Eyal Worthalter

eSIM and its security and privacy issues: Embedded Subscriber Identity Module in a nutshell ☎️ 🐾🔎🌍🎯 Security researchers Maryam Motallebighomi, Jason Veara, Evangelos Bitsikas, and Aanjhan Ranganathan presented their comprehensive review of eSIM technology last month, and discussed the security and privacy issues it has. Some gems from the paper: 💎 Starting an eSIM business is easier than starting a coffee shop. 💎 eSIMs can act like mini spyware - silently pinging servers or downloading hidden SMS messages. 💎 Travel eSIMs offer convenience but also come with hidden data routing, opaque resellers, and potential surveillance risks. Very interesting and practical for many. Please enjoy the read and share it with your peers and friends. Thank you. More details: eSIMplicity or eSIMplification? Privacy and Security Risks in the eSIM Ecosystem [PDF]: https://lnkd.in/d9kdQ8Zk #technology #infosec #cybersecurity #privacy #surveillance #SIM #eSIM #cellular #security #cyber #connectivity #critical #mobile #network

542

7 Comments

Did the acquisition target for Palo Alto Networks’ identity market entry absolutely have to be CyberArk? No, but CyberArk was the best option they had among scaled identity companies. There just aren’t that many viable targets with the right financial profile and product suite. CyberArk is a great company. I’m surprised they got it. CyberArk has more pieces of a comprehensive workforce identity offering than most other scaled alternatives. They have PAM, SSO (albeit third or fifth in the market), and they just acquired IGA with Zilla, an early-stage company. Most of the other targets Palo Alto Networks could have acquired would have required add-on acquisitions to round out the full workforce identity offering. Okta now has SSO/IGA/PAM but likely wasn't willing to sell at their current market cap of ~$17 billion. That's roughly half its all-time high, and now below CyberArk (even before the acquisition report broke). Todd McKinnon is still a relatively young CEO who looks committed for the long haul. Ping Identity could have made sense, but their product portfolio doesn’t have well-established IGA or PAM capabilities, even with ForgeRock. Palo Alto Networks likely didn’t want to be in the customer identity business, either. They do have a directory product, which is nice...but again, directory is not the way the identity market will be won. SailPoint just went public again and has had a successful return. They’re primarily an IGA company that has acquired its way into PAM, but is nowhere near the depth of CyberArk there. They don’t do SSO yet, either. Great company, not as great of a strategic fit for Palo Alto Networks. There is a long tail of smaller companies in the identity market with varying shapes and sizes of a product portfolio. Some have eight and nine figures of revenue: – Saviynt – RSA Security – SecureAuth – 1Password – Keeper – Veza – StrongDM – ...dozens more Palo Alto Networks was playing an entirely different game here. The plan wasn’t to do value acquisitions of different market leaders in multiple identity segments and slowly grow an identity business. The quest to win against both hyperscalers and large competitors like CrowdStrike needed a transformative deal.

661

49 Comments

Platformization? More like IBMization. With its acquisition of CyberArk, Palo Alto Networks is looking more like old Big Blue every day. No pureplay cybersecurity vendor has ever done multi-platform successfully. Even Microsoft is unable to consolidate, particularly in the network security market. Meanwhile, CyberArk is a human identity play, which is a cybersecurity category ripe for disruption. Non-human identity will overshadow human identity during the next decade with the rise of API and agentic AI threats. I believe the Palo Alto Networks-CyberArk acquisition is the end of a successful run from PANW and the beginning of the road to IBMization. https://lnkd.in/d92zXqk6

471

41 Comments

Today’s cyber threats don’t respect vendor boundaries—or national borders. As Michael Sikorski of Palo Alto Networks Unit 42 reminds us, we must mirror that coordination through “competitive allies”—competitors collaborating to defend shared infrastructure. In a compelling Threat Vector podcast, he and J. Michael Daniel, former White House Cybersecurity Coordinator and CEO of the Cyber Threat Alliance, unpack why the real barrier to collaboration isn’t misaligned systems—it’s misaligned cultures and boardroom incentives. This isn’t about goodwill—it’s about national resilience. As adversaries operate in lockstep, defenders must replicate that cohesion—across vendors, sectors, and government—to protect citizens and critical infrastructure. For executives, that means shifting from competitive silos to purposeful partnerships. Embedding threat-sharing into corporate strategy strengthens not just your enterprise—but national defense. https://lnkd.in/gDtyp-kV

55

5 Comments

Palo Alto Networks recently disclosed $1.3 billion ARR for its SASE business. It was kind of a low-key announcement, too — included as part of a broader press release *after* their Q4'25 earnings report last month. Netskope filed its S-1 four days after the report, so I'm sure this announcement was just a coincidence :) Regardless, it's the first time I've ever seen Palo Alto Networks disclose a specific revenue figure for Prisma SASE. They've shared some one-off data points before, but this is their most comprehensive disclosure to date. It's a pretty interesting growth story if you piece together their announcements and disclosures over time: – Early 2019: Prisma Access launched (organic). – 2019-2021: Organic and inorganic expansion (added ZTNA, SWG, CASB, SD-WAN). – Late 2021: First started using the term "Prisma SASE." – April 2023: "Over $1B in bookings over the last six quarters," "more than 4,000 active customers." – August 2023 (Q4'23 earnings): "More than $1B in SASE bookings" (Note: bookings != ARR). – May 2025 (Q3'25 earnings): 36% YoY SASE ARR growth, active SASE customers +22% YoY. – September 2025 (post Q4'25 earnings): $1.3B SASE ARR, growing 35% YoY. 6,300 customers (1/3 of Fortune 500). Framed differently, Palo Alto Networks' SASE business grew from (effectively) zero to $1.3B ARR in six years. It's now among the largest in the market by ARR and growing at a rate similar to companies half its size (or less). Prisma SASE alone has more ARR than ~half of the largest cybersecurity-related *companies* in public markets. Some like to point out how product line revenue can get a little fuzzy, especially with SASE having a relatively loose definition (as Jay Chaudhry noted in the last ZS earnings call). Either way, this is still a directionally reliable number and a helpful (voluntary) disclosure at an important time in the SASE market.

749

37 Comments

Palo Alto Networks summoned some "Q4 magic" (in Nikesh Arora's words) to deliver a massive year-end earnings report. So many highlights: → The end of an era Big leadership news was announced along with this report. Nir Zuk, the founder and CTO of Palo Alto Networks, is retiring after more than 20 years with the company. Another cybersecurity industry icon is moving on to their next chapter, joining several others who have transitioned their roles in the past year. Several promotions have been announced to fill his shoes — all familiar faces from the Nikesh Arora era. The one I'll highlight is Lee Klarich moving into a combined CTO and CPO role and taking a board seat. I've found him both impressive and insightful throughout my coverage over the years. This role at Palo Alto Networks represents one of the most challenging positions in all of tech given the sheer breadth and pace of organic and inorganic product development. With the impending acquisition and integration of CyberArk, there are significant challenges and opportunities ahead. The timing feels right for these leadership transitions as the current team guides Palo Alto Networks into its next stage of growth. → Financial results (!!) The financial results PANW reported for both the quarter and year are incredibly by nearly any measure. Two metrics stood out to me. The big one is reaching a $10B annual revenue run rate, the first pure play cybersecurity ever to do it. The other is $5.6B of NGS revenue (growing at 32%). The NGS portfolio was essentially zero when Nikesh Arora took over seven years ago. Today, its annual run rate exceeds most standalone cybersecurity companies and business units within larger technology companies — many of which had significant head starts. → Predicting the identity market inflection point Nikesh Arora gave some interesting and insightful commentary about (a) Palo Alto Networks' track record with predicting market inflections, and (b) how the timing around identity influenced their market entry decision. Two key points I agree with: First, the security profile of AI agents will more closely resemble privileged users than regular users. This aligns with my hands-on experience and observations, and it's logical given the early use cases for agents. Second, on a macro level, you sense the shift from treating identity as a fringe security function to a central, tightly integrated component of security programs. TL;DR - security is going to get a bigger piece of identity. The shift is going to take time, but it's happening. This was clearly a central part of PANW's rationale for acquiring CyberArk over other scaled options with less security focus. --- It's hard to imagine a better finish to the fiscal year for Palo Alto Networks. FY'26 will be a crucial year for them with CyberArk expected to close and continued execution of their overall strategy. Congratulations to the team on a great year!

245

9 Comments

🚗 𝐀𝐬𝐭𝐞𝐫𝐢𝐧𝐚𝐬 (𝐒𝐓𝐈𝐋𝐋 𝐔𝐍𝐃𝐄𝐑 𝐃𝐄𝐕𝐄𝐋𝐎𝐏𝐌𝐄𝐍𝐓): 𝐓𝐡𝐞 𝐀𝐮𝐭𝐨𝐦𝐨𝐭𝐢𝐯𝐞 𝐎𝐒 𝐓𝐡𝐚𝐭 𝐄𝐧𝐝𝐬 𝐒𝐚𝐟𝐞𝐭𝐲 𝐂𝐨𝐦𝐩𝐫𝐨𝐦𝐢𝐬𝐞𝐬? No more “safe enough” — ASIL-D without the Linux baggage 𝐎𝐫𝐢𝐠𝐢𝐧 𝐒𝐭𝐨𝐫𝐲 ⚡ Born from the ashes of the 2024 CrowdStrike outage (a single memory-safety bug → global chaos), Asterinas asked: “What if we built an automotive OS where 86% of the kernel couldn’t have memory bugs… at all?” 𝐓𝐡𝐞 𝐋𝐢𝐧𝐮𝐱 𝐒𝐚𝐟𝐞𝐭𝐲 𝐓𝐫𝐚𝐩𝐢𝐧 𝐂𝐚𝐫𝐬 🔄 Today’s “safe Linux” stacks are architectural compromises: • Rust-for-Linux: Still unsafe code (legacy C API baggage). • VMs/Containers: Overhead-heavy “band-aids” for driver vulnerabilities. • Certification: Verifying Linux’s 30M+ LoC for ASIL-D? Brutal. 𝐄𝐧𝐭𝐞𝐫 𝐅𝐫𝐚𝐦𝐞𝐤𝐞𝐫𝐧𝐞𝐥 🛡️ • Asterinas’ secret weapon: A 14% TCB (Trusted Computing Base) core (“OSTD”) shielding everything else: • Drivers/filesystems run in 100% safe Rust (zero memory-unsafe code). • 6× smaller attack surface vs. Linux → certification effort plummets. • Performance parity with Linux (even beats it in I/O). 𝐖𝐡𝐲 𝐓𝐡𝐢𝐬 𝐒𝐡𝐢𝐟𝐭𝐬 𝐀𝐮𝐭𝐨𝐦𝐨𝐭𝐢𝐯𝐞 ⚙️ “We’re past the era of ‘safer C’. Asterinas proves rich OS features can live entirely in safe Rust.” • ASIL-D compliance: Verify the 14% TCB, not the whole kernel. • No performance tax: Real-time safety without VM jitter. • Linux-compatible: Runs unmodified apps. 𝐁𝐢𝐠𝐠𝐞𝐫 𝐓𝐡𝐚𝐧 𝐂𝐚𝐫𝐬? 🌐 If Asterinas wins in automotive (where safety = lives), it rewrites the playbook for: • Aerospace ✈️ • Medical devices � • Industrial IoT 🔧 𝐓𝐡𝐞 𝐁𝐨𝐭𝐭𝐨𝐦 𝐋𝐢𝐧𝐞 ✅ Asterinas isn’t “Linux but safer”. It’s a clean-slate rethinking of how we build high-assurance systems — provably safe by design, not by patch.   👉 𝐘𝐨𝐮𝐫 𝐦𝐨𝐯𝐞: Stick with incremental Linux fixes… or bet on architectural revolution? 𝘐𝘯𝘴𝘱𝘪𝘳𝘦𝘥 𝘣𝘺 𝘱𝘪𝘰𝘯𝘦𝘦𝘳𝘪𝘯𝘨 𝘸𝘰𝘳𝘬 𝘧𝘳𝘰𝘮 𝘈𝘴𝘵𝘦𝘳𝘪𝘯𝘢𝘴’ 𝘵𝘦𝘢𝘮 + 𝘎𝘦𝘳𝘮𝘢𝘯 𝘵𝘦𝘤𝘩 𝘥𝘦𝘦𝘱 𝘥𝘪𝘷𝘦𝘴! #Asterinas #RustLang #FunctionalSafety #Linux #Automotive #ASILD #Kernel #EmbeddedSystems #Innovation #SafetyCritical

50

7 Comments

Great discussion on CNBC with our CEO, Nikesh Arora about the coming wave of agentic AI and what it means for enterprise security. His point is critical: while consumer-grade AI browsers are racing ahead with new features, they often lack the foundational security needed for the enterprise. This is more than just a theoretical problem; it's a ticking time bomb. As AI agents become more autonomous, they'll become prime targets for attackers. That's why we're building Prisma Browser with a "security-first" mindset. It's not about blocking AI; it's about enabling it safely. The future of work depends on browsers that can intelligently and securely manage AI agents, not just unleash them. It's a fundamentally different approach, and it's one we believe is essential for our customers. https://lnkd.in/gCSArDuK

211

3 Comments

🔔 Cyber Market Monday Update - Headlines from last week 👇 ▪️RunReveal, an Austin TX based cybersecurity company raised a $7M Seed round last week from Costanoa Ventures, with participation from Runtime Ventures, Modern Technical Fund, and Okta Ventures. ▪️SentinelOne announced plans to acquire Prompt Security for a reported $250M, Prompt Security is an early stage startup focused on securing AI and agentic workloads! This is the second public acquisition in the category with Palo Alto Networks acquiring Protect AI earlier this year. ▪️We also received more details on the Columbia University cyberattack from earlier this summer. On June 24, 2025 they reported an IT outage. On July 1 they reported that it was in fact a #cyberattack. Last week the university shared that approximately 869,000 people were impacted and that attackers had been inside their environment since May 16, 2025. 39 days before the outage, 46 days before public notice. We have come a long way in security, but experiences like this show we still have a long way to go! Let's keep building!! I hope everyone made it home safely from Black Hat last week! #investing #publicmarkets #stocks  —————————————————————— ♻️ Repost to share with other cyber GTM professionals 🔔 Follow Konnor Andersen for more tips on cybersecurity GTM ——————————————————————

26

4 Comments

Top MCP Security Resources — August 2025 is here! MCP Security is critical for anyone building Agentic AI systems. As TCP/IP connects devices, MCP connects AI agents to tools and data—making it essential infrastructure. Explore top MCP Security Resources to help you stay ahead. This digest gives you the context, tools, and strategies to defend what matters. Top MCP Vulnerability: https://lnkd.in/dHWP5Fqv Top Defense Guide for MCP Security: https://lnkd.in/dMCdMa2q Top Tool for MCP Security: https://lnkd.in/dzvZqzZK Top MCP Threat Model https://lnkd.in/dqY_h58u Top MCP Security Research: https://lnkd.in/dgaUsM9K Top MCP Security Resource: https://lnkd.in/dCEQqjVr Top MCP Security Article: https://lnkd.in/dMG4DupK Top MCP Security 101 Guide: https://lnkd.in/d3vKC5Sj Top MCP Security Video: https://lnkd.in/da25guw5 Explore all 27 Top MCP Security resources in our blog and please add in the comments what you think were the top publications that we missed in the full article! → Read the full list: https://lnkd.in/diV-jB4s #MCP #MCPSecurity #AISecurity #AgenticAI #AIRedTeaming #SecureAI

41

3 Comments

I've spent decades building and scaling security solutions, and I'm not surprised that this deal is going down. However, I AM surprised at how many miscues this highlights. Palo Alto Networks has excelled in network and endpoint security, but it has lacked a coherent identity strategy. With recent acquisitions like Talon (enterprise browser), Dig (cloud DLP), and now CyberArk (privileged access management), they’re piecing together what appears to be a full-stack identity and data access portfolio. Add in IGA via Zilla and machine identity through Venafi/NHI, and the picture becomes clearer. But this deal signals more than just product expansion. It raises critical questions for security buyers: CyberArk hit the innovation wall 🧱 CyberArk helped define the PAM category - but defining a market and continuing to lead it through innovation are two very different things. Over the last several years, they’ve struggled to evolve alongside the needs of modern, cloud-native, Zero Trust environments. This acquisition suggests that instead of breaking through with a next-gen vision, they chose to exit. Integration over innovation - again 🛠️ Palo Alto Networks now faces a herculean task: integrating a growing portfolio of disparate technologies into a unified strategy. That’s hard enough on its own. But it becomes even more challenging when the strategy isn’t clearly articulated or demanded by buyers. Without a focused product vision, there’s a real risk this becomes a patchwork of platforms - frustrating to manage, slow to evolve, and brittle at scale. Expect lock-in 🔐 One thing is certain: PANW will need to extract value from this massive investment. That usually comes through bundling, upsell motions, and deepening customer dependencies across the stack. Security leaders should anticipate increased pricing pressure and a push toward all-in adoption - classic vendor lock-in strategy. Whether that aligns with your organization’s flexibility and independence goals is a conversation worth having now. Identity is still the frontier 🙇 At a high level, this acquisition validates what many of us have believed for years: identity, access, and control are the future of cybersecurity. But validation isn't enough - security leaders need tools that are agile, adaptive, and purpose-built for the environments they run today. Not yesterday. To the teams at PANW and CyberArk - congrats on the deal. The next few years will determine whether this is remembered as a defining moment… or a missed opportunity. https://bit.ly/40KWEpX

289

16 Comments