Palo Alto Networks, Inc. (PANW) Earnings Call Transcript & Summary

Right? Just to pivot off that for a second as well, too, because just walking around this conference, almost every booth has a reference to AI, right? And so we know it's out there. We know it's fair to say. But now I feel like this year is the year of show me the value, right? So we know it can do all these things with HR and business processes that we can help the supply chain and endless number of things that AI can do for a business, especially for retail. But what is the value? And how do I implement that safely, securely and enable the business while also protecting it and the data that's in it as well?

I think that's a theme I didn't mention earlier. We see a lot of our customers starting on internal use cases first. So it gives you kind of a safe, secure environment to test out generative on kind of internal associate chatbots, on your core functions and in the security space. So then those governance councils or, however, your team has kind of orchestrated the oversight, then start to get feedback, you can identify more risks and threats and it's kind of a nice way to wade yourself in Because in retail, everybody has been using AI for a long time. We've had recommendations engines. A lot of them weren't generative, but you have teams and people and processes that have been thinking about it. It is now just kind of an expansion of that capability. And so flexing a couple of new muscles. We also see people have very different teams engaged in generative. So when you think about prompt engineering, we're seeing retailers, as an example, bring in their UX and UI team. And just teams that think about the problem differently who might not have thought about some of these different factors. And so kind of getting everybody up to speed on what to be thinking about from a data privacy and protection and then a cybersecurity element. So it's kind of new and old, but an expansion of skill set for everybody to think through. And it's important to call out because you don't want to think, oh, this is just like what I was doing before, which was a lot of closed loop AI in your digital experience and now language models really exposing you to a much broader corpus of data and list of threats.

Carrie, you bring up an interesting point about just kind of the intersection of skill sets needed now. And so, Diane, I want to turn that question back to you, just in the sense of organizational structure, retail, I think, is unique because oftentimes you have loss prevention, who is also at the intersection of cybersecurity professionals who in many other industries would be siloed off, right, completely. So I'm curious, are you seeing now a need organizationally to combine also AI skill sets? Are there any kind of new skill sets maybe you're bringing on to the team that are critical to really effectively protecting your enterprise?

Ulta has an advantage. We bought a company about 5 years ago called Quasi and we've been using AI. If you ever go to our Ulta app, you can try on makeup, you can try all different hairstyles, and that's all AI-driven. And that was from this company. So we've already been playing in that area. So from an AI perspective, we have controls because it's really hard to put controls in place, but very sophisticated mature program when it comes to that. The problem is when it comes to the GenAI side of it and we were talking about the governance piece of it, it's because -- I think, the organizations are going slow to put in those guardrails for people. People don't want to wait, as we know with the -- how technology is today, everybody has a cell phone, everybody has a computer. People aren't waiting for that guidance. And that's the scary part that we need to find the skills to find -- to learn how to investigate that. Because one of the things when AI -- this whole GenAI first came out, it was -- a few of our vendors reached out and they're like, "Oh, we can protect you from GenAI " I'm like, okay, show me how, but they really can't. They're just taking basically what they have and restructuring just a little bit. So, therefore, your skills like you were talking about that now rely back on your risk management teams and also our data governance team, we are in lockstep with our data governance team and how to educate them. But -- and that's where we hope we rely on. At some point, we realize we need our partners, we need the Googles, the Microsofts, the Palo Alto people to help us. That's what we need because you've been playing -- you've been doing this as part of your tooling for a long time and that's where, I think, a lot of us are looking for that guidance, to your point, is what skills do they need? I mean I have very good threat hunters. I have great investigators, but is there a different skill they need to be able to identify that type of traffic across your network.

Right, right. You're spot on just in terms of kind of not only the ecosystem, right, that needs to exist and that you depend on and any organization does, but really the fact that we like to say, cybersecurity is a team sport, right? It relies on so many different skill sets to get the job done. So, Nicole, I'd love to hear what your perspective is at Kroger, just in the sense of how are you organizing your team? Are there new skill sets that you're needing to bring on? Are there new challenges that your team is facing?

Sure. So with my team, particularly, we have such a diverse background. And I handpick those people for their background, right? We have HR, we have law enforcement, we have dark web, brand monitoring, marketing. And that all plays into how we protect the company. My team reaches out across multiple orgs within Kroger, one of which, as you mentioned earlier, was that physical security, organized retail crime perspective. And more and more, we're seeing a shift of cybersecurity also touches the physical security space. And so my team is regularly working with our asset protection folks, our organized retail crime folks in making sure that we understand where each other play. And so if they're seeing a threat in the store from a physical security perspective, maybe gift cards [ broad ] for example. We can see that on the back end in the cyberspace. You think about an account takeover, you mentioned loyalty payments. We see that come into the physical aspect because then it transfers to actual products in the store being stolen, obviously, and then resold online or used by the threat actor. We think about skimmers in the store as well. There's a physical aspect to those too that we have to work hand in hand with those teams and it's so important nowadays. If your cybersecurity team is not working with asset protection and your organized retail crime and physical security, you really need to start that conversation. We're regularly -- I would say, probably weekly working with those teams on those threats. So it's great to have a diverse set of backgrounds on your team, but you also have to understand where you can reach out to within your org to get those skill sets if they're not on your team already.

Right. No doubt about that. So sticking with some of your latter comments about this organized crime, right, what are some of the trends that you're seeing today in stores? Or anything new that has come up in the last, say, 6 months that has caught you by surprise?

So I would say, obviously, the theft in the stores is a big one more Diane was talking about it.

You mean physical theft, right?

Physical theft, correct. We were talking about it earlier. We're seeing just different pieces of store. For Kroger, it's the diapers, the Formula, the laundry detergent, alcohol. And we're starting to have to put some of those behind the counter or you transition to a lock-proof system. Diane was sharing how they do that as well. And it's unfortunate, but it's the reality of where we live today. And so how do we, again going back to the customer experience, make sure that we are protecting the bottom dollar with the company, but also not making it a bad experience in-store for our customers. So yes.

And, I think, this is one of those areas that NRF is also thinking about. So how do you apply vision and data looking at these problems. So using vision to start understanding kind of common swipe motions, how they're going after these. And so in the past, a lot of times, most retailers have a policy not to intervene. It's a safety issue for your associates. There's always somebody that wants to step in and be a hero and then you hear on the news, there's some tragic situation at retail. And so part of the challenge is a lot of times what they're stealing in an individual case is not going to be a felony. And so how do we apply data and start using vision to look at, how do we aggregate things that are happening, so it becomes a felony faster. So this is not to say we're at an end solution, but it's starting to use the technology capabilities to help retail combat some of these issues because there's certainly no sign that this is going to abate and get easier. So you're seeing kind of more crews and efforts and things that I think just in the last couple of years that we weren't dealing with as much 10 years ago. So I'm excited to see how technology can start to chip away at that element and hopefully make it a little bit easier for retail to be operating. I think it's heartbreaking from an industry perspective as you hear about store closures and where retail just can't operate in certain environments. And so how do we point technology at those problems and get to a solution faster?

So, I think, there's one way where AI has really -- is going to be able to help us a lot. So we actually have a bot management solution and our bot management solution was able to detect that we had some bad actors out there scanning for a very expensive hair dryer, I won't call it out by name. And they were scanning our inventories trying to find out where they were. And we were able to discern with this company's help that -- which stores they are going to go steal the products from. And this store was able to go pull those products off the shelf and prevent that loss. So here's another way that the intelligence that we get and the information that we receive in IT helped loss prevention. We're like, we're lockstep with our fraud teams because usually, there's just commonalities between the bad actors. But that -- I think that is what, from a technology -- from an IT security perspective, that's what we're looking for our vendors to help us with, is that's how you can use AI. Start taking -- you have that data, you can see what people are doing, take that data and then turn your mindset a little bit because you're about -- you're saying, okay, I'm just looking for bad actors doing x. Well, you actually have so much your point of the data out there, take that data and see what else you can do with it because it was for this company, it was actually an employee challenge. They bring all their employees together once a year, and they gave them a challenge, and they said, what else can we do with this data that we have? And they're like -- and so they sat in a room like all day long, and these engineers came up with this idea. Well, why don't we start looking for other trends? And not just think about threat, threat, threat, IOC, IOC, but look at all that data. And I think from a value perspective, I think that's where we really see a lot of help as an organization is, we can't do that ourselves. I mean, I can train somebody, but then I don't need your tools. It's like so -- but we -- and we don't have staff big enough for all that. And that's where I think we become very dependent on making sure companies like Palo and Google, that are out there always doing research. I love when people show us how much they spend in R&D. That just means you're investing in it and you're listening to us and you're making changes in your products because we need help. Organized crime, as Nicole and I were talking about, we put in those cases, but we have fragrance, she has alcohol, we have fragrance, they'll break open the cases. I mean they'll come in there with a hammer because they come in quarter to 9 at night when you close and they'll break the cases open. And it's like, what else do you do? I mean at some point, like you said besides close your stores. You start closing your -- the State of California is not going to have a single store left pretty soon because of they have such threat rate out and there's the organized crime in California is just amazing. So -- right?

Well, Diane, I think you bring up such a great point and something that's so difficult for the cybersecurity industry in general, which is kind of quantifying the actual impact that we have as security professionals to the bottom line. And so I love the story that you highlighted of, hey, our teams identified that this theft was potentially about to happen and these stores were targeted and able to remove product, right, in order -- in advance to prevent that. We have a few minutes left, and I'd love to open the floor to the audience to ask a couple of questions because we've got such a great panel of experience here. So yes, sir, we do have mic runners, but while we're waiting for them, may be you can shout out your question and I'll repeat it.

Yes. My name is [indiscernible].

Yes. So maybe, Carrie, I'll turn that to you first. So for anyone who didn't hear, the question was about just an ever-changing landscape in terms of new technologies, and is there a framework that maybe you're using in your organizations to help identify what's next, what you're taking into practice and how you're dealing with that?

Yes. I'd actually love to throw that to Nicole and Diane first because I think as kind of buyers, your framework is most important, and then I'll just add some thoughts.

Yes. So for me, particularly, if I'm looking at a new product and solution, it is what is the value to me. So there are a whole host of new solutions out there. But what is it doing differently than what I currently have in place because if I have to spend the time in the engineering personnel on the back end to implement that tool. How do I do that and then also show value to that tool? And so for me, it has to have that plus add that bonus on the back end, once we implement it how is it going to help solve something that we haven't seen before or a gap that we haven't previously identified.

And also the other point to me on that one is we're looking for a multipurpose tool. That Swiss Army Knife is always I want. But I -- it's really hard when a vendor comes and they sell you one tiny piece of it, because to me it's like they're not looking at the big picture because there's more to security than just that one small piece. There is more to anything in retail. And one of the things that we're always looking for, like I said, how they can bring that extra value to the organization. And that's why I love when with the Palos and the Googles, they're always looking at companies. They're always bringing in new companies that they can help us support them. And for me especially with remote workers that is the toughest thing that we have right now as remote workers. And during our -- during COVID, we actually switched, we put in an EDR product. And that EDR does so much for us. And I didn't realize going away from a simple, like, antivirus application that was all based on signatures, go into a behavioral analysis tool could help us so much. It was just amazing. And then they continue to add little pieces to their product that you don't even know until they're like, "Oh, by the way, you can do this now." And you're like, "Oh my gosh." If you're doing an investigation on somebody, it's like, Oh yes, we can show you their whole Internet history now like, you're an EDR tool. And they're like, Yes, but they can do it now. And that's what I -- we're constantly looking for. I always tell vendors and like, if you want to sell something to me, question you should be asking is, how do you make my life easier, like Nicole was saying, if you're not going to bring value and make my life easier, I'm not interested. And if my team is going to spend 6 months rolling out your product, I don't want to do that. I don't have 6 months' worth of time to do things. So that's kind of the approach that we take.

So then I would just add really quickly on that. In the context of generative, it matters how big the corpus of information is. And so we actually lecture all the time that a bigger model is not always better, depending on the topic. But when it comes to security, it is. So Chronicle is something we've built as an example. It was built to protect Google and so can handle anything at scale and looking across all these threats. So really understanding that. And then we haven't really touched on one of the dynamics of the retail. A lot of folks are diversifying their businesses. So a lot of you have kind of banking or credit cards involved, health care embedded into kind of your value proposition in grocery. And so you're only as secure as your least secure element. And so making sure when you're looking at any of these tools, it is the -- what have you done for me lately, you show me the money type of response. But also making sure that it can handle a very complex e-com stack, martech stack and understand the different dynamics you may be introducing from the architecture of the stack itself. So really looking at -- point solutions often can be very high performance and you can get really good measures, but sometimes not always as good as looking across the whole ecosystem. So just kind of looking at the makeup of your organization and stack.

All right. Yes, one more question. Thank you.

Hope King from Axios. Just awesome topic and just awesome that you're all women just have to say that. It's really cool. I wanted to be here to hear you guys. I'm sorry, I came in a little bit late. So would it be possible just to maybe go through some of the trends of where these cyberattacks are coming from maybe in the last couple of years? And then specifically, I think you mentioned at Kroger that employees were sort of a problem when it comes to theft. Is that right? Did I hear that right? Or I'm hearing from others that maybe employees are part of the shrink issue. So those 2 questions.

Right. Perhaps, Nicole, should we start with you?

Sure. So I'll tackle that first. No, I was not meaning to say that employees were part of the problem. I mean, it certainly is a possibility, right? So there's always that. But no, that's not the trend that we're seeing. For your other question, we're really seeing it across the board. So one of the things that we like to do is do that historical correlation and really understand where the attacks are coming from. And although I don't like to specifically say it's probably better topic for you, Wendi, and what you're seeing across all the landscape, but we do see definitely targeted threats from specific countries, from specific threat actors.

Yes. I'm happy to take that one. So I think I would categorize it in 3 ways, speed, scale and sophistication. So we're seeing increased speed in particularly the effort. So widespread vulnerabilities being now the #1 initial infection vector, which is very different than social engineering, which -- spearfishing, which has been for decades now, right? So with that then comes increased speed to like [ definition ]. So if we're talking about a ransomware attack or we're talking about data exfiltration, it's oftentimes now within hours instead of days or weeks or months. In many of these cases, I think scale really speaks to the widespread use of vulnerabilities that we see leveraged, right? So even -- it's not just nation-state actors, it's often now cyber criminals who are widespread using, like we look at MOVEit, 3CX, any of the major vulnerabilities that were exploited over the past year, and we're continuing to see that. And then on the sophistication side, it's not so much just the security teams, right? Now we're talking about help desk who need to be really well educated on how to effectively combat identity verification challenges. We're seeing these attackers specifically in the cyber criminal space, really have an understanding of business-to-business relationship. So how an Ulta or a Kroger or Google may work with their vendors who have access to certain types of systems and credentials within their environment, how they onboard those organizations, how they offer them and specifically looking for vulnerable windows within those time frames to be able to take advantage of those types of attacks. So within the retail space, and I think you add on the complexity of the actual physical attacks to stores, the need for consumers to have access to their data and be able to conduct transactions seamlessly, whether it's on the online platforms or the physical space as well. So just a huge amount of added complexity, I think, within the retail landscape. And then you're all managing the challenges of what it's like to run an organization internally and make sure all your employees accessing corporate devices and in store and other locations, right, are trying to keep all of those transactions secure at all times. So that said, we are at time. I want to thank you to everyone who joined us today. Certainly, thank you to our panelists who have provided such amazing insights into how your organizations are running and the retail landscape. So thank you, everyone.