Most of a working day now happens in a browser tab. The email, the CRM, the code review, the chatbot someone pastes a customer list into. Or Eshed spent his early career watching attacks land in that tab while the security budget guarded the network around it, and on this episode he put the company he built in one line.
“LayerX is basically around the vision of going where users are. We provide browser security, now we expand to AI applications as well, with the purpose of spending most time where users are, or adjacent to the SASE space.”
Or Eshed, at 1:56
Or is the co-founder and chief executive of LayerX Security, which his LinkedIn dates to August 2020 and which lists its headquarters in New York and its tagline as “The All-in-One AI & Browser Security Platform.” Before LayerX he was a military intelligence officer and an operational intelligence and OPSEC expert in the Israel Defense Forces, a threat intelligence analyst at Check Point, where his LinkedIn says his work exposed the company behind the Fireball botnet, and a cyber threat intelligence analyst and team leader at OTORIO and a specialist at ABN AMRO (LinkedIn). On May 14, 2026, Akamai announced it would acquire LayerX for about US$205 million (Akamai), the deal closed on July 2 (Akamai), and the product is now Akamai Workforce Protector. On this episode Or tells me why he left the network for the browser, how a startup sells into a market where most of the budget never moves, where his company found its wedge, and why the AI part of the business that runs on its own belongs to somebody else.
Where we sit, so you can weigh what follows: YSecurity helps startups pass the security and compliance reviews enterprise buyers run, from the first questionnaire to SOC 2 and ISO 42001. In Or’s terms that puts us with the founders on the buying side, the companies whose first enterprise customer asks how they govern employee AI use and which browser extensions can read their data. I hosted this one on my own. We recorded in early 2026, in the winter, with Or in New Jersey and saying “we’re in 2026,” and the episode aired on June 30, 2026, seven weeks after Akamai’s announcement.
Going where the users are
Or opened with the problem rather than the product. Users spend most of their day outside the corporate perimeter, in SaaS applications and AI tools, “and it’s pretty much impossible to maintain a traditional perimeter security approach.” When I summed LayerX up as the all-in-one AI and browser security platform, the same words its LinkedIn page uses, he took it: “Something like that, yes.”
Then I asked the question a buyer would ask. If I’m a CISO responsible for a large organization, with all of these users browsing outside the security domain, what is this thing? He answered from the CISO’s chair.
“First of all, what do you get out of it? If you’re a CISO, you need to think what you get out of it. And what you get out of it is full last-mile security across web, SaaS and AI. If you want a strategy for safe enablement of AI, that’s your way to go.”
Or Eshed, at 2:50
The delivery model is what made it easy to say yes to. “The way it’s run, it’s agentless. It’s working in the application layer.” LayerX deploys as a browser extension built for enterprises, across any browser, and the pitch to the security team is that “you get the benefits you wanted, but you don’t make any changes to architecture.” Agentless here means no separate endpoint software. Application layer means the extension sees the session the way the user does, as the page renders, which is where a paste, an upload or a login actually happens.
Akamai’s page for the product today describes the same bet in its own words, a way to secure AI, SaaS, web and private applications “without replacing browsers or altering network architecture” (Akamai). A week after the episode aired, Or put the point more sharply on LinkedIn: the browser itself is nearly perfect, and what you secure is what people do in it.
I joined The Security Podcast of Silicon Valley with Jon McLachlan to talk about browser security, GenAI security, and why the browser is becoming the enterprise risk surface.
Or Eshed · July 7, 2026
For the controls a startup can turn on before it buys anything, from allow-listing extensions to managed browser policies, our guide to enterprise browser security walks the ladder rung by rung.
A thousand CISOs
Before he said a word about technology, Or did the arithmetic every security founder eventually does. “I think, you know, there are a million startups out there. I always laugh at that. In the Fortune 1000, you still got only 1,000 CISOs, and the number of startups and security vendors is growing.”
“When 80% of the budget is going to the GSIs and the hyperscalers, actually very little goes to solve risk.”
Or Eshed, at 3:33
GSIs are the global systems integrators, the large consultancies that implement security programs. Or’s hyperscalers are the biggest security vendors, and later in the conversation he names Microsoft, CrowdStrike, Palo Alto and Fortinet. With that much of the money spoken for, he said a startup faces two questions. The first is “which problems are good problems to solve?” His answer was AI and data, “because they’re very meaty and they’re very much meeting the organization.” The second is what kind of technology a buyer can make a big bet on, “because unfortunately you won’t be able to buy features endlessly. You need to buy something that can scale and expand to additional use cases.”
That second question is where he made his most future-facing claim of the hour.
“Maybe two years from now, AI will be boring. It will be yesterday’s news, and everything will be around identity. Guess what? Identity is happening online, in the browser, as well.”
Or Eshed, at 4:11
I agreed that AI becomes the norm, something people just expect everywhere, and that identity will always be with us. The bet underneath his answer is that a control point in the browser survives whichever of those becomes the headline. Jasson Casey of Beyond Identity made the identity half of that case on episode 92.
From the IDF to Fireball
I asked what inspired him, and Or started with the practitioner years. “I felt a need. I’m a former practitioner.” He spent a couple of years in the IDF working on web security, and “it was always clear to me that application intrusion, identities and applicative layers are the most interesting ones.” Then he went to Check Point.
“Then when I left to the, you know, to the market, I led the takedown of the largest browser hijacker operation in history while I was working at Check Point. And at the time, everyone was ransomware, ransomware, ransomware.”
Or Eshed, at 5:04
The public record on that operation is Check Point’s own. On June 1, 2017, its research team described Fireball, a browser hijacker that could also run any code on a victim’s computer, as a Chinese operation that “has infected over 250 million computers worldwide, and 20% of corporate networks,” run by Rafotech, a large digital marketing agency based in Beijing (Check Point). Wikipedia notes that Microsoft said it had been tracking the malware since 2015 (Wikipedia). Or’s LinkedIn credits his work there with the arrests of at least 15 threat actors.
What he took from Check Point was a mismatch. The best place to do both defense and offense is where employees spend their time, and the activity in the browser “was just scaling.” Yet a decade ago he was working at Check Point “while using a firewall and stretching that ineffectively with IPS and IDS signatures to try and catch web traffic,” when the alternative was to sit inside the session itself. Then came incident response for financial services, and his LinkedIn lists a 2019 project at ABN AMRO, the Dutch bank. That made it personal.
“And guess what? Every IR investigation would end up with a user downloading something or browsing somewhere or doing something online. And it just, you know, bugged me.”
Or Eshed, at 5:44
Ten percent of the effort
Plenty of people saw that attacks end in the browser. The question was when you could do something about it, and Or named two things that happened at the same time. “One is that Microsoft deprecated Explorer, and all the browsers became supportable browsers in terms of browser extensions, so you actually had a technological path that allows doing that.” The second was “a point in time in which Office 365 became accessible and something you can deploy on SaaS, and suddenly you don’t actually need the operating system.”
“At that point in time, I was like, okay, you can, in 10% of the effort, solve 90% of the problem and do way more. I must do this.”
Or Eshed, at 6:26
The public timeline fits his account. Office 365 reached general availability on June 28, 2011 (Wikipedia). Microsoft released Edge in 2015 to succeed Internet Explorer 11, stopped new feature development for Internet Explorer the following year, and ended support for IE 11 on Windows 10’s semi-annual channel on June 15, 2022 (Wikipedia). By 2020, when LayerX started, Explorer was on its way out and the work had moved into SaaS applications that run in a browser.
Then the timing turned into something better than good. “Luckily, it was a good time,” he said, with the company doing well and “great CISO adoption.” And then AI arrived, which he called “a huge gift for us, because it just landed exactly where we are.” I told him he hadn’t just skated to where the puck was going to be. He was already there, and the puck arrived.
Luck or wisdom
Or didn’t claim the credit. “So it’s a good question. You know, is it luck or is it wisdom?” His answer was a trend he treats as permanent, that “it’s easier to deploy and deliver capabilities and services as SaaS. It’s an always true statement.” He pointed at AI companies building browsers of their own as the latest proof, “a discussion we’ll probably keep for later,” and gave the rule underneath it: “you just want to be where the crowd is.”
In April, Or made the same argument at length on Brave’s podcast, The Brave Technologist, with Luke Mulks: account takeover still the top outcome, cookies and extensions as the soft spot, and AI sidebars and agents turning one prompt into a full session.
The browser has become the fundamental corporate user interface - and AI is amplifying that risk surface.
Or Eshed · April 15, 2026
Vivek Ramachandran, founder and CEO of SquareX, told the story of building browser-based security on episode 49.
Two kinds of sells
I said his background gave him the credentials to be a thought leader, since he had felt the pain directly. Or turned that into a theory of selling.
“I think there are two kinds of sells. One of them is to the mind, the other one is to the heart. And within our space, selling to engineers is actually pretty easy, because they feel the pain. Actually, I never sold to an engineer.”
Or Eshed, at 7:41
Engineers, he said, “sell to themselves, they self-qualify, and they spot us as a good solution.” The harder sale is to people who are less technical, who hear that whatever vendor runs their firewall or SASE already takes care of it, and who reason that the vendor is a great company and a startup is not. “I think I’ll go with them. I’ll stick to them. Like, what’s the worst that can happen?”
His answer to that buyer was not fear. It was awareness and making the buyer stronger, and then a line I keep coming back to.
“Eventually, cybersecurity is not that significantly different than selling ceviche or falafel. It’s just a commodity. It’s supposed to be a net positive for the buyer. You’re not supposed to stress or fear sell to anyone.”
Or Eshed, at 8:30
You’re supposed to be, in his words, “an instrument they can use to get to their professional and personal goals.” In April he wrote a post that reads like the long version, aimed at vendors who answer every public breach with an “if they only used my solution” post.
Security folks are incredibly sharp. They don't ignore risks for ideological reasons or lack of knowledge.
Or Eshed · April 21, 2026
Find a place to hook to
Or framed the founder’s central tension as long-term vision against “what you do tomorrow morning.” If he had a time machine, he said, the conversation he would have with his younger self is the one he’d have with any founder now. You start with a picture where everything runs smoothly and you grow until you’re bigger than Palo Alto. “In reality, it doesn’t work that way. You see a tall mountain, you need a strategy on how to start the incline. You need to find places to hook to and find areas in which there is demand.” Then he gave the example that became LayerX’s wedge.
“A bit over a year ago, there has been a huge breach. A DLP vendor called Cyberhaven got compromised. [An] attacker took over their admin account in the Google Chrome Store, replacing their browser extension used for DLP with malware. Suddenly, it raised awareness to browser extensions as an offensive vector.”
Or Eshed, at 9:33
The public record matches his account and adds the mechanics. Early on December 25, 2024, an attacker used a compromised Chrome Web Store account to publish a malicious version of Cyberhaven’s extension, which had roughly 400,000 corporate users, and the company pulled it the same day (TechCrunch). Follow-up reporting found Cyberhaven was one of at least 35 extensions hijacked in the same campaign, with a phishing email and a rogue OAuth grant as the entry point (BleepingComputer). We walked through that campaign step by step in our enterprise browser security guide.
LayerX had invested in the extension problem before it was news. “We were very fortunate to invest in that early on. We have a technology partnership with Google. We’re now expanding it to other browser vendors.” Or claims the largest data lake in the world for browser extension sandboxing, a vendor claim rather than an audited figure, but the lesson he drew is the one any founder can use.
“That’s what CISOs want today. They have a qualified pain. They tell me, I don’t have that. I don’t want to convince them they have a problem. I want to go for the problems they already are convinced they have, and then grow with them and build the right relationships.”
Or Eshed, at 10:06
The vision comes back at the end, on the customer’s side. “So in my vision, once I’m a unicorn, I’m already there with them, and they’re on my side, so we can grow together.” He leans toward what people will pay for tomorrow morning, “because if you do that, that’s an enabler to go and fulfill your dreams and everything.” LayerX kept publishing extension research after the tape, including a May 2026 report on TikTok downloader extensions that turned into tracking tools.
SC Media covered our StealTok research: 12+ TikTok downloader extensions looked legitimate, some even “Featured,” then shifted into covert tracking and remote config. 130K+ users were compromised, and 12.5K installs were still active at analysis
LayerX Security (@LayerxSecurity) · May 11, 2026
Nobody likes to be sold to
I said founders dream of a better world, and the path there isn’t a straight line. You find a wedge into the market, use a small amount of resources to solve a pain point today, and when the pain point is in your crosshairs and solved, it sells itself. Or agreed, and made it about the buyer’s side of the table.
“People don’t want to be sold to. Everyone loves to buy. If I have 10 minutes, and I’m busy, I guess you’re busier than me, if I have 10 minutes to scroll through Amazon and find a cute coat for my dog, even though he likes the cold winter here in New Jersey, I’ll enjoy that.”
Or Eshed, at 11:20
The dog has a name on LinkedIn. Before RSAC 2026, Or posted that Freddie would be staying home to vibe-code a next-gen agentic EDR, by Or’s reading of the barking.
Big announcement! 📣 Many of you have asked me - "will Freddie will be at RSAC?" 🐶
Or Eshed · March 20, 2026
The patience is the other half of his point. Browser security today is “considered a very hot category, with M&As and other stuff and companies going in,” but five years ago the conversations were split. The more technical CISOs understood why they needed it and where it was going and still found it hard to justify a budget. Others said they didn’t understand what it was. “So it takes time. The market maturity takes time.” You enjoy the early adopters on the bell curve, pick the right ones to grow with, and become powerful with them, because there are always negative surprises down the road. His summary got a laugh out of me: “And sales, you know, sales cures everything.”
A glove to a hand
LayerX has two founders, and they knew each other long before the company. Or’s co-founder, David Vaisbrud, served with him in the military, in the same split of roles they have now.
“My co-founder David and I actually served together during our military service. Actually, we had the same relationship back then, when I was the one identifying whatever we want to build, and David was running technology operations, which is engineering, tech operations, maintenance, research, everything. So it was like a glove to a hand.”
Or Eshed, at 13:04
The pitch happened at a cafe table outside, during the pandemic, “because of the lockdown.” Or told David this is what he wanted to build, and he named the trap every founder walks into at that moment: “Looking backwards, every idea seems like a great idea, but at the point in time when you launch, every idea seems like a bad idea. Even Facebook, even Google, everything seems like a bad idea at the time when it actually happens.” David understood the technical need and, in Or’s telling, saw himself being successful as the CTO of such a company. Or gives the technology the credit. “Now, I’m not a famous founder. It’s my first startup. And we got to amazing outcomes. It’s all thanks to great technology and great products.”
I said I couldn’t imagine serving with someone and not trusting them. Or explained where that trust comes from: white nights when the lights don’t go off, an operation or a catastrophe to handle, and seeing how people perform under pressure. When he hears about a startup with a founders’ conflict, his reaction is strong. “It’s like marriage. It’s actually bigger than marriage.”
Customers who sell for you
I asked about his proudest day, and Or wouldn’t pick one. “I wouldn’t say superstitious, but, like, you can’t celebrate half a marathon out of a marathon.” Hitting the numbers is tactical, he said. The two things that make him proud are both about customers.
“One is a logo retention rate of 99% and great NRR. Like, customers sell to themselves, which is amazing.”
Or Eshed, at 16:06
Logo retention counts the customers who stay. NRR, net revenue retention, counts what they spend a year later, including expansion. The second source of pride is the inbound call that starts with someone saying “that guy who is your customer spoke so highly of you, I had to take a look,” from a buyer who had never heard of LayerX. “A customer testimonial is worth a thousand efforts I can do indirectly in other frontiers to get traction,” Or said, and “they always sell me better than I do.” One of his former workplaces is a customer, and he called it amazing to see the technology move the needle on pains he saw firsthand when he worked there.
I guessed his NPS must be through the roof. “I hope so,” he said, and turned referrals into a definition of sales.
“And it goes to what actually sales means, which is real qualification of the positive outcome for a customer to have your product or services, and what would be the negative implication of not having it. The true qualification means that you improve their life. You don’t get money from them. They enjoy a service from you.”
Or Eshed, at 17:23
When you do that continuously and manage to scale it, he said, that shows you’re ready for scale. And when a customer is so happy with your solution that they sell it to someone else: “It’s kind of, the proof is in the pudding.”
Investors who understand the buyer
I asked whether LayerX took venture money. “Yes, of course. You must.” The sequence he described is a common one for security startups.
“Our seed funder is Glilot Capital Partners, together with the angels from the cybersecurity industry. The A round was also led by Glilot, together with Dell Technologies Capital, later joined by Jump Capital.”
Or Eshed, at 18:24
The pre-seed came first, and the seed closed two months later, which made the pre-seed look cheap in hindsight. “But it’s always the case,” Or said. He chose Glilot Capital, which he called “probably the first vertical cybersecurity VC in the world,” and he was clear that it wasn’t for lack of options or for valuation alone. The one thing Glilot offered was “true deep understanding of the cybersecurity market,” and he extended the same credit to his investors from Dell Technologies Capital and Jump Capital.
“And it’s critical, because for every company, things will change. Technology cycles are so short. You need a partner that really understands the buyer mindset.”
Or Eshed, at 19:10
What that buys a founder, in his account, is signal in a noisy world and protection from the wrong advice. “And then, when your investors don’t understand cybersecurity, you can get bad advice, such as, everyone is doing AI, let’s do whatever AI. And I’ve seen so many companies fail that way.” You need someone you trust enough to fight the world with and swim against the stream, which is hard, “because when you swim against the stream, most signals say that you’re wrong. But those are the best possible investments.”
I said a great founder has to share that vision confidently even when it feels like swimming upstream. Or added the limit. “If you’re at consensus, you’re not doing something right. Consensus is really bad in entrepreneurship. Being entirely against everyone is also not the greatest.” The specialist investors help with that balance, because “the vertical cybersecurity VCs talk to CISOs daily,” and in his words “eventually it’s a force multiplier that’s unbeaten.”
Where startups can sell
Inside that answer about investors was the sharpest piece of market analysis on the tape. Only a small subset of the market is ever exposed to a startup, Or said, and he walked through the math.
“You know, half of the cybersecurity market is GSIs. That’s untouched. 80% is the hyperscalers. It’s Microsoft, CrowdStrike, Palo Alto, Fortinet, a few others. Just untouched. Like, 20% of half, which is pretty much 10% of the cybersecurity market, could be utilized by startups.”
Or Eshed, at 19:54
And not all of that 10% moves every year. “So not everyone in your ICP is in the market,” he said, meaning the ideal customer profile a startup sells to. That shapes what success looks like early. “So actually, in the first couple of years, you’re supposed to get a couple of millions, and then you’re a great company. Not tens of millions, not hundreds of millions.” The discipline that follows is knowing your ideal customer, how you reach them, and how you avoid scope creep outside them and lose traction. These are Or’s estimates from experience, not market data, and the calculator further down lets you put your own numbers in their place.
Skin in the game
Or picked a hypothetical to explain how early-stage companies actually unfold. “Let’s say you have an idea. Jon, you came up with an idea for a time machine. That’s a great idea. Not that easy to build.” I agreed it would be very difficult to build. His point was that people assume the journey ends with the idea.
“People assume in early stage it ends with your idea, then you get to execution, and then you get to build the product. Then there are always nasty surprises when you do that.”
Or Eshed, at 22:23
After the first couple of sales you need to show efficient selling, a low CAC (what it costs to acquire a customer) and a high ACV (annual contract value), and you need to build a sales organization. “Good sellers for early stage are like unicorns. If you find one, catch it.” Good sellers ask two questions before they join, he said: who invested in you, and does that voice mean something, and how much skin in the game do the founders have.
“You know, one of the reasons I moved to the US was because of that. I wanted to show my sellers I have skin in the game.”
Or Eshed, at 23:00
Whenever they ask him to join a meeting, “day and night, 24/7, I’ll be there, because they need this confidence.” Make good sellers want to work for you and any seller will, “and that’s actually when the race actually begins.” I said that for an entrepreneur it begins again every morning. “100%. And you dream about it at night.” In September he wrote about the move itself, to the US at the beginning of 2025, and the sun rising over Manhattan.
My journey with LayerX Security led me to relocate to the US at the beginning of 2025.
Or Eshed · September 15, 2026
The bad days
I asked about his most difficult day. Or’s first answer was that he assumes the hardest one is still ahead, because things can always get worse. Then he drew a distinction that I think every founder should write down. Missing a huge deal “on points, on inches” is annoying, but you did the best you could.
“And then if you just put in the meat grinder, like, 10 of those, you’ll close five, and that’s a great company. So don’t think about that one. Think about the next one.”
Or Eshed, at 24:21
The bad days are the other kind, “when you get into a reality in which you actually had enough information to take a different decision, and you went consciously to the wrong path.” Those cost cash and other people’s time, and worse, “it makes me question my own decision-making process.” Luckily, he said, it happens very rarely. Then he reached for tennis.
“On the other hand, you know, Federer, the tennis player, was on a VC event once, said that he, you know, he only wins, like, a bit over half of the matches, but he wins those that matter.”
Or Eshed, at 24:54
The version Federer tells is about points rather than matches, and it makes Or’s lesson stronger. In his commencement address at Dartmouth on June 9, 2024, Federer said that in the 1,526 singles matches of his career he won almost 80%, yet he won only 54% of the points he played (Dartmouth). Nearly half the points lost, and still one of the best records in the sport. Or’s conclusion holds either way: “You don’t have to catch every ball, but you need to catch the balls that matter the most.” It’s never perfect, and I agreed it never is.
Invest in problems, not solutions
I asked what LayerX looks like as a smashing success, and Or answered with a rule. “We basically invest in problems. We don’t invest in solutions. We invest in problems.” The test is whether the problem space is growing, and he reminded me that every reality is good for someone: “global warming, I guess there is an ice cream shop that’s cheering out there.” Then he named the trends he sees.
“One of them is consolidation, which means, pardon my French, that every big hyperscaler becomes like Walmart. You can’t really find what you need. It doesn’t really work.”
Or Eshed, at 26:12
With some of those vendors, he said, “customers say, I get for cheap a lot of bad products,” and the return on the spend becomes very questionable. The second trend is a mindset: “the understanding that you can’t secure everything will be a part of the status quo.” The third is technical. Application delivery is getting more complex, with more encryption and more sophistication, “so I think the network security players are destined to become VPNs, glorified VPNs.”
That’s where he sees the opening. “I think there is a once-in-a-generation opportunity to build a next-generation approach to security service edge that does not require dependence on proxies and inline data centers.” Security service edge is the cloud-delivered bundle of secure web gateway, cloud access security broker and zero trust network access that many enterprises route their traffic through. Or’s version moves it to the user and the device, “in a lightweight manner.” He described LayerX a couple of years out as “a billion-dollar company selling things outside of browser security, but on the same paradigm, which is device-centric user governance,” expanding into DLP, network security and zero trust. He named the failure mode too. “What shouldn’t be happening is becoming another tiny Walmart, where you’re trying to do too many things.”
He came back to crowded categories in September, after dozens of next-gen EDR startups pitched him in a couple of months.
In the last couple of months I was approached by dozens of "next-gen EDR" companies (more than I can count).
Or Eshed · September 16, 2026
Andrew Rubin made the long-game version of the same argument from Illumio’s side, that you can’t keep everything out and have to limit what gets reached, on episode 88, and Taher Elgamal, the father of SSL, the encryption behind the traffic a network tool can no longer read, told its origin story on episode 61.
Agents are someone else’s problem
Or ended his look ahead with a line that made me laugh and then made me think. “Aside from that, we’ll see other crazy things happening with non-humans, agents, stuff like that. But that’s someone else’s problem.” I had been about to ask how AI shifts the security landscape, and I told him I loved that ruthless sense of focus. He explained it the way he explains it to CISOs, by splitting AI in two.
“And then I tell them, you know, we talk about AI, and then you have users to AI, which is natural stupidity to artificial intelligence sort of thing.”
Or Eshed, at 28:18
Then there are agents roaming the web, which he called “an application security problem. It’s a bit different.” You can try to do everything, he said, and then he gave the line of the episode.
“But then, you know, I tell them, you know, the same cow looks very different to the butcher and the veterinarian. Like, you can’t assume that everything AI should be handled by the same vendor.”
Or Eshed, at 28:35
Trying to be the AI security vendor, he said, is “a poison pill,” because “if AI is everywhere, you have to be the everywhere security vendor.” He backed it with history.
“Newsflash, we’re in 2026, 40 years after the first security vendors came to the market. Some offerings are like 30, 35 years old, and they’re actually downsizing. They’re starting to minimize what they do. None of them tries to do everything everywhere.”
Or Eshed, at 28:55
“You can’t be everything for everyone. You need to just be in love with an amazing problem that’s growing.” For LayerX that problem is the people. “So we’ve taken the user to AI interaction. As long as you have employees, you’ll have the same mistakes happening time and time again, and we can be the strategy that you can go to battle with.” The robotic part of the business, the agents, belongs to other companies, and he expects specialized vendors to do amazingly well while the all-in-one players fail to keep up. Trevor Hilligoss of SpyCloud made the human half of that case, from reused credentials up, on episode 86, and Xia Hua of Traceforce covered the AI tools employees love on episode 100.
Or took the same split on the road after we recorded. He announced a keynote at The Official Cybersecurity Summit in Boston titled “The world is not about to end,” and a talk at Gartner’s security and risk summit arguing that firewalls make binary decisions on network traffic while AI risk lives inside browser sessions.
The world is not about to end.
Or Eshed · May 4, 2026
"Don't Bring a Firewall to an LLM Fight."
Or Eshed · May 27, 2026
Do I actually need a dashboard?
The second half of Or’s AI answer was about building, not buying. “Another thing is, with AI, you can ship quality products faster. It takes a mind shift to do that. Two mind shifts, actually.” The first is that buyers stopped caring about the algorithm.
“So, like, a decade ago, if you had, like, we have the best detection engine, we have like 140% true positive rate, all kinds of BS that no one believes in. Nowadays, it doesn’t interest anyone. You can take a naive model and do a good enough job.”
Or Eshed, at 30:10
Buyers look for impact and intuitive added value instead: what data you process and what context you have. The second shift is about your own product.
“Do I actually need a dashboard? Or can I just have a prompt, when you can ask it, show me trends over the last five days? Actually, you can deploy solutions much, much faster, more reliable.”
Or Eshed, at 30:38
“The faster you understand how to build with AI, the more likely you are to survive.” I summed it up as using AI inside the products and services we build, not just to build them faster, after we fall in love with the problem. “We’re falling in love with problems, not with solutions,” I said, and the problem will still be there when the solution changes.
Fall in love with their problem
Or put a number on why that matters for security in particular. “The cybersecurity market is not gigantic. You have two companies over a hundred billion, and then you have a couple in the tens of billions, and then the rest are pretty small.” It’s smaller than retail or finance, so “you can build a name easier, but it’s harder to get attention as well,” because everyone wants the same buyers.
“And eventually, if you don’t have a path towards being a great business, why bother? Like, you should really start with that. And the way to do that, you won’t convince people to love your technology.”
Or Eshed, at 31:59
You offer them a strategy for a problem they really care about. “So you need to fall in love with their problem.” I tied it back to buying versus being sold: when you feel a pain point you look for the Tylenol, and advertising by itself doesn’t work so well. Or added the piece I’d missed. “A bit more modesty as well, because there needs to be trust.” A buyer can believe the problem is real and the technology is good and still not trust you, because you’re a small startup without a name. “There are so many reasons why not to buy from you.” So you learn the buyer’s decision-making process, build toward it so you’re more credible and more reliable, “and don’t try to preach to them, because they hate that.”
How a startup earns trust
I asked how LayerX broke through and became a trusted player. Or gave three answers, in order. The first was a huge investment in customer success and professional services, which he says is the best in its space, so that every customer, small or large, gets the best possible service, “because they are ambassadors to the market.”
“Second thing, don’t lie to prospects. Be candid. It’s better to miss opportunities than to misdeliver. Not everyone would agree, but I think you need to make sure that you’re trusted.”
Or Eshed, at 33:45
The third is qualification. People appreciate being asked about their tech stack and how they work, “even doing a prior analysis. It shows that you care and you really want to have a conversation.” I added what good investors bring beyond capital: credibility, a couple of intros, warm leads and the confidence of someone backing you. Or explained why that works so well in security in particular.
“In the cybersecurity market, there are quite a lot of CISOs that invest weekly in learning and educating themselves by meeting startups, to learn what’s going on in the industry. Those are people that, if they would open up a consultancy service, they should charge like a couple of thousand dollars an hour.”
Or Eshed, at 34:53
Those CISOs burn their own time on startup calls, so they want someone to filter for them, and the specialized VCs do that pre-qualifying. I compared it to hiring someone with Apple or a successful startup on the résumé. Or agreed and went further: “everyone is looking for external validation for everything. And even your buyers want external validation.” His picture of it was a restaurant in a foreign country where you don’t speak the language. You go to the place with the longest queue outside, “even though I’ll stand longer in line.” I said it’s worth the wait, and it always is. The buyer’s side of the same question is the subject of our list of AI security questions enterprise buyers will ask, and credibility in a questionnaire is earned the way Or describes, candidly.
Objections sharpen your knife
I asked what tool or service he wishes someone would build for entrepreneurs. Or answered with a habit instead. “Listen more than talking, and ask questions, and listen.” LayerX, he said, “could have been a faster company, launching earlier, if we processed feedback better.”
“Objections are not insulting you. That’s what I say to the young entrepreneurs that are listening. When you get objections, someone is offering to sharpen your knife for you.”
Or Eshed, at 37:18
They highlight the vulnerabilities and weaknesses in your idea, and the faster you address them, “the better and more crisp your idea will be, and eventually your company will be as well.” Get the feedback from the right sources, he said, and it’s free: walk into a company you can learn from, or stand outside and bump into someone on the street. “You just need the courage, and you need to be willing to listen.”
I called it a growth mindset, not throwing up defenses, being open to being wrong. Or jumped in: “It’s amazing to find that you’re wrong.” Then he told me how he runs his own team.
“I always tell my employees, you know, if you prove me wrong, the faster you do, you give me back time, which is the one resource I have very limited.”
Or Eshed, at 38:30
“I learned to be in love with being wrong. I wasn’t always like that.” It took getting “spanked by reality once or twice,” he said, and the regret of thinking that if he had only learned he was wrong earlier and faster, it could have been great. “When you learn how to do that, you just become a better entrepreneur.” I put it the way I think about it: you don’t have to, you get to.
Hiring, AI browsers and the DBIR
For his plugs, Or spoke to three audiences. If you buy network and endpoint security and care what your employees do online, “that’s the best strategy to go.” If you’re a security practitioner, “we’re constantly hiring great technicians and non-technicians in the US as we scale the business.” And if you just want to learn, follow LayerX, because “we’re expecting quite a few announcements on our support and integration into AI browsers, which is becoming a really hot topic in 2026.”
He closed on research. “By the way, we’re contributors to a lot of research entities, Verizon’s Data Breach Investigations Report. We were the only AI security contributor in 2025.” That’s his claim about the contributor list. What the report itself says on the subject is worth knowing: Verizon’s 2025 DBIR found 15% of employees routinely accessing GenAI systems on their corporate devices, and 72% of those used non-corporate emails as the identifiers of their accounts (Verizon). Those are exactly the user to AI interactions Or built LayerX to see, and our guide to shadow AI covers what a startup can do about them this quarter.
What happened after the tape
The months after we recorded were the busiest in LayerX’s history. In April, Or took the browser argument to Brave’s podcast and, in a LinkedIn post, to vendors who chase breaches. In early May he announced his Boston keynote, and on May 14 Akamai announced it would acquire LayerX for about US$205 million for all of its outstanding equity, with closing expected in the third quarter (Akamai). The announcement described LayerX’s technology as browser-based AI usage control that works with the browsers people already use, put LayerX at about US$10 million in annual recurring revenue by the end of the year, and said Or and David Vaisbrud would join Akamai’s Zero Trust organization. It was Akamai’s fourth Tel Aviv-based cybersecurity acquisition in five years. Or’s statement called securing human and agentic AI usage “one of the defining challenges in enterprise security.”
Today is a special day for LayerX Security! 🦄
Or Eshed · May 14, 2026
Or’s talk at Gartner’s security and risk summit was set for June 1, and on June 29 LayerX posted that The Hacker News had named it Best AI Usage Control Platform (X). This episode aired the next day, on June 30, on Podbean and on our YouTube channel. On July 2 Akamai completed the acquisition, calling LayerX a secure enterprise browser provider and AI usage control leader (Akamai). The product became Akamai Workforce Protector, and its page now lists the AI browser support Or said was coming, naming Atlas, Comet and Dia next to Chrome, Edge, Firefox and Safari, along with a public extension database called ExtensionPedia (Akamai). A few days later, LayerX shared this conversation on X.
🎙️ Or Eshed joined The Security Podcast of Silicon Valley to discuss how enterprise AI risk shows up inside everyday browser sessions.
LayerX Security (@LayerxSecurity) · July 6, 2026
Listen ↓
Spotify: open.spotify.com/episode/00d7pLYfxZu4C562ju2GKo…
Apple Podcasts: podcasts.apple.com/us/podcast/98-how-browser-security-became-the-new-battleground/id1566441549…
On July 15 the team presented Akamai Workforce Protector at CISO XC in Chicago (X). In September Or wrote about the move to the US and about the next-gen EDR crowd, both embedded above, and in October he spent a week in Japan with Akamai’s local team, writing that the Japanese market is at the front of AI security adoption (LinkedIn).
The bet Or described is the one the deal priced in. People do their work in a browser tab, the data leaves through the same tab, and AI made both of those more true at once. For a startup the useful part is smaller than an acquisition and easier to start on: know which AI tools and extensions touch your data, put your rules where the paste and the upload happen, and be able to show a buyer that you did.
Did you catch it? A six-question quiz
Interactive · six questions
Did you catch it?
Six questions on what Or and I actually said, with the timestamp for each answer. The answers are under each question for anyone reading without JavaScript.
-
What does Or say a CISO gets out of LayerX?
- A replacement for the firewall
- Full last-mile security across web, SaaS and AI
- A new browser for every employee
b. "And what you get out of it is full last-mile security across web, SaaS and AI." Transcript, 2:54.
-
Which two things happening at the same time told Or he must build LayerX?
- Ransomware and remote work
- Cloud budgets and a hot funding market
- Microsoft deprecating Explorer, and Office 365 on SaaS
c. "One is that Microsoft deprecated Explorer, and all the browsers became supportable browsers in terms of browser extensions, so you actually had a technological path that allows doing that." Transcript, 6:00.
-
Which breach raised awareness of browser extensions as an offensive vector, in Or's telling?
- The compromise of the DLP vendor Cyberhaven
- Fireball
- A Chrome zero-day
a. "A DLP vendor called Cyberhaven got compromised." Transcript, 9:36.
-
By Or's math, how much of the cybersecurity market could be utilized by startups?
- About half
- Pretty much 10%
- About 80%
b. "Like, 20% of half, which is pretty much 10% of the cybersecurity market, could be utilized by startups." Transcript, 20:05.
-
What was one of the reasons Or moved to the US?
- To be closer to his investors
- To open an office in New York
- To show his sellers he has skin in the game
c. "I wanted to show my sellers I have skin in the game." Transcript, 23:03.
-
How does Or explain why one vendor shouldn't handle everything AI?
- The same cow looks very different to the butcher and the veterinarian
- AI will be boring in two years
- Agents are too expensive to secure
a. "But then, you know, I tell them, you know, the same cow looks very different to the butcher and the veterinarian." Transcript, 28:36.
Is the browser your control point?
Or’s case is that the user to AI interaction happens in the browser, so that is where a company can see it and govern it. This scorecard asks eight questions about your own company. It takes about two minutes.
Scorecard · eight questions
Is the browser your control point?
Answer for the laptops and accounts your people use for work today, contractors included. If two answers fit, pick the lower one.
-
Do you know which AI tools your people use for work, and on which accounts?
- No, we'd be guessing
- We know the tools we approved, not the rest
- We have an inventory by application, with corporate and personal accounts told apart
"As long as you have employees, you'll have the same mistakes happening time and time again." See Agents are someone else's problem.
-
Do you know every browser extension running on company devices?
- No
- We allow-list some by policy
- We inventory every extension, block broad permissions and review new versions before they spread
The Cyberhaven hijack arrived as an update. See Find a place to hook to.
-
What happens when customer data or source code heads into a prompt or an upload?
- Nothing we would see
- A written policy and training
- The browser warns, redacts or blocks it at the point of use, and logs it
"Full last-mile security across web, SaaS and AI." See Going where the users are.
-
Can contractors and people on personal devices reach company SaaS?
- Yes, with no session rules
- Only through a VPN
- Yes, with the same session policies as a managed laptop
"The operating system is not very significant." See Ten percent of the effort.
-
How do your people sign in to the tools they use in the browser?
- Passwords, with MFA where an app offers it
- Single sign-on for most apps
- Single sign-on everywhere, with phishing-resistant sign-in and session revocation
"Identity is happening online, in the browser, as well." See A thousand CISOs.
-
If a buyer asks how you govern employee AI use, what do you send?
- A reassuring email
- A policy document
- The policy, plus logs or screenshots that show it working
"Don't lie to prospects. Be candid." See How a startup earns trust.
-
Have you decided which AI browsers and in-browser assistants your people may use?
- We haven't looked
- We banned them on paper
- We decided which are allowed, and they follow the same session rules as a person
AI browsers were "becoming a really hot topic in 2026." See Hiring, AI browsers and the DBIR.
-
Who owns the security of the AI features and agents you ship to customers?
- Nobody in particular
- The same tool we use for employee AI use
- An application security owner, with its own review and testing
"The same cow looks very different to the butcher and the veterinarian." See Agents are someone else's problem.
Most of what your people do with AI and SaaS happens where nothing of yours can see it, and that's fixable in weeks. Start with an inventory of AI tools and extensions, allow-list the extensions you need, block broad permissions, and write a one-page rule for which data may go into which tools.
You know what's installed and you have rules on paper. Now put the rules where the paste happens, give contractors and personal devices the same session policies as everyone else, and keep the logs a buyer will ask to see.
Your people's AI use is visible and governed at the point of use, and you can show it. Keep the extension inventory current, decide on AI browsers on purpose, and give the AI you ship its own application security owner.
How much of the market can you reach?
Or’s market math says half of security spending goes to integrators, most of the rest to the largest vendors, and about 10% is open to startups, not all of it in market in a given year. This calculator runs the same math on your category.
Calculator
How much of the market can you reach?
The yearly security spend in your category, the share that goes to integrators, the share of the rest held by the largest vendors, the share of buyers in market this year, and the share of those deals a startup like yours could win.
10% of this category is open to startups, about $200,000,000 a year. With 20% of buyers in market this year, $40,000,000 is up for grabs, and winning 5% of that is $2,000,000 a year.
The 50% to integrators and 80% of the rest to the largest vendors are Or's estimates from the tape, not market data. The category size, the share in market and the win rate are placeholders to replace with your own. Or's benchmark for the first couple of years is a couple of millions, "and then you're a great company."
From Fireball to Akamai
Everything on this page sits on one timeline, from Or’s first intelligence role to Akamai Workforce Protector. Filter it by thread.
Timeline · 2010 to 2026
From Fireball to Akamai
Filter by thread. Dates are from the public record except where marked as part of this show.
- Military intelligence
Or becomes a military intelligence officer in the Israel Defense Forces (LinkedIn).
- Office 365
Microsoft's subscription suite reaches general availability (Wikipedia).
- Operational intelligence
Or becomes an operational intelligence and OPSEC expert, until 2016 (LinkedIn).
- Edge
Microsoft releases Edge to succeed Internet Explorer 11, and stops new feature work on Explorer the next year (Wikipedia).
- Check Point
Or joins as a threat intelligence analyst (LinkedIn).
- Fireball
Check Point reports a browser hijacker on over 250 million computers and 20% of corporate networks (Check Point).
- OTORIO
Cyber threat intelligence analyst, then team leader (LinkedIn).
- ABN AMRO
Cyber threat intelligence specialist on a project in the Netherlands (LinkedIn).
- LayerX
Or starts the company with David Vaisbrud, and becomes its chief executive (LinkedIn).
- Explorer retired
Support for Internet Explorer 11 ends on Windows 10's semi-annual channel (Wikipedia).
- Episode 49
Vivek Ramachandran of SquareX on browser-based security (episode 49).
- Cyberhaven
A malicious version of Cyberhaven's extension is published from a compromised store account (TechCrunch).
- 35 extensions
The same campaign hijacked at least 35 Chrome extensions with about 2.6 million users (BleepingComputer).
- To the US
Or relocates for LayerX (LinkedIn).
- The DBIR on GenAI
Verizon finds 15% of employees routinely using GenAI on corporate devices, most of them on non-corporate accounts (Verizon).
- We record episode 98
"Newsflash, we're in 2026, 40 years after the first security vendors came to the market."
- Intel
LayerX and Intel announce AI security that runs locally on the endpoint (X).
- The Brave Technologist
Or on why the browser became the attack surface (YouTube).
- No ambulance chasing
Or on vendors who answer a breach with a sales pitch (LinkedIn).
- The world is not about to end
Or's keynote at The Official Cybersecurity Summit in Boston (LinkedIn).
- Akamai's announcement
Intent to acquire LayerX for about US$205 million (Akamai).
- Episode 95
Pranava Adduri and George Gerchow of Bedrock Data on enabling AI instead of blocking it (episode 95).
- Gartner SRM
"Don't Bring a Firewall to an LLM Fight" (LinkedIn).
- An award
The Hacker News names LayerX Best AI Usage Control Platform (X).
- Episode 98 airs
This conversation, on Podbean and YouTube (YouTube).
- Akamai Workforce Protector
The acquisition closes, and LayerX takes Akamai's name (Akamai).
- LayerX shares the episode
With a clip of the conversation (X).
- CISO XC Chicago
A session on AI security as work moves across GenAI, SaaS and the browser (X).
- Episode 100
Xia Hua of Traceforce on the AI tools employees love and the data they leak (episode 100).
- Sunrise over Manhattan
Or on the move to the US (LinkedIn).
- The piñata
Dozens of next-gen EDR startups in one category (LinkedIn).
- Japan
A week with Akamai's local team and customers (LinkedIn).
What to do this week
Five things, in the order Or’s argument suggests.
- Inventory the AI tools and the accounts behind them. Which applications your people use for work, and whether each one is signed into with a company account or a personal one.
- Inventory and allow-list your browser extensions. Block anything that asks to read and change data on all websites unless you need it, and treat new versions as changes to review.
- Put your data rules where the paste happens. A one-page rule for which data may go into which tools, enforced in the browser at the point of use, not only in a policy document.
- Give every session the same rules. Contractors and personal devices reach the same SaaS as your managed laptops, so the session policies should follow them there.
- Split your AI security the way Or does. Govern how your people use AI in the browser, and give the AI features and agents you ship their own application security owner.