Guy Bejerano and the trouble with feeling secure

There is a peculiar moment in a security executive’s working life when the tools have been bought, the reports have been assembled, and the important question remains unanswered. Would any of it stop the attack everyone is worried about? Guy Bejerano knew that moment from the inside. He had held the security job, faced the customer questions, and tried to turn technical detail into a useful account of business risk. Eventually, he helped build a company around the question that kept surviving the presentation.

SafeBreach, which he co-founded with Itzik Kotler in 2014, runs controlled attack simulations against enterprise defenses. The proposition has an appealing lack of ceremony: give the defenses something to defend against, then examine what happens. A security product can have an impressive name and a perfectly respectable invoice. Neither tells you how it behaves on a particular company’s network.

For Bejerano, that gap became a career. His story is about the patience required to make a familiar frustration into a repeatable practice, and then persuade other people to change their habits around it. The work also required a change in his own habits. Knowing how to run security did not supply every answer about running a company.

Before the company, a translator

Bejerano’s background includes information security and red-team operations in the Israeli Air Force, followed by senior security roles in the private sector. He served as CISO of Ness Technologies and CSO of LivePerson. Those jobs placed him between technical systems and the people who needed to trust them. He had to understand how a defense worked, then explain why that understanding mattered to a customer or a business leader.

At LivePerson, the commercial consequences were visible. Former colleague Jim Dicso has described security requirements slowing sales and creating difficulties before Bejerano joined. His recommendation credits Bejerano with helping turn security into an advantage in customer conversations. Another colleague, Larry King, recalled his ability to balance LivePerson’s business concerns with customers’ concerns about risk. This was security work with a direct connection to whether a deal moved forward.

That experience helps explain the way Bejerano talks about his field. He wants technical evidence to survive the trip into the boardroom. Counting weaknesses is one task; deciding which ones could seriously affect the business is another. In a 2017 discussion of vulnerability and risk, he emphasized that an organization can face risk even without a known software vulnerability. Misconfiguration and human actions complicate the picture. A neat inventory cannot settle every consequential question.

Two people, one unfinished question

The founding problem had a wonderfully awkward quality. Bejerano wanted to keep asking after a security test was over. In a later account, he recalled bringing in white-hat hackers who demonstrated four routes to confidential information. He wanted to know about additional scenarios. One of the hackers understood the larger question and introduced him to Kotler. A finite engagement had exposed an appetite for something ongoing.

Kotler brought the experience of a hacker and independent red-team consultant. Bejerano brought the responsibilities of the person who had to decide what the findings meant. They founded SafeBreach in Tel Aviv in 2014. The pairing connected offensive technique with an executive’s need for usable answers. A successful demonstration of a weakness would be the beginning of the work: teams also needed to understand their controls and improve their response.

The early financial milestones made the idea into an organization with room to develop. In July 2015, SafeBreach announced $4 million from Sequoia Capital and Shlomo Kramer. By May 2018, a $15 million round included PayPal and Deutsche Telekom Capital Partners. The investors offered capital and connections, while the founders still had to sell a practice that asked customers to examine the effectiveness of things they already owned.

That is a delicate sales conversation. Most people prefer their past decisions to age gracefully. Continuous testing reserves the right to produce an inconvenient result tomorrow. Bejerano has described differentiation as a challenge in a security market crowded with vendors claiming novelty. SafeBreach’s case depended on making the test useful enough that customers would welcome an answer, including an unwelcome one.

A decision should have an exit

In recounting the early company, Bejerano has resisted the temptation to give it a perfectly plotted beginning. He acknowledged that the founders did not have a complete advance plan. They listened to CISOs and developed the platform around enterprise needs. Their attention expanded from demonstrating attacks toward helping the defensive side address what the tests revealed. Listening changed the work.

There is a connection between that account and a piece of advice he gave in 2018: “Don’t fall in love with your decisions.” The line has the useful bluntness of somebody who has had to revise a choice while other people were depending on it. Make a decision, recognize a mistake, and correct it. The founder gets no exemption from the need to test his own assumptions.

“Don’t fall in love with your decisions.”

Guy Bejerano · on learning to change course

His advice about teams is similarly concerned with what happens after the hiring decision. In 2022, he argued that strong performance requires a shared strategic vision and enthusiasm for the company. Individual knowledge and skill contribute less when people disagree about the direction. A collection of impressive résumés still needs a common destination. Otherwise, everyone can be exceptionally qualified to pull in a different direction.

Company building also gave him unfamiliar work to learn. Security expertise could help explain a customer’s problem; it could not make every operating decision for a first-time CEO. His public accounts of entrepreneurship leave room for that education. The attraction includes getting better at the job itself. There is something refreshingly practical about treating a title as the start of learning rather than proof that the learning is complete.

He has also described working with young entrepreneurs and passing on lessons from the journey. His advice includes choosing work that matters to you, surrounding yourself with people you trust, and taking the company’s highs and lows with some perspective. That is a less cinematic version of founding a business than the usual heroic montage. It leaves room for the long middle, when enthusiasm has to become a way of working.

A camera, a drone, a wider view

Bejerano’s interests extend beyond networks. In 2018, he described taking portraits and landscape photographs, using a DSLR or a drone, and combining photography with hiking and travel. The detail gives a more ordinary scale to a career spent discussing enterprise defenses. Sometimes the equipment goes outside, and the thing being examined is a landscape.

“You need hobbies to take your mind off work,” he said. The camera is a useful detail precisely because it need not become a business parable. A photograph can simply be a photograph. A founder is allowed an interest that does not end in a slide about leadership. His account makes room for a life in which the company occupies a great deal of attention without being the only subject worth looking at.

Even an enterprise security business has to adjust its own routines when circumstances change. In April 2020, Bejerano described completing a financing round quickly and adapting the company’s marketing as physical conferences became unavailable. SafeBreach recruited an executive focused on remote marketing. The episode is a reminder that a founder can spend years developing an argument for customers, then have to change how the argument reaches them. The product and the way of selling it are both unfinished work.

The question keeps getting bigger

The company grew around the original testing problem. In November 2021, SafeBreach announced a $53.5 million Series D led by Sonae IM and Israel Growth Partners, bringing its reported total funding above $106 million. Bejerano used the announcement to criticize the habit of buying more security products and hoping they would improve protection. The money would support expansion into new geographies and further development of the offering.

By 2025, that development included an exposure validation platform combining SafeBreach Validate with Propagate, which examines attack paths toward important assets. His review of the year reported customers in 34 countries. The ambition had widened from testing an individual defense toward helping an organization understand how exposures connect. The geographic spread was a company milestone; the underlying management problem remained recognizable.

In April 2026, SafeBreach announced an AI-powered continuous threat exposure management solution. Its Helm agent was designed to connect information, prioritization, validation, and remediation through a conversational interface. The significance for Bejerano’s story is the direction of travel: findings are supposed to lead to decisions and action. Automation adds another layer of machinery around a question he had been asking long before that machinery existed.

His October 19, 2026 writing returned to the organizational obstacles. Discussing a new survey of business leaders, he focused on disconnected risk functions and reports that fail to come together. He recalled the frustration from his own CISO years. Better information can accomplish surprisingly little when the people responsible for it cannot connect their work. The problem can outlive several generations of software.

That persistence gives Bejerano’s career its shape. He has spent years trying to make security answerable to observation, while learning to run the business built around that demand. The interesting question at the end is the one he carried into the beginning. After the purchase, the meeting, and the presentation, what actually happens when the defenses are asked to work?