part of the big money that flows into Israel is pumped by Zuk himself, who became a sort of “exit strategy” for venture capital funds specializing in cyber. Palo Alto’s Israeli acquisitions are also responsible for its local massive growth, despite not being an Israeli company in essence. It’s true that Zuk, who lives in Israel these days, is the founder, but the company’s management is based in California.
In 2018, Palo Alto launched its Israeli shopping spree. To date, it has swallowed six local startups, which have turned into its only R&D center outside the U.S. After recruiting more than 100 new workers in 2021 alone, the company currently employs about 700 people in its Tel Aviv office in Alon Tower.
"Unlike international companies, where the Israeli branch usually works on projects for the American firm, in Israel we lead the development of complete products. This is our second-largest office, we do not have another R&D center except a small one in India that we inherited in one of the acquisitions. I don’t open R&D centers in places that don’t have orderly intellectual property laws and enforcement against information theft. I don’t know how wise it is to build R&D in such places,” he said, carefully critiquing Israeli and global companies launching R&D departments in central and eastern Europe as a way to deal with the human capital shortage in Israel.
How extreme is the increase in wages in Israeli high-tech today? When you started operating here the costs were attractive, but now, everyone is talking about how Israel is no longer cheaper than Silicon Valley.
"It's no different than it was in the late 1990s in Silicon Valley. I was not in Israel then, so I do not know what it was like here, but wages in Israel are rising faster now than they are in Silicon Valley."
How significant is the strengthening of the shekel against the dollar? Do people in the U.S. headquarters still see the rationale for expanding the center in Tel Aviv?
"A strong shekel is less disruptive in high-tech, unlike traditional industries. So a startup that spends $100 to sell $80 will now spend $103. Palo Alto’s Israeli center gives so much to the company that 5% or 15% here or there is not what hurts me, it is the lack of manpower in Israel."
How fast can this shortage be resolved, if at all?
"It is worth examining how many people completed computer science studies today compared to the 1990s and compared to how much the Israeli high-tech industry has grown. The capacities of universities and colleges should be increased, as well as turning to populations who aren’t part of it all. Here though, there is a need for help by the country in encouraging minorities and Ultra-Orthodox to work in the industry.”
Palo Alto California headquarters. Photo: Getty Images Meanwhile, how annoying is it to meet 25-year-olds who served at the same technology units as you, and ask for a salary of NIS 50,000 (almost $18,000) and even NIS 70,000 (more than $22,000) per month, before options, without blinking? Do you even still meet with candidates directly?
"I interview a lot of candidates, in fact, I have an interview with someone today, but I do not deal with the money. Recruiting is less difficult for Palo Alto than what I hear from others because cyber people want to come work for us," Zuk again shoots a polite, yet accurate arrow towards his big and small competitors alike. "It is not like we do not have open positions that take time to fill, but it's a little easier for us. Psychological research on what makes people stay or leave a job found that the three components of the decision are ‘how much money I get, who I work with, and what I do.’ Palo Alto provides cyber professionals interest in a large company that holds a lot of data. Much of today’s cyber is moving towards AI and machine learning, and that requires a lot of data. The larger a company, the more data it has, and you can write better artificial intelligence. It is a kind of snowball."
Where do you recruit people from?
"First of all, a lot of computer science graduates are recruited immediately after school, and also from the IDF’s Academic Reserve or Talpiot program. Another source is from the competitors, and we also invest in recruiting people from different populations, especially the ultra-Orthodox. There are many talents in the ultra-Orthodox world. These are people who love and know how to study, their ability to concentrate is incredible, their logic is amazing, and that is exactly what is needed in computers. A lot of them want to work, and we train them in less than a year. It turns out that the gap in math and English can be covered."
But what if everything will burst like in 2000, will wages fall? During Covid-19, high-tech companies knew how to cut wages quickly across the board, at double-digit rates.
"It is difficult to lower wages. It might not go up, but it will not fall either. It will drop for those whose wages are tied to options and stocks, but it is not really possible to lower wages. By the way, we did not make the cross cuts that many companies made at the beginning of the pandemic."
Today, you closely manage the Israeli R&D center, which is quite different from the American one you ran until recently. What are the most noticeable differences?
"Things are moving faster here, but in a slightly less orderly manner. Although lately, I see companies starting to focus more on processes. It has a lot to do with the fact that more people in product management have been returning to Israel since Covid-19, and they are putting more order and adding maturity to the Israeli market,” he said.
"One of the things that bothered me in Silicon Valley is that when you sit in a restaurant, especially a fancy one, all you hear is people who talk exclusively about high-tech. 'How much money did I raise', 'from whom did I raise' - it’s just about the money. Here it is different. There are real problems in Israel, so the discourse is not monotonous. The food in these restaurants is also better in Israel,” he laughed.
Is there really a wave of returnees since Covid-19?
"People have always returned. I have been in the U.S. for more than 20 years, and my wife Hadas for 30, and we had almost no friends who stayed there for more than 10 years, there was always a turnover. Since Covid, which was better managed in Israel, more people have been moving back."
So you also moved back because of the pandemic?
"Not because of it, rather thanks to it," he laughed before adding, "First of all we did not move back, we live here now, and we will see where we will be in five years. But yes, for a long time we wanted to come back, we have children who just finished high school (Zuk and his wife have five children) and came with us to Israel. It was the right time. What prevented us from moving was my work there. When Palo Alto announced flexible work I took advantage of it, like a lot of workers, and I came to Israel."
"The Bank of Israel is the most conservative central bank in the world, and rightly so"
This past year, Zuk has been fostering a new venture beyond Palo Alto which some believe is the real motive for his return to Israel, establishing a digital bank. Zuk is leading the project with the former Israel Securities Authority chairman Shmuel Hauser and with the entrepreneur Yuval Aloni. The project is still shrouded in mystery, but Zuk is already working to obtain a banking license from the Bank of Israel (Zuk confirmed meeting with Bank Governor Amir Yaron) and is trying to attract investors.
According to estimates, Zuk already invested tens of millions of dollars in the new venture, pocket change for him. Zuk’s base salary is about half a million dollars a year, with most of his income coming from options, for example, his 2019 package reached $35 million. His Palo Alto shares are worth about half a billion dollars. A few weeks ago he exercised a tiny amount of shares, which yielded him about $6 million.
How much of your time today is devoted to the digital bank?
"I don’t like it when it is called 'digital bank,' but I’m not sure what the right term is. The term ‘digital bank’ describes a bank that provides traditional banking services using traditional software and a traditional core platform, simply without branches, and perhaps with a nice app. I don’t believe in doing what has been done for 30 years in a slightly different way, I believe in doing it completely differently. Now, there is an opportunity to develop a blue-and-white banking platform by modern means, suitable for the third decade of the 21st century, and to build a bank different from all of the rest." From his words, it seems Zuk is taking a shot at Amnon Shashua's First Digital Bank which is supposed to start operating soon, and how it isn’t the revolutionary disruption that Zuk is planning for the banking world.
When will it start operating?
"It depends on the Bank of Israel, which positively amazes me. On the one hand, we really see a desire to change banking in Israel, even at the levels of the Governor and the oversight. There is a desire for entrepreneurship, innovation, and change. On the other hand, the Bank of Israel is probably the most conservative of its kind in the world, and rightly so, in its concern that the banks in Israel will not fall. I think they have it right with this combination, and they make sure that when a new bank is established in Israel, it will not fall. "
What is this venture for you - a new startup, or an expression of Zionism?
"For me, this is a high-tech company. We will establish a completely different bank in Israel, and then we will see about expanding abroad.
- Hunting season: The escalating tech recruitment war
- Palo Alto’s new focus on profitability is bad news for Israeli startups
- Check Point is ready to fight for its place, reveals numbers behind cloud operation
"50% of companies in Israel are not protected from a cyber attack "
Since returning to Israel, Zuk has met many CEOs of Israeli companies from all fields, industries, and sectors, both private and governmental. These encounters made him very concerned when talking about Israel's level of protection against cyberattacks. "I am very, very worried about what is happening here," he emphasized. "The situation isn’t good in most of the world, but in Israel, it is extremely bad. Fifty percent of companies in Israel aren’t protected. In banks and insurance companies the situation is better, but the infrastructure companies, governmental companies, and large manufacturers bother me. Since I’ve been in Israel, I have been amazed that organizations responsible for critical infrastructure can’t upgrade their cybersecurity because of differences between management and the workers' union,” he said.
“We have to assume that the real attacks have already happened and that our enemies are where they need to be, and they will harm us. The Iranians will not close the gas stations just to show us that they can, rather they will wait for the right moment when it will really hurt."
How is that possible? We are the cyber-nation, since the beginning of 2020 more than $10 billion have been invested in companies in the field - but the local industry is not protected?
"I have been ringing the alarm bells for a long time about the lack of investment in cyber. There are years of neglect here. In many companies in Israel, the board doesn’t deal with cyber at all, and many of them don’t have a cyber affairs committee on the board at all. American companies have more awareness and more budgets; There, the rate that goes to cyber from the IT budget is about 4%-10%. In Israel, I would be surprised if it reaches 2%-3%."
In the critical infrastructure as well?
"Especially there. In the public sector, spending on cyberinfrastructure is far from the global average, and far from sufficient. I’m most troubled by the impasse in thinking for many years, which I see less of in the rest of the world. The cyber market has evolved whenever a new challenge comes and a new group of companies developed products and sold them; This is how organizations find themselves with dozens of products from dozens of vendors. When there were three threats and three products it worked, but today there are dozens of products. Lots of organizations - especially in critical infrastructures, especially governmental ones - do not stop and say, 'we do not really have a cyber strategy, we do not have a guideline’. They are content with checking the box on three cyber projects a year, which are usually born not out of a strategy, but from salespeople who came to sell products. There is no thinking on what should be protected, what the threats are, or how to defend.”
"I prefer to be on the defensive side rather than on the offensive one”
In a manner that might seem paradoxical to many, Zuk is not concerned with the recent large attacks, for example, the ransomware attack on Hillel Yaffe Medical Center or on Shirbit Insurance, the latter of which was forced to be sold to Harel Insurance.
"Ransomware attacks are terrible and annoying, but if you do things right, unlike what some of the companies here have done lately, they are easy to deal with," Zuk said. “They are immediately visible, unlike situations where a foreign country sits on critical infrastructure, and during the next war this infrastructure will stop working, God forbid. The problem is that in many organizations in Israel, the products that are responsible for telling the organization that it has been attacked are also the products that are supposed to stop the attack. If the system hasn’t identified the attacker, it doesn’t know to alert you that you were attacked.”
Zuk didn’t say "Check Point ", but in fact, he is implying to a widespread notion circulating in the cyber ecosystem over the past year that the majority of Israeli organizations that have been victims of ransomware and other cyberattacks had installed Check Point’s firewall systems, which missed the threats in real-time. Check Point commented in response that the companies that installed its products were the ones which blocked the attacks.
Check Point CEO Gil Shwed. Photo: Amit Shaal "I recommend to all organizations in Israel to formulate a plan for dealing with and recovering from a cyberattack," Zuk stated. “These are not attacks you should fear, because in the end, their damage is limited, however, they prove how vulnerable an organization is. The attacks that really need to be feared are the ones that are not known about. We have seen it before in the U.S., and it will burst here one day too. It always happens on the wrong day."
What else needs to change in the behavior of the CEOs and IT managers of Israeli companies?
"Every board should include a cyber committee, which will demand to see readiness for attack - preferably through a third party. Plenty of outside companies in Israel can do it. Cyber staff in organizations need to decide what architecture is needed for their organization, and stop with processes built on what salespeople sell."
Perhaps part of the problem is with the local cyber companies, which, like many technology companies, skip the small Israeli market and do not market their products here.
"Startups here always show me their list of customers, and I actually see mostly Israeli companies."
From your meetings with local CEOs, what do you recognize in them? Is there a willingness to change the way they work?
"I mostly identify fear because they see it happening to other companies. There are places where seeds of change can be seen."
What about the NSO fiasco, which has been blacklisted by the U.S. administration as a provider of offensive cyber means? How much does it hurt Israel?
"It is a political matter and I do not want to get into it, but as a rule, I prefer to be on the defensive side rather than on the offensive side. First of all, it is immoral to attack. Beyond that, the use of offensive cyber should be reserved for countries, not for private companies, certainly not for criminals."
