Nir Polak’s credit card details were stolen. The fraud was an irritation; the response to it was interesting. A card company could recognize that a purchase looked out of character. Polak began considering what that kind of attention might do inside a corporate network, where an intruder could arrive wearing an employee’s perfectly legitimate credentials.
A password can establish which account is being used. It cannot, by itself, establish whether the person using it belongs there. For someone preparing to start a cybersecurity company, that gap offered a question worth pursuing. The account might look familiar. What about the behavior?
Years later, Exabeam would announce a funding round valuing the business at $2.4 billion. Polak would move from founding CEO to chairman. The fraud alert belongs near the beginning of that story, but the distance between an observation and a company contains most of the interesting work.
An education in how companies work
Polak was born in Israel and moved to the Bay Area at the age of one. His mother was doing postdoctoral work at Berkeley; his father worked in technology. The family returned to Israel when he was five. His early years therefore included a California preschool and an Israeli childhood, with two rather different introductions to how people approach the world.
After school came military service in an artillery unit, where he became a commander. He later studied computer science and met his wife at college. He has described himself as someone who had not grown up a computer obsessive. Choosing the field was a decision he made along the way, rather than a childhood destiny retrospectively furnished with a keyboard.
His professional education ranged across engineering, products and customers. He held engineering positions at Adjungo Networks and Shopping.com. At Imperva, he set product strategy and launched and managed the worldwide services organization. That combination put him close to both what software promised and what customers needed after buying it. Those are useful neighboring countries for a future founder to visit.
The idea had to survive other people
In June 2014, Polak was already writing publicly about the limits of concentrating on the first moment of a breach. Malware could provide an entry point, but stolen login credentials let an attacker continue moving through a business. Detection needed to account for the activity that followed. A familiar identity could be doing unfamiliar things.
There is an appealing simplicity to that argument. The practical difficulty lies in deciding which departures deserve attention. An organization needs useful investigations, and the people responsible for them have finite time. Adding another stream of unexplained alarms gives an analyst another stream of unexplained alarms.
Exabeam’s founders were Polak, Sylvain Gil and Domingo Mihovilovic. Gil brought market knowledge and a willingness to challenge an idea. Mihovilovic brought experience building security management systems. They consulted prospective customers before writing code. The people who might buy the product were involved while its shape was still negotiable.
That willingness to revise mattered to Polak. He has said he spent two years considering different business ideas before narrowing the work to Exabeam. He describes research as a process that changes the original proposition. A founder who emerges from every customer meeting with exactly the same pitch may have enjoyed the conversation more than the listening.
The work eventually occupied a market called user and entity behavior analytics, mercifully shortened to UEBA. Even the company’s name combined scale with observation: an exabyte of data and a beam illuminating patterns. For a business concerned with finding something significant in a very large pile, it was a reasonably economical introduction.
The analyst still needed a steering wheel
Polak could explain a product limitation without requiring a glossary. When Exabeam introduced Threat Hunter, he compared existing behavior analytics to Netflix recommendations without a search function. The system could offer suggestions; an analyst also needed to ask a specific question. Exabeam’s answer added the ability to search for user sessions matching chosen criteria.
The distinction reveals something about his approach. Automatically spotting unusual behavior was useful. Giving a professional the means to pursue a suspicion was useful too. A security product had to accommodate the person doing the investigation, including the moment that person wanted to take a different route.
By 2018, the company was also making a commercial argument about its broader security information and event management platform, or SIEM. Its flat pricing challenged the practice of charging according to data volume. Polak linked that proposition to advanced analytics and the expansion from analytics into data storage and incident response. The business was growing around more of the analyst’s working day.
The pitch connected capability with the cost of using it. Asking customers to collect enough information for a useful investigation creates an awkward conversation if every additional byte makes the bill less comfortable. Pricing belonged in the product discussion because it helped determine what customers could afford to do with the product.
Trust at a different scale
Exabeam ranked twelfth on the 2018 Inc. 5000. In a 2019 conversation about its growth, Polak described a company approaching 400 employees worldwide. That was a different organization from the founding group arguing over an idea. Communication and hiring now had to carry values across people who had never sat in the original room.
“The biggest thing for me is trust.”
Nir Polak, on hiring and working relationships, 2019
He emphasized trust when discussing the people he hired. The useful colleague could have something to prove, but needed to work hard and speak openly. Culture required attention as the organization changed. A relationship that depended on everyone knowing the founders personally would have a fairly obvious limit on headcount.
Growth also exposed a technical problem. In a later conversation with Jon Sakoda, Polak discussed the debt that can accumulate when sales run ahead of a product’s capacity to satisfy new demands. Winning customers brings requests and expectations. Sometimes, he argued, a company should temporarily slow its investment in sales to give the underlying work time to catch up.
It is a distinctly unglamorous piece of founder advice. More demand usually makes a better announcement than more time spent fixing foundations. Yet the customer who has already bought the software experiences the foundations every day. The next sale and the existing customer eventually meet in the same engineering queue.
The founder becomes part of the question
On June 1, 2021, Exabeam announced $200 million in Series F funding at a $2.4 billion valuation. Michael DeCesare, previously CEO of Forescout and president of McAfee, became CEO and president. Polak moved to chairman and remained on the executive team. The announcement paired fresh capital with a change in who would run the business.
A dated financing milestone for Exabeam.
Polak later described a complication that rarely appears in a founder biography: knowing too much. His familiarity with the company could work against him. The founder remembers how the product, messaging and decisions came into existence. Colleagues bring problems; the founder supplies answers; the company learns where to send the next problem.
He has separately described the result as becoming a bottleneck. The observation gives the CEO handoff a more interesting context than a title change alone. Expertise can make someone indispensable in a way that limits everyone else. Learning to leave a problem with another capable person becomes part of building the organization.
At SignalFire, which he joined as a Board Partner in 2022, that experience became useful to other founders. The firm credited Polak among the advisers who supported Dig Security before its acquisition by Palo Alto Networks. He was now helping another team make decisions, carrying experience from his own company without occupying its founder’s chair.
Back to the unfinished beginning
In 2024, Polak publicly introduced WhiteRabbit with Caleb Sima. The venture studio’s stated work included validating security problems, assembling teams, reaching customers and committing an initial check of more than $5 million. Polak was returning to the stage when the company itself remains an open question.
WhiteRabbit’s current presentation keeps that emphasis on practical access: candid feedback from security leaders, introductions to buyers, and help with positioning, pricing and sales. Its team also includes Tyson Kopczynski, a former CISO. The proposition draws on people who have operated the systems or built the companies they now discuss with founders.
Polak’s advice about choosing partners is similarly concrete. Complementary skills need shared values underneath them. He urges founders to discuss conflict and decision making while they still like one another. His sixth-grade April Fools’ prank involved a forged letter dismissing a teacher and, he recalled, a police investigation. By adulthood, his discussions of founder agreements gave signatures rather more careful treatment.
Asked for the best advice he had received, he offered a less elaborate safeguard: “Don’t believe your own bullshit.” It suits a career that began by questioning what a legitimate account could conceal. An appealing explanation deserves another look. So does an encouraging customer response. So, eventually, does the founder’s own job.