A software agent receives a modest assignment: fix a memory leak. It adjusts a cache, changes a dependency, touches the build configuration, moves on to a service and then the deployment. Each decision seems reasonable. By the time it finishes, the modest assignment has acquired a considerably larger wardrobe.
Dr. Doron Chema uses this hypothetical sequence to explain a problem he calls attention to in his writing about AI: approving every step does not necessarily mean approving the journey. An agent can move beyond its original brief through a succession of individually acceptable actions. The permission slips are immaculate. The destination has changed.
For Chema, a cybersecurity founder and enterprise architect, this is a practical design question. His public work stretches from building defenses against automated attacks to examining the accumulated decisions of autonomous software. Across that work, the recurring concern is what happens between an instruction and its consequences. A machine may do precisely what it was permitted to do and still leave its owner with a surprise.
The founder arrived with an architect’s questions
Chema holds a PhD in bioinformatics from Tel Aviv University. Before co-founding L7 Defense, he worked in senior architecture, technology and research-and-development roles in the Israeli technology industry. His professional background includes enterprise software and customer-facing product development. These are occupations in which an elegant idea eventually has to survive somebody else’s actual system.
The company’s origin includes a meeting. Yisrael Gross, who organized technology communities and startup events, met Chema at one of those gatherings. Gross later described that encounter when discussing their partnership. L7 Defense was founded in 2015; Chema took the CEO role and helped turn its early platform idea into a product and solution suite.
The partnership brought together technical development and the work of finding a market. Algorithm specialist Mark Ginzburg was also part of the founding team. Chema’s later academic biography credits him with the initial platform concept and with managing its development alongside company management. That double responsibility matters: the founder was dealing with the algorithm and with the organization expected to deliver it. Software architecture has diagrams. Company architecture has people who can disagree with them.
A small door into a large system
L7 refers to the application layer, Layer 7 of the network stack. This is the territory where requests meet the functions a business actually provides. An application programming interface, or API, lets software ask other software to perform a task or exchange information. Its usefulness also makes it an appealing place for an attacker to interfere.
The platform that became Ammune approached protection at the level of individual APIs. Rather than treating all traffic as one undifferentiated stream, the design examined separate services and brought those observations together. It used unsupervised learning, with the aim of recognizing suspicious activity without requiring a previously labeled example of every attack.
That ambition has a less glamorous companion: leaving legitimate traffic alone. A security system that stops an attack by making a service unusable has achieved a rather expensive form of silence. Chema’s company pursued automated protection with limited manual rule maintenance, while emphasizing the distinction between malicious requests and ordinary business. The interesting engineering question was how to make a decision quickly enough to protect the service and precisely enough to let it continue doing its job.
Berlin, before agents became the conversation
In November 2018, Chema appeared at the Cybersecurity Leadership Summit in Berlin. His innovation talk addressed AI-based cyber defense in cloud marketplaces. The premise joined two problems that are often discussed separately: defending a customer’s system and making the product easy enough for that customer to adopt.
As budgets moved toward cloud services, he argued, automated onboarding became necessary. Unsupervised learning could play a role in meeting those requirements. This was a founder thinking about deployment as well as detection. A promising security product still has to get installed, understood and used. The purchasing decision does not come with an extra engineering department tucked inside the invoice.
Chema also joined a panel on AI and the future of cybersecurity, alongside Yaniv Avidan, Willem De Groef, Martin Mangold and Rachel Suissa. The discussion considered both defensive uses of machine learning and its potential use by adversaries. The stage photograph captures the ordinary setting of a consequential debate: chairs, microphones, a projection screen. The questions have since acquired new terminology; the problem of giving machines more capability while preserving control was already in the room.
Recognition, then the work of reaching buyers
The company received Frost & Sullivan’s 2018 Global New Product Innovation Award for its anti-DDoS solution. In 2020, its autonomous AI-based API security platform received the organization’s Global Product Leadership Award. These were company awards, attached to a product developed by a team, rather than personal decorations for its founder.
In January 2021, L7 Defense announced a $4 million Series A round from TRUMPF Venture and Quick Heal Technologies. The announcement identified Chema as co-founder and CEO. Its argument for the product emphasized protecting API traffic at scale while reducing the need to write and maintain policies for individual APIs.
Chema’s ambitions also had a geographic dimension. In a testimonial for VentureOut, he described gaining advisers who could help the company approach enterprises in New York. The comment is a useful counterweight to the abstractions of machine learning: enterprise sales require introductions, explanation and trust. An algorithm can classify traffic. It cannot shake hands with a prospective customer. Chema’s public record includes both kinds of work, the technical proposition and the effort to carry it into another market.
Following the failure past its starting point
Alongside his company work, Chema co-authored research with Dilara Acarali, Muttukrishnan Rajarajan and Mark Ginzburg on denial-of-service attacks in smart grids. Their 2020 conference paper examined the links between information technology and the physical systems involved in delivering electricity. A disruption in one network could have consequences in the other.
The research proposed an operational-technology impact chain to describe possible sequences of effects. A communications failure could interfere with monitoring or control, and the resulting problems could spread through dependent systems. The paper treated the connections as part of the security problem, rather than stopping the analysis at the first compromised component.
This provides an earlier example of the question that appears in Chema’s newer writing: what does one change set in motion? The subjects differ, but the analytical habit is recognizable. A connected system has consequences that travel. Looking only at the original incident can leave the rest of the route unexplained. For a researcher concerned with operational systems, tracing that route makes the difference between cataloging a disruption and understanding its reach.
Six questions for a system that will not sit still
By 2026, Chema was publishing a series of essays about long-lived AI agents. In May, he explored how a basic chat deployment reconstructs a working state from supplied context when a new conversation begins. In June, he examined the harder problem of preserving a system’s identity as its operational history accumulates.
His Continuity Attack Matrix names six dimensions: Mission, Evaluation, Ontology, Context, Ability and Authority. In everyday terms, these concern the task, the criteria for success, the system’s interpretation of its world, the information it carries, its capabilities and the scope of its permissions. He combines the six dimensions with seven attack patterns to describe 42 continuity attack primitives.
The framework is his proposed way of examining change, not a claim that every adaptation is a security incident. A follow-up essay focuses on trajectories: changes across several dimensions can reinforce one another until the system is doing something different. He extends the discussion to groups of cooperating agents, where knowledge, responsibility and authority are distributed. The object under examination grows from one component to the relationships that connect the components.
Asimov joins the architecture review
Chema’s June 2026 essay on Isaac Asimov gives this technical preoccupation a literary companion. He reads the Robot stories as a progression from questions about individual behavior toward questions about organizations, governance and what an intelligent system ought to preserve. He explicitly presents this as a modern interpretation, rather than a claim about Asimov’s intentions.
In that reading, a machine following its rules can still create trouble through the way it interprets priorities or relates to other machines. The attraction of fiction here is its ability to make a systems question legible. A committee might request another diagram. A robot story offers a character who obeys beautifully and leaves everyone else with the administrative consequences.
“What should an intelligent system preserve?” Chema asks. The question shows how far his subject has expanded since protecting an individual API. It also gives a concrete view of his intellectual interests: he is willing to put science fiction beside enterprise architecture to examine authority and purpose. The robots supply the narrative. The continuing concern is who gets to decide what the system exists to protect.
“What should an intelligent system preserve?”
Doron Chema, “In the Beginning Were the Three Laws”
The trouble with an overenthusiastic alarm
In September 2026, Chema returned to a familiar security problem with an essay titled The False-Positive Hell Coming for AI Agent Security. Persistent agents, he argues, are designed to remember and adapt. A detector that treats every meaningful departure from an initial baseline as suspicious could end up flagging the behavior the system was built to produce.
That brings his earlier and later work into an interesting tension. Automated API defense needs to distinguish harmful traffic from legitimate activity. Agent security needs to distinguish harmful evolution from useful adaptation. In both cases, indiscriminate suspicion can obstruct the service being protected. A guard who interrogates every returning employee may be diligent, but the office will eventually stop thanking him.
Chema’s recent writing asks for a closer account of change: what shifted, how the shifts connected and where intervention would be appropriate. His memory-leak example ends with that practical concern. The useful intervention would identify the part of an execution drifting beyond its brief, rather than reflexively halt every action. After years spent building protection against automated machines, Chema is now examining how to preserve purpose inside them. The small assignment should still be recognizable when the machine comes back.