Idan Udi Edry and the trouble with ordinary things

At the RSA security conference in San Francisco in February 2020, Idan Udi Edry and his Trustifi colleagues found themselves with a task that required no password, no encryption key, and considerable patience: chopping onions. One hundred pounds of them. Edry, then the company’s CEO, joined teammates at Project Open Hand to prepare vegetables and food containers. The conference theme was “The Human Element.” They had found a rather literal way to participate.

A kitchen is an unlikely opening for a career that includes military information systems and industrial cybersecurity. Yet it offers a useful glimpse of Edry’s working world. People have to do things together. Someone must think about how the work happens, where responsibility sits, and which small action can affect everybody else. Security conferences tend to make those questions sound forbidding. Lunch preparation makes them wonderfully plain.

Before the inbox, a chain of command

Edry’s technical career began in an environment where responsibility was explicit. He served for more than eight years as an Israeli Air Force officer, reached the rank of captain, and led hundreds of trained personnel building and operating advanced information systems. The scale matters. A system may be described in cables, servers, and interfaces; operating it also requires people who understand their part in the machinery.

He moved into civilian telecommunications as head of data and security at Pelephone, the Israeli cellular operator. There, his work included strategic projects for government agencies and organizations. His remit also brought him into contact with customers and senior officials. The engineer’s problem had acquired another dimension: explaining what a system should do to the people depending on it.

His professional biographies record 13 formal certifications in information technology and telecommunications. That is a concrete measure of training, rather than an invitation to imagine a prodigy. The more telling progression is between settings. Military systems, a cellular operator, and industrial networks each place technology inside a larger organization. In each, the equipment is only part of what must keep working.

The building has joined the network

By March 2016, Edry was CEO of Nation-E, which worked on cybersecurity for critical infrastructure. Its territory included industrial equipment and smart grid environments. Here the consequences of a network connection could reach beyond a screen. Machines that had been designed to run industrial processes were becoming accessible through information networks, creating new routes into older systems.

In his November 2016 writing about oil and gas security, Edry focused on the interface between operational technology and conventional IT. Nation-E’s approach added protection to existing installations, using monitoring, encryption, authentication, and access controls. The practical detail was the installation itself: protection could be added without replacing the underlying operational infrastructure. An organization could improve its defenses while retaining the machinery it already owned.

There is an appealingly unglamorous business problem here. Replacing every machine is a splendid plan if nobody asks about the budget or the production schedule. Edry was working in the world where those questions arrive promptly. A protective layer has to live with what is already there. The technical ambition is constrained by the perfectly reasonable desire to keep the business running.

At the Intelligent Buildings Conference in June 2016, he noticed a change in the audience. Building operators were showing curiosity about security, beyond treating it as an obligation. A connected building could bring elevators, lighting, surveillance, and other equipment into the same conversation as IT. Edry had entered a field where convenience was expanding faster than the familiar boundaries around it.

Make the intruder’s job expensive

Edry’s public explanation of industrial security had an economic streak. In 2016, he argued that reducing the cost of an attack encouraged more attacks. A defender could change that calculation by making a successful intrusion demand more time and computing resources. This is a modest but consequential idea. You do not have to imagine a perfectly sealed world to explain why an additional barrier matters.

His point offers a way to understand the career move toward email. A message can be an inexpensive opening into an organization. It arrives inside a routine that already asks people to read, respond, and get on with their work. A criminal benefits from that routine. Making the opening more difficult changes the bargain, even when the message itself looks ordinary.

When commenting on school cybersecurity in 2017, Edry urged organizations of every size to invest in protection. He described attackers as seeking results for minimal effort. The emphasis fits his earlier argument about infrastructure: the defender should consider the attacker’s workload. Security spending becomes easier to explain when the question is what obstacle it places in the path.

An email address is a remarkably busy address

By 2017, Edry was publicly identified as Trustifi’s CEO. The company’s focus was email encryption and security. As a co-founder and former CEO, he helped shape its approach to business communication. The shift in product was substantial, but his subject remained the risk introduced by connections that people had come to take for granted.

In discussing website privacy in 2017, Edry emphasized the linking power of an email address. It can connect an inbox, a bank account, password recovery, and other services. A name and address can give an attacker a starting point for researching a person. The information feels commonplace precisely because it is used so often. That familiarity does little to reduce its usefulness to somebody else.

Think of an email address as the address printed on several different doors. The observation explains why Edry spent so much time on apparently small acts of communication. The address carries relationships. A message carries instructions. An attachment carries information that may matter elsewhere. Looking at each item alone can obscure the business it connects.

Trustifi’s product descriptions combined protection for incoming messages with outgoing encryption and data loss prevention. They also described tracking and certified delivery. Edry’s concern covered both the hostile message entering an organization and the legitimate message leaving it. The sender’s intention, the recipient’s identity, and the handling of the content were parts of the same transaction.

The button and the people using it

In 2017, Trustifi’s email plug-in could appear as a button on the Outlook toolbar. Users chose whether to encrypt before sending. Organizations could set policies about which messages needed protection. Edry described setting those rules within Trustifi itself, and supported meetings to review security and encryption practices. The software had a place inside a working routine, accompanied by decisions about its use.

His own writing that October argued for security awareness throughout an organization, including executives and interns. He encouraged ongoing training, discussion of breaches, and reporting suspicious messages. Crucially, he also asked what happened to the information if somebody gained access. The password at the entrance could not carry the entire burden of protecting everything behind it.

“If the cyber criminal gains access, the information inside must also be protected.”

Idan Udi Edry, 2017

That sentence explains much of the appeal of encryption in his work. It acknowledges failure as a possibility and asks for another layer of protection. There is no theatrical promise of invulnerability. The idea is to make a stolen opportunity less useful. For a manager, it also creates a more specific conversation than a vague instruction to be careful.

The invitation became the entrance

In April 2020, Edry drew attention to an overlooked object: the emailed invitation to a video meeting. Trustifi described protecting those invitations through encryption, recipient authentication, and single-use access. The meeting could have strict intentions about who belonged in the room while its invitation remained an easier route to the details. Edry was following the communication that preceded the event.

By June that year, he was describing the exposure created when employees worked through home networks. His examples included real estate agencies, law firms, and accounting firms moving sensitive business information between locations. Trustifi then had 24 employees, about a dozen in Las Vegas. These figures belong to that moment, when a small company was dealing with a change in how its customers worked.

Edry’s comments about smaller businesses were especially direct. In 2019, he said some were reluctant to discuss attacks publicly or involve the FBI, while their ability to absorb losses was limited. His audience included businesses without a large security organization. For them, a usable protection mattered because the ordinary work still had to be done.

A place on the team

The same attention to participation appeared away from the inbox. Trustifi brought two paid teenage interns to Black Hat in 2019 to learn conference marketing. Marketing director Alex Marz led that effort. In describing recruitment, Edry talked about chemistry with the team. Those choices gave young people a place inside the work, where they could see how a technology business operated.

His stated ambition for the business was to keep ahead of increasingly capable cybercriminals. The task allowed little room for a final victory speech. New connections would keep appearing; old assumptions would keep needing examination. His career gives that ambition a particular shape, from networks serving military personnel to industrial machinery and messages exchanged by everyday businesses.

The kitchen episode supplies a fitting last detail. A conference can sell the human element on an enormous banner. A team can also spend its time doing something useful together. Edry’s story has room for both the person thinking about a network’s weak point and the colleague accepting an ordinary job. In one case, somebody has to watch the connection. In the other, somebody has to chop the onions.