Idan Plotnik and the trouble with moving faster

Idan Plotnik had sold a security company to Microsoft. Then he found himself waiting for security. The software could be ready, the customer could be ready, the sales team could be exceptionally ready, and still there were questionnaires to complete, reviews to arrange and decisions to sign. Success had delivered him to a particularly elaborate waiting room.

At Microsoft, he recalled managing roughly 250 developers. A release cycle measured in months could absorb another month or two of security work. Weekly releases made the mismatch much harder to ignore. The practices designed for an earlier rhythm were now sharing a calendar with a business that wanted to move faster.

Plotnik was responsible for approving releases. He described developers giving inaccurate answers on questionnaires and commercial pressure to ship features while risks remained. His account of Apiiro’s beginnings has the appeal of an awkward confession: a security professional had become the person squeezed between the security process and the delivery deadline.

There is a useful reversal here. Entrepreneurs often describe an acquisition as the satisfying last page. For Plotnik, the acquisition supplied the next question. How could an organization understand what it was about to release without requiring everyone involved to stop and explain it?

Before the exit, a way inside

His route to that question began with security work much closer to the machinery. He spent about five years in an Israeli military cybersecurity unit, then worked in penetration testing, risk assessment and security design. Consulting gave him a practical view of the distance between an organization’s intended defenses and what an inquisitive outsider could actually do.

He and his brother Ohad built Foreity, a security consulting business acquired by Aman Group in 2012. The next company, Aorato, brought together Plotnik, Ohad and Michael Dolinsky. Its subject was a piece of enterprise infrastructure that rarely receives affectionate attention: the directory through which organizations manage identities and access.

The commercial opportunity lay in behavior. Possessing credentials can make an intruder look legitimate. Watching what an account or machine does can reveal something the credentials alone cannot. That required understanding relationships across a network, rather than treating each event as an isolated occurrence.

Microsoft announced its acquisition of Aorato on November 13, 2014. The company explained that Aorato’s machine learning recognized normal network activity and identified anomalies. At its center was an Organizational Security Graph, continuously mapping the people and machines accessing Windows Server Active Directory.

That description matters to Plotnik’s later career. A graph gives an event neighbors. An action becomes more informative when someone can see who performed it, what it touched and how it fits the wider system. Years before Apiiro, he was already working on security that depended on those connections.

An old machine, still worth a photograph

The childhood version of this interest was rather less corporate. His father bought him a computer when he was six. Games led to programming and then to exploring how systems could be made to behave differently. He remembers Commodore machines, PCs, DOS and Pascal, a collection of names capable of dating a conversation faster than a school photograph.

He has described reading the technical specifications for TCP/IP and becoming fascinated by what happened when a few bytes in a packet changed. The pleasure was in following an instruction from one computer to another and understanding the result.

The enthusiasm survived the executive titles. Visiting a prospective enterprise customer, he spotted an Atari and took a picture. He called it a “piece of art.” A sales visit had briefly become a museum visit, with a better chance of finding a power socket.

The business hidden inside a code change

Apiiro, which Plotnik co-founded with Yonatan Eldar in 2019, took shape around the difficulty he had encountered at Microsoft. The pair had both worked there as engineering leaders. Their new company entered public view in October 2020 with $35 million in financing from Greylock and Kleiner Perkins.

The initial proposition was to connect development, security and compliance around changes that actually mattered. Code was already changing continually. Requiring a separate human explanation of every change created another system to maintain, one that could become stale while the software carried on moving.

Plotnik’s distinction was between a vulnerability viewed alone and a vulnerability understood in its business setting. In a 2021 conversation, he described conventional security’s narrow framing: “you have vulnerabilities or you don’t.” That leaves out what the software does, which information it handles and the consequences if something goes wrong.

His own role made that omission personal. He had been accountable for the software arriving safely while also being accountable for its arrival. A list of technical findings could tell him there was work to do. It could still leave the practical management question unanswered: which work should happen first?

Apiiro’s published product descriptions organize the answer around visibility, prioritization and remediation. Discover the connected software components. Evaluate findings in that setting. Route the work to the people who can fix it. Even the final step depends on an unglamorous fact that can be surprisingly elusive in a large organization: who owns this code?

A three-minute pitch, a longer commitment

In 2021, Apiiro won the RSA Conference Innovation Sandbox contest. Plotnik presented the company’s pitch. The win gave a public stage to a problem usually experienced in private meetings, ticket queues and negotiations over release dates. Here was a security company arguing that the surrounding development process deserved attention too.

The larger financial commitment came in November 2022: a $100 million Series B led by General Catalyst, with Greylock and Kleiner Perkins participating. It followed the earlier $35 million raise. The announcement emphasized finding and addressing risks before software reached the cloud, with the code, configuration and infrastructure considered together.

General Catalyst’s Quentin Clark and Mark Crane wrote that they had known Plotnik for years and had been looking for an opportunity to work with him after Aorato. Their investment account connected the company to the growing volume of software inside enterprises. A bank or retailer could increasingly have the development challenges of a software business, whatever appeared on its front door.

That autumn also brought reports of acquisition discussions with Palo Alto Networks. Plotnik declined to comment on the rumors. He did tell CRN that he was content for Apiiro to remain independent, and emphasized employees and company values. The contrast with the earlier Microsoft sale is a matter of chronology; his public explanation put the team at the center.

Money gave the company room to continue. The task remained exacting: make a security product useful to people whose working day already contains more findings, tools and competing demands than they can comfortably accommodate.

Knowing what is actually there

By 2024, Plotnik was repeatedly returning to inventory. Security leaders could often count cloud containers or endpoints, he said, while struggling to say where APIs, sensitive information or AI components appeared across their code. You cannot choose what to protect intelligently if the map is incomplete.

The inventory has to show relationships as well as ingredients. Apiiro’s product materials describe deep code analysis and a risk graph that connect application components, scanner findings and development workflows. An alert acquires practical value when it comes with enough context to decide what to do, and enough ownership information to get the work moving.

A partnership with Akamai offered a concrete example. Runtime API findings could be traced back to the relevant code, repository and owner. The operational benefit was the shorter journey between seeing a problem in a running application and finding the part of the codebase responsible for it.

It is easy to lose the human being in this vocabulary. Yet the work keeps returning to human limitations: someone has to interpret the finding, find the right colleague and make a decision. Plotnik’s product argument treats those hours as part of the security problem. The queue counts, even when the dashboard does not show it.

“I have two things in life, family and work.”

Idan Plotnik / Cloud Security Podcast, 2024

The release train gets another engine

AI-assisted development has given his original concern a new setting. In March 2026, he discussed with Security Weekly how faster code generation changes application risk and strains traditional vulnerability management. The interview was sponsored by Apiiro; the argument was consistent with the company’s increasingly explicit focus on AI-driven development.

At an executive panel published the previous month, Plotnik appeared with former GitHub CEO Thomas Dohmke, banking technology executive Liora Shechter and Armis co-founder Yevgeny Dibrov. The discussion considered code review, business exposure and responsibility as AI changes how software gets made. Plotnik focused on understanding software architecture well enough to assess the resulting risks.

His prediction was a future involving several specialized agents working together. That is an aspiration for how development and security might operate, rather than a settled description of how every enterprise works today. The underlying problem is familiar: increasing output puts pressure on the processes meant to examine it.

In August 2026, Apiiro announced that it had joined Chainguard’s Athena coalition and was making AutoFix available free to open source maintainers. The company described architecture-aware prioritization and automated fixes that become pull requests for review. Plotnik emphasized the difficulty of fixing vulnerabilities quickly without disrupting applications.

The progression from Aorato to Apiiro is visible here. First came understanding behavior within an identity system. Then came understanding changes within a software system. Now the software system includes agents producing changes. Each stage asks for a richer account of what is happening around the event.

▶ WATCH THE PANEL

The surfboard can wait

Asked in 2024 what occupied him away from work, Plotnik reduced the answer to family and work. He mentioned his wife and two children, and recalled wave surfing and kitesurfing as activities he used to do. Building the company had made them harder to fit in.

When the conversation turned to something he was proud of, he talked about deals the company had closed and credited the collective effort across product, engineering, marketing, sales and partnerships. His answer moved quickly from the outcome to the people who had made it possible.

The family answer contains a less tidy admission: even while with them, he said, he thinks about work. An entrepreneur discussing efficiency can still have difficulty putting down the job. The surfboard offers a rather pointed reminder that a calendar also needs an owner.

Plotnik’s career keeps bringing him back to the same practical predicament. Somebody wants to release something. Somebody needs to understand the consequences. He has occupied both positions, sometimes at once. Apiiro is the company he built around that experience, with an increasingly complicated cast of software authors and the same stubborn question waiting at the end: what, exactly, are we about to ship?