Nikesh Arora: Mythos is Real, Analytical SaaS is Dead, and Google can be a $10T company

Nikesh Arora describes using Mythos to assess Palo Alto's codebase, finding vulnerabilities in six weeks that would have taken five to seven years by traditional methods, at a cost in the low millions. The AI can daisy-chain vulnerabilities to discover novel attack paths even on high-security codebases.

Arora estimates Mythos-level offensive capabilities could be available in open-source or adversarial models within three months. He argues most enterprise breaches happen via simple credential theft, not sophisticated cracking, and identifies small businesses (dentist offices, etc.) as the real systemic risk rather than national-security targets.

Arora divides SaaS into three categories: analytical SaaS (dead — LLMs can replace it), infrastructure software (undervalued — 10x data growth coming), and system-of-work/record (to be re-engineered for agents over five years). He argues enterprises will aggregate data cross-product and run analytics with models rather than buying specialized analytics apps.

Arora reveals Mythos's false-positive rate was 30%, making it excellent for offense but unreliable for defense. He argues the core enterprise AI problem is reducing model false-positive rates from 10–20% to near zero before deploying in high-stakes workflows like insurance claims or security patching.

Arora argues against holding back powerful models for 3–6 months since a leading model's weights can fit on a USB stick and can be distilled in 24–48 hours after release. He views models as eventually becoming a utility layer differentiated by IQ-level and cost, not a strategic moat.

Arora argues the profit pools in AI are in applications, not model usage. He observes OpenAI and Anthropic are already attacking the application layer (Codex, Claude Code) because that is where enterprise revenue concentrates. He predicts a generation of new agentic application companies will be needed to replace existing SaaS.

Asked to critique major companies, Arora calls Google underrated and predicts it will be the first $10T company, citing its hyperscaler sales force advantage. He praises Waymo's cars and says the product should expand to more cities. He argues OpenAI should sell faster and notes Anthropic has improved ARR faster than OpenAI.

Arora argues hardware remains the cheapest way to manage low-latency, high-throughput workloads and will not go away. He flags that production back-orders are the long pole, not design cycles, and cites hardware companies committing massive capex (e.g., a CEO pledging $100B in memory production) as evidence the industry is responding.

Arora describes Palo Alto's evolution from product-acquisition roll-up to an AI-native margin-optimization play. Having acquired a $25B identity-security company three months prior, he now sees the opportunity in running the most AI-efficient enterprise operation possible. Contrary to consensus, he expects Palo Alto's technical headcount to grow, not shrink, because of AI.