Ely Abramovitch and the art of knowing when to improvise

Ely Abramovitch once had a job in which rehearsal threatened to consume everything else. He played jazz in New York, a city with plenty of musicians and remarkably little interest in making their lives convenient. He had gone to the United States to play and study. Eventually, the daily terms of the bargain stopped appealing to him.

“It was hard to do anything but rehearse,” he said. He returned to Israel, studied mathematics and went into technology. Years later, after product leadership at Microsoft Sentinel, he became co-founder and CEO of Legion Security. The company builds AI that watches security analysts investigate threats and learns how they work.

There is an appealing symmetry here: someone who left a profession built around practice now asks software to learn from people practising theirs. Abramovitch makes a more direct connection himself. He has written about knowing when to improvise, when to follow and when to listen. Those are useful distinctions for a musician. They also happen to describe a difficult problem in security automation.

The rehearsal that changed the plan

The jazz chapter resists the usual tidy founder mythology. Abramovitch has described a lifestyle that did not suit him. He changed course. There is something refreshingly ordinary about that decision, even if the itinerary that followed was unusual.

His education took him through jazz and contemporary music studies at The New School in 2012-2013, then mathematics at Tel Aviv University from 2013 to 2017. Economics and philosophy were part of the latter course of study. It is a varied reading list for someone who would eventually spend his working life considering what a security alert means.

Music, mathematics and philosophy can make a biographical paragraph look suspiciously well arranged. His explanation is less ornamental: he came home, studied and entered high-tech. The later career included being an early employee at Indegy, the industrial cybersecurity company acquired by Tenable, and leading product work for Microsoft Sentinel. The work moved from a very small company to a very large one.

The patient work of joining the dots

To see that Microsoft period at human scale, it helps to look past the size of the business and into the product notes he wrote. In August 2021, Abramovitch introduced a new way to turn Azure Sentinel on or off for a workspace. Previously, people using its programming interface had to make several calls to different endpoints. A dedicated endpoint gathered that work together.

This is the sort of improvement that rarely earns a dramatic photograph. Its value lies in removing a piece of administrative friction. Someone trying to deploy a security service has fewer separate operations to manage. The glamorous business of catching attackers still depends on getting the plumbing right.

In May 2022, he described a different improvement: allowing analysts to add alerts to an incident or remove them as an investigation developed. Related alerts initially appeared with dotted lines. Once an analyst established a connection, the line became solid and the alert joined the incident timeline.

That small visual distinction carries a serious idea. A possible connection and an established connection deserve different treatment. An investigation develops as evidence arrives; the software has to let its account of events develop too.

Read together, the two product notes show the range of work inside a security platform. One concerns the effort required to get started. The other concerns how an analyst records a developing understanding of an attack. Both are practical questions about helping a person do the job in front of them. They make Abramovitch’s product background more tangible than a list of titles.

His name also appears among five inventors on a Microsoft patent, granted in May 2024, concerning likelihood assessments for security incident alerts. It describes learning from an organization’s previously labelled alerts to help assess subsequent ones. Long before Legion’s public launch, the problem of using an organization’s own experience to interpret new signals was already part of his work.

“I don’t think jobs are going away.”

Ely Abramovitch, on the changing role of security analysts

Three people, two familiar worlds

Legion’s founding relationships came from different parts of his life. Michael Gladishev was a former colleague from Microsoft Sentinel. Eyal Fisher was an AI entrepreneur Abramovitch had met while living in London. Gladishev became VP of R&D; Fisher became CTO. Abramovitch took the CEO role.

The company was founded in 2024, but the conversations preceded it. Accel investors Andrei Brasoveanu and Dana Eliaz first met Abramovitch in Tel Aviv in June 2023. Their account describes repeated discussions as his initial idea developed and the founding team came together. A startup’s official birthday can conceal a considerable amount of conversation.

In July 2025, Legion announced $38 million in combined seed and Series A financing. The $30 million Series A was led by Coatue, with Accel and Picture Capital participating. At that announcement, the team numbered 25 people across Israel and New York. Those figures describe a particular moment, when work that had been taking shape privately became a public proposition.

Start with the tabs already open

Abramovitch’s product argument begins in a familiar place: the browser. Analysts already use it to move between security tools, inspect evidence and document what they find. Legion’s extension observes those investigations, uses language and vision models to learn the processes, and turns them into workflows the team can inspect and automate.

The choice has consequences beyond installation. Each organization has its own mixture of commercial products, internal applications and accumulated habits. Asking the entire enterprise to reorganize before automation can help is quite a request. A new tool can arrive with a plan; the company already has a calendar.

In a later interview, Abramovitch argued that enterprises have to be met as they are, including their complexity. He compared the problem to building machines for a world designed around human beings. The software should be able to work in the environment people actually inhabit.

That is also a particular way of valuing the analyst. The person doing the investigation possesses knowledge the system needs to acquire. The everyday sequence of checking, comparing and deciding becomes something worth observing closely, rather than background activity to rush past.

Where the instructions stop

By March 2026, Abramovitch was writing about what happens when a captured process reaches its limit. Legion Investigator, introduced that month, was designed around goals rather than an exhaustive sequence of instructions.

His example was a phishing investigation. Checking a sender or examining a link can be described as a sequence. Discovering something suspicious raises a broader question: who else was affected? A campaign may use different subjects, sender names and links. Matching a single field can miss the relationship the investigator needs to understand.

The next search depends on the last result. Writing down every possible turn produces branches, then more branches, with an awkward remainder at the end: someone still has to decide what the evidence means.

Investigator’s proposed role is to work through that remainder. A team sets a goal and defines which tools and actions are permitted. It also decides where the agent can proceed and where approval is required. Abramovitch’s ambition combines room to investigate with limits set beforehand. The person responsible for the outcome gets to establish the terms of the delegation.

The security department goes first

His argument about adoption extends beyond the product. In a public post, he urged security departments to become early users of AI inside their own organizations. Their deployments could establish patterns for identity, permissions, audit records and gradual trust that other departments could reuse.

He described an early customer whose Legion deployment became the company’s first successful AI project, then spread into other departments. It was a founder’s account of a customer experience, but the management proposition is clear: demonstrate a workable approach and colleagues have something concrete to follow.

He also expects the analyst’s job to change. In an interview about initial responses to threats, he described AI taking the first steps and escalating when necessary, with people managing, governing and provisioning the agents. His forecast puts a substantial burden on vendors: they have to help customers make that transition.

In October 2026, his public commentary returned to the scale of the work. He cited Virgin Money’s security-alert backlog and its reduction through agentic automation, then considered attacks that generate signals across several departments at once. His concern was how defenders connect those signals. It is a larger version of the investigation problem he described at Microsoft: the pieces need to become an intelligible account.

Leave room for the next player

The old profession has not entirely vanished from his public life. Ahead of Black Hat 2026, Abramovitch invited people to a jazz event Legion and Ocean were arranging at Easy’s speakeasy. There would be a live band, he wrote, and he might join it for a tune or two.

That invitation brings the story back down to a pleasingly manageable size. Between financing rounds, enterprise workflows and the future of security operations, there was still the possibility of sitting in with other musicians.

He had already explained which part of that experience stayed with him: deciding when to improvise, follow or listen. At Legion, he is asking how software can learn enough from people to take on more of their work. Listening remains a sensible place to begin.