Hi everyone, it's Air, the host of In Conversation. We just wrapped up our final episode of season 1. It's a Christmas special and an absolute cracker. The founder of Checkpoint, Imperva, and now Cato. First check investor into Aqua, Exabeam, Sumo Logic, and Palo Alto. Goes through his whole history of cyber. Best story I've ever heard. You have to watch it. We got the godfather of cyber security. It is Mr. Shlomo Kramer himself. Shlomo, welcome.
No, thank you for making the effort and time. So, I start every conversation by embarrassing you a little bit and talking about you to the camera just to make sure the audience knows who you are. So, if you would let me, I'm going to just talk a little bit about you.
I will embarrass you away. Okay. So, for those of you who don't know Shlomo, and if you don't, you should be embarrassed. After studying maths and computer science and doing his military service, Shlomo's first work, he decided to start Checkpoint, one of the founding companies in the '90s in the firewall space. And actually I watched a YouTube video and you said it wasn't your first business. When you were in school you did something with Sinclair computers, was it reselling them or fixing them?
I did startups as a PC kid before there was a PC, on Sinclair Spectrum and even ZX before that. The Z even extended to the now infamous Quantum Leap QL that ended the Sinclair brand.
Well, a lot of people here, it's a UK audience, huge fans of Sinclair computers. So there you go. A great start to the biography of Shlomo, but this is just the beginning. So his first company job was founding Checkpoint back in '93, leading it to IPO in '96. You were there up until the point that you then moved into the world of structured data founding Imperva, leading that company as well to IPO in 2011. You decided that wasn't enough while you were there and you started angel investing. And if a lot of people are not aware, Shlomo is also probably the most successful cyber security angel investor in the world as well. He's done non-cyber investments like Gong which are unicorns, but just in the cyber world he wrote first checks and sat on the board of Sumo Logic, Palo Alto, Exabeam, and Aqua, all companies that everyone is still using to this day. And then after finishing with Imperva, you thought why don't I do it a third time and you founded Cato in 2015, starting the whole push into SD-WAN and what is now called SASE as well. So incredible story. That's why we're calling Shlomo the godfather of security. That's why I'm wearing a Christmas jumper. This is a very special episode. And now let's talk about Cato.
Where you're currently running still. You founded it 10 years ago. I've got some notes here. ARR greater than 350 million, over 3,000 clients. You're still growing 50% year on year.
There you go. Live update. 4,000 more than 4,000 clients. Growing 50% year on year. You're in the Gartner Magic Quadrant. And at the last funding round, and you can correct me if there's new news, I have last funding round 4.8 billion was the valuation.
So you've heard there, three unicorns as a founder, four first checks into unicorns in the cyber space plus more in the non-cyber space. So I think the first question we have to ask is why did you agree to talk to us? You are an incredibly successful person. You know we're a UK based cyber security consultancy doing a YouTube video. Why? Why did you agree?
I think first of all, you're a very important partner and thank you. That's very kind. Hopefully we'll continue to do great work in the future. And happy to tell the story wherever I can.
Brilliant. Well, I mean just doing the research for me was fascinating. So I'm really happy to share the story. But I have to ask one more question before we get into the story. We've gone through the success. You didn't need to work a very long time ago. You could have stopped working and I was speaking to your team earlier and they're saying, and some of them worked with you previously in Imperva, and they're like this is a different Shlomo. He is engaged, he is pushing, he is in every meeting, he's flying around the world. Why are you still working so hard?
I've never worked in my life a single day. So it's never been a work. I started doing this when I was 16 on the personal computer and kept just kept going because this is a passion. So that's what I love doing. Every morning you wake up, as long as I can get on the court and play ball, I'm going to do it.
Okay. I'll be honest with you, as someone who's now running a business, I feel the same way. I enjoy waking up, I enjoy working. So I can relate to that. So let's get into the serious questions now. So your first business, you know, obviously you had the business while you're in school, right? But you finished your military service and straight away you thought, I'm going to start a business. I'm not going to be an employee. I'm going to start a business. How did you have the confidence to do that straight away?
It's twofold. First of all, I always had this dream of a startup, of being an entrepreneur, even before I knew what being an entrepreneur actually meant. I remember Sinclair days that I worked at a shop that sold Sinclair as well and somebody showed me a game that somebody in the UK actually developed and said, 'Hey, this guy is 17 years old and look, he's got a startup and he's selling all over the world.' And that was like a light bulb. I want to be like that. And the second piece is the self-confidence. And I'll tell you frankly, the years of serving in the IDF, in the intelligence forces, it was really an elite unit. If you ask me what was the most formative and exciting experience that I had in my professional life, I would say the five years I spent in the early '90s. And the one thing that you took from there is that everything is possible. The internal feeling that everything is possible. So when Checkpoint, which was an extension of the army days, it was actually all the people that worked with me in the army moved to Checkpoint. When we were hugely successful after a year of development and some micro system used us and signed an OEM and we exploded, I remember that to me it felt like, oh obviously we are extremely successful. We said we're going to do it. We've done it.
That's a surprise. On the benefits of being very young. Youth comes with natural confidence. Now when you founded Checkpoint in '93, what problem were you trying to solve? And I want to put this into context. I started my career in 2001 at Cisco. I was a system engineer. And I remember we had a product we'd bought called PIX firewalls. I remember which is I think NTI was the company we bought. It was not so much a firewall as a network address translation box. It was hardware based. And you guys had a software based product. You could run it on Sun. You could, it was much broader. So looking back in those days, what problem were you trying to solve?
It was really a simple use case. Organizations wanted the internet, it got deregulated, and enterprises wanted to connect to it. But they couldn't because there was a security issue. So we came to solve that security issue with an idea we developed already in the IDF. And we were not the first firewall. Actually when we joined, we joined a mailing list that was called firewall something. So the word was already there. But we were the first commercially viable firewall, I would say. A firewall that fits on a single floppy disc. You put it in, you install it in 5 minutes, and it supports not only all the applications that you have today, but you can be certain that it will support every new application that you will develop in the future. So essentially it was operationally efficient and business agile and could say yes to the business that wanted to use this application. And all in one disc. And that premise of operational efficiency and business agility is actually the one that goes throughout the decades in network security, driving every new generation of network security.
Amazing. So talking about that, you're saying every generation the same principles. What principles from that era do you think are still here? It's been 20 something years, more than that. What principles are still true from that time?
I think the principle is the principle of convergence. We didn't do only network address translation. We did also firewalling. We did stateful inspection. We did a certain amount of securing the connections themselves. I won't go into the technical details, but trying to provide as much functionality on a single platform on the floppy, and making the usage of that platform as efficient as possible in terms of budgets and headcounts, and make that platform ready for whatever is next. I would say that these premises are the ones that stay with the future successful, like for example Palo Alto Networks and Fortinet, which is the second generation.
Okay. So staying on the same theme, as someone who's founded multiple billion dollar companies, what would you say is the common DNA across those companies? Is it culture? Is it having good timing? Is it having the best technology? Is it all of the above? What is the common DNA of a successful business? And you had so many of them.
A deep understanding of the history of the category, and having hands-on current understanding of the status of this category and understanding what's broken. So Gil was a system administrator. He was a user. He was tasked with how do you segregate these two networks and allow for certain traffic to go, and he built something as best he could. So he had hands-on customer experience. Nir Zuk spent years in NetScreen and before and Juniper and before that Checkpoint, so he understood the network security category and understood what's broken in it. That customer angle is really critical. I find at the moment there are too many people who want to be founders because they want to be founders. They're not actually passionate about a problem that they're trying to solve and evolve the next generation.
That rings very true to me. We've been talking a little bit about cyber evolution. Last week or two weeks ago, it was the anniversary of the first worm, the Morris worm. I can't remember his name now, but obviously his surname was Morris. The son of the NSA executive, the founder of Y Combinator, who while studying at Cornell unleashed the first worm, took 10% of the internet down. What have you seen in terms of evolution of cyber threat? Because at first it was mischief. It was smart students trying to see what's possible. Now we're seeing criminals and monetization. We're seeing geopolitical attacks. What have you seen in this evolution?
Let me tell you that it's not necessarily the case that in the beginning it was mischief. A month before I started Checkpoint, I read a book called The Cuckoo's Nest. It was about the very first computers that got connected to the internet between Compasses and how they were attacked immediately as they were connected by a group in Eastern Germany that actually was driven by the KGB. And how one system administrator in one university was able to track this attack down right in the beginning. So right from the start there were nation state attacks.
So you don't think there's been that much change then?
I think the entire palette of threats was available from the start.
Fantastic. I'm going to take note of that book. We're going to find it and try to put a link in the video. So one thing I have to ask, and I'm going to ask you this a few times through this conversation, is around AI because it's just an unavoidable topic. What worries you in terms of AI and the cyber threat and how they're using AI?
AI is obviously a big threat in cyber security and also a big promise. It's a threat because it's a completely new layer that is very different than all the other layers. You need to develop a completely new cyber security stack to provide the posture management, protection, detection, response cycle. That's something that is being done ferociously today. It's also a way to industrialize sophisticated attacks. The AI is not quite there yet, but it will get there. And on the fraud side, which is not really cyber security but it's adjacent, it makes fraud so much more sophisticated. And actually, I think that is the biggest risk of AI: the fact that it undermines people's ability to tell truth from lie, and by that determining what's coming next and gaining the psychological comfort that comes from it, which is absolutely essential. The attacks are polymorphic, bespoke to each person based on their social media, written in the tone of whoever they're impersonating. But the implication on society goes way beyond just financial crimes.
Okay. And do you think who is winning right now? Is it the criminals or the defenders?
I think the defenders are always in the Red Queen race. They need to try very hard just to stay in the same place. It's an almost impossible and asymmetric challenge to gain ground in this fight. The question is whether we are able to stay our ground.
