Thank you, Kevin, for being here.
You helped build this industry, helped amazing companies, and now you're building a VC again. We're biased for working, and it's been an honor and a pleasure. And now finally, you're back to the game.
Yeah, which is super exciting. And you know, it gets me to the first question I'd like to ask about that. Given everything you've seen evolve, right, and where attackers are actually going next, what drove you to start Armadin, and what problems are you setting out to solve?
Well, you know, I'd love to say that I helped build the industry. The reality is, this industry is built by the oldest professions: espionage, crime. Right? If you didn't have people that performed espionage, you wouldn't need cybersecurity. If you didn't have people that wanted to rob people, you wouldn't have cybersecurity. But I think we always have geopolitical differences. You will always have spying. And quite frankly, you're always going to have, wherever money goes, crime follows. So cybersecurity had to exist. And it was literally built by the adversaries that we're trying to defend companies from every day. And so now, to your question: why Armadin? Why now? You know, I've done this startup thing before, and we were talking right before the camera came on about, you said something interesting. You said you're building again.
Well said. And you forget sometimes, you know, I had three years where I was bought by Google. Google's pretty well established, you know, almost $4 trillion market cap. They still build, but when you're small, you build or you die, right? There's a higher risk. And that higher risk gives you a higher sense of urgency. A higher sense of urgency gives you a sense of purpose, right? I believe that. In fact, I would argue urgency is how you measure purpose. And boy, do I feel it. You know, like you feel it right now while we're shooting this video. We're the small guys building and innovating to change the future. And quite frankly, you know, our livelihood depends on that, the velocity and the quality of our work. When the stakes are high, you innovate faster. And for startups, the stakes are high. So, and I like it. You know, it's something that, you know, when sometimes you're at a bigger place, some people like the scale of it. They like, quite frankly, the safety of it. You know, if you're profitable and you're making billions of dollars a quarter, yeah, you take big bets, but you can lose so many and be just fine. You can't lose a lot of bets as the little guy, can you, Gal? So, so there you go. It's that excitement of knowing the margin of error is less. You have no air cover. You better get it right. And that sense of urgency translates to purpose. That's just how I look at it.
I love that. Yeah, this type of like war-type CEO, right? Always like in this type of like mode and getting everything. And I think it goes back to, you know, we used to, and one really smart guy once told me, like, cybersecurity is one, is this market that is a market that is influenced by attackers, right? Without attacks, without having attacks, like we wouldn't be here.
You got it. Absolutely not. If there was world peace and no crime, you know, you wouldn't have to worry about it. You know, it's, if there was no terrorists, you wouldn't have metal detectors at airports. You know, so it's just the way it is.
Yeah, absolutely. And it gets me to the next question again. As you mentioned, like, where are the small guys that are building, right? But like, with all due respect, like that's the difference from the big companies when they innovate, right? The pace is very different. It gets me to this question, right? Like you've seen everything. You see how the attackers evolved, and now we're in an era that attackers are innovating faster than ever, right? Using zero-days and supply chain attacks and abuse of course, like all of the AI-accelerated attacks. So like, how does that change, I think, you know, from your perspective, the job of the defender, right? What are the approaches that need to be considered, right?
Yeah, without a doubt. And you've got to be in the right place at the right time, or you can't have a lot of humans in the loop. When you have AI emerging, you have technology for the first time ever that can think, it can learn, it has total recall. I think you're going to see AI agents that are as capable or more capable than intermediate attackers, and maybe even over time, vulnerability research will be done better by computers and AI agents than humans. And without a doubt, that may come sooner than people think. So what does that mean? You know, everybody's talking about shift-left security all the time, but you've got to know what's in production, what's actually vulnerable. I call it almost like shift-right. You know, you've got to be not necessarily right of boom, but you got to have the attacker's perspective. You got to recognize that we used to have, you know, the espionage and nation-state capability, then criminal, which has gotten really close to about the same as espionage, and then, you know, maybe less experienced. Everyone is going to be great on offense with AI agents. And I say the beast isn't out of the cage yet. We're at the inflection point where in under a year, attacks will occur at such velocity, they will be expert attacks, they may very well be zero-days. They will be bespoke to your organization. And if you have a human in the loop to figure out is this good or bad, you've lost. And no matter how far you shift left, I've learned that vulnerabilities aren't always bugs. They are many times features. There are many times people leveraging a feature of something to get a desired command executed or to pilfer data. So I like that you guys do runtime, because here's the reality: you want to secure everything you can before you go into production, but you better know what's going on in production, because that's what gets attacked. And that's the biggest difference. Scale, velocity, and total recall of AI is coming at you. The certitude that you'll have an expert attack hit you will be 100%.
Yeah, that's not a lot of good news.
But here is the good news. It is forcing defense to get autonomous, to think, to learn, to adjust to an emerging threat. I actually think we can have better cybersecurity two to three years from now. We're going to have a certain amount of gap, though, where the advantage probably goes to the offense based on asymmetry.
Yeah. And I loved it. And I think you once mentioned that I think we've only scratched the surface, right? Like I think the world was pretty shocked when, again, Entropic uncovered the force and nation-state orchestrated attack, or even like Cl0p bot agents or hacking companies. But like you've seen, you've been on the front lines. You've seen those like real sophisticated attacks, from financially motivated to espionage. Like I'm sure we're like still, you know, not hearing like the real boom, but it's coming, as you mentioned.
So, at my company, Armadin, we've built things that we haven't seen out in the wild yet. So we already know the art of the possible, and it's not great for defense. And I think defenders know it, you know it, we know it. But modern nations aren't letting the beast out of the cage yet, because nobody wants to deal with it, right? Because it's going to compress that whole 'we prevent, and when we don't prevent, we detect and respond.' Are you kidding? Your detect and respond better be in microseconds in the future, or you're just not stopping it. And we all know what happens when an attacker punctures the balloon, meaning they get into your network with remote code execution. If that should happen, the inside is toast. In an AI age, you know, it used to be a hand on a keyboard would get access to you, do one command at a time. In the AI-driven age, you're going to see a thousand threads expand. You're going to see an attack that just keeps going. So you have to have a network defense or cyber defense that can turn a kit in runtime. It's got to be able to stop the attack automatically. And even if it's not an attack, stop anomalous behavior. Literally, if it's new and different, just stop it. But you can't stop everything. And that's almost how we're structured now. You know what I mean? It's like the gate comes down and the whole town shuts down. Gate goes up and everybody's available. It's got to be that way. It's like micro-segmented. We shut this app down, this process down, this data store down. You got to compartmentalize it better. So we're going to see better automation. We're going to see a world where offensive agents built by the good guys are training defensive agents to autonomously respond. And where you guys fit in too, with that runtime inspection, you're exactly right. If you can detect at runtime something going wrong, well, you can stop it. It may still go wrong, but you can limit the impact to nothing, right? And that's what's critical.
