Two companies. One building. In Or Eshed’s account of a browser-malware investigation, the revealing tool was Google Maps. One business appeared to sell advertising traffic. Another looked malicious. He plotted their addresses and found them in the same building in China. The respectable storefront and the operation compromising browsers suddenly looked rather less like strangers.
It is a satisfying detective story because its decisive moment is so wonderfully unglamorous. Cybersecurity tends to arrive in public dressed as a wall of code. Here, a street address helped connect the dots. Eshed told the story while discussing the browser-hijacking operation he helped expose, describing a business with a clean public face and a darker source of traffic.
Years later, his company would make a similarly practical argument. If work happens inside a browser, put protection there. Let employees keep the software they know. In July 2026, Akamai completed its acquisition of LayerX Security, the company Eshed co-founded with David Vaisbrud. The announced deal value was approximately $205 million. A browser extension had become a considerable business.
A career on both sides of the browser
Eshed came to company building through intelligence and research. His background includes service in Israeli military intelligence and work on offensive security. He held cyberthreat-intelligence roles at Check Point, Otorio and ABN AMRO Bank, and developed machine-learning systems. He also holds an MSc in applied economics. This is a career that crosses the people building security products, the people testing defenses and the institutions trying to live with them.
Those are useful changes of perspective. A researcher can show that a defense has a hole. A bank has to decide how to close it while the bank remains open. A founder has to persuade someone to pay for the repair. Eshed’s later arguments about usability make more sense against that background: he had encountered web security as an operational problem, with users attached.
In 2017, Eshed helped expose a large browser-hijacking campaign. His research work included Fireball, the malware Check Point described that June. The operation manipulated browsers and redirected their search activity. Advertising revenue was one part of a broader security concern: compromised browsers could also be used to execute code and download further malware. The underlying lesson was uncomfortable: something that looked like advertising could sit beside capabilities with far more serious consequences.
Follow the traffic and the incentives become visible. A browser supplies access to searches, accounts and attention. The investigator’s task is to work out who benefits when those things take an unexpected turn. Eshed’s Google Maps anecdote is memorable because it gives that abstract economy a physical address. The web may feel placeless; the people making money from it still have offices.
The decision to keep the familiar icon
Eshed and Vaisbrud knew each other from military service. When they began considering a company, the choice included building a browser or protecting existing ones. Vaisbrud investigated both approaches and argued for the latter. Eshed later described how customer conversations sharpened the idea, particularly with larger organizations that wanted to give employees more freedom while retaining security controls.
By October 2022, LayerX had emerged from stealth with $7.5 million in seed funding. Other companies were already selling enterprise browsers. Eshed had to explain why his team was taking a different route. The distinction was small enough to sound like a product detail and large enough to determine what customers would have to change.
“Regular browsers are great. They stay compatible with the web. LayerX stays compatible with the browsers.”Or Eshed, 2022
There is a pleasing lack of conquest in that position. The familiar browser already does an enormous amount of work. LayerX would add controls through an extension rather than ask the user to begin again somewhere else. For a security buyer, that is an argument about deployment. For the employee, it is an argument about getting through Tuesday.
Eshed explained the problem using a car analogy. The manufacturer has responsibilities for the vehicle; the driver still has responsibilities for its use. Likewise, a browser can be well engineered while the activity passing through it exposes company information. An employee can upload a document to the wrong destination without the browser malfunctioning at all. The application may behave perfectly while the decision deserves intervention.
The product’s name expressed the intention: an extra layer of protection. In his early explanation of the company, Eshed kept returning to a practical complaint about security vendors that require organizations to adapt to the product. He wanted the product to fit the organization. That promise creates its own demanding test. An extension has to earn its place without making every routine action feel like a border crossing.
Competitors had already knocked on the door
Entering a crowded category can be an advantage if somebody else has explained why it exists. In a 2024 discussion with Glilot Capital Partners co-founder Kobi Samboursky, Eshed credited competitors with creating awareness that helped LayerX. The remark is refreshingly economical. A rival can spend money teaching the market, then leave behind a customer who wants the problem solved another way.
That does not remove the need to sell. Eshed also described starting with a limited customer project and expanding after it worked. His account of security buyers was blunt: they are difficult to reach and easily irritated by strangers explaining their problems to them. A working installation has a conversational advantage over an unsolicited pitch. It has already done something useful.
The company’s finances grew alongside that proposition. In May 2024, LayerX announced a $26 million Series A, led by Glilot’s early-growth fund with Dell Technologies Capital participating. An $11 million extension led by Jump Capital followed in April 2025, bringing reported total funding to $45 million. These are company financing figures, useful markers of the business taking shape around Eshed’s technical argument.
Then the text box acquired an AI assistant
The rise of generative AI gave Eshed another reason to look closely at ordinary browser actions. A prompt looks harmless enough on screen. Its contents may have come from an internal document, a customer record or proprietary code. A policy about which applications employees may access only answers part of the question. What they give those applications matters too.
In an August 2025 conversation, Eshed argued for enabling browser-based AI use while managing the risk. He recalled a colleague describing how enthusiasm for blocking ChatGPT had declined among security leaders. The anecdote expressed a practical constraint: a tool that people find useful becomes difficult to exclude from their working lives. Security teams still need a way to govern its use.
His explanations often bring a large technical subject back to a small action. A login. An upload. A piece of text pasted into a field. Those actions are familiar even when the destination changes. His browser argument depends on that continuity: new applications arrive quickly, while the point where a person shares information remains observable.
By 2026, he was also discussing agents and the permissions available to extensions. In his conversation with Brave’s Luke Mulks, he explored the awkward bargain behind tools that help users write or act online. Useful access creates responsibility. The same ability to interact with a page that makes an assistant convenient also requires scrutiny. Convenience comes with permissions, and permissions deserve more attention than the installation button generally receives.
In June, Eshed discussed AI adoption and browser security with Alan Shimel, including differences between direct use of an AI tool and AI embedded into other workflows. The distinction expands the question he has been asking for years. Where does work actually happen? A company cannot answer that just by counting the applications it bought. Some of the consequential interactions take place within tools employees already had open.
A larger address for the same argument
Akamai announced its agreement to acquire LayerX on May 14, 2026. The plan placed Eshed, Vaisbrud and their colleagues inside Akamai’s Zero Trust organization. For the buyer, browser and AI usage controls would extend a portfolio already covering areas such as network access and segmentation. For the founders, the transaction offered a much larger distribution system for their work.
The acquisition closed on July 2. Akamai described the addition as a way to protect existing browsers and gain visibility into interactions with web content, prompts, uploads and software services. The language followed the same path Eshed had laid out at the company’s launch: observe work where it happens and add controls there. The corporate setting had changed; the location of the problem remained familiar.
Announced agreement value
Agreement announced02 JULY 2026
Acquisition completed
By August, Akamai identified Eshed as vice president of enterprise security product and engineering. He was speaking alongside its enterprise AI usage research, warning about sensitive information dispersed across prompts, personal accounts and autonomous agents. His responsibilities had acquired a new title, while his subject had acquired more ways to move data.
Eshed’s public account of the deal also included a smaller ambition, expressed with unusual directness for an acquisition announcement: “As a builder, the best thing in the world is seeing your tech everywhere.” That is a useful way to understand the move. A company sale is a transaction. Getting a tool into more working lives is a continuing assignment.
The early investigation and the later product share a habit of attention. In one, an address helped explain the relationship between two businesses. In the other, an upload or prompt helps explain the relationship between a worker and an application. Eshed keeps returning to the places where an abstract system becomes an observable act. There is plenty to investigate in a browser window. Most of us have several open already.