Palo Alto Networks tries to stay agile by maintaining a startup mentality

Palo Alto Networks, launched in 2005, went public in 2012 and today is a $124 billion company. Yet in spite of being a mature organization, it tries to organize itself in small groups, mini startups in a sense, an approach designed to operate with more agility and flexibility.

Over time, the company’s mission has expanded well beyond its firewall security roots. Through a steady stream of acquisitions, it’s been building out a broader platform of security services.  Since acquiring its first company in 2014, it has purchased a total of 22 companies so far, per Tracxn, most of which were startups.

This approach requires a clear understanding of what the company can build internally and when external acquisitions make more sense. We spoke with Chief Product Officer Lee Klarich, who has been with the company since its earliest days, about the evolution of his role and the strategies for scaling the company without losing the ability to move fast.

Empowering employees

Klarich has been with the company long enough that he’s gone from supervising nobody to leading a 5000 person team. He believes that the key to managing such a large group without micromanaging is empowering them to make decisions. “If you hire people, and you tell them what to do every day, you're not going to get the best people. No one really wants that."

He says by giving employees a sense of independence, it  allows them to maintain that startup mentality, even in a company that’s been around for two decades. “I still think of the organization as almost like a bunch of mini startups,” Klarich told FastForward. “In startups, in my mind anyway, you enable people, but you hold them accountable, and you give them responsibility. That's the only way to both move fast and build.”

He recognizes that as companies get bigger, process can get in the way of innovation, and by delegating responsibility to his employees, and minimizing process to the extent possible, he can keep his company fresh and coming up with new ideas. 

Building an integrated set of services

While Palo Alto was originally a firewall security product, over time it became a platform in order to cover a broader array of security services. While Klarich prefers to think of platformization in terms of integration, that’s the direction that the company has taken over the years.

“In those early days, we wanted to take network security as a sort of class of products, and we wanted to talk about it in a far more integrated approach than anyone had done before,” he said. It wasn't simply about having multiple capabilities. It was how they fit together to make the overall solution better.

In startups, in my mind anyway, you enable people, but you hold them accountable, and you give them responsibility. That's the only way to both move fast and build.

“So if a customer turns on, let's say the IPS (intrusion prevention system) capabilities on the firewall, it's about how the IPS capabilities get better because they're part of the firewall, and how the firewall gets better because it has IPS capabilities,” he said.

That meant as they started making acquisitions, they needed to consider how the new company’s tooling fit into the existing set of services instead of having a certain functionality for the sake of having it and checking a box. “We have to think about not just how fast we can get new functionality to market, but how fast we can get it to market in an integrated approach,” he said.

When to acquire

That philosophy of integration also plays a key role in how the organization approaches acquisitions. As the company became more acquisitive over the years, Klarich’s job expanded to look at the range of solutions available in the market, decide whether to build or to buy and then how to integrate the acquired companies into the broader organization.

He says it all starts with talking with customers and finding out what they need. From those discussions, he may start exploring companies, including startups, that are already working on the problem, or he could begin thinking about how they could build it themselves. 

If the functionality is related directly to underlying platform capabilities, he would lean towards building, but there are cases where there is unique expertise that is needed, and acquiring would be faster than trying to build up the expertise in-house. “If you look across the different acquisitions, you'll see we've done more acquisitions in new areas like cloud security, than we have in, say, network security, which I think makes sense given our roots,” he said.

There is also a speed element in a rapidly changing market. “There are times where acquisitions allow us to move faster than if we were to build it organically,” Klarich said. A case in point is last week’s acquisition of Protect AI (a boldstart portfolio company).

The company announced its intent to acquire the startup to get a jump start on, well, protecting AI. When the deal, which is subject to normal regulatory oversight, closes, it will provide Palto Alto with a talented group of employees, who have been working on model security for over three years.

The plan is to fold Protect's 120-person team, including the founders, into the Prisma AIRS product group, Palo Alto’s in-house AI security solution announced just last week at the annual RSA conference. This acquisition should help the company accelerate that vision and build on their in-house efforts.

Whether building or buying, Palo Alto takes its cues from customers, then boosts in-house engineering efforts with strategic acquisitions to keep on top of an ever-shifting market. Klarich manages his large staff by maintaining a startup mentality that enables the company to keep innovating – even after almost two decades on the job.

Feature photo by Ron Miller