Episode 35 of The Security Podcast of Silicon Valley aired on January 8, 2024, with Jon McLachlan hosting. The guest was Aviv Grafi, the founder and CTO of Votiro (Podbean, Apple Podcasts, Spotify). Menlo Security acquired Votiro on February 19, 2025 (Business Wire), and his LinkedIn now lists him as Menlo’s Field CTO since February 2026 (LinkedIn). The episode is called “Aviv Grafi, Founder and Innovator at Votiro: from IDF 8200 to Cybersecurity Visionary.” It has no video version.
The idea under the whole conversation came up eight minutes in, after Aviv told the story of how he used to break into his clients.
“Let’s deliver always good known content.”
Aviv Grafi, at 8:10
This page follows the conversation in order: a section for each part of it, seventeen figures, twelve clips from the tape, a LinkedIn post, the full transcript, and five tools: a quiz, a scorecard for whether your security enables or restricts, a calculator for what blocking password-protected files costs, a timeline, and a to-do list. Where the decodes of the tape disagree on a word, the transcript puts its best guess in brackets, and the page doesn’t quote those words.
Taking things apart
Jon opened with Aviv’s resume: founder and CTO of Votiro, research in low-level security before that, and time in the IDF’s 8200 unit. He asked Aviv to explain that last part. Aviv started a little earlier.
Since he was a teenager in high school, he said, he had “kind of a hobby to tear things apart.”
Then the internet came out, and he took things apart online. One thing led to another, he said, and he got interested in security, hacking and software.
Unit 8200
Before he finished high school, the next step was set for him. In Israel, he said, you do three years of military service.
“I was recruited by the intelligence forces”
Aviv Grafi, at 1:32
He described the work there as defense and offense security operations, done with a license. Wikipedia describes Unit 8200 as an Israeli Intelligence Corps unit of the Israel Defense Forces responsible for clandestine operations, signal intelligence and code decryption, counterintelligence, cyberwarfare, military intelligence and surveillance (Wikipedia). Jon said the specifics are hard to get into.
“but it sounds like you were reverse engineering.”
Jon McLachlan, at 1:51
Aviv said yes, and that it was a natural thing for him to do during his time in the military service.
His LinkedIn lists three roles in the IDF from October 2003 to October 2007: embedded real-time networking software engineer, senior high-performance networking software engineer, and security researcher. After that came three years as a kernel researcher at Neocleus, working on low-level parts of a virtualization product (LinkedIn). Gadi Bashvitz of Bright Security told his own path from the same unit on episode 67, and Or Eshed of LayerX told his path from the IDF to Check Point on episode 98.
Hacking with a license
After the army, he kept going on the attacking side.
“After I graduated from the army service, I was continuing to do some pen testing work, like services work, for a lot of companies.”
Aviv Grafi, at 2:05
He worked for two companies and then started his own services firm. He traveled to meet clients and interview their IT teams.
“And practically, that was a hacking with a license, showing them how vulnerable they are.”
Aviv Grafi, at 2:29
He said that’s where Votiro started to form. Wikipedia defines a penetration test as “an authorized simulated cyberattack on a computer system” (Wikipedia). Jon said a pen tester never has the same day twice, and creativity is front and center.
A Palm Pilot and a curiosity game
Aviv went back further, to how he first got under the hood. He asked whether Jon remembered the Palm Pilot.
“I do remember those things.”
Jon McLachlan, at 3:14
“There may be a few listeners that are googling what a Palm Pilot is.”
Jon McLachlan, at 3:21
For those listeners: the PalmPilot was a handheld electronic organizer from Palm, launched on March 10, 1997 (Wikipedia). Aviv had one as a teenager, and installed software on it that wasn’t meant to be installed on the device. He called it a curiosity game, and it led to security research.
“How do I get more stuff out of something?”
Aviv Grafi, at 3:51
He taught himself online in the early days of the internet, and he was the one who helped his friends, with computers and with getting things done. Jon had named creativity a minute earlier, and Aviv put curiosity next to it.
“the catalyst for a lot of the security research, at least I experienced.”
Aviv Grafi, at 4:15
“that’s actually what drives my passion.”
Aviv Grafi, at 4:20
The resume that worked every time
Jon asked what Votiro does, and what it does better than anyone else in the world. Aviv answered with a story from his pen testing years.
“And there was one thing that just worked for me”
Aviv Grafi, at 5:34
It worked every time.
He went to the client’s website. It could be a law firm, an insurance company or a utilities company. He looked at the open positions, and sent the recruiting department a PDF.
“something that looks like a resume, but actually that’s a weaponized PDF.”
Aviv Grafi, at 5:57
The PDF went to the recruiting department with a short note about wanting to apply and knowing someone at the company. On the other side was a person whose job is to read resumes.
“they need to screen hundreds of those resumes a week.”
Aviv Grafi, at 6:18
“So when someone was opening that PDF, I was able to screen capture the screen, and that’s it.”
Aviv Grafi, at 6:21
In his February 2025 post on the acquisition, he told the same story about himself: a former pen tester who sent compromised resumes to HR departments (LinkedIn). On this site, Hiring Is Now an Attack Surface covers fake candidates, fake recruiters and laptop farms.
A fine balance
The trick taught him why it worked so well. There is, he said, a “fine balance between security and productivity.”
“you need to spot the phishing while you’re doing your job, which is, sometimes, it’s just impossible.”
Aviv Grafi, at 6:46
Wikipedia calls phishing “a form of social engineering and a scam,” in which attackers trick people into revealing sensitive information or installing malware (Wikipedia). Aviv said that 20 or 30 years of technology built to block malicious attachments still fails.
That’s when he understood there was room for something new.
Flip the problem on its head
Here is where Votiro started. He didn’t want the recruiter deciding whether a PDF is suspicious. The recruiter, he said, is “interested in the content of that document.”
What the recruiter needs is the title, the contact details, the experience, the text and maybe the links.
“So if I’m taking all that content and just move that to a safe template of the exact same file type”
Aviv Grafi, at 7:48
Deliver that, and the recruiter gets the exact same experience, without anything that may be malicious in it.
Anything else in the file stays outside. Trying to find the bad stuff, he said, is impossible. He said that’s what Votiro does better than anyone else in the industry, because the rest of the industry relies on history to predict the future. Wikipedia calls the technique content disarm and reconstruction, “a computer security technology for removing potentially malicious code from files.” It doesn’t try to detect what malware does. It removes every part of a file that the policy doesn’t approve (Wikipedia). His LinkedIn names Votiro’s version Positive Selection, a patented technology that sanitizes every file before it reaches the user (LinkedIn).
Take the good stuff
Jon liked how simple it is.
“You’re just going to take the good stuff and leave everything else, and you don’t have to worry about identifying specific patterns of malicious behavior or code or snippets or Metasploits or whatever.”
Jon McLachlan, at 8:30
When Votiro started, most files came in over email and web downloads. That changed. The list Aviv gave next included Box, Dropbox, OneDrive and SharePoint, and Votiro had to support every one of those sources. Then he said what he tells his own people.
“open any document you get from outside. Just open it.”
Aviv Grafi, at 9:16
“Even if you think that it’s malicious, just open it, because it’s completely safe.”
Aviv Grafi, at 9:19
Don’t blame the victim
Aviv guessed that Jon runs phishing training too.
“Oh, yeah.”
Jon McLachlan, at 9:46
Aviv described the email people get after they click.
“Oh, you clicked the wrong link. Now you need to do kind of a crash course on something.”
Aviv Grafi, at 9:52
“Yeah, it killed me to blame the victim.”
Jon McLachlan, at 9:57
Aviv agreed. You can’t “throw all that responsibility on the victim,” he said.
Then he admitted he would fall for it himself. If an email said there was a problem wiring his paycheck this month, he would open the attached form and fill it in, because he wants his paycheck. Jon put it plainly: you want to get paid.
You can’t tell employees to think twice before they do their jobs, he said.
“And I think that’s what I would like to see more in the world, like more proactive protection rather than reactive.”
Aviv Grafi, at 10:37
Ganesh Krishnan of Anzenna, the guest the month before on episode 34, called security awareness training broken. His answer was training in context, sent to the employee.
One swoop
Jon came back to the idea. A rule that keeps only the content doesn’t care what the next exploit is.
“a very rich ecosystem of things that interpret documents.”
Jon McLachlan, at 11:08
“a nice way to cover all of that ground in one swoop.”
Jon McLachlan, at 11:16
Upload portals
Aviv added a source nobody planned for. After COVID, more companies went digital. Filing a health insurance claim now means uploading documents online.
“But now a lot of companies also now, you know, they might be attacked by those upload portals.”
Aviv Grafi, at 11:50
“And I was talking with pen testers. They said they love it, because that’s the easiest way to get in.”
Aviv Grafi, at 12:12
“Just send something through that upload portal of a company, and bam, you’re in, because no one suspects that.”
Aviv Grafi, at 12:18
“But no one told us, don’t open attachments or documents from the system that you’re working on every day, which doesn’t look like email.”
Aviv Grafi, at 12:30
Always one step behind
Jon said he understood why Aviv started Votiro: he saw the opportunity, used it firsthand as a pen tester, and felt an obligation to solve it for everybody. Aviv said he couldn’t find a decent solution. The tools on the market look at what happened in the past and try to predict the future. They all rely on signatures, he said.
“What they know, that’s what they can detect.”
Aviv Grafi, at 13:15
Machine learning didn’t change that for him, because a model is only as good as the data it was trained on. He called that a problem, because “the bad guys would always be one step ahead.” So he chose not to “participate in that cat and mouse game.”
His answer was to turn the problem on its head.
“I want to get the good stuff.”
Aviv Grafi, at 13:49
Wikipedia describes antivirus software as “software intended to prevent, detect, and remove malware,” and notes a shift in the industry toward signature-less approaches, including behavioral detection, machine learning and cloud-based file detection (Wikipedia). A zero-day is a vulnerability unknown to its developers or anyone who could mitigate it (Wikipedia).
An API in minutes
Jon asked about go-to-market. Top-down or bottom-up? Could he sign up and integrate it in one day? Aviv said Votiro started out tied to one or two sources, like email.
“a couple of years ago, when we moved to offer that as a cloud service, we opened that as an open API approach.”
Aviv Grafi, at 14:20
“So as long as you can code in any language, you can connect your business application”
Aviv Grafi, at 14:26
“So that’s pretty easy, like, in minutes to integrate if using the cloud service.”
Aviv Grafi, at 14:42
Security-savvy organizations that want it on-prem could have that version. More and more customers were moving to the cloud API, and often a technical team or an architect found it first. So adoption usually ran bottom-up, he said.
Avery Pennarun described Tailscale’s bottom-up adoption on episode 42.
The best day
Jon asked for the best day so far. Aviv said there wasn’t one best day. There were a lot of great days, and a great day is when a customer or design partner says a feature, or the direction of the product, is exactly what they wanted.
Jon said none of the technology matters unless it improves people’s lives.
“Yeah, I am a firm believer that at the end of the day, we can build all of this technology and have all of these products out there and an ecosystem of stuff, but unless we’re actually improving and changing our fellow humans’ lives for the better”
Jon McLachlan, at 16:17
Aviv listed the feedback he likes to hear. Saving a customer money is fine. Better is a customer who says “You saved me a lot of time,” and best is this one:
“That’s exactly what I was looking for”
Aviv Grafi, at 17:00
Safe first, details later
Jon asked whether Votiro can tell a customer that a document had something malicious in it. Aviv said it couldn’t at first. Customers could open everything without thinking twice, and Votiro added analytics and threat intelligence on top.
“we actually scan those documents days or weeks after they’ve been delivered, with some best-in-class detection solutions in the market”
Aviv Grafi, at 17:40
Those detection tools take days to catch up. Because the safe version went out first, the original can wait for them. A week later, the customer can hear that a resume they got was malicious, and that they were safe.
“And the good thing is that we don’t need to panic the SOC team.”
Aviv Grafi, at 18:17
The SOC still wants to know, he said, and it can learn that a resume was malicious without a scramble to remediate.
Jon raised a question the rescan leaves open: was it intentional, or was there malware on the sender’s machine that slipped something into emails they sent?
Inside and outside
Everything so far was about external documents coming in. Jon thought the same technology fit the internal threat. Aviv said customers use it that way, but less. Most internal threats, he said, are about information going out, not malicious files moving around. Jon pointed to rules that require it.
“a lot of verticals have regulatory requirements to handle certain types of insider threat.”
Jon McLachlan, at 19:29
Wikipedia defines an insider threat as one that comes “from people within the organization,” such as employees, former employees, contractors or business associates (Wikipedia). Business Wire describes Votiro’s data detection and response product as bringing simplicity to data loss prevention and data masking (Business Wire).
The worst day
Jon gave him a second to think about the worst day. Aviv said the worst day rarely looks that way weeks or months later. The tough days were about people.
“for example, I had the wrong hire”
Aviv Grafi, at 20:20
Or someone he thought would help make a change didn’t deliver, or there was a mismatch of values. Realizing he had to part ways with someone on the team was not a great day.
“Yeah, those can be challenging moments, a little bit of short-term pain, and maybe, for long-term, more happiness on both sides of the equation.”
Jon McLachlan, at 20:43
Aviv said he had learned the same thing.
“it’s happiness for both sides.”
Aviv Grafi, at 20:55
“I mean, customers and crises, there are always such things”
Aviv Grafi, at 21:04
Jon said he and Aviv share a focus on people, and that he tries to be intentional about long-term goals.
“And sometimes that requires a short term… not a compromise, but just overcoming the challenge.”
Jon McLachlan, at 21:58
A North Star
Jon asked what success looks like. Aviv’s answer started with the approach. Success would be seeing this change spread across the industry:
“changing that paradigm of how we treat content”
Aviv Grafi, at 22:34
He named two forms success could take:
“either part of one of the big vendors or being the player actually designing that approach”
Aviv Grafi, at 22:49
Thirteen months after the episode aired, Menlo Security acquired Votiro. See What happened after the tape.
“success is all about adoption”
Jon McLachlan, at 23:08
The good guy and the bad cop
Jon asked for a favorite interview question. Aviv heard it as a question he likes to be asked in interviews: the key takeaway for CISOs and security architects.
“as a CISO, you need to be the good guy”
Aviv Grafi, at 24:31
“And you need to think how you find solutions that enable the business”
Aviv Grafi, at 24:36
“I want to have enabling security and not restrictive security.”
Aviv Grafi, at 24:45
He said he used to be the other kind himself.
“and I admit that I was part of that kind of approach”
Aviv Grafi, at 24:52
That meant stopping things, and policy that looks nice on paper and is a pain for the business. On this site, Stop Saying No covers the same habit for AI.
Two types of security people
Jon said security done right is quiet and in the background, and getting there takes a lot of work behind the scenes.
“there’s really two types of security people in the world.”
Jon McLachlan, at 25:57
The first type walks into a meeting room and the room thinks “Oh, no.” They’ll be told what they can’t do, and handed strange new standards to implement.
“And then there’s another type of security person.”
Jon McLachlan, at 26:22
The second type walks into the same room with the same security goals, and is seen as an ally who helps the team ship on a tight deadline.
“collaborative instead of prescriptive.”
Jon McLachlan, at 26:49
“That’s exactly right.”
Aviv Grafi, at 26:52
When security is collaborative, Jon said, people come and ask about it, in a playful and learning way. Jon told the same story a month earlier to Ganesh Krishnan on episode 34.
The password-protected question
Aviv has a question that tells him what kind of security leader he’s talking to.
“what is your security policy regarding password-protected documents on the way in?”
Aviv Grafi, at 27:40
“Are you blocking all those password-protected documents altogether, or are we just allowing them to go in, no matter what there is in them?”
Aviv Grafi, at 27:45
Jon asked what the strict side says. The strict leader can’t be sure the file is safe, so he blocks every password-protected document. From a business view, Aviv said, that’s horrible: a lot of documents arrive password-protected today, even for privacy reasons, and his customers asked for a solution. The other side lets them all in, without knowing a solution exists.
“and I prefer not to impact the business”
Aviv Grafi, at 28:56
In May 2021, he posted that Positive Selection had stopped a zero-day attack delivered in a zipped, password-protected file (LinkedIn).
No business at all
Jon pulled the thread to money.
“At the end of the day, a business has to balance its books and enable growth and all of these things.”
Jon McLachlan, at 29:04
Jon said he believes security can be positioned as “an advocate and a top-end enabler of new growth for a business.”
“That’s right. I agree.”
Aviv Grafi, at 29:22
Aviv took the strict answer to its end.
“just let’s disconnect all systems from the internet”
Aviv Grafi, at 29:31
Then you would have no business at all.
Jon’s reply was a joke about the CIA. In security, the CIA triad is confidentiality, integrity and availability, and Wikipedia adds that information security protects them “without hampering organization productivity” (Wikipedia).
The hard thing about hard things
Jon asked what book or movie Aviv would hand his younger self.
“there is a book called The Hard Things About the Hard Things.”
Aviv Grafi, at 30:20
The book is The Hard Thing About Hard Things: Building a Business When There Are No Easy Answers, by Ben Horowitz, the co-founder of the venture capital firm Andreessen Horowitz and the former CEO of Opsware (Wikipedia).
“So I think what I liked about that book is that it’s really based on real experience.”
Aviv Grafi, at 30:26
“It’s not a model.”
Aviv Grafi, at 30:32
“because it’s based on real things that usually they’re not being described in those textbooks.”
Aviv Grafi, at 30:43
He liked that it reads like a series of short blog posts.
The highs and the lows
Then the advice for his younger self.
“I mean, the highs are not that high, and the lows are not that low.”
Aviv Grafi, at 30:58
The rest of the advice was not to take any of it too seriously. He said that’s what experience teaches.
“I love that advice for your younger self.”
Jon McLachlan, at 31:20
Jon answered with a line he credits to Oscar Wilde, that life is too important to be taken so seriously all the time.
“when we’re at those peaks and those mountains, well, it’s like, yeah, it’s temporary.”
Jon McLachlan, at 31:53
The troughs, where it feels like everything is collapsing, are temporary too.
Reading minds remotely
Jon asked a playful question for the entrepreneurs listening: what problem does Aviv keep running into that someone else should go solve? Aviv’s first answer was an AI model he could chat with, and he said that already exists.
His real answer was a way to read people’s minds.
He would tap a button over Zoom, and that’s it.
“Okay, that’s a magical technology.”
Jon McLachlan, at 33:39
Jon guessed it would use AI to read our information leakage: facial expressions, the way we say things, and “the micro gaps between words.”
“That’s the new feature for a ChatGPT thing.”
Aviv Grafi, at 34:00
They both said they were joking.
“There must be, like, a Black Mirror episode on that.”
Jon McLachlan, at 34:15
Black Mirror is a British anthology television series created by Charlie Brooker, mostly set in near-future dystopias (Wikipedia).
Two final words
Jon asked for final words of wisdom. Aviv gave two. The first was to look for enabling security over restrictive security.
“And of course, don’t take life too seriously.”
Aviv Grafi, at 34:53
What happened after the tape
Menlo Security bought Votiro. On February 19, 2025, Menlo Security announced that it had acquired Votiro. Business Wire describes Votiro as specializing in “advanced Content Disarm & Reconstruction (CDR) and data loss prevention,” and Menlo as protecting organizations “from cyber threats that attack web browsers” (Business Wire). The two had partnered four years earlier, in February 2021, on safe downloads from the web (LinkedIn). On the tape, being part of one of the big vendors was one of the two forms of success Aviv named.
Aviv’s post. The same day, Aviv wrote that he had co-founded Votiro 14 years earlier “to make file security effortless and foolproof.” He told the resume story again, and wrote that Votiro had processed over 10 billion files.
Aviv on Menlo Security's acquisition of Votiro, 14 years after he co-founded it.
Aviv Grafi · February 19, 2025
Inside Menlo. His LinkedIn lists him as CTO, Data Security at Menlo from February 2025 to January 2026, where he led the integration of Votiro into Menlo’s offerings. Since February 2026 he has been Menlo’s Field CTO, working between customers, field teams and product (LinkedIn).
More on this show. Browser security, Menlo’s business, comes up often on this show. Or Eshed of LayerX explained how browser security became the new battleground for enterprise AI on episode 98, and Vivek Ramachandran of SquareX argued that web security belongs in the browser on episode 49. On the blog, Enterprise Browser Security explains why the browser became the control point, and Pentest Once a Year? covers what enterprise buyers expect from a penetration test.
Did you catch it? A seven-question quiz
Seven questions from the episode. Each answer links the moment in the transcript.
Quiz · seven questions
Did you catch it?
Pick an answer to see whether you caught it.
-
What did Aviv send to recruiting departments in his pen tests?
b. "something that looks like a resume, but actually that's a weaponized PDF." It worked every time. Transcript, 5:57.
-
What does Votiro do with a file, in place of judging whether it's bad?
a. "So if I'm taking all that content and just move that to a safe template of the exact same file type" Transcript, 7:48.
-
Why do pen testers love upload portals, according to Aviv?
c. "Just send something through that upload portal of a company, and bam, you're in, because no one suspects that." Transcript, 12:18.
-
What does Aviv say the detection tools rely on?
b. "What they know, that's what they can detect." Transcript, 13:15.
-
What happens to the original file after Votiro delivers the safe version?
a. "we actually scan those documents days or weeks after they've been delivered, with some best-in-class detection solutions in the market" Transcript, 17:40.
-
What's the question Aviv asks to learn a security leader's approach?
c. "what is your security policy regarding password-protected documents on the way in?" Transcript, 27:40.
-
What does Aviv say a CISO needs to be?
b. "as a CISO, you need to be the good guy" Transcript, 24:31.
Is your security enabling or restrictive?
Eight questions on how files from outside reach your people, and how the rest of the company sees your security team. Each tip quotes the tape or paraphrases it, and links its section.
Scorecard · eight questions
Is your security enabling or restrictive?
Answer for your company as it runs today. If two answers fit, pick the lower one.
-
What happens to a file from outside before someone opens it?
- Nothing. People decide whether it looks safe
- It's scanned for known threats
- Its content is rebuilt into a safe copy first
"Let's deliver always good known content." See Flip the problem on its head.
-
What do you do with password-protected files on the way in?
- Block them all, or let them all in
- Someone opens them by hand
- We open them safely and deliver a safe copy
Aviv asks this question to learn a leader's approach. See The password-protected question.
-
Are your upload portals and forms that take customer files covered?
- No
- Some of them
- All of them
Pen testers told Aviv an upload portal is the easiest way in. See Upload portals.
-
Which ways in do you cover: email, web downloads, file-sharing tools?
- Email only
- Email and web downloads
- Every way files reach us
Box, Dropbox, OneDrive and SharePoint came after email. See Take the good stuff.
-
What happens after someone clicks in a phishing test?
- A crash course and a warning
- A short explainer
- We also fix what let the email through
"throw all that responsibility on the victim." See Don't blame the victim.
-
Do you rescan delivered files once detection catches up?
- No
- Sometimes, by hand
- Yes, and the SOC gets a report
"And the good thing is that we don't need to panic the SOC team." See Safe first, details later.
-
When security joins a planning meeting, what does the room expect?
- A list of what they can't do
- It depends on who comes
- Help shipping on the deadline
"collaborative instead of prescriptive." See Two types of security people.
-
Do teams bring security questions to you before you ask?
- Rarely
- Some teams
- Most teams
When security is collaborative, Jon said, people come and ask. See Two types of security people.
Your people decide what's safe, and security says no. Start with what files from outside go through before anyone opens them, and ask Aviv's password-protected question about your own policy.
Email is covered. Next, cover upload portals and file-sharing tools, rescan what you delivered, and stop phishing training at the click.
Your security enables the business. Keep checking new ways files get in, and keep the room glad to see you.
What does blocking password-protected files cost?
Aviv called blocking every password-protected file horrible for the business. This calculator puts hours on it.
Calculator
What does blocking password-protected files cost?
Three numbers: how many password-protected files you block in a week, the minutes of work each blocked file costs someone, and your working weeks in a year.
Blocking 50 files a week at 20 minutes each costs 16.7 hours a week, 800 hours a year, or 20.0 forty-hour weeks.
Every default here is a placeholder: put in your own numbers. The minutes are for whoever chases a blocked file: the person waiting on it, the sender asked to send it another way, and IT if a ticket gets opened. Letting them all in costs no hours on this calculator. That's the other answer Aviv hears, from leaders who didn't know there was a solution.
From 8200 to Menlo
Aviv’s path, Votiro’s, Menlo’s, and the episodes on this site that pick up the thread. Filter by topic.
Timeline
From 8200 to Menlo
- The PalmPilot
Palm launches the handheld. Aviv had one as a teenager and installed software on it that wasn't meant for it (Wikipedia, on this page).
- The IDF
Embedded real-time networking software engineer, then senior high-performance networking software engineer (LinkedIn, on this page).
- Security researcher
In the IDF, through October 2007 (LinkedIn).
- Neocleus
Kernel researcher on a virtualization product, through 2010 (LinkedIn).
- Votiro
Aviv co-founds it and becomes CTO (LinkedIn, on this page).
- CEO
Aviv runs Votiro through June 2021, with offices in the U.S., Australia, Israel and Singapore (LinkedIn).
- Entrepreneurs' Organization
He joins as a member, and LinkedIn lists him as a board member. EO was founded in 1987 as the Young Entrepreneurs' Organization (Wikipedia, LinkedIn).
- A partnership
Menlo Security and Votiro team up on safe downloads from the web (LinkedIn).
- Measuring invisibility
Aviv shares a post by Votiro's head of product, Alon Blum, on measuring how invisible the product is (LinkedIn).
- Risky Business
Aviv on the Risky Biz podcast, alongside GreyNoise and MergeBase (LinkedIn).
- A zero-day in a locked zip
Positive Selection stops a zero-day attack sent in a zipped, password-protected file (LinkedIn, on this page).
- Secure File Gateway for Web Browser
Votiro launches it, for downloading files from the web (LinkedIn).
- Capture the CISO
Votiro and Aviv win the first season of the CISO Series show (LinkedIn).
- Defense in Depth
Aviv on managing the onslaught of files, with Steve Zalewski and David Spark (LinkedIn).
- $11.5 million
A Series A led by Harvest Lane Asset Management (SecurityWeek).
- Episode 34
Ganesh Krishnan of Anzenna on why security awareness training is broken (episode page).
- Episode 35
Aviv on the show (Podbean, transcript).
- Episode 42
Avery Pennarun on Tailscale's bottom-up adoption (episode page).
- Episode 49
Vivek Ramachandran on why web security belongs in the browser (episode page).
- Menlo buys Votiro
Menlo Security acquires Votiro (Business Wire, on this page).
- CTO, Data Security
Aviv leads the integration of Votiro into Menlo, through January 2026 (LinkedIn).
- Episode 67
Gadi Bashvitz of Bright Security, another 8200 alumnus (episode page).
- Field CTO
Aviv becomes Menlo's Field CTO (LinkedIn).
- Episode 98
Or Eshed of LayerX on browser security (episode page).
What to do this week
Five things, in the order of the episode.
- Map every way files get in. List email, web downloads, file-sharing tools and every upload portal, as in Take the good stuff and Upload portals. Then take the scorecard.
- Fix what let the email through. If your phishing training ends with a crash course for the person who clicked, look at the system too, as in Don’t blame the victim.
- Rescan what you delivered. Run delivered files through detection again once it catches up, and decide how the SOC hears about it, as in Safe first, details later.
- Ask Aviv’s question. Ask your own team what happens to password-protected files on the way in, as in The password-protected question, and put hours on the answer with the calculator.
- Try the resume trick on yourself. Our Penetration Testing covers application, cloud, AI systems and physical access. Our 24/7 Monitoring & Response watches cloud, network, endpoints and mobile, with hands-on triage. If you want to talk it through, book 15 minutes with us.