Neatsun Ziv didn’t open with a product pitch. Asked what OX Security is up to, he opened with the idea the company was built to replace.
“OX was formed with the problem statement that shift left as a concept failed us for years. We’ve been trying to make it work, but it’s just that everybody’s got their priorities.”
Neatsun Ziv, at 1:43
Neatsun is the co-founder and chief executive officer of OX Security, which he started in October 2021 (LinkedIn). Before that he spent almost ten years at Check Point, first as director of its secure cloud work from December 2011 and then, from June 2016 to July 2021, as vice president of threat prevention and intelligence. Earlier he founded and ran Vanadium Security for eight years, and his first jobs were in software development, at Scitex, at Motorola and in the Israel Defense Forces. He co-founded OX with Lior Arzi, now its chief product officer, and the two met at Check Point (TechCrunch, OX Security).
OX describes its mission as “a world where software secures itself,” and sells an application security platform that runs from the prompt to the runtime (OX Security). In May 2025 it raised a $60 million Series B led by DTCP, with IBM Ventures, Microsoft, Swisscom Ventures, Evolution Equity Partners and Team8, for $94 million raised in total. TechCrunch reported about 200 customers and 150 employees at the time, with OX analyzing more than 100 million lines of code a day (TechCrunch).
Where we sit, so you can weigh what follows: YSecurity helps startups pass the security reviews enterprise buyers run, and our vulnerability remediation program works on the same backlog problem OX sells software for, from the services side. Jon McLachlan and Sasha Sinkevich host the show together, and the episode aired on March 24, 2026. Our companion posts, Why Shift-Left Security Keeps Failing and Vibe Coding Security, turn the episode’s ideas into plans for a young company. This page stays with the tape.
Shift left failed us for years
Shift left is the habit of moving testing earlier in the life of a piece of software, and the phrase goes back to Larry Smith, who wrote about it in Dr. Dobb’s Journal in September 2001 (Wikipedia). In application security it came to mean scanning code as it’s written and handing the findings to the developers who wrote it. Neatsun’s complaint is with how that handoff worked in practice. Developers have their own priorities, and security arrived as one more item on a list that was already full.
“It is super hard to try and fix security as we go along. And as technologies emerged, we started saying, hey, let’s prioritize, let’s do this, let’s do this, and constantly trying to push it towards the cutting edge of making sure that application security and product security actually work from the moment you start thinking about code up until it’s running in the cloud.”
Neatsun Ziv, at 1:55
That span, from the first thought about code to the code running in the cloud, is the scope OX set for itself. Each new technology widens it, and Neatsun said the latest one changes the size of the problem.
“So that’s a basic concept, but every year you see new technologies, especially now with AI coming into the equation. It just becomes mind-blowing.”
Neatsun Ziv, at 2:15
Five million issues
Sasha picked up on how much there is to cover and asked the question every security team faces sooner or later.
“There are so many things we could be solving every day, but we cannot spread too thin. How do you guys figure out the question, what is the biggest pain point that we need to focus as a team?”
Sasha Sinkevich, at 2:30
Neatsun answered with what you find when you look closely at a company’s findings.
“You get a situation where you get the companies and you actually see that they’ve got like five million issues, and you say, oh, well, this is really bad. And then you go one over one, just sample them, and you see that most of them are not relevant.”
Neatsun Ziv, at 2:43
Then he described what “not relevant” looks like. A scanner flags a password in the source code, and a comment in front of it says it’s an example. A scanner flags a critical open source library, and the library sits in a test application that never reaches production.
“Or you see a lot of those cases where you’re saying, hey, you’ve got this open source Log4j, super critical, it will crash your system, but it’s in a test application that is not running in production. There is no way to get there.”
Neatsun Ziv, at 3:12
The Log4j example is a deliberate one. Log4Shell, the remote code execution flaw in the Log4j logging library, was reported in November 2021 and got its CVE identifier on December 10, 2021, and it had sat unnoticed in the code since 2013 (Wikipedia). It’s about as critical as a finding gets. A copy of it inside a test project nobody deploys is still a finding a professional would set aside, and Neatsun spelled out how that professional thinks.
“So what a professional would do is they would go through a process to start triaging it, saying, you know what, this is not connected to the internet, this is not exploitable, this is not real risk, this is just a test project. Just understand the context.”
Neatsun Ziv, at 3:26
They’re going to ignore you
The cost of skipping that triage is paid in trust. Hand developers everything the scanners produce, and they learn that most of it doesn’t matter.
“If you’re going to push a lot of noise towards developers and ask them to fix things, what you’re going to get back is actually they’re going to ignore you.”
Neatsun Ziv, at 3:40
He had tested it himself, on a team of about 600 developers.
“I used to manage a team of about 600 developers, and we’ve done this exercise, and it sounded very simple. Just take the defects and fix them. And out of the 20 prioritized, they said, we are willing to fix two.”
Neatsun Ziv, at 3:47
The developers weren’t refusing to work. They were answering the questions the list hadn’t. That one is a container issue, that one isn’t exposed to the internet, that one lives in a lab. Every answer was a detail somebody could have looked up before the list went out.
There’s a long-running conversation on this show about the same gap. Jack Cable found on episode 84 that customers needed to know which findings to fix before they needed help fixing them, and on episode 87 Venkat Thiruvengadam described the ticket trap, the way infrastructure work arrives as tickets that someone else has to pick up.
Bring the details for them
OX’s starting idea came from turning that exchange around. If every finding comes back with the same questions, the security side can answer them first.
“What we had in mind is, why are we expecting somebody else to bring these details? Why don’t we just go in and bring these details for you? It’s very easy for us to know. Is it live? Is it exposing API? Is this right now exposed to the cloud? Is this a live Kubernetes agent?”
Neatsun Ziv, at 4:08
None of those answers is secret. Deployment records, cloud configuration and the cluster itself already hold them. The trouble, in Neatsun’s telling, is where the work of collecting them lands.
“Just all of this information is available, but we are just shifting it to somebody else to fix, and nobody’s taking care of that.”
Neatsun Ziv, at 4:22
Jon summed it up as context making security problems “a little bit more relevant, a little bit more focused,” and asked whether AI was the way to speed it along.
Coming blind
Neatsun’s yes came with a qualification. Context has always been the answer. What’s been missing is access to it.
“First of all, yes. I think for years we know it’s all about the context.”
Neatsun Ziv, at 4:44
He made the point with a bank account. Give someone the account number and the password, and guessing their way in is easy. Most people looking at a finding have nothing like that.
“But the challenge is most of us are coming blind to those questions. Saying, is it deployed to the cloud? I don’t know. Is it right now exploitable, exposing any APIs? What does it mean? We’re blind to that.”
Neatsun Ziv, at 4:58
Why wait for the wrong code?
Then he moved the context somewhere new. Instead of collecting it for the developer after the code exists, give it to the agent that writes the code.
“So yes, it is context, but I think one of the advancements that we’ve seen recently is actually taking it to the developer and saying, maybe we could take it not to the developer itself, maybe we can take it to the context of the vibe coding agent.”
Neatsun Ziv, at 5:10
The logic follows. A scanner finds problems in code that’s already written. An agent that knows the environment before it writes can avoid writing the problem at all.
“And as part of this journey, we started getting to play, saying, hey, if you’ve got the context in advance, why wait for the wrong code to be actually written?”
Neatsun Ziv, at 5:24
He listed what that context would say, in the voice of a reviewer briefing the agent before it starts.
“If we can load upfront the context, saying, hey, you are going to touch right now with this request an API that is externally exposed. These are the databases that this app is connected to. Those are the microservices that’s going to be deployed in connection with. We want you to have those security restrictions and this rate limit and this sanitization.”
Neatsun Ziv, at 5:33
And the agent can do the work a ticket would have asked for.
“And I’ve already found a few passwords. Why don’t I just move them to your vault, and just do the work, instead of shifting it to the developer that is already loaded?”
Neatsun Ziv, at 5:54
This is the idea our vibe coding security post builds on, and it’s the reason a security context file checked into the repository is one of the cheapest controls a startup can add. Michael Nov argued on episode 76 that the design stage is where most startups skip security. Context in front of the agent moves the design decisions to the moment the code is written.
A big enough lever
Neatsun closed the thought with a line borrowed from antiquity.
“So with the right context, you can do marvelous things. I’m not sure what’s the equivalent of the sentence, give me a big enough lever and I’ll move a planet, to AI context. But I’m sure that there is such a thing.”
Neatsun Ziv, at 6:07
The sentence he was reaching for is Archimedes’. Pappus of Alexandria attributed to him the remark “Give me a place to stand on, and I will move the Earth,” about the law of the lever, which Archimedes proved (Wikipedia). The art at the top of this page is that lever. A small, well-placed weight on the long arm moves something far heavier on the other side, and in Neatsun’s version the weight is context.
Security that vibes
Jon was sure there’s an equivalent too, and found one in OX’s own words.
“Just looking at OX Security, it’s like VibeSec, security that vibes the way that software is built. Unless you’ve been living under a rock, the software engineering space is absolutely changing.”
Jon McLachlan, at 6:20
OX says VibeSec “prevents insecure code and destructive scenarios in AI coding tools” (OX Security), and the company introduced it in a video titled Meet VibeSec on September 30, 2025 (YouTube). Vibe coding itself is younger than OX. The computer scientist Andrej Karpathy coined the term in February 2025, and Collins English Dictionary named it its word of the year for 2025 (Wikipedia).
Jon described what the change means for the people doing the work.
“And now, as an engineer, we’re a little bit more like almost managing these agents as they produce a lot of the code that ends up in production systems. And I guess the timing smells perfect to like revisit all of these hard security problems that we’ve been like manually slugging through, everything in our rearview mirror, all of our past histories.”
Jon McLachlan, at 6:36
Then he asked about the moment Neatsun decided to start a company. “We have to be a little bit crazy to start a company, a little bit crazy to be a founder,” Jon said, and asked what that spark felt like.
Burn the bridge
Neatsun’s answer started with what he gave up. At Check Point he had, in his words, everything he wanted.
“Yep. Okay, so before starting OX, VP, large security company, big department, like huge budget, accountability from sales to product, like everything that I wanted. But at a certain point, you do understand that large companies have this disadvantage, that you can’t do everything that you’re doing and still focus on new projects.”
Neatsun Ziv, at 7:17
A new project, as he described it, needs the kind of focus a big company can’t give it, and a founder has to remove the way back.
“But you basically need this absolute focus, and you need to be in a situation where there is no regrets, no undo. It’s like you can’t go back. You actually need to burn the bridge behind you.”
Neatsun Ziv, at 7:46
The way back stays tempting, and he was candid about the doubt that followed.
“After my partner and myself left the company [we] worked for and started OX, it’s like you get to those moments in time that you’re saying, oh my God, what have I done?”
Neatsun Ziv, at 8:03
“And I’m sure you heard it from a lot of founders, but a founder’s life, it’s like a roller coaster. It’s like you never know if you’re going up next minute or down. You just know that it’s going somewhere that you don’t expect.”
Neatsun Ziv, at 8:14
Two weeks apart
Jon asked how Neatsun met his co-founder. They started at the same company within two weeks of each other, and that company was Check Point (TechCrunch).
“So we work together at the same company. We actually joined the company with a two weeks difference from each other. So we actually worked together for almost fourteen years now.”
Neatsun Ziv, at 8:34
“So you’re kind of like work spouses,” Jon said, and Neatsun agreed. These days the partnership spans two continents, and they build in time away from the work.
“I’m New York based, he’s Israel based, so we are actually trying to do like at least twice a year, do like a hike together, usually in the US or Europe. And it gives us like a few good days to hash things out.”
Neatsun Ziv, at 8:49
Jon pointed out that a roller coaster needs a foundation of trust under it. Neatsun’s description of what makes the pairing work was short.
“So, yeah, well, he’s got this amazing trait not to get excited from anything. And I’m exactly the opposite. So it’s like he balances me off.”
Neatsun Ziv, at 9:12
A field they had always overlapped with
Jon asked whether the two founders complement each other in skills too, and whether both are security experts. Neatsun said yes, with a twist.
“But one of the things, I think, is that actually the field that we’re working in right now, it’s a field that we always were in overlap with, but we never worked in this field.”
Neatsun Ziv, at 9:39
Learning it properly, he said, meant owning it.
“Just to own every detail, saying, you know what? I can do this better. Like, I’ve tested other products. I know why they failed miserably, and we have a shot at doing something better.”
Neatsun Ziv, at 9:58
Jon heard a founder’s edge in that. “It’s almost like you feel that pain firsthand,” he said, “and that’s maybe part of your superpower in this space.”
The best and the worst day
Then Jon asked about the proudest day so far. Neatsun answered with a pattern rather than a day.
“I’d probably say that every time that we’re getting to a new milestone, it’s like the best and the worst day. The moment that you see that the goal that you set is actually achievable, you haven’t reached it yet, but you can feel it, and it might be a quarter away, but you can actually say, you know what, I’m in the right trajectory to get there. That’s the high.”
Neatsun Ziv, at 10:27
The low arrives a second later, when the next goal comes into view.
“And the next goal is not going to be like, okay, we moved from 10 million dollar to 20. It’s going to be from 20 to 50. So the next one is like way higher. And then you’re just like, I have no idea how to do that one.”
Neatsun Ziv, at 10:54
He didn’t say on the tape which of those numbers OX had reached. Ten months before the episode aired, TechCrunch reported OX was “generating around $10 million in annual recurring revenue,” a figure Neatsun expected to double by the end of 2025 (TechCrunch).
What comes after the low is a restart.
“It’s like you need to scrape yourself from the floor and start from the beginning. And every founder that I had this conversation with goes through this journey and say, yes, it happens in a few interesting points.”
Neatsun Ziv, at 11:12
He described the way through as effort plus something nobody controls, and when Jon suggested being in the right place at the right time, he raised his estimate.
“It’s like you don’t need a bit of luck, you need a lot of luck.”
Neatsun Ziv, at 11:46
Andrew Rubin of Illumio put the same idea another way on episode 88, where luck and timing turned out to be one thing.
What are you trying to achieve?
Sasha brought the conversation back to the noise, and to the customer conversations that cut through it.
“And Neatsun, you mentioned that it’s important to have those conversations with your customers in order to distill away all of the noise and focus on what actually matters, the actual pain point that, if solved, will deliver huge benefit. What does this process look like for OX Security and your partners?”
Sasha Sinkevich, at 11:58
Neatsun’s process starts with the plainest question there is, and he admitted it’s harder to answer than it sounds.
“Usually it starts with a very basic question, which is, what are you trying to achieve? I know it’s very mundane, but just getting to a very crystal answer on this one, it’s usually a very hard exercise.”
Neatsun Ziv, at 12:20
He worked an example live. Imagine a company with a thousand employees, 20 years old, that makes a lot of its money through what it exposes to the internet. Ask what it’s trying to achieve, and the first answer is usually the wrong one.
“So the basic answer is simply, I don’t want any risks. And that is usually a bad answer. It’s like, you will need to accept risks, and you kind of need to understand where it is that you feel comfortable.”
Neatsun Ziv, at 12:48
The comfortable place sits on a line. At one end a company invests nothing and expects nothing. At the other it expects a lot and pays for it. Most companies, in Neatsun’s experience, pick a spot in the middle and describe it in people and money.
“I don’t want to pay too much for this. I kind of have like three people to put on the problem and this amount of budget. And now, what’s the best you can do for me?”
Neatsun Ziv, at 13:14
Is a million good or bad?
“The best you can do for me” still needs a measure. Customers reach for the one they have, the size of the backlog, and Neatsun walked through what happens next.
“Okay, how many items do you have right now in the backlog? Saying, a million. Saying, a million is good or bad? It’s like, bad. What a good number, it looks like? Like, half a million is good.”
Neatsun Ziv, at 13:29
A count of open items is easy to measure and hard to interpret, and the conversation about what good looks like is where customers find the real goal.
“And most understand really early into the process that the AppSec program is a way to reduce the risk. It’s not canceling the risk. There is always going to be a risk. And the best thing you can do is just think smart about what’s probable, what’s going to hit you, how am I engaging with the developer to actually fix it.”
Neatsun Ziv, at 13:44
Our post on why shift-left security keeps failing walks the public data on how few published vulnerabilities are ever exploited, which is the statistical version of the same point.
Great detection, nobody fixing
The last part of that answer, engaging the developer, is where Neatsun sees most programs stall. A team can find everything and still have done nothing.
“You see this and you’re saying, this is very good, I’ve got great detection. But then nobody’s actually picking up the phone and fixing that. You hadn’t done anything, really.”
Neatsun Ziv, at 14:20
The fix itself competes with everything else on a developer’s plate.
“Now, fixing, I know it sounds very easy, but you need to go to a developer that has product managers, Jira backlog, performance issues, UI issues, customers, and you say, oh, I need you right now to stop everything and fix a million issues. Like, yeah, that’s not going to happen.”
Neatsun Ziv, at 14:33
He has watched teams try incentives, a developer of the month with a small prize, and seen those programs grow into a different question.
“It’s about how do I drive execution on where I want to draw the attention? How do I focus my attention and understanding what is important, and then making sure the right person is actually associated with it?”
Neatsun Ziv, at 15:08
Seven months after the episode aired, OX measured that gap at internet scale, in the hours after an emergency patch. It’s in what happened after the tape.
Just get me through this
Not every customer is building a program. Some are on a deadline.
“For others, it’s a different journey, saying, okay, I just need to pass SOC 2. This is everything that I need to do. It’s like, I don’t care more than that. Just get me through this.”
Neatsun Ziv, at 15:32
Neatsun didn’t treat that as a lesser goal. It’s a starting point that grows a component at a time.
“If you just need to do that for now, all you have to do is like check the box on those five things. Easy. The year afterwards, they’re saying, okay, I just need to add one more component. So great, let’s do this, let’s add that. So everybody has a different risk profile, and we’re just helping them with this journey.”
Neatsun Ziv, at 15:42
A SOC 2 report describes the controls a company runs and, for a Type 2, whether they operated over a period, so a first report can be small and honest and still grow from year to year. Our guide to what a SOC 2 actually is covers the basics, and agentic code review and your SOC 2 Type 2 audit covers what changes when agents write the code.
Sasha tied the thread together with a question about who pays.
“But at the end of the day, it needs to be aligned with business initiatives, and the question is, who is your economical buyer at that point in the company’s journey?”
Sasha Sinkevich, at 15:57
Who buys, who evaluates, who fixes
Neatsun’s answer described three seats, and only one of them belongs to security.
“So I would say that the economic buyer in larger companies is usually the CISO of the organization. And the technical evaluator and the people that actually need to work on the system are more on the AppSec and DevSecOps guys. But the guys that need to solve the problem are actually from engineering and DevOps. So you’ve got this flow from strategic to operational, to actually hammering down issues one by one.”
Neatsun Ziv, at 16:28
At a startup the three seats are often one person, which is why the order of the work matters more than the org chart. The same questions still apply. Who decides what risk is acceptable, who checks the findings, and who changes the code.
What does the I stand for?
The people in the third seat, Neatsun said, usually aren’t trained for the second.
“And if you think about it, when developers see issues, even engineering managers, they are not equipped to understand what is important versus what is not important.”
Neatsun Ziv, at 16:54
The curious ones teach themselves, one acronym at a time.
“They would just type into ChatGPT and saying, what is this CSRF? What does it mean? It’s like, this is the first time that they’re encountering this concept, or SQLi. What does the I stand for? Oh, it’s SQL injection. I heard this term before.”
Neatsun Ziv, at 17:08
Cross-site request forgery is an attack where “unauthorized commands are submitted from a user that the web application trusts,” and SQL injection is “a code injection technique used to attack data-driven applications” (Wikipedia, Wikipedia). Both are old, well-documented classes of web vulnerability. Neatsun’s point is that training alone can’t keep up with the people it trains.
“So it’s about getting to the place saying, we need to train people, we need to educate them. But this is mission impossible. You’re training your developers, and within a year, a third of them moved away, and you’ve got somebody else to train.”
Neatsun Ziv, at 17:24
Everybody’s becoming a manager
“So, what’s the smarter and better way to do it?” Jon asked. Neatsun’s answer starts with how the job of writing code has already changed.
“I think that as we’re entering the vibe coding era, what we are seeing is that everybody’s becoming a manager. When you’re doing right now vibe coding, unlike what we had a year ago, where it wasn’t vibe coding, it was like you’re giving commands, and now you’re just describing intent.”
Neatsun Ziv, at 17:46
The step after intent, he said, is structure. You describe the boundaries, and the agents work inside them.
“And some of the recent enhancement is like, do more than intent, create a policy or a structure, and we’ll work within the boundaries. And I think that as we’re evolving and saying, we’re actually taking concepts from how development teams work and start using AI to think about them as multi-agent that builds the task, verifies the task, adds analysts to it.”
Neatsun Ziv, at 18:04
If the team is made of agents, security can be one of them.
“And this is also an opportunity to take pieces of the AppSec, CloudSec, product security mentality and actually say, hey, maybe an agent on our behalf should be part of this game as well.”
Neatsun Ziv, at 18:29
Ged Ossman made a related argument on episode 99, that an agent should declare everything it will need before it runs, the way an app declares its permissions. Boundaries written down ahead of time are what make both ideas work.
A threat model that keeps up
One old practice gets a second chance in that world. Threat modeling, the work of listing what could go wrong with a design and what to do about it, has always had a maintenance problem (Wikipedia).
“Maybe part of the things that we really wanted to do always as part of security is to make sure that you’ve got a threat model for everything. But that was always like a futile exercise. Like, you’re doing this, and the implementation was never similar to the original design, and maintaining this becomes harder.”
Neatsun Ziv, at 18:42
With agents writing the code, the guidelines can travel with the work, and something can check the design’s assumptions against what got built.
“Maybe now we’ve got a different shot, saying, hey, why don’t we just give guidelines, and somebody will go over the assumptions that we have, and we’ll see how reality faces the design.”
Neatsun Ziv, at 18:58
Michael Nov talked on episode 76 about the designs nobody is looking at. Drift is the same problem after launch, and our post on the MCP server that passed review and then changed follows it into the tools agents connect to.
One layer higher
Jon summed up the direction.
“Yeah, I love it. It’s taking all of the advancement that we have at our disposal today through AI and applying it directly to these difficult problems that we face day in and day out as security professionals.”
Jon McLachlan, at 19:19
Neatsun took it a step further, to what the work becomes for the people doing it.
“Exactly. I think we’re getting to this age where a part of our mind is going to be on not just doing things, but articulating them as a context in a very clear and precise way, that somebody can take this context from us, or process from us, and actually implement it, and allowing us to move one layer higher in focusing on the design, on the concepts, on iterating and verifying.”
Neatsun Ziv, at 19:33
He called it “one of the fastest and most impressive transformations in an industry that I’ve ever seen.” That’s a strong claim from someone who has worked in software since 1996.
Owning the store
Jon asked what the hardest new security challenge will be for the community. Neatsun answered with an analogy from the early days of smartphones, when everybody worried about mobile malware.
“And then basically the owners of the platform kind of said, you know what? We own this. We will make sure that the stores are cleaned from issues. And every time that there’s a security issue, we will patch an update and own up to it.”
Neatsun Ziv, at 20:19
The platform owners could make that promise because they controlled every layer. Code and cloud don’t work that way.
“The challenge for the mobile application is they owned everything. They owned the decision, the store, the operating system. They knew everything. When you think about code and cloud deployment, well, first of all, you don’t have the context. You don’t own everything. You actually own the repo that you’re working on right now. So this creates a context problem.”
Neatsun Ziv, at 20:45
The repository is the slice of the world a team actually controls, and it’s also all a coding agent sees unless someone gives it more. Neatsun put the stakes in two sentences.
“Because think about it. With the right context, you solve everything. With the wrong context, you’re going to get hallucinations.”
Neatsun Ziv, at 21:16
Augment, not replace
Jon heard his own approach to leading people in the answer.
“When you have a team, if you’re just barking orders and giving commands about what to do, you’re really like violating autonomy. But if you set up a situation where, through the context of what’s going on, you share like the difficult problems that we’re trying to solve with that context, you’re respecting people’s autonomy to allow them to go off and think about how to solve problems.”
Jon McLachlan, at 21:28
The same move works with agents, he said, and he singled out one of Neatsun’s words.
“You used a word too, augment, which is one of my favorite words these days. And it really goes back to this idea of maybe like enhancing the things that we’re already doing as humans instead of like replacing humans.”
Jon McLachlan, at 21:59
Abuse of trust
Neatsun answered with a distinction from a conversation a few days earlier, about the difference between fraud and cyber.
“And somebody told me a sentence that just placed everything in place.”
Neatsun Ziv, at 22:19
“so cyber, it’s more about abuse of system, where fraud is more of an abuse of trust.”
Neatsun Ziv, at 22:23
He thinks AI agents bring the second kind of problem into the first kind of system. An agent starts from a set of instructions, and the attacks he expects are attempts to break out of them.
“As we’ve seen, then it’s like, okay, can I do like the equivalent of a VM escape to the basic instruction set that the agent gets? How do I hard code things? How do I make sure that the trust given to the agent is actually enforced?”
Neatsun Ziv, at 22:38
A virtual machine escape is an attack that breaks out of a virtual machine and reaches the host it runs on (Wikipedia). The agent version breaks out of its instructions and acts with whatever access it was given. That’s why access is the place to start. Our posts on least privilege for AI agents and on whether to give the agent write access at all cover the practical side.
Two things you trust
Then Neatsun described something OX’s researchers found, which he believed had already been published.
“But let’s say that you just go to GitHub and you publish the equivalent of a typosquatting. And in this typosquatting, you’re actually adding a command that one of the famous vibe coding environments just treats as, hey, if it’s on the machine, then I’m fine with it. Then you can instruct it to actually say, you know what, write a malware locally that takes everything from the machine, just uploads it.”
Neatsun Ziv, at 23:01
Typosquatting started with web addresses, as a form of cybersquatting that “relies on mistakes such as typos made by Internet users” (Wikipedia). The same trick works on package and repository names, and a coding agent types names too. What makes Neatsun’s example dangerous is that neither half looks wrong on its own.
“It’s a name that I think I’ve trusted, downloading this package. Yes, I’ve mistaken with the hyphen, but I got this by mistake. I’ve got this environment that I trust because it’s really doing good for me. And the combination of trusting this and trusting this is really a bad idea.”
Neatsun Ziv, at 23:30
He expects more of these, cases where each piece passes review and the combination doesn’t.
“I think that we’re going to find a lot of those edge cases that you think about, one solution, it’s fine. You’re combining two things that you trust. I’m sure that we’re going to find a lot of quirks over there.”
Neatsun Ziv, at 23:46
Our vibe coding security post turns this into controls, starting with an allowlist of packages and a sandbox around the agent. Jon was glad to have the problem. “I mean, stuff like that to me is exciting,” he said. “We get to think through a new problem space as security professionals, as a security community.”
The token economy
Sasha turned to the other side of the fight.
“And with AI, it’s a pretty common concept and pretty common acceptance that AI allows attackers to be a lot more nimble. How do you see the defense side of the house?”
Sasha Sinkevich, at 24:12
Neatsun flagged his answer as an opinion he hasn’t proven, and then made the case with prices.
“It is my opinion. I haven’t proven it yet, but it actually increases the asymmetry between the attackers and the defenders. Think about token economy for a second. So in token economy, every intent that you have costs you something, let’s say tokens.”
Neatsun Ziv, at 24:40
For an attacker, a cheap request does a lot of work.
“You can actually say, you know what, take my code and scramble it so it won’t look the same. It would cost you a few tokens, a few millions of tokens, nothing big. It’s like $10, really, for a deep work.”
Neatsun Ziv, at 25:10
A defender pays for every look at everything, and most of what gets looked at is harmless. Neatsun cited research he’d seen putting the malicious share of traffic at “like 0.3% of malicious content, or unwanted content.” Looking at all of it with an expensive model is the naive way, and it costs the defender far more than the attacker spent.
“And as part of it, it actually puts a very, very, very high cost on the defender if you’re going to do it in a very naive way.”
Neatsun Ziv, at 25:39
OX’s answer is to spend the expensive scans where they count and let cheap patterns do the rest. The model helps write the patterns too.
“So instead of human analysts actually working on generating hundreds of what we call signatures, we can really automate this loop and just say, hey, what are the odd cases?”
Neatsun Ziv, at 25:58
“And I would just balance the cost, saying, most of the time I’m going to do pattern base. Periodically, I’m going to do like a deep scan. And you need to start thinking about things in a different way. I don’t think that we’ve figured this one out.”
Neatsun Ziv, at 26:15
Rejah Rehim made a related point on episode 82, that the attackers’ models have no guardrails. Our vibe coding security post has a section on who pays for scanning.
The law of unintended consequences
Jon changed direction and asked whether Neatsun would take the chance to meet his younger self, and what he’d tell him. Neatsun found the first half the harder question.
“You meet yourself, then your younger self actually knows how your older self is going to be. So am I actually eliminating timelines that I don’t know? That’s a very tricky question.”
Neatsun Ziv, at 27:08
Jon added that there’s a self-acceptance piece to the question too, since changing yourself could leave you a different version of yourself. Neatsun thought the meeting would help, and doubted it would end well.
“I think that, yes, it will definitely augment my previous self. I’m not sure that the law of unintended consequences will actually be in my favor in this case. So I don’t know.”
Neatsun Ziv, at 27:35
The law he named is older than any software. The sociologist Robert K. Merton popularized it in the twentieth century, starting with a 1936 paper, “The Unanticipated Consequences of Purposive Social Action” (Wikipedia).
So Jon offered a version without the time travel, someone very similar to his younger self. Neatsun’s advice was about risk, and about sleeping afterwards.
“But I would probably say, at least in our space, I would probably say that it’s really about taking risks. And while keeping it safe makes a lot of sense, part of this journey is really about taking the risk and be able to go to sleep and actually sleep. It’s not as easy as it sounds.”
Neatsun Ziv, at 28:04
All the gear all the time
Jon took the risk theme somewhere personal. He rides motorcycles.
“There’s this saying, like, all the gear all the time, which kind of goes along with our discussion around like security. We don’t need to take astronomical risks, but you need to be prepared for the inevitable.”
Jon McLachlan, at 28:44
Neatsun said motorcycles have their advantages, “not necessarily in the wintertime,” and Jon asked Sasha, who rides occasionally, to weigh in. Sasha brought it back to the work.
“Occasionally. I was going to say, isn’t that what security is all about? It’s managing the risk. It’s a scale. In any product, security is usually there for a reason, and that reason is to protect the crown jewels and protect the business.”
Sasha Sinkevich, at 29:03
The scale has a cost on the other side, Sasha said, because security can read as overhead and as a brake on where the business wants to go. The answer is to build it in.
“It’s very important that security is an integral part that is very seamless. It shouldn’t introduce friction, but rather it should add value while being very seamlessly integrated in the background.”
Sasha Sinkevich, at 29:37
It’s not the security that slows the business
Neatsun offered a different angle on the same point.
“I’ve got like similar, but a bit different perspective. Usually it’s not the security that is slowing the business.”
Neatsun Ziv, at 29:50
What slows it down, in his view, is a vague decision to do or block something, made out of past experience, regulation or fear. He has seen security leaders take the opposite approach with their regulators.
“I had the opportunity to talk with a few CISOs that went into the regulator and say, hey, look, this is a really, really bad idea. I want to explain to you, this is not what I’m going to do. This is what I’m going to do. Instead, this is actually a better risk profile.”
Neatsun Ziv, at 30:09
The tool that makes that conversation possible is the compensating control, a different way of meeting the same goal when the obvious reading of a rule doesn’t fit. The constraint underneath is headcount.
“So we’re trying to put like a generic security for everybody, saying, for most people, this should work. And this is the most cost-effective thing that we can do, placing security at 300 people to one ratio, let’s say. Now, if you had security in a one to 50 ratio, hey, you can do way better than that one. But most of us don’t have this luxury.”
Neatsun Ziv, at 31:11
Michael Nov described the view from inside on episode 76, three people reviewing designs for three hundred engineers. Generic security at ratios like these is a reasonable default, and context is what lets a team do better than generic.
Life is all about managing expectations
Neatsun closed the answer with a sentence he said he has been thinking about for twenty-some years.
“I think somebody told me a sentence like twenty something years ago, and I’m still chewing on that sentence. And it said, life is all about managing expectations. And that’s like the end of the sentence. And the more you think about the sentence, it’s like it makes perfect sense.”
Neatsun Ziv, at 31:30
“Well said,” Sasha said. Jon had a sentence of his own.
“I’ve heard a similar sentence, or your sentence reminds me of this one, is that everything is temporary.”
Jon McLachlan, at 31:49
“I think it’s important that we have these sorts of discussions, and we have them as a community, and we think about them individually, and we noodle on these, especially as we undergo such rapid change, right? So we can navigate that together.”
Jon McLachlan, at 31:57
Three years, not eighteen months
Sasha’s last question pulled the threads together. Security and compliance work has to fit where the business is today.
“Just like we said, there are a lot of pain points that we have to solve in the security and compliance space, but it needs to be timely, just like a lot of things in life.”
Sasha Sinkevich, at 32:27
Neatsun said he had an obvious answer and a more complicated one, and went to identity as his example. Some investments have to be made ahead of the need.
“So some places you do need to invest ahead of time, even though you’re gambling, you’re taking a bigger solution than you need right now, with the understanding that, hey, this is not like the ultimate solution that a company 10x from us will do, but we’re going to move to that space.”
Neatsun Ziv, at 33:00
The cost of guessing too small isn’t the license. It’s the migration, and the project it pushes aside.
“And painful not in the cost sense, in this needs to be prioritized over another project that I want. And you’re basically saying, oh, I need to do this again. So I’m going to waste a quarter in a year and a half from now, when I’m going to be too big for the current solution.”
Neatsun Ziv, at 33:27
His rule of thumb is a horizon.
“So three years, yes, I’m fine with gambling on, solution is fine right now. Gambling on eighteen months, I don’t know. It’s a very delicate balancing question.”
Neatsun Ziv, at 33:58
For more on why identity sits under everything else, Jasson Casey of Beyond Identity made the case on episode 92 that identity sees everything. “There’s a time and a place for everything,” Jon said as they wrapped up, and thanked Neatsun for “all of those vulnerable and very deep moments that we get to share together.”
What happened after the tape
The episode aired on March 24, 2026, and went up on YouTube on June 17 (YouTube). The next day OX announced that the inaugural Gartner Magic Quadrant for Software Supply Chain Security named it a Leader. OX’s announcement called the software supply chain “the defining attack surface of the last five years,” naming SolarWinds, Log4Shell, XZ Utils and the self-propagating Shai-Hulud package campaign (OX Security).
OX’s researchers also spent much of 2026 on the Model Context Protocol, the standard AI agents use to connect to tools. In August, OX reported a Shai-Hulud worm payload delivered through a listing in the official MCP Registry, and in September it analyzed 15,465 MCP servers and found that 2.3 percent of their hostnames no longer resolved. Our post on the MCP server that passed review and then changed has both, with the sources. In October, Neatsun congratulated the team. Its first MCP project of the year, he wrote, had led to more than 30 disclosures and more than 10 CVEs, and its second asked what agents are being connected to.
What are we actually connecting our AI agents to?
Neatsun Ziv · October 8, 2026
In September Neatsun wrote that “The AI agents we’re securing today aren’t the ones we’ll be securing tomorrow,” and argued for building security around what agents will be able to do rather than how today’s agents are built (LinkedIn). It’s the threat model problem from the episode, a design that keeps changing under the people securing it.
Then, in October, came the clearest picture yet of the gap between knowing and fixing. On October 21 the PHP project shipped emergency fixes for PHP2Shell, two critical flaws, CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remote code execution in the PHP engine. OX counted more than 2.2 million publicly visible PHP instances through Shodan. Twenty-four hours later, 14,151 of the 1,974,890 it could place in the affected range showed a patched version, 0.7 percent (OX Security).
That's an enormous gap between knowing about a critical vulnerability and actually fixing it.
Neatsun Ziv · October 22, 2026
OX kept counting. Five days after disclosure, 127,430 of 1,990,772 measurable affected hosts were patched, which left 93.6 percent exposed, and about 1.33 million of the affected hosts ran end-of-life PHP branches that no longer get official fixes (OX Security).
Five days after PHP2Shell dropped, 93.6% of measurable PHP instances are still unpatched.
OX Security (@OX__Security) · October 26, 2026
These are OX’s numbers from public scans, measured by a company that sells application security, and they only count hosts that advertise their PHP version. They still line up with what Neatsun said on the tape seven months earlier, that great detection with nobody fixing means “You hadn’t done anything, really.” Two days later OX introduced Agent Activity, which it describes as a way to see what your AI agents are actually doing (OX Security).
Did you catch it? A six-question quiz
Interactive · six questions
Did you catch it?
Six questions on what Neatsun, Jon and Sasha actually said, with the timestamp for each answer. The answers are under each question for anyone reading without JavaScript.
-
How many issues does Neatsun say companies often turn out to have?
- About five thousand
- Like five million
- About fifty
b. "you actually see that they've got like five million issues" Transcript, 2:47.
-
Out of 20 prioritized defects, how many did Neatsun's 600 developers say they were willing to fix?
- Two
- Ten
- All twenty
a. "And out of the 20 prioritized, they said, we are willing to fix two." Transcript, 3:55.
-
In the sentence Neatsun borrows for AI context, what does a big enough lever move?
- A mountain
- The market
- A planet
c. "give me a big enough lever and I'll move a planet" Transcript, 6:12.
-
In the sentence someone gave Neatsun, what is fraud an abuse of?
- Systems
- Trust
- Money
b. "so cyber, it's more about abuse of system, where fraud is more of an abuse of trust." Transcript, 22:23.
-
About what does Neatsun say it costs an attacker to have code scrambled so it won't look the same?
- About $10
- About $1,000
- About $100,000
a. "It's like $10, really, for a deep work." Transcript, 25:21.
-
For an identity investment, which horizon is Neatsun fine gambling on?
- Six months
- Eighteen months
- Three years
c. "So three years, yes, I'm fine with gambling on, solution is fine right now." Transcript, 33:58.
Signal or noise?
Eight questions on whether your security findings arrive with the context a developer needs. Each one links the part of the episode it comes from.
Scorecard · eight questions
Signal or noise?
Answer for the code you ship and the systems it runs on today, not the plan. If two answers fit, pick the lower one.
-
When a scanner flags a vulnerable dependency, what does the finding tell the developer?
- A severity score and a package name
- The severity plus the repository and who owns it
- Whether the code is deployed, reachable and exposed to the internet
"Just understand the context." See Five million issues.
-
How many of your open findings could you show matter, today?
- We don't know
- We've checked the critical ones by hand
- Every open finding is tagged with whether it's reachable and exposed
"And then you go one over one, just sample them, and you see that most of them are not relevant." See Five million issues.
-
Do you know which services hold customer data, take payments or handle secrets?
- Not really
- A few people know
- It's written down in an inventory the tools can read
"But the challenge is most of us are coming blind to those questions." See Coming blind.
-
What reaches a developer when a finding is real?
- A ticket with a severity score
- A ticket with the context and a suggested fix
- A pull request with the fix, ready to review
"Just all of this information is available, but we are just shifting it to somebody else to fix, and nobody's taking care of that." See Bring the details for them.
-
Do your AI coding agents get your security rules before they write code?
- No
- Some repositories have a rules file
- Every repository has a security context file the agents read
"So with the right context, you can do marvelous things." See A big enough lever.
-
How do you decide which findings you won't fix?
- We don't, they stay in the backlog
- Case by case, when someone asks
- An accepted-risk register, re-checked when the context changes
"There is always going to be a risk." See Is a million good or bad?
-
How do new packages get into your builds?
- Whatever a developer or an agent installs
- Lockfiles, but no allowlist
- An approved registry or allowlist, with pinned versions
"And the combination of trusting this and trusting this is really a bad idea." See Two things you trust.
-
When a critical flaw hits something you expose to the internet, how fast is it patched?
- We'd find out when someone asks
- Within days
- Within hours, and we can show it
"But then nobody's actually picking up the phone and fixing that." See Great detection, nobody fixing.
Your findings probably reach developers without the details they need to act. Start with two moves: tag your services with what they expose and what data they hold, and sample 20 open findings to see how many still matter.
Part of the context is there. Close the gaps next: send real findings to the owner with a drafted fix, give your coding agents a security context file, and write down the risks you accept.
Your findings probably arrive with the context to act on them. Keep it that way as you grow, because the context changes faster than the code, and time your patch window on the next critical disclosure.
How long would your backlog take?
The order you work a backlog in decides how long the findings that matter wait. Put in your own numbers.
Calculator
How long would your backlog take?
Three estimates: how many findings are open, the share you'd still call a real risk once you know what's deployed, reachable and exposed, and how many fixes your team ships in a month.
Worked top to bottom, the queue takes 50.0 months. Sorted by context first, the 200 findings that matter are done in 5.0 months, and the other 1,800 go into an accepted-risk register to re-check when their context changes.
A rough model, not a measurement. It assumes every fix takes the same effort and nothing new arrives. In practice new findings keep coming, which makes the order matter more. The share that matters is yours to estimate, and sampling 20 findings by hand is a quick way to start.
From Scitex to PHP2Shell
Everything on this page sits on one timeline, from Neatsun’s first job to OX’s October counts. Filter it by thread.
Timeline · 1996 to 2026
From Scitex to PHP2Shell
Filter by thread. Dates are from the public record except where marked as part of this show.
- First jobs in software
Software development at Scitex, then Motorola (LinkedIn).
- Israel Defense Forces
A software developer, to 2003 (LinkedIn).
- Shift left gets a name
Larry Smith writes about shift-left testing in Dr. Dobb's Journal (Wikipedia).
- Vanadium Security
Neatsun's first company, as founder and chief executive officer, to September 2011 (LinkedIn).
- Check Point
Director for secure cloud, where Neatsun and Lior Arzi start two weeks apart (LinkedIn, on this show).
- Vice president
Threat prevention and intelligence at Check Point, to July 2021 (LinkedIn).
- OX Security
Neatsun and Lior Arzi start the company, based in New York and Tel Aviv (TechCrunch).
- Log4Shell
The Log4j flaw reported in November gets its CVE identifier (Wikipedia).
- Vibe coding
Andrej Karpathy coins the term (Wikipedia).
- Series B
$60 million led by DTCP, for $94 million raised in total (TechCrunch).
- Meet VibeSec
OX introduces VibeSec, for insecure code in AI coding tools (YouTube).
- Episode 91 airs
"With the right context, you solve everything." (Transcript).
- On YouTube
Episode 91 goes up as a video (YouTube).
- A Leader in a new Magic Quadrant
The inaugural Gartner Magic Quadrant for Software Supply Chain Security (OX Security).
- A worm in the MCP Registry
OX reports a Shai-Hulud payload delivered through an official registry listing (our MCP post).
- Tomorrow's agents
Neatsun on securing what agents will be able to do, not today's designs (LinkedIn).
- 15,465 MCP servers
2.3 percent of their hostnames no longer resolve (our MCP post).
- Two MCP projects
The first led to more than 30 disclosures and more than 10 CVEs, by Neatsun's account (LinkedIn).
- PHP2Shell
Emergency fixes for two critical flaws in the PHP engine (OX Security).
- 99.3% unpatched
OX's count of measurable affected PHP instances, 24 hours after the fixes (OX Security).
- 93.6% after five days
About 1.33 million of the affected hosts run end-of-life PHP (OX Security).
- Agent Activity
OX introduces a way to see what AI agents are actually doing (OX Security).
What to do this week
Five things, in the order Neatsun’s argument suggests.
- Sample your backlog. Pick 20 open findings at random and answer Neatsun’s questions for each one. Is it live, is it exposed, can anything reach it? Count how many still matter. The scorecard above is a quick first pass, and the calculator shows what the order of work is worth.
- Write the context down once. Tag every service with what it exposes to the internet and what data it holds, and check a security context file into each repository so your coding agents read your rules before they write code. Our vibe coding security post has a checklist, and our secure AI development team sets this up with startups.
- Send fixes, not tickets. When a finding is real, it should reach the person who owns the code with the context attached and, wherever possible, a drafted fix ready to review. That’s how our vulnerability remediation program runs, with a senior engineer reviewing every change.
- Write down the risks you accept. Keep a register of the findings you won’t fix, why, and what change would reopen each one. It turns a backlog that never shrinks into decisions you can show an auditor or a customer’s security team.
- Pin what you trust, and time your patch window. Use an approved registry or allowlist with pinned versions, and run coding agents in a sandbox with scoped credentials. On the next critical disclosure, time how long your internet-facing systems take to patch. If you’d like a second pair of eyes on any of it, book 15 minutes with us.