Omri Lavie and the problem of too many locks

A company can buy another lock. Buying coordination is harder. By the time Omri Lavie unveiled Orchestra in November 2017, he was arguing that corporate cybersecurity had acquired an awkward habit: organizations kept buying specialized defenses, then paying people to make the defenses cooperate. The instruments were expensive. The rehearsal was interminable. His proposed business even came with a musical name.

For Lavie, this was a particular sort of second act. He had co-founded NSO Group, whose Pegasus surveillance software became the subject of international scrutiny. Orchestra would sell corporate defense. The connection makes his career interesting, and uncomfortable: experience building an offensive business sits beside a commercial argument for making organizations harder to attack. Both belong in the picture.

His public career offers more than a neat conversion story. There are repeated partnerships, investments, acquisitions and arguments about how technology gets used. Follow those threads and a recognizable business question emerges. How much of a product’s value lies in the thing itself, and how much lies in the system around it?

Before the conductor, the telephone

Lavie’s entrepreneurial record reaches back into media and telecommunications. He co-founded MediAnd in 2006 and CommuniTake in 2007. His listed roles included chief executive at the former and director at the latter. These were businesses concerned with connecting people, devices and commercial opportunities, before his name became associated with a surveillance company.

NSO was founded in 2010. Its initials came from its founders’ first names: Niv Carmi, Shalev Hulio and Omri Lavie. For a business that would attract so much attention for what it could conceal, the company name was an unusually straightforward piece of labeling.

NSO sold mobile surveillance technology to governments and law enforcement agencies. Pegasus could provide access to information on a phone. The customers’ stated missions included investigating crime and terrorism. The controversy concerned the people placed under surveillance, including journalists and activists, and the responsibility of the company supplying the capability.

Lavie also co-founded Kaymera in 2013, a business focused on protecting mobile phones. He held a director role there until 2019. Offense and defense were overlapping interests in his career, rather than two consecutive chapters with a clean page between them. That overlap matters when reading the later Orchestra story.

The reputation that came along

By December 2017, Lavie was publicly defending NSO’s sales practices. In a Hebrew-language podcast interview, he described strict legal review before taking on customers and said the company sold to government bodies considered legitimate internationally. Those were his explanations of its safeguards. They did not settle the dispute over what customers actually did.

Investigations had already connected NSO technology to surveillance of an activist in the United Arab Emirates and to targeting journalists, activists and political opponents in Mexico. The gap between an approved customer and an acceptable use had become central to the argument. A purchase order could identify the buyer. It could hardly answer every question about the target.

When Lavie was raising money for Orchestra in 2020, he was asked whether association with NSO complicated the task. “So far it’s helped me rather than hurt me,” he said. It was a blunt answer to a question other founders might have attempted to wrap in several layers of corporate tissue paper.

The comment describes his experience with potential investors at that moment. It also captures a tension that follows the profile: the same background could function as commercial credibility and attract public criticism. Neither observation cancels the other.

A business built between the tools

Orchestra was announced in late 2017 with plans to begin operating in early 2018. Lavie would be CEO, Isaac Zack COO and Jacob Ukelson CTO. Zack and Lavie already had a working relationship through Founders Group, the investment firm they established in 2013. The new company extended an existing partnership into an operating business.

Their initial argument was practical. An organization might need dozens of security products, each handling a particular task. Managing them required resources, and the products did not necessarily work well together. Orchestra proposed bringing defensive tools into a coordinated system. The name explained the sales pitch before anyone had opened the slide deck.

Zack’s accompanying concern was economic: narrowly focused startups could spend substantial funding on marketing rather than product development. Bringing capabilities together offered a possible answer for suppliers as well as customers. The ambition was to change how security was assembled and bought, alongside how it was managed.

In April 2020, Orchestra raised $7.5 million in a round led by Prytek, with Target Global participating. It had 35 employees at the time. Lavie described existing customers and revenues of several million dollars, while saying the new money would support acquisitions. These are figures from that financing period, rather than a measure of the business today.

Acquisition as architecture

Buying companies became a visible part of Orchestra’s development. Its acquisitions included CyIoT and Cronus, followed by Netformx in December 2021. The Netformx deal was its third acquisition; financial terms were not disclosed. This was a company being assembled partly by bringing established capabilities into the same business.

Netformx supplied network discovery and design technology for IT providers. It also brought relationships with service providers and systems integrators. For Orchestra, the attraction included a more detailed understanding of network infrastructure and connectivity, plus access to a broader customer base, particularly in North America.

That choice gives the orchestration metaphor some substance. Before deciding which route an attacker might take, a defensive system needs to understand the network it is supposed to protect. An inventory and a diagram are less glamorous than a dramatic threat alert. They are also rather useful when someone asks which door the alert refers to.

Lavie said the combination would help accelerate risk technology development and expansion to a global audience. This was his ambition for the deal. The acquisition established the combination; its announcement alone could not establish how well every part would perform together.

How an attacker reads a room

In a March 2022 essay, Lavie laid out a defensive argument built around the limits of protection. His point was that an attacker could exploit different kinds of weakness to advance through a system. A missed update, poor configuration or weak password could each become part of a route.

He described attackers thinking in graphs: connected possibilities, rather than an isolated list of flaws. Defense, in that account, requires understanding plausible attack scenarios and deciding which changes will reduce risk most effectively. A long checklist can record a great deal of activity without revealing where an intruder might travel next.

Read as a business proposition, the essay asks customers to buy a process of continuing assessment and improvement. Read as a view of his profession, it rejects a finish line. There will always be another change to evaluate. The challenge is making that permanent work manageable enough for an organization to keep doing it.

“There is no such thing as 100% cyber security.”

Omri Lavie / March 2022

The colleagues behind the argument

Ukelson supplied a complementary technical explanation in 2022. Combining many limited protections, he argued, was difficult without an overall view of the organization. His account of joining Lavie and Zack was grounded in examining that problem technically. Orchestra’s founding trio paired business development and investing experience with a CTO’s product and engineering background.

Lavie’s own company biography emphasizes ecommerce, international sales, business development and opening new markets. It is a useful description of his place in the partnership. His record includes building companies and investing in them; the work involves finding people and capabilities that might fit together, as well as finding customers willing to pay.

There is a quieter example of that public role in his appearance at TAMIDcon, where students heard him discuss the challenges of starting multiple companies. The subject was entrepreneurship in practice. It places him in another familiar founder setting: explaining the difficult parts to people preparing to encounter them themselves.

A forecast with a pause in it

Asked in June 2022 to imagine cybersecurity 30 years ahead, Lavie first questioned how confidently anyone could see even five years forward. He then anticipated a larger role for artificial intelligence as systems became more complex and the volume of information increased. Humans, in his forecast, would set directions while AI handled more decisions.

The hesitation is more revealing than a confident date on a roadmap. He was willing to predict increasing automation while admitting the limits of the exercise. His argument for AI rested on a specific workload problem: people would struggle to assess all the relevant information at once. It was a forecast about the division of labor.

Orchestra’s current public offering emphasizes automated risk assessment for smaller organizations, alongside products including Harmony Purple and Harmony IoT. The stated aim is to help teams identify meaningful exposures and decide what to address. In that setting, the old coordination problem acquires another constraint: limited budgets and limited specialist staff.

By January 2026, Lavie had left NSO following its ownership transition. That closes a corporate chapter without removing it from his biography. The question running through his career remains practical and consequential: who uses the technology, how it fits into a larger system, and what responsibility follows once it is put to work.