Part IThe Story
Seven Letters, No Vowels
The car was an old BMW. The partners at Sequoia Capital remembered the plate more than the make. California allows seven characters on a vanity tag, and Nir Zuk used all of them, dropping every vowel to fit his meaning: CHKPKLR. Check Point killer. In 2005 he pulled the car into the firm's lot on Sand Hill Road to talk about the company he wanted to build next. The tag announced its purpose before he reached the door. "Never had a drive to derail an incumbent been so clear!" the firm wrote later in its own account of the meeting, with an exclamation point that venture firms rarely spend.
The target was not a stranger. Check Point Software Technologies was, by the accounting of one Israeli financial newspaper, the company where Zuk had been the third employee. By his own accounting it was where he "built the first firewall." He had worked there from eight in the morning until about ten at night, every day, for years. He had moved to America for it. He had met two of its three founders while serving in Israeli military intelligence, when he was a teenager with a talent for writing computer viruses and they were the older men who left the unit first. The man in the BMW was not aiming at a rival. He was aiming at his own past. He had made a license plate out of a grudge, and the grudge looked a lot like a family resemblance.
The plate had started, Zuk said years afterward, as "a marketing stunt," put on the car after his first startup was sold to one of Check Point's biggest competitors. By the time he drove it to Sequoia it had become a business plan. Sequoia had known him and an engineering executive named Rajiv Batra "for over a decade," and the firm said it "hoped to be part of whatever they did next." It introduced the two men to each other and gave them space in its own office. Palo Alto Networks was incorporated on March 1, 2005.
What happened over the next twenty years is the kind of story the industry likes to tell about itself. The company became the largest standalone cybersecurity vendor in the world, serving more than 70,000 organizations in over 150 countries, including 85 of the Fortune 100. In May 2026 its market value passed $200 billion. Zuk was never its chief executive. He stayed chief technology officer, a title he chose and defended. On August 18, 2025, he retired. A few months later, on Sequoia's Crucible Moments podcast, he described the retirement as a kind of completion: "I think that Palo Alto Networks has finally achieved the vision that I set 20 years ago."
Check Point still exists. It was never killed. When Zuk now gives advice to founders facing disruption, he names it as the cautionary example, next to Nokia: "If you end up like Check Point... You will get killed by a disruption." The sentence on the license plate was never carried out. It turned into a parable instead. Then, in March 2026, the man who spent two decades telling the world to put its security in the cloud started a company built on the claim that the world had gone too far into the cloud. The new company's first customers would be the ones his old company had left behind.
The plate was seven letters with the vowels taken out, an argument shortened until it could be read at speed. Much of what follows is about that compression. It is about a man who could state what he wanted in a few characters, and who needed an enemy to name before he could name himself.
By the Numbers
Three Companies, One Grudge
$45MStock price NetScreen paid for OneSecure, Zuk's first startup, in 2002
$4BJuniper's all-stock acquisition of NetScreen, announced February 9, 2004
$260MRaised in Palo Alto Networks' NYSE debut, July 20, 2012
90%+Zuk's estimate of the win rate once a customer agreed to a proof of concept
$25BCyberArk acquisition, announced July 2025, which Zuk said completed the platform
$11.5BPalo Alto Networks revenue in fiscal 2026, with 21,920 employees
$200BMarket capitalization first reached in May 2026
The Boy Who Made the Letters Fall
The first program Zuk is known to have written for an audience he never met did one thing. It made the characters on a computer screen fall. Letters and numbers came loose from their positions and dropped down the display at random, "akin to the opening scene to the 1999 hit movie The Matrix," as a CRN reporter described it decades later, "albeit much more slowly." This was the late 1980s. Viruses traveled by floppy disk. To move from one machine to another, they had to be carried by hand.
"Back then we were doing this for fun; it was much more challenging," Zuk said. "It was mostly about learning how to program very low-level programs. It wasn't about exploiting vulnerabilities." This is a cheerful account of juvenile malware, and possibly a convenient one. Still, it is consistent with everything he has said since. The interest was never in breaking things for their own sake. It was in how things worked at the lowest level. He has a line for it that he repeats to journalists, students, and his own new hires: I was one of the first virus developers in the world. He says it the way other executives mention a semester abroad.
He was born in 1971 in Rehovot. At a 2025 education conference he made a point of saying the town was "still considered the periphery" when he grew up there. Rehovot is home to the Weizmann Institute of Science, and he was "lucky," he said, to take classes there as a child. He later studied computers at ORT, a technical high school network. In a 2010 interview he described the electrical engineering track there as "38 guys and two girls, and one of them was my girlfriend, so that was probably my biggest high school achievement." The interviewer had asked about his biggest high school achievement, and he gave the honest answer.
The computer came late, by the standards of the legend. A friend got one in fourth grade. Zuk got his own a few years later, a Dragon 64, and he taught himself to program on it when he was sixteen. He remembers one negotiation from that time. He "did manage to convince my parents to buy me the one with the 30 megabyte hard drive instead of the 20 megabyte, because I needed the extra space. 30 megabytes was huge." It is a small story, but it has the shape of the larger ones. A teenager decides the standard configuration is not enough and argues the adults into the premium option. By sixteen he was writing commercial software for money. He was also writing viruses, which taught him security "from that side."
Then came the army, which in Israel is not a choice. Zuk was recruited, as he put it, "by a special unit that was looking for whiz kids that knew how to program." That was Unit 8200, the signals intelligence branch of the Israeli Intelligence Corps. He stayed five years and rose to head of software development. While serving, he began studying mathematics at university. He chose not to study computer science: "I saw no reason to study computer science, since I already knew what I needed to know." He almost finished the mathematics degree. He never did. Asked in 2010 where he got his degree, he said: "I don't have a degree. That makes it much more interesting."
In 2025, after twenty-three years in America, he stood in front of an Israeli audience and attacked the system that had produced him. "The education system in Israel is nothing special, to say the least." The 2025 education budget was 90 billion shekels, he said, "a million shekels per year for a classroom of 40 students, and yet I don't know where the money goes." Nearly all of the country's high-tech graduates came "from elite military tech units," and the industry was "forced to rely on that alone." He was describing his own path, the periphery kid rescued by a science institute's enrichment classes and an intelligence unit's recruiters, and arguing that the country should stop depending on paths like it.
Third Employee
Of the three men who founded Check Point, Gil Shwed is the one who matters most to this story, though Zuk will not say his name. Shwed and Zuk became friends in Unit 8200. In Zuk's telling, Shwed and the other founders "were older than me. They left the service before I did." Shwed went on to run Check Point as its dominant chief executive for a quarter of a century: a software developer who became a CEO and stayed one, criticized for years for trying to be both. Marius Nacht, a co-founder, became chairman. Shlomo Kramer, the third, left years ago to start other companies, which made him the first in the group to discover that a founder can leave.
In late 1994 Zuk left the army as the company was getting started, and he joined. "At that time, Checkpoint was very small with only a handful of employees," he said. It had built the first commercially viable firewall. "We invented a technology called stateful inspection, on which all network security technology today is based." Stateful inspection meant a firewall that tracked the state of each connection, reading a packet in the context of the conversation it belonged to instead of judging it alone. The pronoun in his sentence, we, is generous by his standards, and it still claims a lot. Later biographies call him "one of the developers of stateful inspection technology," and in one case "the principal developer of the first stateful inspection firewall."
The hours were real. "I had to work hard, from 8 am to probably 10 pm every day, so I didn't have time to finish my degree." The mathematics degree, almost complete, was dropped there. He was also needed for something rarer. Check Point's American business required an engineer to fly back and forth across the Atlantic, and "I was the only one who spoke decent English that was willing to do it." Then he married, and the commute became "too much." In January 1997 he moved to the United States. He was still at Check Point, now running development on the American side, and he would live in California for twenty-three years.
He left in 1999. Later profiles describe a growing frustration that the company was choosing bureaucracy over invention, and the story he tells is about a culture that had become careful. The departure was not quiet. A 2019 Calcalist profile said he left "slamming the door behind him." Interviewed then at forty-eight, he offered a disclaimer that read more like evidence: "None of this is personal, it's just business." The reporter, Sophie Shulman, noted that Shwed's name "does not pass Zuk's lips once during our conversation." She also suggested that Shwed was "the man who shaped Zuk's professional life," and that he "indirectly dictated many of his actions, including Zuk's decision to remain the chief technology officer of his own empire instead of becoming CEO."
In 2010 a trade publication asked Zuk what he would refuse to do. "Ask me to do anything but..." The answer was four words: "Work for a big company." He spent the next fifteen years building one.
Dropping Packets
Rakesh Loonkar had money and no plan. "I had a $25M term sheet and no idea what to do with it," he wrote, more than a quarter-century later, about the evening a mutual acquaintance named Asheem Chandna introduced him to an Israeli engineer who had just left Check Point. Both men were twenty-eight. Loonkar later co-founded Trusteer, another security company. Later still he became an investor, which means he spent his career noticing who else had seen something early. He asked Zuk to join him as a co-founder. Zuk agreed, and the company became OneSecure.
OneSecure built what Loonkar calls "the first inline IPS," an intrusion prevention system. Its predecessors only detected attacks. An inline device sat directly in the path of network traffic and made decisions in real time about what to block. That meant it would sometimes discard legitimate traffic by mistake, and customers found this unacceptable. "I can't tell you how many of the smartest customers in the world told us they would never drop packets with an inline product," Loonkar wrote. A detection system raised an alarm. A prevention system acted, which meant it could be wrong in public. The industry wanted the alarm. Zuk was building the system that acted.
Prevention became the core of Zuk's philosophy, and he later said so in nearly those words. But OneSecure did not get to prove the point alone. It quickly received an offer from NetScreen Technologies, then one of Check Point's largest competitors.
NetScreen had its own founder who left. Ken Xie co-founded it in 1997 with Yan Ke and Feng Deng, built it around custom chips, served as CEO until a professional executive arrived in 1998, and then left in 2000 to start Fortinet, which built competing chip-based firewalls. The professional executive was Robert Thomas, who came from Sun Microsystems, where he had been general manager of intercontinental operations for its software business. Thomas took NetScreen public in December 2001 at $16 a share, selling ten million shares for $160 million, with Goldman Sachs leading the offering. Within months, NetScreen bought OneSecure for $45 million in stock, and with it the company's intrusion prevention technology, which became NetScreen's core IPS product.
The offer letter survives in public filings. It is dated August 22, 2002, and addressed to "Mr. Nir Zuk." It offered him the position of chief technology officer, "reporting directly to Robert Thomas," at a base salary of $8,333.33 paid twice monthly, or $200,000 a year. It was contingent, like every such letter, "upon your ability to show proof of eligibility for work in this country." It provided that OneSecure would grant him options on 1,062,276 additional shares, vesting monthly "over a 3-year/no cliff period," to be converted into NetScreen stock at the closing. The following May, NetScreen registered 1,569,376 shares for resale by former OneSecure stockholders. On May 16, 2003, those shares last traded at $22.16.
So this is how a twenty-eight-year-old's term sheet became an Israeli engineer's paper wealth: through a prospectus, an exchange ratio, and a clause about work eligibility. And this is when the license plate went on the car. NetScreen competed with Check Point, and Zuk was now NetScreen's CTO. The tag on the BMW turned a corporate rivalry into something he could drive around the Bay Area.
The First Day at Juniper
On February 9, 2004, at six in the morning Pacific time, Juniper Networks and NetScreen announced that Juniper would acquire NetScreen in an all-stock deal. Based on Juniper's closing price of $29.47 the previous Friday, the deal was worth about $4 billion: 1.404 Juniper shares for each NetScreen share. Scott Kriens, Juniper's chairman and CEO, called it "a combination of two strong companies" and, on the conference call, "a game-changing day." Robert Thomas said his executives were "almost delirious." NetScreen's 900 employees would join Juniper's 1,600 in a new security products group run by Thomas. A Gartner analyst explained the logic in the trade press: "For the longest time, networks were about being wide open to everything... Thanks to worms and hackers, however, the Internet is being locked down."
The deal closed in April 2004. Zuk tells what happened next in a few sentences, with no pause between the insult and his response: "Literally the first day after the acquisition closed in April 2004, my new boss... told me that they were not interested in the products, so I left. Many other people left and I left to start Palo Alto Networks."
That was the second time a large organization had told him, in effect, that what he built was not what it wanted. At Check Point it had happened gradually, as the company shifted from invention to protecting what it had. At Juniper it happened in one day. In both cases he decided almost immediately. He did not stay to fight inside the building. He went somewhere else and fought from there.
Somewhere else was Greylock Partners, where he became an entrepreneur in residence. Then came the morning in Sequoia's parking lot, and the introduction to Rajiv Batra. Batra was a different kind of engineer. He had a master's degree from the University of Wisconsin in 1983, and decades later the school would give him a distinguished alumni award. His name, with his wife Ritu's, is now attached to an endowed chair for cybersecurity at IIT Kanpur. Sequoia described him as "a world class engineering leader with a knack for hiring and motivating elite coders." Zuk drew the architecture, and Batra built the organization that could execute it. The pairing worked like a translation from one man's argument into an engineering plan.
A year later, in 2006, Lee Klarich joined. He would run product for most of two decades and eventually succeed Zuk. In his farewell, Nikesh Arora would describe Klarich as the man who "has always been the architect turning that foundational vision into the platforms that define us today."
The first product shipped in 2007. It was a firewall. That was the point, and it was also the problem.
The F-Word
There is an internal debate at Palo Alto Networks that people there still talk about almost the way people talk about a religious schism. It was over what to call the product.
The product did something firewalls of the time could not do. It identified the application inside network traffic, not just the port and protocol it used. Traditional firewalls, Zuk liked to say, assumed the internet was web browsing and email. If traffic used port 80 it was the web, and if it used port 25 it was mail, and anything else was blocked or ignored. Meanwhile, as he told AllThingsD on the day of the company's IPO, "there are hundreds of new things. There was no SharePoint, and no Dropbox and no Twitter." The old devices "can't provide any protection for the new things, other than to just block them." His device could see them, so it could let them through safely.
The safe commercial move was to sell it as something that sat next to the customer's existing firewall: an "application visibility and control tool," a helper. Customers would not have to throw anything out, and the sales cycle would be shorter. Zuk refused. Sequoia's summary of the decision calls it insisting on being "a new kind of 'firewall' vs. a 'firewall helper,'" and says the company chose to use "the F-word" knowing that every prospect would answer: we already have a firewall. That answer was what Zuk wanted to hear. He did not want to sit next to Check Point's box. He wanted to replace it.
In 2009, Gartner published a definition of a "next-generation firewall": full traditional firewall capability, intrusion prevention, application awareness, and "full stack visibility allowing for fine-grained detection and control of applications." It reads almost like Palo Alto's spec sheet. Starting in 2011, Gartner placed the company in the leaders quadrant of its enterprise firewall report, and by 2019 it had been there eight years in a row. The category now had a name, and the name protected the company.
Not everyone accepted the framing. A security consultancy called Anitian published a post titled "The Cult of Palo Alto Networks," which said in print what some competitors said privately. "I have observed reasonable companies spend two to four times what a comparable Juniper, Cisco or Fortinet would cost, so they can have that special Palo Alto love." The author reviewed the specifications and found "nothing unique," then quoted the company's website: the only firewall to classify traffic based on... the application, the only firewall to identify, control and inspect SSL encrypted traffic, and so on, the only repeated down the page. His conclusion was "language." "Palo Alto has learned and embodies a new paradigm in technology: you don't have to BE innovative, you have to make people THINK you're innovative." On the founder, he wrote: "Nir Zuk is a smart guy if a little self-absorbed. But who isn't?"
The critique is useful mostly for what it confirms. In April 2010, asked what he was reading, Zuk named George Lakoff's Don't Think of an Elephant, a short book about how the frame of an argument decides it before the facts arrive. The man who named the next-generation firewall was studying framing. The man who had dropped the vowels from Check Point killer to fit a license plate knew exactly what a name could do.
He also knew what it felt like to lose control of one. On February 25, 2009, he published a blog post on the company's website, under his own name, about Check Point's announcement of a "Software Blade Architecture."
— Nir Zuk, Palo Alto Networks blog, February 25, 2009I am pissed off. I am hurt. I built a big part of the Check Point product and to see what a bunch of jerks have done to that company really hurts.
The post continues: "Check Point's major innovation is a new freaking LICENSING SCHEME!!!" It ends, without irony, "So sad. So sad. Nir." The founder of a company competing directly with Check Point was writing about Check Point as a former lover would. He was not angry that it was a competitor. He was angry about what it had become. The grudge was real, and so was the grief behind it. A public company does not usually let its CTO publish posts like this. Palo Alto Networks was not yet public.
He took the same argument on the road. At a meeting with British banks in London, he asked a room of security officers why they had firewalls. "What is it doing for you? No-one could come up with a good answer." He pressed them on what would happen if they removed the device. "They concluded eventually that their security posture wouldn't change even if you took the firewall away." Firewalls, he said, "don't do much, because they aren't asked to do much more than manage ports. Over the last seven years, no-one has added anything new, so customers are paying thousands, hundreds of thousands, or even millions [of pounds] for nothing." A Symantec representative disagreed in the same article. A Belgian researcher named Jan Guldentops split the difference in a way Zuk could have written himself: "He's right and he's not right... you need a more intelligent firewall."
That was the pitch: the firewall is dead, so buy our firewall.
Give Us a Week
The sales method was simple enough that Zuk still describes it as almost unfair. "What we told customers is, hey, today you are blind to anything that comes in not via web browsing and e-mail. Put our box on the network for a week, give us a week and let us show you what you're missing."
The box went in. Because it identified applications, at the end of the week it produced a report: every application running on the network, by user and by volume, most of which the incumbent firewall had never seen. "They go back to their vendors, they ask for a fix, they vendors. No fix and then they buy our product." The transcript is garbled in the middle, but the sequence is clear. "We knew from the beginning. That if we get a POC, a proof of concept with the customer. Our chances of selling the product were in the 90s, so 90% or more. So we focused on convincing customers to give us the opportunity to show them a proof of concept. And it wasn't that difficult."
This explains how the company sold, and it also answers the Anitian critique, though not entirely. A proof of concept turns a claim into evidence, and the claim the company was making was that its device could show customers something their current device could not. The marketing language worked because the customer could test it on their own network within days. The skeptic had a point about the word only. He had less of a point about what a CIO saw on the screen on day five.
A channel partner in Chicago, J.D. Butt of Nexum, said this to CRN: "I didn't think five years ago that there would be something exciting to talk about with firewalls... We've never had a product in our organization take off as quickly as" Palo Alto's.
It is fair to ask what the method left out. A one-week trial measures visibility, not resilience. It shows what a device can see during a week of normal traffic. It does not show what the device will stop when an attacker who has studied it shows up. Sequoia's account of the company says Zuk claimed "over 95% of vendors sell snake oil that looks impressive but doesn't actually work, because customers struggle to verify it," and that Palo Alto paid the higher development cost to build products that actually secured customers. That is a strong claim about everyone else. It is also the claim any company with a good proof of concept would make. In security, products are judged by the attack that does not happen, so it is hard to tell a good product from good marketing until something goes wrong.
You Just Passed Check Point
The company went public on the New York Stock Exchange on July 20, 2012. It priced the night before at $42 a share and closed its first day at $53.13, up 26.5 percent, after raising $260 million. It listed the same day as Kayak, the travel search site. VentureBeat later ranked it the fourth-largest tech IPO of the year. The market had spent two months recovering from Facebook's botched May offering, and the trade press treated the two debuts as a sign that things were improving.
Arik Hesseldahl of AllThingsD interviewed Zuk at the exchange that afternoon. Asked what made his firewall worth disrupting the incumbents for, Zuk said: "I think the industry has been sleeping a bit, despite the efforts of hackers, who never do." The rest of the interview covers Dropbox, "since I use that from time to time," and how to secure it.
A detail from the IPO filing tells you more about him than the stock price does. The registration statement included an employment letter, signed December 19, 2011 and effective three days earlier, confirming the terms of Zuk's job. It is addressed to him at 3300 Olcott Street, Santa Clara. It confirms that "you will continue to serve as Chief Technology Officer" and that "you will continue to report to the Chief Executive Officer." It sets his salary at $220,000 a year, with a target bonus of $66,000. Nine years earlier, NetScreen had paid him $200,000. Between the two letters he had founded a company now going public at a multibillion-dollar valuation, and his salary had gone up $20,000. The money was in the equity, of course. Still, the letter makes clear he had arranged things so that someone else would sit above him on the org chart and deal with what he called, years later, "shareholders, analysts, or human resource concerns."
Growth after that came fast and noisily. The company grew from about 700 employees in 2012 to more than 1,300 by 2014. Zuk told CRN that he made decisions from his gut, not through a "bureaucratic process," and that the engineering team was still deliberately small. "We're making sure that we do as much as we can with the smallest team," he said. "We're not one of those companies that becomes successful and then starts having to justify new products or strategies on a financial level." In the same interview he attacked the independent testing firm NSS Labs, saying one of its studies set a low bar that "enables mediocre vendors." He said Sourcefire had disappeared after Cisco bought it. He called FireEye, then the industry's favorite, "a marketing machine that likes to showcase the zero-day exploits it finds like a badge of honor." That last line was a little ironic, coming from a company another consultant had already called world-class at marketing.
By his own count, "in 2013 or 14, we became the largest network security vendor in the world." Around then the company bought a large billboard over the Ayalon Highway, the main road through Tel Aviv, next to Check Point's offices. It read: You Just Passed Check Point. So did we. The license plate had come home, at highway scale, aimed at Gil Shwed's office windows.
In 2014 Palo Alto Networks co-founded the Cyber Threat Alliance, a nonprofit for sharing threat intelligence among competitors. The other founders were McAfee, Symantec, and Fortinet. Fortinet was Ken Xie's company, the one he started after leaving NetScreen to compete with the firm he had founded. By 2018 the alliance had twenty members, including Cisco, Juniper, and Check Point. All three companies Zuk had worked for, or worked against, ended up sharing a table "for the greater good."
The Man Who Would Not Be CEO
"As far as I'm concerned, managing people is a waste of time," Zuk told Calcalist in November 2019, in what the paper called the first full-length interview he had ever given to Israeli media. "I'm not good at it, I don't like it, and I think that tech people need to choose early in their career what they really want—to manage people or to manage technology. Those who opt for people become chief product officers, and those who love technology become chief technology officers."
The CEO role, in his view, was a trap for technical founders. "When the company succeeds, the CEO needs to be a sales and marketing person... any hour I spend dealing with shareholders, analysts, or human resource concerns is an hour I am not investing in the company's future. I'm much better with technology." The reporter read this as a criticism of Shwed, the developer who had stayed CEO at Check Point for twenty-five years. Read that way, Zuk's career structure, a founder permanently in the second chair, was the opposite of his old friend's choice. Whatever Check Point does, do the reverse. One sentence in that profile describes Zuk's business approach as exactly that.
The advice he gives founders now is blunter. Sequoia summarizes it: if you have never scaled a company from tens of millions to hundreds, or from hundreds to billions, don't be a hero. Bring in someone who has done it.
The person he eventually got was Nikesh Arora, who joined as chairman and CEO in June 2018. He came from senior roles at Google and SoftBank, where he had been one of the most-watched executives in technology. He was an outsider to security, and he had a talent for capital allocation, which security companies have rarely had. Arora's first memory of Zuk, as he told it at the retirement, is warm: "sharp, insightful, and welcoming." His account of how they divided power is less warm and more useful. "Nir Zuk has his opinions," Arora told Calcalist in 2022, "but he is not the one who decides. I am the CEO."
Zuk did not object to this. He had arranged for it.
What Arora decided was to buy companies, at a pace the company had never attempted. Palo Alto Networks had built nearly everything itself for about a decade, because the promise of the next-generation firewall depended on everything working together seamlessly. Sequoia says that conviction "nearly caused them to miss the cloud era entirely." The company had made a few acquisitions earlier: Morta Security in January 2014, a startup founded by former NSA engineers, and Cyvera that April for about $200 million. But after Arora arrived, acquisitions became a strategy. The deals came quickly: Evident.io for $300 million, which became the basis of the Prisma Cloud division; RedLock for $173 million; Demisto for $560 million in February 2019; Twistlock for $410 million; PureSec for $47 million; Zingbox, Aporeto, CloudGenix; Crypsis Group for $265 million, which was folded into the Unit 42 threat team; and in December 2020, Expanse for $1.25 billion.
Zuk explained the logic in London in September 2024 in terms of incentives, as an engineer would. "We prefer acquisitions. The reason we prefer acquisitions is because when a large company develops something new, the people that are doing it don't have the same incentives as those that do it in their startup. In a large company it's not life or death if something you develop is successful or not." This is the man who left Check Point and left Juniper, explaining why a big company should buy the urgency it cannot produce internally. He also admitted something few founders would say on stage: "We also overpaid probably, at least from our perspective, on the two companies that we acquired in the last few months." Those were Talon, for about $625 million, and Dig Security, for about $400 million. "But look, everything has a price."
It is worth noting that the company's earliest bet on the cloud came from Zuk, and it came before the in-house approach nearly made it miss the cloud.
— Nir Zuk, on Sequoia Capital's Crucible Moments, December 2025Everybody thought we were crazy. Nobody would use the cloud for cybersecurity, nobody would send cybersecurity-related data to be inspected in the cloud and so on. And when I hear something like that, I say, of course I'm going to do it, you know, because it's the right thing. And if everybody believes it shouldn't be done or it cannot be done or nobody would want it, then, you know, it's a good reason to do it.
WildFire, the company's cloud-based malware analysis service, launched in 2011. It ran suspicious files in a virtual environment in the cloud, which was exactly the feature the Anitian critic had listed among Palo Alto's suspicious onlys. So Zuk was right about the cloud early and still nearly missed the cloud as a market shift. Both are true. Being right about an architecture does not mean the organization will adapt to it, and he had built an organization around the firewall.
In July 2020 he wrote an op-ed for TechCrunch that reads like a diagnosis of the security industry. "Most organizations have taken a stopgap approach to cybersecurity over the years. Each time there is a new type of threat, a new set of startups are founded to come up with a solution to counter it... This has become a house of cards. One product piled on top of another, with no core foundation to hold everything together." Those startups, the ones that appear for every new threat, were exactly what his company was busy buying. He described the house of cards as a problem and was solving it by acquiring the cards.
Twenty-Five Billion Dollars and Peace
At the end of July 2025, Palo Alto Networks announced it would acquire CyberArk, the Israeli identity-security company, for about $25 billion. It was the biggest move in the company's history. Ynet reported it as the second-largest exit in Israeli high-tech history. CyberArk had nearly 3,000 employees and a sales operation expected to bring in more than a billion dollars that year. Investors did not like it. The stock fell on the news and, three weeks later, was still about ten percent below where it had been.
Calcalist observed that Zuk was the only Israeli in Palo Alto's senior management "who could easily converse with Udi Mokady," CyberArk's executive chairman. On August 18, the company announced that Zuk had retired.
The press release was polished. "I started Palo Alto Networks with a radical idea and the conviction to challenge a stagnant industry with a cybersecurity platform," he said in it. "Our vision has always been to lead from the front, and our recent intent to acquire CyberArk is a testament to that enduring ambition." Lee Klarich became CTO and joined the board. Arora called his co-founder "a legend in cybersecurity," whose contributions were "forever etched in our history books." John Donovan, the lead independent director, thanked him for "foundational contributions."
Sophie Shulman of Calcalist, the reporter who had noted Shwed's absence from his conversation six years earlier, called the retirement "perhaps the most surprising yet unsurprising event that could have happened." It was unsurprising because Zuk "has not been deeply involved in its operations in recent years." It was surprising because of the timing: why would the company's "central technological figure" leave just as his creation made its riskiest bet? She did not answer the question, and neither did he, at first.
Four months later, on the Sequoia podcast, he answered it in one long sentence that he seemed to want on the record. CyberArk, he said, "completes the platform." Then he went through the inventory: "network security, endpoint security, security operation center, automation and control and cloud security, identity and access management... AI security... email security... vulnerability assessment and vulnerability management. We have all the major components... that an organization would need in order to achieve their cybersecurity goals, which is what I set to do 20 years ago."
— Nir Zuk, on Sequoia Capital's Crucible Moments, as reported by Calcalist, December 2025And now I can retire from Palo Alto Networks with peace.
Peace is an unusual word for a man whose first public persona was a license plate threatening a competitor.
His attention had already been elsewhere for a while. During the pandemic, after twenty-three years in California, he moved back to Israel. In the four years after his return he invested nearly $150 million of his own money in Israeli startups: fintech, health tech, defense tech, anything but cybersecurity, where he said conflicts of interest kept him out. "There is a higher risk in Israel, but that also means valuations are low," he said in New York in March 2025. "It's hard to raise money, so you can get a big chunk of a company for a relatively low amount of money. I'm taking that opportunity." That was mostly a value investor's argument, from someone who had moved home. Asked about the fear of a brain drain during the war, he offered a qualified optimism: "Leaving Israel is not as easy as leaving other countries." He had left once, for twenty-three years. He knew how hard it was.
Not every bet worked. He co-founded Air Haifa, which Ynet called Israel's fourth airline. He backed Ash Bank, a digital bank that was still looking for investors when he retired. He funded a news outlet called Relevant, which closed in 2024 after losses. Calcalist mentioned "a struggling Israeli communications project." A man who had spent his career in purely technical businesses was spending his money in sectors full of regulators, unions, and fuel prices. Whatever this was, it was not a CTO building a platform. It looked more like a citizen trying to fix the things in his own country that technology alone could not fix.
In January 2026, Cybercrime Magazine named him its Cybersecurity Person of the Year for 2025. The editors quoted a prediction he had made the year before, that the industry would see "tectonic shifts in 2025, unlike any we've seen in years past," and added: "In retrospect, Zuk was spot-on." Earlier honorees included the head of U.S. Cyber Command and the director of CISA. The man who wrote early viruses had become, in the magazine's word, a "hero."
Puddles
He called the new company Cylake. On March 5, 2026, it announced a $45 million seed round led by Greylock, the firm where he had been an entrepreneur in residence twenty-one years earlier. The other investors included Lightspeed, Redpoint, IQT, Asheem Chandna, who had introduced him to Rakesh Loonkar in 1999, and Loonkar himself, now investing through Picture Capital. Loonkar marked the occasion on LinkedIn with a photograph of Zuk at Loonkar's wedding "exactly 20 years ago," wearing an Indian kurta. Several commenters were delighted. One said that at first he thought the image was AI-generated.
Zuk's co-founders were Udi Shamir, a co-founder of SentinelOne, and Wilson Xu, a longtime Palo Alto engineering leader. Xu's name appears next to Rajiv Batra's in the title of a Palo Alto 8-K filing recording a leadership transition between the two. The people around Zuk had rearranged themselves into a familiar configuration.
The argument behind Cylake reverses the one he spent two decades making. "The industry has overrotated toward delivering everything in the cloud," he told Business Insider, "and that has left many of the most important customers stuck 20 years behind." These were governments, defense organizations, critical infrastructure operators, and banks: organizations running "air-gapped environments," as he put it to Pulse 2.0, "so they aren't even connected to the internet," or held back by regulation, or worried, increasingly, "about the geopolitical implications, especially of running or consuming a SaaS service from a US vendor." They were, he said, "stuck with 25-year-old on-premises products like Splunk and McAfee."
He knew this from experience. "I heard from customers over the years that they wish they could use the products that we were pitching to them, but they couldn't because they were in the cloud," he said. He had been the one pitching. The customers left behind by the cloud were customers his own company had left behind. He now intended to sell to them, with the same skeptics in the room making the opposite objection.
He also had a new word for the problem. Modern security products, he said, each collect their own data, which he called "puddles." Cloud security reads one set of APIs. IoT security reads network traffic. Detection runs in one tool and response in another. "So visibility, detection, response, and policy each operate on their own little data puddle." Cylake would put everything in one lake and run every function on top of it. It was the platform thesis again, the unified architecture he had drawn twenty years earlier, now built from scratch for customers who could not, or would not, send their data out of the building.
The thesis has a tension in it that he has partly stated himself. In April 2025, still Palo Alto's CTO, he told CRN that a new security startup competing against Palo Alto in the age of AI "is like trying to build a new search company and compete against Google. There's no way for you to get the data." In March 2025 he said: "Customers are buying fewer point solutions." Eleven months later he started a security company. The data moat he described belonged to the cloud vendors, whose AI improved as more customer data flowed to them. Cylake's customers, by definition, cannot send data to anyone. The bet is that sovereignty is a market the moat cannot reach. It is also a bet that the man who described the moat knows where it ends.
Investors took the bet, and then took it again at a larger size. In early September 2026, while a frontier AI lab was walking away from a multibillion-dollar Israeli acquisition after due diligence, an Israeli tech newsletter reported that Cylake had raised another $245 million. "A company with no shipping product, no customers you can call and no disclosed revenue," the newsletter wrote, "raised $245 million on the strength of one man's name." The platform was scheduled for general availability in early 2027.
Under Loonkar's celebratory post, a commenter named Edoardo Camerinelli wrote the most sensible thing anyone has said about the Zuk legend: "Not fully convinced three correct calls in a row is really the story worth telling here... What rarely makes it into posts like this, I think, is how many people made the same kind of contrarian inline-security bet and lost quietly... being early and being wrong look identical for the first few years either way."
He is right. The legend leaves things out: the ten percent drop after CyberArk, the bank still looking for funding, the newsroom that closed, the cloud transition that nearly went wrong, the critic who saw a marketing operation where others saw a revolution. The plate said killer, and the target is still running. Zuk is fifty-five now, with a fortune Forbes puts near $1.5 billion. He is again at the stage where he is early, and where, by Camerinelli's logic, no one can yet tell whether he is right.
He is building for rooms that are not connected to the outside world, where data cannot leave and nothing can get in except what someone carries through the door. He has worked in that kind of setting before. In Rehovot, around 1987, there was a Dragon 64 with a thirty-megabyte drive that a teenager had argued his parents into buying. It was connected to nothing. A program could only reach another machine on a floppy disk carried by hand, and on its screen the letters came loose, one at a time, and fell slowly down the screen.
Part IIThe Playbook
What follows is an attempt to separate the method from the myth. Zuk's career is easy to retell as one long contrarian bet that kept paying off, and Camerinelli's warning about survivorship bias applies to everything below. But the decisions themselves can be studied. Choosing to call the product a firewall, choosing to stay CTO, choosing a one-week proof of concept over a long sales cycle, choosing to buy instead of build: these were specific choices made under specific constraints. Taken together they form a consistent view of how to attack an established market from the inside. The principles below are drawn from that record, and several of them contain the cost of following them.
The principles
- 1.Name the enemy, then let the enemy become the cautionary tale.
- 2.Take the most contested word in your category.
- 3.Make the proof the pitch.
- 4.Treat "crazy" as a signal worth investigating.
- 5.Choose your altitude early.
- 6.Don't be a hero at scale.
- 7.Buy the urgency you can't create internally.
- 8.Plan for your greatest strength to stop working.
- 9.Keep the team small relative to the ambition.
- 10.Build where the data compounds.
- 11.Go back for the customers your success left behind.
- 12.Leave when the blueprint is finished, not when the work is.
Principle 1
Name the enemy, then let the enemy become the cautionary tale
The CHKPKLR plate was a joke and a strategy at once. It gave a scattered set of grievances, about a stagnant firewall market and a former employer focused on licensing, a single target that everyone could understand. Recruits knew what they were joining. Investors knew what they were funding. Sequoia said it had never seen "a drive to derail an incumbent" so clear. A named enemy clarifies the mission, and it does so without a mission statement.
The more important move came later. Zuk stopped treating Check Point as an opponent and started citing it as an example of what not to become. "If you end up like Check Point... you will get killed by a disruption." An opponent defines you by contrast. A cautionary tale defines what you must avoid becoming, which is a more useful standard once you are the incumbent. The 2009 blog post, with its "So sad. So sad," shows the shift starting. Underneath the anger was a warning to himself about what success can turn into.
Tactic: Name a specific incumbent your team is built to beat, and once you pass it, keep its decline posted where everyone can see it as the future you are working to avoid.
Principle 2
Take the most contested word in your category
The "F-word" debate is the best case study in Zuk's career. Calling the product an "application visibility and control tool" would have meant easier sales and immediate budget from a new line item, with no fight with the existing firewall vendor. Calling it a firewall meant hearing "we already have a firewall" in every first meeting. Zuk chose the harder word on purpose, because the word set the boundary of the market. A helper sits next to the incumbent's box. A firewall replaces it.
Gartner's 2009 definition of the next-generation firewall shows what was gained. The category was named on terms that matched the product, and the company spent the next decade in the leaders quadrant. The Anitian critique, "you have to make people THINK you're innovative," is the cost. Taking a contested word invites the charge that the word is doing the work. Zuk was reading Lakoff on framing. He knew the risk and accepted it.
Tactic: Before launch, write down the incumbent category your product will replace, and refuse every positioning option that lets buyers keep the incumbent and add you alongside it.
Principle 3
Make the proof the pitch
"Put our box on the network for a week." That offer was the whole sales method, and it reported a conversion rate above ninety percent. It worked because the product's main claim, you are blind to everything that isn't web or email, could be shown on the customer's own network in days. The demonstration did not just support the argument. The demonstration was the argument. The customer then took the report to the incumbent, the incumbent had no answer, and the incumbent ended up helping make the sale.
The lesson is not that every company should offer free trials. It is that the product should be designed so its value shows up quickly in the buyer's environment, and the sales organization should be built around getting into that environment. Zuk's team "focused on convincing customers to give us the opportunity." The goal was the trial. The trial closed the deal.
Tactic: Identify the single report your product can produce from the customer's own data within one week, and redesign your sales motion so its only goal is to get the customer to agree to run it.
Principle 4
Treat "crazy" as a signal worth investigating
"If everybody believes it shouldn't be done or it cannot be done or nobody would want it, then, you know, it's a good reason to do it." Taken literally, that is not a strategy but a temperament, and a dangerous one. The record suggests something more precise. Each of Zuk's contrarian calls rested on a technical reason the consensus was underweighting. Inline IPS: attacks had become too fast for detect-and-alert. Cloud-delivered analysis in 2005: one vendor's view across many customers would beat any single customer's local view. Cylake: regulators and air gaps are permanent features of the market, not temporary obstacles.
Loonkar's list of the smartest customers who "would never drop packets" is a reminder that the objection usually comes from the most sophisticated buyers. Their objections are informed. They are also tied to the architecture they already run. Camerinelli's counterpoint applies too: being early and being wrong look the same for years. The useful discipline is to require a specific technical reason the consensus is wrong, and not to treat disagreement as evidence on its own.
Tactic: When experts call your idea crazy, write down the one technical fact they are underweighting; if you cannot state it in a sentence, treat their objection as correct.
Principle 5
Choose your altitude early
"Tech people need to choose early in their career what they really want—to manage people or to manage technology." Zuk stayed CTO for twenty years, and he wrote that choice into his employment letter: you will continue to report to the Chief Executive Officer. His reasoning was about time: "any hour I spend dealing with shareholders, analysts, or human resource concerns is an hour I am not investing in the company's future."
The choice cost him formal authority. Arora put it plainly: "He is not the one who decides." In exchange he got to focus. He could spend two decades on architecture, write an angry blog post, go after a testing lab in the trade press, and draw the platform blueprint that CyberArk eventually completed. Founders who try to stay both chief architect and chief executive often end up shortchanging one of the two roles.
Z
Two Founders, Two Altitudes
Zuk's career is partly a running argument with the path he left behind.
| Decision | The incumbent's path | Zuk's path |
|---|---|---|
| Founder's role at scale | Developer-founder remains CEO for decades Risk | Founder stays CTO; hires an outside CEO Scale |
| Response to new threats | Repackage existing product as modular "blades" | Rebuild the core around application identity Try |
| Positioning against rivals | Defend the installed base | Billboard: "You Just Passed Check Point. So did we." Scan |
| Growth in the cloud era | Organic development | Roadmap filled through acquisition Scale |
Tactic: Decide now, in writing, whether your highest-leverage hours go to people or to the product, and design the org chart so the other job reports elsewhere.
Principle 6
Don't be a hero at scale
Sequoia's summary of Zuk's advice is blunt: if you have never scaled a company from tens of millions to hundreds, or from hundreds to billions, bring in someone who has. Zuk did this twice in spirit. Rajiv Batra built the engineering organization from his architecture, and Nikesh Arora ran a capital-allocation program that a founder-CTO would probably not have run. The choice of Arora is telling. He came from Google and SoftBank, not from security. The skill the company lacked was not knowledge of the domain but a willingness to spend billions buying the future.
This principle is not self-deprecation. Zuk is not modest about his technical judgment. It is a precise assessment of which skills matter at which stage. The founder who wrote the 2005 blueprint did not need to be the person who executed it at $10 billion in revenue. He needed to make sure that person shared the blueprint.
Tactic: List the next two orders of magnitude your company must grow through, and for each, name whether anyone on your leadership team has done it before; where nobody has, hire for that gap before you hit it.
Principle 7
Buy the urgency you can't create internally
"In a large company it's not life or death if something you develop is successful or not." This is the most original part of Zuk's view of acquisitions. It is not mainly about speed or talent. It is about incentives. A startup team building a cloud-security product has everything at stake. An internal team doing the same thing has a performance review at stake. Zuk had been the startup founder whose product the acquirer did not want on day one, and he built an acquisition strategy around valuing what Juniper had thrown away.
Arora's version, as Sequoia summarizes it, makes the leaders of acquired companies the drivers of product strategy, not the existing executive team, and does product-roadmap diligence before financial diligence. The 2024 admission, "we also overpaid probably," shows the cost. Urgency is expensive, and sometimes the buyer pays for it twice.
$
Buying the Roadmap
Selected acquisitions, showing the shift from in-house building to acquired urgency.
2014
Morta Security (founded by former NSA engineers) and Cyvera, for about $200 million.
2018
Evident.io for $300 million, the basis of Prisma Cloud. RedLock for $173 million. Arora arrives in June.
2019
Demisto ($560M), Twistlock ($410M), PureSec ($47M), Zingbox ($75M), Aporeto ($150M).
2020
CloudGenix ($420M), Crypsis Group ($265M), Expanse ($1.25B).
2023
Talon (about $625M) and Dig Security ($400M). Zuk later says "we also overpaid probably."
2025
Protect AI ($500M). CyberArk ($25B) announced; Zuk says it "completes the platform" and retires.
2026
CyberArk and Chronosphere ($3.35B) close; Koi Security (about $400M) and Portkey follow.
Tactic: For each roadmap gap, ask whether an internal team would lose anything real if it failed; if not, start acquisition conversations before you staff the project.
Principle 8
Plan for your greatest strength to stop working
Palo Alto built everything itself for a decade because integration was the product. The next-generation firewall's promise was one device doing everything seamlessly, and you cannot promise seamless operation across code you did not write. That conviction drove the early success, and according to Sequoia it "nearly caused them to miss the cloud era entirely." Zuk's own advice now, "Always embrace a disruption," is partly an account of how his company almost failed to do that.
The point is not that building in-house was wrong. It was correct for the conditions of 2007. The point is that the conditions had an expiration date nobody wrote down. A strength becomes a liability when the market changes and the organization's identity has formed around the old strength. The fix is to name your core strategy and the specific market condition that makes it work, then watch that condition.
Tactic: Write down your company's defining strategic habit next to the market condition that justifies it, and review that condition every quarter as if it were a key risk.
Principle 9
Keep the team small relative to the ambition
"We're making sure that we do as much as we can with the smallest team," Zuk said when the company had about 1,300 employees and was already the largest network security vendor in the world. "We're not one of those companies that becomes successful and then starts having to justify new products or strategies on a financial level." A small team was the condition for making decisions from the gut instead of through what he called a "bureaucratic process," which was the thing he had left Check Point and Juniper to escape.
His career shows a consistent dislike of large organizations: "Ask me to do anything but... Work for a big company." Since he did end up building a big company, the practical question was how to keep its decision-making from becoming big. Keeping engineering small, especially compared with sales, was one answer. Acquisitions, which brought in teams that still had startup instincts, were another.
Tactic: Set a ceiling on the size of your core architecture team and require every exception to be justified by a product that cannot ship without it, not by revenue growth.
Principle 10
Build where the data compounds
"If you have a lot of good data, your AI is better. And when you compete against other vendors, you win, and then you have more data. It just creates this positive feedback loop that other vendors cannot get into." Zuk's comparison of a new security startup to a new search engine competing with Google is self-serving, as CRN noted, but it is structurally sound. "There's just no way to buy that data. You have to collect it over many, many years."
This principle connects his platform thesis from 2005 to Cylake in 2026. Point products collect "puddles." Platforms collect lakes. In an AI-driven market, the lake is the moat. The useful refinement is Cylake itself: if the biggest lakes sit with cloud vendors, the next opportunity is wherever data cannot flow to them, such as air-gapped networks, sovereign infrastructure, and regulated rooms. Every moat has an edge, and the edge is a market.
Tactic: Map where your customers' data cannot legally or physically go, and ask whether a product built entirely inside that boundary could win against vendors who depend on data leaving it.
Principle 11
Go back for the customers your success left behind
"I heard from customers over the years that they wish they could use the products that we were pitching to them, but they couldn't because they were in the cloud." Every major platform shift leaves a set of customers stranded. Palo Alto led the move to cloud delivery, and that move left governments, defense organizations, and heavily regulated institutions "stuck with 25-year-old on-premises products." Zuk heard those objections as a CTO and kept them as a founder.
This is the most portable lesson in his later career. The incumbent you helped create will optimize for the customers who moved with it. The ones who could not move, because of regulation, physics, or geopolitics, are a market defined by your own past success. You understand their objections better than anyone, because you were the one they objected to.
Tactic: Pull the list of deals your current company lost for architectural reasons rather than price or features, and treat it as a market sizing exercise.
Principle 12
Leave when the blueprint is finished, not when the work is
Zuk's retirement explanation was unusually specific. He did not cite family, fatigue, or a desire to "explore new opportunities." He listed the platform's components, network, endpoint, SOC, automation, cloud, identity, AI, email, vulnerability management, and said they matched what he had drawn twenty years earlier. "Which is what I set to do 20 years ago... And now I can retire from Palo Alto Networks with peace." The finish line had been defined at the start, so he could recognize it when he reached it.
This approach has a cost. Calcalist noted the odd timing: the founder left just as the company made its riskiest acquisition, with integration ahead and the stock down. Leaving when the blueprint is done is not the same as leaving when the risk is done. But it gives a founder something most never have, which is a clear reason to stop. Without that, founders tend to stay until they become the bureaucracy they once left.
Tactic: Write your company's complete architecture, the full set of components that would mean the vision is achieved, and store it where you will read it again in ten years.
Free playbook
Get The Business Model Playbook
58 business models, one visual page each: how the money flows, the metrics that matter, and who runs it. Free when you join the Faster Than Normal email.
Free. No spam. Unsubscribe anytime.
Part IIIQuotes and Maxims
In their words
— Nir Zuk, to AllThingsD, July 20, 2012, the day of the IPOI think the industry has been sleeping a bit, despite the efforts of hackers, who never do.
— Nir Zuk, to Calcalist, November 2019As far as I'm concerned, managing people is a waste of time. I'm not good at it, I don't like it, and I think that tech people need to choose early in their career what they really want—to manage people or to manage technology.
— Nir Zuk, at Mind the Tech London, September 2024In a large company it's not life or death if something you develop is successful or not.
— Nir Zuk, to CRN, at Ignite on Tour, New York, 2025I think that today, competing against a large vendor like Palo Alto Networks in the cybersecurity space, especially given the [expansion of] AI, is like trying to build a new search company and compete against Google. There's no way for you to get the data.
— Nir Zuk, to Business Insider, on founding Cylake, March 2026The industry has overrotated toward delivering everything in the cloud, and that has left many of the most important customers stuck 20 years behind.
Maxims
- Fit the mission on a license plate. If your strategy can't be compressed to seven characters, your team can't hold it in their heads either.
- Fight for the category name. Positioning that lets buyers keep the incumbent will keep you a helper permanently.
- Get the box on the network. One week of the customer's own data is worth more than a quarter of persuasion.
- Require a reason before you believe in "crazy." Contrarianism is only useful when you can name the fact the consensus is missing.
- Pick people or technology, then structure around the choice. The hours a founder spends on the wrong one never come back.
- Hire scale you haven't lived. Admitting you have never run a company at the next size is a strength, not a weakness.
- Acquire the people who have everything at stake. Urgency is the one asset a large company cannot produce internally.
- Write down when your strength expires. Every winning habit depends on a market condition, so watch the condition, not the habit.
- Sell to the people your success left behind. Your company's lost deals are the outline of your next market.
- Define the finish line before you start. A founder who knows what "done" looks like can leave in peace instead of staying out of habit.
