Palo Alto Networks Rode a Ransomware Simulation to a $265B Market Cap — in 25 Minutes

Twenty-five minutes: that’s how long Palo Alto Networks’ Unit 42 researchers took to simulate a complete ransomware campaign, from initial entry to data exfiltration — against a typical enterprise detection timeline measured in days. Jason Lemkin’s breakdown uses that gap to explain why CEO Nikesh Arora argues AI is raising cybersecurity’s terminal value rather than compressing it: AI agents generate far more east-west network traffic requiring inline inspection, which Arora credits with driving hardware’s best quarter in ten years even as the company’s business has otherwise gone all-in on platform consolidation.

The numbers behind that platform bet are substantial. Palo Alto now runs at an $11.4 billion revenue rate across roughly 70,000 customers, built through 20+ acquisitions across five pillars: Strata network security and SASE (SASE ARR at $1.6B, growing 40%), Cortex/XSIAM security operations ($600M+ ARR, growing 100%), Cortex Cloud, CyberArk identity security (acquired February 2026 for $25 billion), and Chronosphere observability (acquired January 2026 for $3.35 billion). The stock roughly doubled over twelve months to an all-time high of $368.80 in July, after briefly falling to $139 on the weight of roughly $29 billion in acquisition spending, a GAAP loss, and about 14% shareholder dilution — before the core business reaccelerated and pushed the market cap to around $265 billion.

The speed argument isn’t isolated to one vendor. OpenAI’s own Daybreak cybersecurity program reports its specialized GPT-5.6-Cyber model completing roughly 95% of sensitive cybersecurity research requests, versus 1.5-2% for standard-access models — and says it’s already used the model to surface previously unknown vulnerabilities in Chrome’s V8 engine. Arora’s “terminal value” framing and OpenAI’s own capability jump are describing the same compression from opposite sides of the fence: AI is shortening both how fast attacks execute and how fast defenders can respond, and platform vendors betting on inline, automated detection are the ones capital is rewarding for it.