Podcast Episode 103
Your zero trust is running on a sticker
with Roei Ganzarski · Alitheon
Also on Spotify, Apple Podcasts, Podbean, Player FM
Episode notes
Roei Ganzarski is the President and Chief Executive Officer of Alitheon, the Bellevue, Washington company behind FeaturePrint, and he isn’t a founder of it. He calls himself a mercenary CEO, which is the fourth time he’s been brought into a group of mathematicians and physicists who built something remarkable and then wanted a different set of skills in the building. His degree is in economics and finance. He says the pleasure of the job is usually being the least smart person in the room, and his rule for the team is that they don’t have to explain it to their mother, they have to explain it to him.
What Alitheon does is biometrics for things. The argument starts with people. We used to identify a human with a badge or a passport, then governments worked out that a proxy can be lost, transferred, faked or manipulated, so they moved to fingerprints and irises instead. A twin can carry his brother’s real driver’s license into a real building, and the document is real and the person is real, and the link between them is the lie. Physical products are still stuck at the proxy stage. A barcode, or a hologram that reads as authentic mostly because it’s shiny and the picture changes when you tilt it.
The mechanism is worth hearing him explain. No machine can make the same thing twice, so design engineers publish a tolerance band, and everything inside that band passes quality control and looks identical and works identically. Alitheon’s math reads the differences that are still there inside that band, and turns them into what they call a FeaturePrint. The fingerprint exists because the thing was manufactured, which means it can’t be peeled off, swapped, or re-issued with the paperwork. He puts the odds of 2 products carrying the same manufacturing signature at one in six and a half trillion. It runs on off-the-shelf industrial cameras, there’s no training phase, and he says there’s no machine learning anywhere in it. His words are discrete mathematics.
Then host Jon McLachlan, co-founder of YSecurity and Cyberbase.ai, puts his security hat on and asks about hardware tampering in transit, and Roei makes the argument this episode is titled after. Zero trust says verify everything connecting to your network. The cyber runs on hardware. And the hardware is trusted because a sticker says who made it and where. He’s presented this to rooms of cybersecurity people who told him hardware isn’t their problem.
The 4 markets he sells into are all versions of one idea he calls high consequence items, which covers expensive goods like the gold bullion that goes into national banks, anything that goes in or on a body, and then transportation and defense parts where the consequence of getting it wrong is somebody getting hurt. The example that stays with you is the aircraft engine supplier caught in the United Kingdom selling real used parts with fake paperwork saying they were new. Fatigued parts that were supposed to be destroyed at end of life went into commercial aircraft, and nobody found it for 5 years, and it wasn’t an accident that found it.
Also in this one. Why a syringe that knows its own manufacturing date closes a loophole that the box can’t. Why counterfeit and gray market are 2 different problems, and why a customer’s own distributors are sometimes the people being caught. Why several customers won’t publicize that they use this at all. Why Alitheon doesn’t need to keep the images, or much data at all. The coin collector at the trade show whose question started the whole company. The day he had to tell roughly 40% of a team they were done, and why he did it himself instead of sending their managers. And the Friday all-hands he runs at every company he’s joined, which starts with Arabic coffee he makes himself and the question of who made a really cool mistake this week.
His ask for the audience is a bigger one than usual. He wants critical thinking back. In his framing the goal is to stop seeing a box at all, and specifically to stop handing the questioning to a large language model because it’s easier than doing it yourself.
Episode 103 of The Security Podcast of Silicon Valley.
Hosted by Jon McLachlan — co-founder of YSecurity.
Key takeaways
-
Zero trust stops at the sticker.
Roei Ganzarski's argument is that zero trust verifies everything connecting to the network while the hardware underneath is trusted because a sticker names a manufacturer and a country of origin. He has made the case to rooms of cybersecurity people who told him hardware isn't their problem.
-
Biometrics for things.
Governments moved from badges and passports to fingerprints and irises because a proxy can be lost, transferred, faked, or manipulated. Physical products are still identified by proxies, a barcode or a hologram, and Alitheon's FeaturePrint reads the object itself instead.
-
The fingerprint lives in the tolerance band.
No machine makes the same thing twice, so every design engineer publishes a tolerance band, and the differences inside that band are what FeaturePrint reads. Roei puts the odds of two items sharing a manufacturing signature at one in six and a half trillion.
-
No training phase, and in his words no machine learning.
FeaturePrint runs on off-the-shelf industrial cameras with no training phase, and Roei describes the math as discrete mathematics. Alitheon markets the product as optical AI, and both descriptions are of the same system.
-
Real parts, fake paperwork.
An aircraft engine supplier in the United Kingdom sold parts with paperwork calling them new. In Roei's telling, fatigued parts went into commercial aircraft and it took about five years to catch. The public record (the AOG Technics case) proves forged release certificates on more than 60,000 parts, found by a mechanic rather than an accident.
-
Counterfeit and gray market are different problems.
A counterfeit is a fake object. A gray market product is a real object moving through a channel the manufacturer never authorized, and Roei says a customer's own distributors are sometimes the people being caught.
-
High consequence items.
Alitheon sells into four markets that share one idea, from the gold bullion that goes into national banks to anything that goes in or on a body, plus the transportation and defense parts where a wrong part means somebody gets hurt.
-
Critical thinking is the ask.
Roei wants the audience to stop seeing a box at all, and specifically to stop handing the questioning to a large language model because it's easier than doing it yourself. His Friday all-hands at every company he has run opens with who made a really cool mistake this week.
Questions this episode answers
- What does “your zero trust is running on a sticker” mean?
- Roei Ganzarski's point is that zero trust architecture verifies every user and device connecting to a network, while the hardware those controls run on is trusted for one reason, a sticker that names the manufacturer and the country of origin. Counterfeit or tampered hardware can carry a backdoor, listen in, or manipulate data, and the software layer has no way to know.
- How does Alitheon's FeaturePrint identify a physical object?
- No machine can make the same thing twice, so design engineers publish a tolerance band, and everything inside it passes quality control and looks identical. FeaturePrint reads the surface differences that remain inside that band with an off-the-shelf industrial camera and turns them into a digital identity, which Alitheon calls biometrics for things. Roei puts the odds of two items matching at one in six and a half trillion.
- Does FeaturePrint use machine learning?
- On tape Roei Ganzarski says there is no machine learning in it anywhere and no training phase, and that the math is discrete mathematics. Alitheon's own site describes FeaturePrint as optical AI using machine vision with no training data required, so the two descriptions are of the same system from two angles.
- How does tampered hardware get into a data center, and what does zero trust miss?
- Jon McLachlan asks about tampering between the warehouse and the data center. Roei's answer is that the usual checks are impedance tests and destructive sampling, and that the software above the hardware never checks the hardware at all. His alternative is a photograph of the part compared against what the manufacturer's factory actually produced.
- What is the difference between counterfeit and gray market?
- A counterfeit is a fake object. A gray market product is a genuine object moving through a channel the manufacturer never authorized, which is why Roei says a customer's own distributors are sometimes the ones being caught. Both problems get solved the same way once each item carries its own identity.
- What happened with the used aircraft engine parts sold as new?
- Roei describes an aircraft engine supplier in the United Kingdom that sold real used parts with paperwork saying they were new, and his conclusion is that the industry relies on paperwork because paperwork is easy. The public case that matches is AOG Technics: in February 2026 its director was sentenced to four years and eight months after admitting more than 60,000 parts were sold with forged release certificates between 2019 and 2023. A maintenance engineer, not an accident, found it.
- What is a high consequence item?
- Roei Ganzarski's term for the four markets Alitheon sells into. It covers expensive goods like the gold bullion that goes into national banks, anything that goes in or on a body, and transportation and defense parts where the consequence of a wrong part is somebody getting hurt.
- What is a mercenary CEO?
- Roei's name for his own job. He isn't a founder of Alitheon. This is the fourth time a group of mathematicians and physicists built something remarkable and then brought him in to turn it into a business, and his rule for the team is that they don't have to explain it to their mother, they have to explain it to him.
Chapters
Tap a chapter to play from there.
Pull quotes
“I am what I like to define myself as a mercenary CEO.”
“At best, you know that the proxy is what it says it is. At worst, even the proxy is fake.”
“Your entire cybersecurity zero trust could be running on hardware that gives a backdoor or listens in or manipulates any of your data, and you'll have no clue until it's too late.”
“How about just taking a picture of it and saying that's not what that company made in their factory.”
“One of the things I'm learning on this job, which is scary, is human greed has no boundaries. There are no red lines.”
“Who buys a product for the box? You buy it for the product.”
“I don't have to have you explain it to your mother. You have to explain it to me. And if I get it, then we can tell the story.”
“People relied on me to be able to pay their mortgages, take care of their kids' tuition, and more. And having to tell a person you won't be getting that anymore was one of the hardest things I have ever had to do.”
“AI can help you tremendously. But don't let it think for you.”
“Who made some really cool mistakes that we can all learn from?”
About the guest
Roei Ganzarski, President and Chief Executive Officer, Alitheon, Inc.
Roei Ganzarski is President and Chief Executive Officer of Alitheon, Inc., the Bellevue, Washington company behind FeaturePrint, an optical identity system that identifies individual physical objects from their own surface features. He joined Alitheon in February 2022 after running magniX, where the team flew an all-electric commercial aircraft in December 2019, and has also served as Executive Chairman of Eviation Aircraft and Chief Executive Officer of BoldIQ.
About the host
Jon McLachlan is co-founder of YSecurity, the on-demand cybersecurity team for startups, and of Cyberbase.ai. The Security Podcast of Silicon Valley is hosted by Jon McLachlan and Sasha Sinkevich. Jon McLachlan on LinkedIn ↗
Context and sources
- Roei doesn't name the engine parts supplier on tape. The public case that matches his description is AOG Technics, whose director was sentenced in February 2026 to four years and eight months for fraudulent trading after more than 60,000 parts were sold with forged release certificates between January 2019 and July 2023. Source ↗
- CFM International identified 126 engines with parts of falsified documentation by October 2023. Source ↗
- Alitheon named Roei Ganzarski President and Chief Executive Officer on February 2, 2022. Source ↗
- Alitheon raised an $8 million Series A1 in June 2026 led by Emerald Technology Ventures with eBay Ventures, and describes the technology as biometrics for things. Source ↗
- Zero trust architecture as the term is used on the show follows NIST Special Publication 800-207, whose fifth tenet is that the enterprise monitors and measures the integrity and security posture of all owned and associated assets. Source ↗
- The London Bullion Market Association selected Alitheon in February 2023 to bring authentication and traceability to the gold market. Source ↗
- FeaturePrint is a registered trademark of Alitheon, Inc.; the company describes it as optical AI with no training data required and a fingerprint file of 500 kilobytes or less. Source ↗