Itai Tevet and the case of the unread alert

A security alert is a peculiarly incomplete thing. It announces that something deserves attention, then hands the expensive part to somebody else. A person must open it, gather evidence, work out what happened and decide whether anyone needs to act. Itai Tevet has spent much of his career on the receiving end of that arrangement. He now runs a company built to change who does the next piece of work.

In a January 2026 interview, the Intezer co-founder and CEO described a large enterprise facing roughly a thousand alerts a day. That was his illustration of the workload, rather than a universal daily quota. The practical difficulty was easy to grasp: a team can own plenty of detection technology and still lack the people to investigate its output. A dashboard, however handsome, has never volunteered to work the late shift.

Tevet’s story begins before AI became the answer offered at every conference booth. It begins with someone who had used the tools, managed the investigations and noticed how much work remained after the alarm.

The customer before the company

His early biography contains a modest description: “PC kid.” An interest in computers became an interest in security, followed by leadership responsibilities in the Israeli military. He eventually led its cyber incident response team. Working on attacks meant dealing with both technical complexity and a relentless supply of new problems.

He met Roy Halevi on an IDF project. Their working relationship preceded the company: they had already built things together under pressure. Alon Cohen, the founder and former CEO of CyberArk, joined them in founding Intezer. The combination brought operating experience, technical experience and someone who had already built a security business.

In a 2020 interview, Tevet recalled that leaving the military changed his sense of the market. He had been handling sophisticated attacks; outside, he saw enormous security spending alongside a problem that continued to grow. His stated aim was to alter the economics for attackers, making their work less rewarding. That is a fairly stern business plan. It has the advantage of knowing exactly whose day it hopes to spoil.

Software has a family tree

Intezer’s early work took the origins of software seriously. Code gets reused. A suspicious file may contain pieces related to code encountered elsewhere. Finding those relationships can give an investigator useful evidence about what the file is and where it came from. Tevet described an ambition to become a “Google of binary code.” Indexing was part of the investigation.

The idea had a research life as well as a product life. In his review of 2019, Tevet described a collaboration with Check Point mapping connections among Russian advanced persistent threat samples. The study identified 22,000 code-reuse connections across 2,000 samples. Intezer also released tools allowing others to explore the work. Another collaboration, with IBM Security, uncovered the PureLocker ransomware service.

These were team efforts, and Tevet’s account credited collaborators and colleagues. His review also noted a doubling in users of the free community edition. The company was building a commercial product while giving practitioners another way to examine unfamiliar software. An investigation could produce something useful beyond the customer who first needed it.

Selling that approach required explaining the machinery. Tevet noticed differences among buyers. In the same 2020 interview, he described Japanese executives checking technical details themselves, compared with his experience of American executives concentrating on the broad business proposition. He also identified LAC as a Japanese partner. Here was a founder learning that the person signing off might want to look under the bonnet.

The work after the alarm

Over time, Intezer widened the assignment. Its automated investigation tools could sit alongside an organization’s existing security products, collect evidence and determine which alerts required further attention. Code analysis became one part of a larger process. The aim remained connected to Tevet’s old job: help a team arrive at a useful decision.

A January 2024 release illustrates the practical detail behind that shift. Tevet announced an updated scanner for Linux endpoints, extending automated memory forensics beyond the Windows investigations the platform already supported. Different operating systems create different investigative demands. Expanding coverage meant giving the system more ways to examine the actual machine, including evidence that a file sitting on disk might not reveal.

In September 2024, he announced a $33 million investment led by Norwest Venture Partners. His account emphasized developing the platform and expanding its market presence. He described security teams constrained by both resources and specialist skills. The proposed relief was more investigative capacity, delivered through automation. The financing served a product argument that had been years in the making.

“AI is not a silver bullet for everything.”Itai Tevet, Defense in Depth, December 2024

That December, discussing alerts with David Spark and Steve Zalewski, Tevet explained that Intezer combined AI with deterministic technology to reproduce parts of an analyst’s decision process. He also pushed back on the idea that every warning required an elaborate picture of the whole organization. Some cases were narrower: a file classified as ransomware might simply need to be shown harmless. Other cases needed wider context. A useful system had to handle both.

This is a revealing distinction. The experienced practitioner knows that different questions require different amounts of machinery. Sometimes the answer is in the file. Sometimes it lies in the connections around it. Giving every problem the same treatment can become its own expensive habit.

A useful kind of doubt

After RSAC 2025, Tevet wrote about an industry suddenly crowded with agentic AI. His proposed evaluation was refreshingly specific: examine accuracy, the share of alerts passed back to humans and the time taken to investigate. He urged buyers to ask what the agents could actually collect and analyze, including files, logs, email data and memory images.

Those measures create obligations for the seller, too. Accuracy involves identifying threats and correctly clearing benign activity. A system that sends too much work back to people may leave the original staffing problem largely intact. A quick answer still needs evidence. Tevet also called for explainability, auditability and human oversight. A polished demonstration has to become a process someone can inspect.

His later explanation divided security operations into detection, investigation and response. That middle layer was the place where people had traditionally decided whether an alert represented an incident. Seeing the layers separately helps explain Intezer’s evolution. Better detection supplies more warnings; the investigation still has to happen somewhere.

By February 2026, the company was discussing that challenge through a report based on more than 25 million alerts from its customer environments. It said some genuine incidents originated in alerts assigned the lowest severity levels. These were findings from Intezer’s own dataset. For Tevet’s argument, the implication was direct: ranking a warning low does not finish the job of finding out what it means.

What the experienced analyst remembers

In July 2026, Tevet introduced Org Brain. The premise starts with a familiar office problem: experienced people accumulate knowledge that never quite reaches the documentation. They know which recurring behavior is ordinary, where to query for evidence and how previous cases were resolved. When someone leaves, part of the organization’s working memory can leave with them.

The system separates procedural knowledge from organizational facts. One describes how the team investigates; the other describes its users, assets and data. Tevet’s account outlines a loop that draws on historical cases, fetches current context during an investigation and reviews what happened afterward. The ambition is continuity: tomorrow’s investigation should benefit from yesterday’s work.

He acknowledged a corresponding hazard in discussing the release. A learning system can preserve mistakes as readily as lessons. Intezer described checks for contradictions and a human ability to override conclusions. Tevet also distinguished an early estimate of reduced human review from a validated benchmark. That restraint matters when the product’s attraction is its willingness to make decisions without waiting for a person.

In his public writing during 2026, Tevet has also turned the question inward, describing a month spent applying AI to Intezer’s go-to-market organization. His LinkedIn articles move between operating a company and explaining the security stack. The former responder is now testing how these tools change work across his own business.

For analysts, his forecast is a move toward supervising systems, owning escalated cases and applying business judgment. In a February interview, he described people overseeing AI rather than spending the day chasing tickets. It is an ambition with consequences for training as well as software. Someone still has to understand the organization well enough to decide what an acceptable outcome looks like.

There is a certain continuity here. Tevet began with people he trusted, doing investigations under pressure. His company first tried to make unfamiliar code legible, then to make investigative work repeatable, and now to preserve what the team learns. The unread alert remains the unfinished business. His wager is that the people who once had to open every warning can do more valuable work when the evidence reaches them already assembled.