Palo Alto's CEO Says Analytical SaaS Is Dead. Here's the Three-Bucket Framework Every Software Investor Should Use Tonight.
On 9 June 2026, sitting in the All-In studio in Los Angeles, Nikesh Arora — the man who has grown Palo Alto Networks' market capitalisation from roughly $17 billion to about $238 billion across his near eight-year tenure — delivered a verdict that will irritate every founder of a dashboard, every Tableau reseller, and a meaningful slice of the public software complex. "If you're an analytical SaaS company, it's over."
It was not a throwaway line. Arora laid out a triage chart for software investors — three buckets, ranked by what survives the next model cycle and what doesn't. The first bucket, analytical SaaS, is dead in his telling because models can now run analytics directly against customer data, and the marketplace of add-on apps that charge for analysis is being routed out by the same intelligence being bolted into the database. The second bucket, data infrastructure — the Snowflakes, Databricks, MongoDBs and Oracles of the world — is the most under-loved corner of the complex, because enterprises will need roughly 10x more data stored over the next three years than they hold today, and someone has to hold the bits. The third bucket, the system-of-record giants — Salesforce, SAP — faces a slower death: not the next three years, but a five-year reinvention in which "UI enterprise software and consumer software UI is the worst thing we did as technologists" and agents quietly strip the screens out.
The framework matters because Arora is not a sell-side analyst with a target price. He is a chief executive who has just spent $25 billion on an identity business because, in his own framing, identity is the choke point of an agentic-AI security architecture. He has run Mythos, a frontier reasoning model, across his own codebase and watched it find vulnerabilities that would have taken human testers five to seven years to surface, in roughly six weeks, for a low-millions-dollar compute bill. He is not theorising about software. He is reporting from inside the most expensive R&D lab in the category.
What follows is the framework, the dissent, and the stakes.
The analytical tier: dead on arrival
Arora's argument is structurally simple. For two decades, the enterprise software playbook was to extract data from a system of record, drop it into a warehouse, and sell a licence to a dashboard that re-rendered it for human eyes. The customer paid a per-seat fee for the privilege of looking at their own numbers. What changes in 2026 is that the model can sit between the warehouse and the question. A 250-IQ reasoning engine does not need a Tableau licence to read a Snowflake table; it needs a prompt and an API key.
The All-In hosts offered their own anecdote to anchor the claim. Jason Calacanis described replacing a 20-seat product — roughly $1 million in annual subscription — with a Slack and Claude integration that returned essentially the same answers to roughly the same questions, at what he pegged as a 90% reduction in software spend. Whether the anecdote generalises to the largest enterprise contracts is the live debate, but the direction of travel is not seriously contested by the people building the models. The question is speed, not destination.
The investor consequence is uncomfortable. Public analytical SaaS — Looker, Sisense, ThoughtSpot, the dashboard layer of the modern data stack — trades on growth and on multiple expansion. If the buyer is no longer paying for the human interface because the interface is going away, the multiple gets compressed before the revenue does.
The data layer: the most underweight bucket
The second leg of Arora's argument is the contrarian one. While software investors have been rotating out of Snowflake, Databricks, MongoDB and Oracle on the assumption that AI compresses storage demand (models, after all, are the new "intelligence layer"), Arora argues the opposite. Enterprises, he says, will need 10x more data stored over the next three years than they hold today.
The reason is partly defensive. He has spent the last six weeks watching Mythos comb Palo Alto's codebase. The implication, multiplied across roughly 10 million developers worldwide, is that every Fortune 500 company has an accumulated technical-debt backlog measured in single-digit years of human effort. Enterprises cannot remediate that backlog fast enough to keep up with the offensive AI they are about to face. The only honest answer is to collect and store vastly more telemetry, run models against it constantly, and accept that storage is now a security input, not a cost centre. The same logic applies to model training data, evaluation data, and the long context windows that the new reasoning models want to chew through.
The valuation arithmetic gets interesting. If storage demand roughly decuples while hyperscaler capex continues to be constrained by power and chip supply, the price per gigabyte stops collapsing. For the data-platform names that have been marked down on the assumption that storage becomes commoditised, that is a non-trivial re-rating tailwind.
The system of record: a five-year reinvention
The third bucket is the slowest to die, and the most important for the public basket because it carries the index weight. Salesforce and SAP are not going to zero in 2026. Arora's argument is that what they sell — a UI in which a human types data into a record — is being disassembled. The user interface is being stripped out. Agents handle the data entry. Humans stop touching the record. Audit trails, ironically, improve, because the agent is logging every action in a way that the human clicking through Salesforce never did.
The replacement total addressable market is the fastest enterprise revenue, in Arora's framing: 50,000 companies need essentially the same application, the way they once needed essentially the same CRM. The agentic version of Salesforce does not look like Salesforce. It looks like a thin layer of orchestration that calls a model, calls a database, and returns a structured answer. Arora's claim — that the most valuable company in the next cycle will be the "Salesforce of agents" — is a direct challenge to Marc Benioff's incumbency, and a bet that the system-of-record vendors either reinvent fast enough to hold the customer, or watch the agentic layer peel the workflow away from the UI.
The cyber math: the part investors cannot ignore
Software is the headline, but the second half of Arora's appearance was a cyber-risk briefing that justifies the $25 billion identity deal and explains why the framework is not just a valuation argument.
Three figures matter. First, Mythos ran across Palo Alto's codebase and surfaced vulnerabilities that would have taken human testers five to seven years to find, in six weeks, for a low-millions-dollar compute bill. Second, offensive AI cyber capability at the Mythos level — what Arora estimated six months ago at "six to nine months away from being in the wild" — is now, in his revised read, roughly three months out, because Anthropic 4.8 and 5.5 are already out with similar capabilities and open-source and Chinese model releases are running on a comparable clock. Third, 89% of breaches are still credential theft, not sophisticated cracking. The attacker does not need to break the safe; the attacker steals the key.
The national-security risk, in Arora's framing, is not a grid going down. "I'm worried about the small offices across the country," he said. "Remember when Change Healthcare got breached, every physician's office shut down." The reference point is real and recent: the February 2024 attack on UnitedHealth's Change Healthcare clearinghouse disrupted prescription billing across the United States for weeks and forced billions in emergency credit to providers. Multiply that across every regional medical claims processor, every small-bank core system, every payroll vendor, and the attack surface is not exotic. It is the long tail of the economy running on software that was never audited for a model that did not exist when it was written.
This is why Arora expects Palo Alto to have more technology employees in two years than it does today, not fewer — a counter-view to the layoff narrative that has dominated software in 2024 and 2025. AI is not reducing the work. It is causing every function to demand transformation, and the company that builds the most AI-efficient enterprise — Arora cited operating margins "gross in the 90s, net in the 40s-50s" as the target — will compound for a decade.
The hardware counter-thesis: latency is moat
The one place Arora pushes back on the consensus is hardware. The market has been treating compute as a fungible commodity since the GPU shortage eased. Arora argues financial services — Goldman Sachs, JP Morgan, Morgan Stanley — cannot move to the cloud because the latency penalty directly reduces trading profit. The data centre, in his telling, is fundamentally a high-throughput, low-latency bit-management problem, and the production of the boxes is the bottleneck, not their design. His evidence is the return of Dell to a $300-400 billion market capitalisation — a company most growth investors had written off a decade ago, now trading on the simple observation that the physical layer of the AI stack is more constrained than the software layer on top of it.
For the software investor, the implication is that the AI capex cycle has a longer runway than the bear case assumes, and that the companies building the picks-and-shovels — even the unsexy ones — are the ones whose earnings will not require a multiple expansion to deliver a return.
Dissent and what the framework gets wrong
The framework is not gospel, and the objections are serious. The first is survivorship bias. Arora runs a security company that has benefited from a regime change in the threat model. He has every incentive to talk up the defensive tailwind. The second is the rate-of-replacement argument. A model can read a Snowflake table, but it cannot yet negotiate a multi-party contract, navigate a regulated approval workflow, or produce an audit-grade financial statement without a human in the loop. The system-of-record vendors are not dying; they are being asked to rebuild a layer that took twenty years to standardise, and the rebuild is happening in a regulatory environment that is not getting looser. The third is the open-source timing claim. Arora's assertion that a frontier model's entire weights can now fit on a USB stick and be distilled in 24 to 48 hours, citing a conversation with a model-company CEO, is plausible but unverified at scale. If it is wrong — if the frontier labs find a structural moat in compute or data that prevents distillation — the three-month offensive-AI timeline slips, and the urgency premium for defensive software softens.
The honest read is that the directional call is right and the speed of the call is the variable. Analytical SaaS as a category is being routed out faster than the public multiples suggest. Data infrastructure is the most plausible underweight, not because it is loved but because the demand case is stronger than the bear case concedes. System-of-record SaaS has a five-year window to reinvent the UI, and the agentic winners will look less like Salesforce than Salesforce's investors hope. The cyber tailwind is real, and the small-office economic-chaos scenario is the under-priced tail risk in the basket.
Arora, for the record, is also long Google. "I think Google's underrated. I think it's going to be the first $10 trillion company in our lifetime." Take that as you will from a man whose own company has done fourteen-fold in eight years.
For software investors tonight, the triage is simple. Sell the analytical tier into any rally. Buy the data layer when it sells off on storage-commoditisation headlines. Hold the system-of-record names only if the management is shipping agentic product, not pitching it. And treat identity, observability, and endpoint detection as the picks-and-shovels of the next cycle, because the model is not the moat. The model is the utility layer. The application that arbitrages the model is the moat. And the breach that shutters a thousand small offices is the risk nobody is pricing in.
Wire provenance
This editorial synthesis draws on the following public wire/social posts:
- https://www.youtube.com/watch?v=hObRMv6qCi0