Palo Alto Networks prefers two kinds of companies for its acquisitions: One is those with a net new capability but no integration needed; the other is those with a technology that can complement the security giant’s existing products, like its latest acquisition – Cider Security. The common theme is they have to be best of the breed, Chairman and CEO Nikesh Arora claims.

“Across the board, we probably spent $4 billion on about 17 companies since I've been here. And I'd say most of them are working,” Arora told the press during the vendor’s recent Ignite event. “Forty-percent of companies are a net new capability that didn't require integration, 60% require integration. And we had a common theme … to buy the No. 1 or two in the industry.”

Arora pointed out that McAfee, Juniper Networks, and Cisco all strengthened or broadened their security portfolio through acquisitions. “Nobody's actually built a brand new, from scratch billion-dollar booking stream across three different categories that you entered,” he stated.

The executive also said that while he cannot tell the press who is the next company Palo Alto Networks is going to buy, “in terms of future M&A guidance, what will drive it is either unique capability, which we believe is important to solve customers’ problem, or we were late to the party by not building it, [and the acquisition] gives me that capability.”

The vendor used to focus on firewalls when Arora joined. Then, Palo Alto Networks decided to become the security solution partner for customers, which required broadening its portfolio and creating a number of technical capabilities. However, “it takes seven years to build great products in general,” Arora noted. But, “we didn't have seven years to go build a product portfolio, so we decided we're going to go buy companies to figure this out.”

For companies that were in a new category that Palo Alto Networks never offered, “there's no [product] integration. [But] you have to integrate the people, the culture, and your salesforce,” Arora said. He used CloudGenix as an example, which was selling as a standalone SD-WAN product in the beginning and then later became part of the vendor’s secure access service edge (SASE) portfolio.

Post-acquisition, Palo Alto Networks will let a company’s leadership or team run the business. “They must be smart if they could, with less resources, solve the customer problem and beat us in the market,” he said. “So if you look at Palo Alto, most of the products that we acquired, their CEOs, their founders are running those capabilities.”

To enhance its Prisma Cloud cloud security portfolio, Palo Alto Networks opened its checkbook several times in recent years and bought several cloud, DevOps, and application startups, including Evident.io, RedLock, Twistlock, Bridgecrew, and Cider Security.

Its $195 million purchase of Cider Security was announced last month. Palo Alto Networks plans to integrate the application security startup’s technology into its Prisma Cloud platform to strengthen its supply chain security and code-to-cloud cloud-native application protection platform (CNAPP) capabilities.

“In the case of cloud security, we are acquiring because you can stack it next to it and integrate it. In the case of the network [security], we think we have a lot of capabilities, … so you get to be more careful,” Arora said. “So that's why you've seen our pace slowed down because we have a lot of capability to focus on and operationalize and grow the go-to-market."

Arora is keeping Palo Alto Networks' next move close to the vest, though he did note there are no immediate plans for a large acquisition.

“People keep asking me that the markets are getting cheap, valuations are down, what about a larger acquisition?” Arora said. “Larger acquisitions only make sense if you have an explicit ability to create incremental value by integrating that capability into your platform. If it's a pure, another on-the-side capability the investors can buy directly, there’s probably a public company to do that. So it has to depend on our ability to add value in a significant way and that requires a technology inflection point.”