Amir Khayat likes an engine-room metaphor. Enterprise security, he argues, spent years improving the front door: logins, permissions, configurations, the polite ceremony of deciding who may enter. Meanwhile, the interesting traffic moved downstairs. OAuth tokens, service accounts and third-party integrations began passing sensitive data between applications. AI agents arrived and made the machinery run faster. The gauges, inconveniently, did not keep up.
Khayat's company, Vorlon, is built around watching that machinery. Its software models the applications, identities and connections inside an enterprise, then follows what data does after access has been granted. The idea sounds obvious once stated, as good infrastructure ideas often do. Pipes should be mapped. Unusual flows should attract attention. A security team should not need a séance to learn which app carried customer records out of Salesforce.
The route that brought Khayat here is more revealing than the pitch. He did not spend his entire career in a laboratory and suddenly discover customers. He moved steadily toward them - from writing software, to field engineering, to sales engineering, to running global solutions architecture. By the time he became a founder, he had watched security products from nearly every chair around the table.
“When uncertainty strikes, don't wait for clarity to appear. Hack the uncertainty.”Amir Khayat, CISO Series Podcast
A career assembled like field research
Khayat studied computer science at Reichman University, then added an MBA from the Hebrew University of Jerusalem. Before his commercial career, he served for three years in the Israeli Defense Forces as a commander and combat soldier in a paratroopers operations unit. His early private-sector work stayed close to code. At Portnox Security, he led software engineering work. At NICE Systems, the axis began to shift: field engineer, team lead, then sales engineer. Cyberbit followed.
A sales engineer lives at an awkward and useful junction. The product must work, the buyer must understand it, and neither side has much patience for the other's favorite abstractions. The job rewards translation. It also reveals where polished architecture buckles against old systems, limited staff and a Tuesday afternoon incident nobody rehearsed.
The founder curriculum, hidden in the résumé
In 2016, Khayat joined Demisto's early team. The company built software for security orchestration, automation and response, a category usually shortened to SOAR because cybersecurity has never met an acronym it could leave alone. Khayat led sales engineering and solutions architecture work. Demisto was acquired by Palo Alto Networks in 2019, and he continued there, eventually leading global solutions architecture for the XSOAR platform.
On the Secure Ventures podcast, Khayat framed this progression as a decade spent preparing to become a founder. It was preparation by proximity. Each move brought him nearer to how large organizations actually buy, deploy and operate security. His technical background let him inspect the engine. His customer roles showed him which warning lights operators could not see.
The leak that made the black box visible
The founding insight arrived at Palo Alto Networks, sharpened by one customer's bad surprise. Khayat was working with enterprises when he saw a customer unknowingly exposing sensitive financial data through a third-party integration. The application had permission. The data still went somewhere the customer did not expect. Posture checks could describe settings, but they could not adequately narrate behavior.
This was the black box. Businesses were filling their operations with SaaS applications connected by APIs and durable credentials. Every connection promised convenience. Each also created another route by which data could move, often outside the traditional controls guarding a company's network. The applications were known. The relationships between them were less so.
Permission answers who can touch data. Behavior answers who did, what moved, where it went and whether the pattern changed. Khayat built Vorlon around the second set of questions.
Khayat reconnected with Amichay Spivak, a fellow member of Demisto's founding team and later a Palo Alto Networks colleague. Spivak became Vorlon's CTO; Khayat became CEO. They founded the company in 2022. Two years later, Vorlon announced a Series A led by Accel, with Shield Capital participating, bringing its reported total funding to $15.7 million.
Their division of labor echoes the company they came from: one founder close to the product's technical core, the other fluent in the complicated path from technology to enterprise adoption. It is a connection forged through prior work, not speed dating for co-founders. Years spent solving the same class of problems gave them a shared vocabulary before they had a new logo.
Follow the data, not the fashion
Vorlon's early language focused on third-party API security. Its current frame is broader: the “agentic ecosystem,” where SaaS applications, integrations, non-human identities and AI agents share access and pass information. The terminology changed because the traffic changed. AI did not invent the connected enterprise. It placed autonomous actors inside it.
DataMatrix, introduced in 2025, is the company's attempt to create a living model of that environment. Instead of treating each application as a separate island, it maps connected services, users, machine identities and the paths among them. The behavioral emphasis is Khayat's recurring point. A list of allowed actions is not a record of what occurred.
“Organizations don't own their data pipelines anymore. They flow through the converged SaaS and AI ecosystem.”Amir Khayat, Vorlon
In 2026, Vorlon published a survey of 500 U.S. CISOs conducted by independent research firm Censuswide. The headline finding was uncomfortable: 99.4 percent reported at least one SaaS or AI ecosystem security incident during 2025, even as their organizations ran an average of 13 dedicated tools across those areas. More tools had not produced a complete view.
Khayat uses the survey to argue that the industry has an architecture problem, not an awareness problem. Security leaders know the risks and keep buying defenses. Yet controls designed to audit configuration or govern access may miss runtime activity: a token used from an unusual place, an integration pulling an odd volume of records, or an agent moving information across several systems before a human finishes coffee.
There is salesmanship in any founder's taxonomy, but Khayat's version has the virtue of continuity. He was talking about consumed APIs and third-party data movement before every vendor discovered an urgent spiritual connection to AI. The agent boom makes his original observation more consequential: unseen connections become more dangerous when software can act through them without waiting.
From seeing to stopping
A map is valuable until the building catches fire. Vorlon's 2026 releases moved from visibility toward forensics, coordinated response and enforcement. The AI Agent Flight Recorder is meant to reconstruct what an agent did across systems. Action Center coordinates remediation. Guardian applies policy as an agent acts. The sequence mirrors Khayat's career: first understand the system, then explain it to the operator, then make action possible.
It also returns to his pithy advice about uncertainty. “Hack the uncertainty” is not a promise to know the future. It is an instruction to improve the evidence available for the next decision. In an incident, clarity rarely strolls in wearing a name badge. Teams assemble it from logs, identity context, data movement and the order in which actions occurred.
Khayat is a founder shaped by the distance between a product diagram and a customer's working day. His public conversations return to validation, clear messaging and the need to understand what the market actually needs. The lesson is less theatrical than disruption and more useful: choose jobs that expose you to the whole problem. Learn how it is built. Learn how it is sold. Learn where it fails in the wild.
That sequence also explains his comfort moving between audiences. In one conversation, he can discuss reconstructing API activity for a practitioner; in another, he reduces the company to three verbs: see, understand and respond. The compression is earned. Khayat spent years inside proof-of-concept meetings and deployments where a technically correct answer could still be operationally useless. Enterprise buyers do not purchase elegance in the abstract. They purchase fewer blind spots, faster investigations and some hope of getting home before the incident bridge becomes a breakfast meeting. His founder voice keeps the architecture attached to that consequence.
Vorlon's future depends on whether enterprises accept its connected view of SaaS and AI security, and whether the company can turn an ambitious live model into daily operational value. Khayat's aspiration is already plain. He wants the invisible movement of data to become legible, and the machine actors using it to become accountable.
The front door still matters. It is simply no longer the whole house. Khayat spent a decade learning the floor plan, then chose the room where the pipes rattle, the gauges flicker and the consequential work happens out of sight.