Palo Alto Networks has placed a striking figure on the cybersecurity challenge created by artificial intelligence: approximately $1 trillion of global cybersecurity debt may need to be modernized as attacks move toward machine speed.

The estimate came from CEO Nikesh Arora during Palo Alto Networks’ Q4 FY2026 earnings call on 1 September. His argument was broader than a conventional call for technology refresh. According to Arora, the fundamental constraint in cybersecurity is shifting from whether organizations can see threats to whether they can detect, understand and contain them quickly enough.

That distinction deserves attention from CISOs.

The AI era does not necessarily make existing security controls irrelevant. It makes latency between those controls increasingly dangerous.

From security visibility to security velocity

Palo Alto Networks describes the arrival of more capable cyber-focused AI models as an inflection point. Vulnerabilities and persistent misconfigurations that may once have taken human attackers weeks or months to identify can increasingly be discovered and exploited much faster.

In the earnings transcript, Arora characterizes this shift explicitly: the security challenge is moving “from visibility to velocity”, with organizations needing to identify exposures before they are weaponized and respond at machine speed.

This changes the meaning of cybersecurity maturity.

An organization may have endpoint protection, SIEM, identity monitoring, cloud-security tools, vulnerability management and network controls. Yet if information from those systems requires manual correlation and several human handoffs before containment occurs, the architecture still operates at human speed.

Palo Alto argues that AI-assisted security platforms can reduce response times from days to minutes by processing telemetry collectively and triggering remediation faster. The company presents platformization as its preferred solution, but the underlying principle is more important than any particular vendor strategy: detection without sufficiently rapid action is becoming inadequate.

The meaning of the $1 trillion cybersecurity debt

Arora’s $1 trillion figure should be understood for what it is: a strategic estimate from one of the world’s largest cybersecurity vendors, not an independently audited measurement of global obsolete infrastructure.

Palo Alto also has an obvious commercial interest in encouraging modernization and consolidation.

Nevertheless, the underlying argument is difficult to dismiss.

Arora stated that cyberattacks are increasingly operating at machine speed and that fragmented legacy tools are therefore becoming less suitable for real-time defense. Palo Alto describes the accumulated modernization requirement as approximately $1 trillion of global cybersecurity debt.

The debt is not simply old firewalls or unsupported software.

It also exists in architecture.

A modern EDR system that generates an excellent alert but waits 40 minutes for human investigation contributes to operational latency. The same applies when an identity platform detects abnormal authentication but a separate team must manually disable the account, or when vulnerability intelligence identifies active exploitation but remediation remains trapped in a weekly patching cycle.

In the AI era, those delays increasingly become part of the attack surface.

Agentic AI adds an entirely new identity layer

The second major development in Palo Alto’s transcript concerns autonomous agents.

The company reports that agentic traffic observed across its SASE platform increased ninefold in only nine months. Palo Alto expects this traffic to continue expanding as enterprises move AI systems from experimentation into production.

This is more than additional network traffic.

Each agent may require credentials, data access, application permissions and tools. Palo Alto describes this as a new class of machine identities with autonomous permissions.

Traditional machine identities normally execute relatively predictable workloads. An AI agent is different because it may reason about which actions to perform next.

That combination creates a new governance problem:

identity + permission + autonomy.

Palo Alto warns that enterprises may deploy thousands of autonomous entities while many remain outside formal governance or operate with poorly scoped permissions.

For CISOs, this should accelerate the convergence between AI governance and identity security.

An enterprise needs visibility not only into which models are being used, but into which agents exist, which identities they use, what credentials they possess, what systems they can reach and how their authority can be revoked.

AI inventories that record only vendor, model and business owner will increasingly be insufficient.

Machine-speed attacks require machine-speed containment

One of the most relevant comparisons in Palo Alto’s earnings call concerns incident-response speed.

Unit 42 reportedly simulated an AI-driven attack that completed in under 30 minutes. Palo Alto contrasted that with what it characterized as an industry-standard defensive response measured in days. The company says customers using XSIAM have reduced mean time to respond to below ten minutes.

Vendor performance claims should always be interpreted carefully, but the strategic implication remains sound.

A SOC can no longer judge its effectiveness only by whether an attack was eventually detected.

It increasingly matters whether defensive automation can complete the sequence:

detect → correlate → decide → contain

before the attacker completes:

discover → exploit → escalate → move laterally.

This is where the discussion moves beyond traditional security-product metrics.

The most important measurement becomes operational resilience under time pressure.

Why the Automated Resilience Index becomes relevant

This transition closely reflects the principle behind the Automated Resilience Index (ARI) proposed by Gianclaudio Moresi.

ARI was introduced to measure security effectiveness through three dimensions: containment success, automation efficiency and Mean Time to Neutralization. Rather than concentrating only on whether a control exists or whether an alert was generated, the model focuses on how quickly and how autonomously the security ecosystem can neutralize a threat.

The connection with Palo Alto’s argument is significant.

If AI compresses attack timelines from days toward minutes, security maturity must increasingly measure whether defenses can compress their own response timeline accordingly.

An organization that detects a threat in seconds but requires an hour to neutralize it may possess sophisticated detection technology while still exhibiting weak automated resilience.

ARI provides one possible framework for quantifying that difference.

CISO Node — Automated Resilience Index (ARI):
https://www.cisonode.com/automated-resilience-index-ari-a-new-standard-for-cyber-security/

ARI Whitepaper:
https://www.cisonode.com/wp-content/uploads/2025/10/Cybersecurity_Automated_Resilience_Index.pdf

Modernization should not become vendor consolidation by default

There is one area where CISOs should maintain healthy distance from Palo Alto’s narrative.

The company repeatedly argues in its earnings call that platformization is the only viable strategy for real-time defense.

The case for integration is strong. Shared telemetry, coordinated policy and automated enforcement can materially reduce response latency.

But platform consolidation is not automatically equivalent to cyber resilience.

Excessive dependence on a single supplier can introduce concentration risk, architectural lock-in and potentially broader impact when a platform itself fails.

The more defensible CISO objective is therefore not simply to reduce the number of vendors.

It is to eliminate unnecessary latency between security signals and security action.

A unified platform may achieve that. A strongly integrated multi-vendor architecture may also achieve it.

The success criterion should be measurable response performance rather than procurement architecture.

What CISOs should take from the Palo Alto warning

The immediate priority is to identify where human dependency still dominates critical response processes.

Identity compromise is an obvious starting point. High-confidence malicious sessions should be revocable automatically. Compromised endpoints should be isolatable without lengthy escalation. Known malicious infrastructure should be blockable across the environment rapidly. Actively exploited vulnerabilities should move outside normal patch-management cadence.

At the same time, agentic AI requires a new layer of governance.

Agents should have individual identities, narrowly scoped privileges, controlled tool access, observable execution and a defined mechanism for immediate revocation. The rise of autonomous agents means that identity governance can no longer remain focused primarily on employees and conventional service accounts.

The final priority is measurement.

Security leaders should increasingly report how quickly threats are actually neutralized, how frequently containment occurs automatically, and how much of the defensive process remains dependent on manual intervention.

Those metrics provide a much clearer indication of preparedness for machine-speed attacks than the number of alerts processed or tools deployed.

CISO Node assessment

Palo Alto Networks’ $1 trillion estimate makes an effective headline, but its most valuable message lies elsewhere.

AI is changing the competitive variable in cybersecurity from visibility to velocity.

Organizations already possess enormous quantities of security telemetry. The emerging challenge is turning that telemetry into sufficiently rapid action.

At the same time, autonomous agents are expanding the population of machine identities, creating new permissions, generating dramatically more traffic and introducing decision-making entities into enterprise environments. Palo Alto’s reported ninefold increase in agentic traffic offers an early indication of the scale at which that transition may occur.

The next cybersecurity modernization cycle should therefore not be measured primarily by how much technology enterprises replace.

It should be measured by how effectively they reduce the distance between detection and neutralization.

That is where concepts such as the Automated Resilience Index become particularly relevant. In an environment where attackers increasingly automate discovery, exploitation and lateral movement, resilience depends on whether defenders can automate containment at comparable speed.

The $1 trillion cybersecurity debt may ultimately prove higher or lower than Palo Alto’s estimate.

But the underlying debt is already visible.

It is the accumulated gap between machine-speed threats and human-speed defense.

And AI is rapidly increasing the interest.

Primary source

Palo Alto Networks — Q4 FY2026 Earnings Call, corrected transcript, 1 September 2026:
https://investors.paloaltonetworks.com/static-files/b6d9916f-f4ab-4b43-8457-2d345aaa0a47