Ofer Israeli and the art of getting lost

At sixteen, Ofer Israeli and a friend advertised themselves as a coding company. They chose a name that somebody else already owned. A cease-and-desist arrived by fax. It was an early demonstration that a promising technical project can encounter a problem outside the code. Years later, Israeli would build a business around another kind of misleading information, this time supplied deliberately.

That business was Illusive. Its proposition had an appealing wrinkle: a hacker who has entered a network still needs to work out where to go. Give the intruder convincing false clues, and the search itself can become a way to detect them. The trespasser brings the curiosity. The defender supplies the directions.

It is an idea with a certain literary satisfaction. Someone arrives expecting to uncover secrets and discovers that the secrets have been arranged for their benefit. Yet Israeli’s career is more interesting than the trick alone. It follows an engineer learning how to turn a technical insight into something an organization will buy, deploy and entrust with its operations.

A physicist’s interest in the next move

Israeli studied computer science and physics at Ben-Gurion University of the Negev. He worked in its Atom Chip Lab on theoretical quantum mechanics, then managed development teams around the world at Check Point Software Technologies. The combination of research and engineering management gave him experience with both abstract questions and the practical difficulty of getting software built by people in different places.

The career details deserve to remain specific. Physics was part of his education and early work. Check Point was where he managed development. Neither fact needs a retrospective prophecy attached to it. A founder’s earlier jobs do not have to contain a miniature version of the eventual company to be useful preparation.

Illusive was founded in 2014 with Team8. At its public launch, Israeli was the founder and vice president of research and development. Shlomo Touboul was CEO. Later, Israeli held the CEO role himself. The early division of responsibilities matters: this was a company whose founder initially occupied the engineering seat.

Team8 also brought a particular way of developing companies. Its work involved choosing a substantial security problem, researching it, testing possible approaches and checking whether a business could be built around the result. For Illusive, that problem was the targeted attacker prepared to invest time and resources in a particular victim.

Such an attacker has a purpose beyond merely getting inside. They want a valuable destination, useful access or an opportunity to cause damage. Israeli’s description of that adversary made the next stage of the journey the subject of the company. The question became what the intruder needed after the first successful intrusion.

Give the intruder bad directions

Picture an unfamiliar office building. Getting through an entrance does not tell a visitor which room contains the documents they want. They still need signs, names, keys and a plausible route. Corporate networks have their own equivalents: credentials, connections and information about machines elsewhere in the organization.

Illusive’s early approach placed deceptive information across the real environment. An attacker following it could reveal their presence. The system was designed to collect forensic information when the bait was used, helping defenders understand what had happened and where. The company called its approach Deceptions Everywhere.

The distinction was practical. A false clue distributed across working systems could meet an intruder during exploration, instead of waiting for them to visit one conspicuous decoy destination. The challenge was to make the information believable enough to influence the next move. An obviously fraudulent invitation is a rather poor trap.

That gives the idea its unusual symmetry. The attacker wants trustworthy information about a system they do not own. The defender owns the system and can influence what information the attacker encounters. A resource that normally helps navigation becomes an instrument of confusion.

There is an operational ambition underneath the stagecraft, too. Security teams need something they can investigate. A meaningful interaction with a deliberately false resource can provide a different kind of signal from a general suspicion about someone’s behavior. The aim is to make an intruder’s decision useful to the people responsible for stopping them.

This also explains why Israeli’s public discussion of security has returned to the attacker’s perspective. Building defenses requires an understanding of the steps the other side must take. The product is concerned with those dependencies: information, access and movement. Even a determined visitor can have an inconvenient relationship with a misleading sign.

The buyer gets a vote

Customers supplied their own reality check. On an early American trip, Israeli recalled one bank responding enthusiastically, followed two hours later by another rejecting the proposed deployment. The trip ultimately brought eleven customers. It also produced a succinct verdict on the afternoon’s reversal: “It was very humbling.”

A demo can demonstrate an idea. A buyer has to consider the environment in which that idea will live. An unfamiliar defensive approach therefore has two jobs: function as intended and become understandable to the people who must approve it. The second job can prove awkwardly resistant to an engineering schedule.

Israeli eventually moved to New York to be closer to customers, including banks and insurers. He explained that proximity shaped his attention: near developers, he was drawn toward development; near the market, toward buyers. His account of that move makes location sound like a management decision about what would occupy his day.

The pattern is recognizable in a technical founder’s working life. The first task is to create something that deserves to exist. Another is to discover how somebody else evaluates it. There is no guarantee the two sides will use the same vocabulary, even when they agree that the problem matters.

“So much more innovation needs to happen.”

Ofer Israeli, speaking in New York in 2021

At a 2021 New York interview, he described Illusive as operating in defensive cybersecurity and discussed identity risk management. His impatience was directed at the pace of attack and the need for defenders to keep developing their own approaches. The conversation was already broader than the early deception pitch.

The accounts nobody meant to leave behind

The expansion makes sense when viewed through access. An intruder benefits from a real credential or an excessive privilege just as surely as they can be diverted by a false one. A company can therefore work on both sides of that equation: reduce the useful routes and detect attempts to follow the deceptive routes.

Israeli’s later writing on risky identities divides the problem into unmanaged, misconfigured and exposed identities. The categories sound administrative. Their consequences are concrete. A local administrator account can be forgotten after a support task. A group arrangement can confer more privilege than intended. Credentials can remain cached on a device.

These are uncomfortable failures because they can coexist with sensible intentions. The organization may have a policy, an access tool and a reasonable explanation for why an account was created. The question is what remains possible in the environment today. An old permission does not resign when its original purpose disappears.

At the time of the acquisition agreement, Illusive’s product descriptions separated two responsibilities. Spotlight discovered and helped remediate identity vulnerabilities. Shadow used deception to detect threats involving privilege escalation and movement through the network. The pairing joined routine risk reduction with the response to an active intruder.

For the founder’s story, that is a useful development. An idea initially associated with misleading attackers grew into work that also examined the real opportunities available to them. There is less theatrical pleasure in finding a forgotten account than in springing a trap. The account may still be the more urgent task.

A different name on the business card

Proofpoint announced its agreement to acquire Illusive on December 12, 2022, and confirmed the deal’s completion on December 28. The combination added identity risk discovery, remediation and defenses against attacks already inside an environment to Proofpoint’s broader security work.

Israeli’s announcement to the Illusive community emphasized pride in the products and the team, then thanked employees past and present, customers, investors and suppliers. It was a reminder of the ordinary collection of relationships inside the formal language of an acquisition. A company has many contributors who never acquire a founder’s public visibility.

His subsequent title at Proofpoint was group vice president and general manager of Identity Threat Defense. Public speaker biographies describe responsibilities for strategy and technology development. In a March 2023 discussion with Yonesy Núñez and Tim Choi, he continued addressing the problem of compromised identities and the difficulty of finding vulnerable access.

The title changed. The practical questions carried on: which account is exposed, what can it reach, and how will a defender know when somebody starts using it? Those questions give continuity to a career that has moved through research, development management, company building and work inside an acquirer.

Israeli’s story leaves us with a pleasingly awkward thought about information. A business needs a clear picture of its customers and its own permissions. An intruder would like an equally clear picture of the business. Much of the work is deciding who should be able to see what, and making the answer hold up in practice. Somewhere in that network, a beautifully plausible wrong turn is waiting.