Inside Nikesh Arora’s Deals Hunt for Palo Alto Networks

Palo Alto Networks CEO Nikesh Arora has never shied away from deals, acquiring more than 40 companies in the eight years since he took the helm of the world’s biggest standalone cybersecurity firm. But over the past 18 months, Arora’s appetite for acquisitions has reached a new fever pitch as he expanded the company’s products to handle new AI threats as well as capture more revenue from existing customers.

For instance, he explored acquiring Datadog, which sells software that helps businesses identify security threats and monitor how cloud applications perform, and Okta, which helps companies ensure workers have access to the right systems, according to two people with knowledge of the situation.

Arora had fallback plans when those two potential deals didn’t pan out. In February, Palo Alto Networks paid $25 billion to buy CyberArk, an identity software firm that competes with Okta in some areas. And in January it paid $3.35 billion for Chronosphere, a smaller competitor to Datadog.

Behind Arora’s dealmaking is his conviction that AI will fundamentally change how companies protect IT systems against cyber threats by requiring that companies constantly monitor their systems to ward off AI agents that can now pull off hacks that humans never could. By adding a variety of new services, he also wants to convince enterprises to expand their budgets with Palo Alto Networks at the expense of rivals Fortinet, Zscaler, Microsoft and Cisco, according to people who have spoken to Palo Alto Networks executives.

Arora is currently interested in potentially acquiring products that complement Chronosphere by helping companies cut the cost of analyzing their log data and databases, according to a person with knowledge of his thinking. Companies that sell such products include Cribl, a startup valued at $3.5 billion after its last funding two years ago, and ClickHouse, valued at $15 billion after a funding round in January, said the person.

More recently, Arora has been exploring potential deals in AI security, including firms that make products designed to help companies protect against cyberattacks that target the AI their employees are using, another person said.

But its AI product ambitions seem broader; in May, Palo Alto Networks bought Portkey, a so-called router or gateway that helps companies use AI models from multiple providers and monitor usage and spending, for hundreds of millions of dollars, according to someone with direct knowledge of the deal size.

A Palo Alto Networks spokesperson said the company doesn’t comment about “rumors or speculation.” Spokespeople for Datadog and Okta didn’t comment.

Arora’s “platformization” strategy to get more businesses to buy a suite of products is a work in progress. But Palo Alto Networks’ shares are up 90% this year, giving it a nearly $280 billion market capitalization, as AI’s increasing ability to spot software vulnerabilities has prompted companies to pay more for security. Arora has told shareholders that revenue from AI-related products is growing quickly but the company hasn’t yet broken out exact revenue from such sales. The company reports its July quarter earnings next week.

Shares of competing firms such as CrowdStrike and Fortinet have also performed well this year. CrowdStrike has been buying companies that resemble the ones Palo Alto Networks has bought, though CrowdStrike’s deals have had much lower prices. Microsoft, meanwhile, is overhauling its security business to make AI-powered security tools a selling point for its broader suite of traditional security products.

“The consolidation wave is real, especially as these firms rethink what security solutions look like in the age of AI,” said Menlo Ventures partner Rama Sekhar, who said he expects “at least three or four” more major acquisitions of AI-focused security firms.

Arora joined Palo Alto Networks in 2018, after years spent as Google’s chief business officer and a two-year stint as president of SoftBank.

Before Arora began his effort to strike megadeals last year, he had only done smaller acquisitions, generally worth less than $1 billion, while at Palo Alto Networks.

In late 2024, Arora had his eyes on identity security, a subset in cybersecurity that manages employees’ logins to make sure that they (and the AI tools they’re using) only access the data they’re supposed to. With lots of established competitors in the field, including Microsoft, Okta and CyberArk, Arora felt he needed to do a big deal to have a real seat at the table, according to a person familiar with his thinking.

That led Arora to approach Okta. Between late 2024 to early 2025, Arora held a series of meetings with Todd McKinnon, CEO of Okta, which was valued at about $13.5 billion at the start of last year, according to two people with knowledge of the talks. These talks progressed to a point where the companies discussed how their products could potentially complement each other, but ultimately stalled after the companies couldn’t agree on a price, these people said.

By July, Palo Alto Networks agreed to acquire CyberArk, another publicly traded identity software firm for $25 billion. (Okta shares are up about 30% since July of last year, giving it a $23 billion market capitalization.)

In the spring of 2025, Arora met with Datadog CEO Olivier Pomel and pitched him on a hypothetical acquisition of Datadog, which was publicly valued at more than $40 billion at the time, according to someone with knowledge of the situation. Pomel wasn’t receptive and the talks never resulted in a formal offer, this person said, eventually leading Arora to pursue Chronosphere instead.

Since then, Datadog’s market capitalization has roughly doubled to more than $80 billion, making it even less likely that Pomel would consider such a tie-up.

In June, Palo Alto Networks said Chronosphere and CyberArk contributed $338 million of the $3 billion in revenue the company generated in the April quarter.

Companies have been raising their cybersecurity budgets to protect against new threats from AI, and both Anthropic and OpenAI are selling AI-powered cybersecurity products that aim to discover and patch vulnerabilities. Anthropic in May launched Mythos, which companies have used to find vulnerabilities in their systems, and OpenAI last month said its AI had hacked its own systems and those of Hugging Face and other app developers, underscoring the threat other businesses may face.

Palo Alto Networks uses models from Anthropic and OpenAI for research and to power some products for customers, but it’s racing to launch more of its own.

For instance, Palo Alto Networks recently developed a product that uses AI as well as data observability features from Chronosphere to scan companies’ IT systems and detect potential AI threats in a matter of minutes, said a person with knowledge of the product, which hasn’t been announced. More than 600 of Palo Alto Networks’ customers, including FedEx, Home Depot, and DHL, are already using it, this person said.