Amihai Neiderman and the trouble with being trusted

Free Wi-Fi is usually an invitation to stop thinking. Find the network, connect, carry on. Amihai Neiderman treated Tel Aviv’s municipal network as an invitation to begin. Behind the name FREE_TLV sat hardware, firmware and a set of assumptions about who could reach what. He wanted to inspect those assumptions. The resulting presentation had a title economical enough to fit on a warning sign: “How I hacked my city.”

The title travelled. His work appeared on the security-conference circuit, including BSides TLV in June 2016 and DefCamp that November. A city network makes an appealing stage for a technical story: familiar streets above, unfamiliar machinery underneath. But the useful part of his account was its attention to the machinery. He described identifying a device, examining its software and building a working test environment. The drama had a substantial amount of homework attached.

That is a useful place to meet Neiderman, who later co-founded Nym and is now co-founder and chief technology officer of NewCore. The companies and titles can make his career look like a sequence of abrupt changes. Follow the work more closely and a recurring subject appears: the distance between what a system promises and what its underlying arrangements actually permit.

A hotspot with a backstory

In his account of the Wi-Fi research, the first useful clue was an external network address. The next was a device’s response. He identified Peplink equipment and began investigating the firmware, the software that makes the hardware operate. A less elaborate version of the equipment offered a more tractable route into understanding it. The investigation moved between versions, looking for a weakness that mattered to the target device.

His description gives considerable space to the obstacles. Firmware was protected. The researcher had to understand how it started and how its pieces fitted together. Eventually he built a virtual model in which he could test his work. That detail matters. A demonstration becomes much more convincing when its author can reproduce the system’s behaviour rather than merely announce that something looks suspicious.

There is an unglamorous pleasure in this sort of work: identifying the right object, refusing a dead end, going back to a smaller problem. The conference abstract reads like a record of those movements. It also makes the later founder biography more interesting. Before a customer can trust your software, you need to know what your own demonstration proves. A good title gets people into the room. The reconstruction gives them something to discuss afterward.

Forty reasons to look more closely

In 2017, Neiderman brought another investigation to public attention: roughly forty vulnerabilities in Tizen, the operating system associated with Samsung devices. At the Security Analyst Summit, the findings included weaknesses in its application store and browser. These were places where trust carried practical consequences. Software responsible for admitting other software has an especially awkward time explaining why its own entrance is insecure.

His verdict was blunt. The vulnerabilities, he said, “felt like 2005.” It was a complaint about familiar errors appearing where he expected greater maturity. For a researcher, the disappointing discovery can be the ordinary one: a problem that already has a history, a name and a place in the textbooks, still waiting inside a current product.

“It felt like 2005.”

Amihai Neiderman, on his Tizen findings, 2017

He also presented “Breaking Tizen” at HITCON in Taiwan. The discussion extended beyond discovering defects to the experience of reporting them. Finding a problem and getting it addressed require different kinds of persistence. One involves code and experiments; the other involves getting a large organisation to hear, understand and act on the result.

The work brought a smaller, rather practical connection. After his Tizen presentation, Neiderman contacted PVS-Studio about its code-analysis software. The company gave him a licence for further research. It is an appealing detail because it leaves the investigator in motion: a public talk followed by another tool to try, another way to inspect the code. A conference appearance can look like the end of a project. For the person doing the research, it may also supply the next instrument.

A programmer before the pitch

His technical interests predate the company biographies. In an early speaker introduction, Neiderman described years spent with computers, ranging from high-level programming to electronics. His working background included vulnerability research on Windows, Linux and embedded devices, and a role heading research at Equus. The range helps explain why a wireless network, an operating system and a physical receiver could all become subjects of investigation.

There is a quieter trail on GitHub. Under the account AmihaiN, his public repositories include pyAsm, an inline assembly module for Python. The README offers a specific origin: he wanted a quick way to locate a process’s Process Environment Block using Python. The resulting library lets Python code execute native assembly instructions. The problem is specialised; the impulse is easy to recognise. Something is inconvenient. Make a tool.

Other repositories include an operating-system workshop and forks of existing software projects. They offer glimpses of the materials rather than a polished personal philosophy. That is their charm. A professional biography tells you where someone has worked. A small programming project can show you the sort of difficulty they found worth spending an afternoon on.

Neiderman studied mathematics and computer science at the Open University of Israel. He completed his degrees while still in high school, then spent about a decade in Unit 8200, the Israeli signals-intelligence unit. His later account of that period emphasised the friendships as well as the technical challenge. It also placed him in the circle from which one of his consequential professional partnerships would emerge.

The company years, and a chair passed on

In 2018 he co-founded Nym with Adam Rimon, a friend from the unit who had studied computational linguistics. Their early technical approach put language, rules and explainability near the centre of the work. Neiderman’s account describes a team spending two years improving its core technology before taking it to market. The researcher was now responsible for an organisation that had to deliver something other people could use.

His memories of early selling contain a particularly good collision of expectations. A prospective business contact in Georgia asked about his military equipment. Neiderman answered, “I had a really good computer.” The conversation eventually led to an invitation to shoot beer cans in the contact’s backyard. He recalled keeping a can. A software company’s early commercial history can contain more outdoor activity than the business plan suggests.

Nym appeared in Globes’ list of ten promising startups in 2020. The recognition placed the young company before a wider business audience. Lists are brief snapshots, but this one supplies a marker between the early technical work and the later leadership transition: the project had become a business with customers, investors and an expanding set of responsibilities.

On May 1, 2023, Nym announced that Or Peles would become CEO. Neiderman would continue as a board member. In his statement, he described a succession process and said he had worked closely with Peles over the previous year. It was a concrete change of job, with another executive taking responsibility for the company’s next stage.

The distinction deserves room in a founder’s story. Starting a company, running it and serving on its board are separate responsibilities. Neiderman’s biography now contains all three. The handover also provides a clear boundary for reading older profiles: his years as Nym’s chief executive ended in May 2023. His next company would put a different title beside his name.

The keys have new applicants

NewCore was founded in 2025 by Neiderman, Zohar Alon and Erez Yarkoni. Alon, previously a Dome9 co-founder, is CEO. Yarkoni brings experience as a chief information officer at T-Mobile USA and Telstra. Neiderman is CTO. In June 2026, the company emerged from stealth with $66 million in funding and more than fifty employees across Israel and the United States.

The company works on enterprise identity, including identities used by AI agents. Its public description asks practical questions: where are those agents, what can they connect to, and how can their actions be controlled? Giving software more work also gives the permissions system more work. Somewhere, someone must remain accountable for what the software is allowed to touch.

A June manifesto signed by the three founders argues for rebuilding identity infrastructure around the present workforce of people, services and agents. It also puts responsibility on the platform providing authentication. Read alongside Neiderman’s early investigations, that ambition has an interesting symmetry. He once examined the trust built into other people’s systems. As a co-founder, he is helping make a system that asks customers to trust its design.

In his June 24 essay on enterprise-managed authorization, he argues for central policies and an auditable record of access across software connections. The concern is recognisable even without the acronyms: individual permissions can accumulate into a company-wide problem that nobody can see clearly. His proposed direction gives the organisation a common place to define and supervise access.

The public Wi-Fi name that opened this story offered a convenient connection. His current work concerns connections made by software that can act on someone’s behalf. Between those chapters lie an operating-system investigation, a language-focused company and a leadership handover. The questions have grown with the systems. Who is here? What can they do? Who remains responsible once the connection is made? Neiderman has found another place to put the computer to work.