A server appears on a screen. The customer says it cannot belong to them. The software must be wrong. Rob Gurzeev has heard this before. In one telling, a CIO disputed CyCognito's result because the machine belonged to an entirely different company. Gurzeev's team followed the thread. The server belonged to a joint venture the customer's company had created. The machine was theirs, just not in the tidy version of the company that lived in anyone's head.
It is the sort of scene that makes a security thesis feel less like software and more like office comedy. The internet remembers the corporate family tree better than the corporation does. Acquisitions arrive. Subsidiaries multiply. A marketing team tries a cloud service. A developer leaves an experiment running. A partner connects something useful, then everyone proceeds to the next meeting. The asset remains, bright as a porch lamp at midnight.
Gurzeev, the CEO and co-founder of CyCognito, built his company around those leftovers. His premise is simple enough to explain without a threat diagram: do not begin with the inventory a company hands you. Begin with its name. Look from the outside, as an attacker would, discover what is connected to it, test what can be exploited and rank the paths that deserve attention first.
“I was taught you never actually know what reality is. You have to go find it. Validate it.”
Curiosity before credentials
The habit began early. Gurzeev has traced his interest in technology to age 13 or 14, when IRC channels gathered people who were curious about hacking, cryptography, messenger apps and file sharing. Some experiments were pranks: an executable sent to a friend might trigger a silly action. He also played basketball, but the technical puzzle kept its grip. The useful question arrived quickly. What happens when the same tricks land in the hands of somebody with harmful intent?
Growing up in Zikhron Ya'akov, Israel, he studied computers in high school and moved into a cyber role in the Israeli Intelligence Corps. He spent five years there. By 20, he was an officer leading an engineering domain; he later became CTO of the Product Department in Unit 8200. The details of the work remain mostly out of public view, but Gurzeev has described automating intelligence collection and searching for paths of least resistance into difficult targets.
He has also described the emotional geometry of the job with unusual clarity. The work was fascinating, like solving a puzzle, and stressful because failure could have consequences beyond a bug report. That combination matters. Reconnaissance was never a parlor trick. It was a disciplined way of discovering what a target wished to keep obscure, followed by the responsibility to decide what mattered.
The balcony shift
After intelligence service, Gurzeev joined C4 Security in 2014. He founded and led its offensive-security group and headed R&D. When Elbit Systems acquired C4 in 2016, that group continued inside the larger company. The experience gave him a view of offense in the private sector, but another problem had become hard to ignore. Commercial organizations struggled to build a complete picture of themselves.
He reconnected with Dima Potekhin, an engineer with experience in internet-scale systems. They took a personal loan and started working from the balcony of Potekhin's apartment in Tel Aviv. Gurzeev remembers nights that ran until sunrise, alongside the first customer and the first funding check. The balcony is a good founding image: improvised, exposed to the elements and occupied by two people trying to map enormous organizations from almost nothing.
Their leap was to turn reconnaissance into a repeatable defensive product. A mobile phone could be connected to a criminal trying to hide; perhaps a laptop, domain or web application could be connected to a corporation overwhelmed by its own sprawl. CyCognito would automate the search, model relationships among assets, test exposures and point security teams toward the handful of routes with real consequence.
The outside-in loop
A market for inconvenient facts
CyCognito raised a $5 million seed round in 2018, an $18 million Series A in 2019 and a $30 million Series B in 2020. Gurzeev was named to Forbes' 2020 30 Under 30 list in Enterprise Technology. In December 2021, the company announced a $100 million Series C at a reported $800 million valuation. The reported total raised at that point was $153 million.
Funding is the easy line to print. The more revealing achievement is that a once-specialized intelligence habit became a recognizable enterprise-security category. The attack surface is the sum of internet-facing assets and paths that might offer entry into an organization. Gurzeev has said that, across CyCognito customers, a typical surface changes by one to three percent each day. Even a correct map begins aging before the ink dries.
Scale gave the idea urgency. In 2020, CyCognito described scanning billions of internet-connected servers and devices, then calculating which ones related to a customer and what could be exploited. The important word was not merely billions. It was related. A naked IP address says little about ownership, business purpose or consequence. Gurzeev and Potekhin's product had to connect technical evidence to corporate context, including subsidiaries and third parties, before a security team could decide what deserved its Tuesday afternoon.
This is why his favorite metaphors tend to involve houses and neglected doors. Protecting half a house would be a peculiar insurance policy. Testing only the assets a team already knows creates the digital equivalent. Attackers need one workable route; defenders must cope with the whole changing estate. The asymmetry is rude but clarifying.
“The typical attack surface changes by one to three percent every day.”
Gurzeev's public manner follows the product logic. He is fond of plain questions that make comfortable metrics wobble. Are you testing everything that matters? How often? When a critical issue appears, does remediation take hours, days or weeks? A dashboard can contain ten thousand findings and still avoid the one number that describes operational speed.
His own list of milestones has a similarly practical flavor. CyCognito's first paying customer sits beside its funding rounds in his memory. So do the people hired along the way. The company grew across Tel Aviv and Palo Alto, joining engineering depth in Israel with proximity to American enterprise customers. Gurzeev moved to the United States to support that growth. The geography changed; the original question did not. Could a system begin with almost no trusted information and still show a large organization how an attacker would approach it?
IRC curiosity turns computer pranks and cryptography into a question about malicious intent.
Five years of reconnaissance, engineering leadership and product technology in Unit 8200.
Offensive-security and R&D leadership at C4 Security, followed by its acquisition by Elbit Systems.
CyCognito begins with Dima Potekhin, a personal loan and long sessions on a Tel Aviv balcony.
The same outside-in thesis expands into continuous AI pentesting.
When everyone can ship
By 2026, Gurzeev's concern had widened. AI tools allow people far beyond engineering to assemble applications and place information online. Creation gets cheaper; organizational memory does not automatically improve. A forgotten asset once required a developer, a server and some effort. Now the distance between an idea and an exposed application can be a lunchtime.
His response is not nostalgia for slower software. He argues for broader coverage, continuous validation and automation capable of operating at the scale of the new surface. In June 2026, CyCognito announced continuous AI pentesting, using AI agents alongside ongoing tests to reason through context and multi-step attack paths. Gurzeev's broader point is pragmatic: depth on a small, known slice cannot compensate for ignorance of everything beside it.
He pairs that technical view with a governance problem. A leader who discovers that most of the estate was never tested must explain an uncomfortable past as well as propose a safer future. Incentives can reward completed projects and familiar key performance indicators more readily than an admission that the denominator was wrong. The attacker's view cuts through the ceremony. It asks what is reachable today, regardless of which team owns the slide deck.
There is optimism beneath the alarms. He has said faster, more intelligent technology can help defenders beat attackers, provided it supplies context and leads to remediation. The aspiration is not a prettier catalogue of danger. It is to shorten the interval between evidence and repair, ideally until critical issues are handled in an hour or two rather than waiting through weeks of process.
The useful theft
What can someone outside cybersecurity borrow from Gurzeev? Start with the possibility that the official map is incomplete. Customers know their pain, but they may not know the object causing it. Organizations remember the systems with owners, budgets and recurring meetings. Reality includes the joint venture's server, the abandoned test and the odd connection everyone assumes belongs to somebody else.
Then change vantage point. Gurzeev's career has crossed intelligence, offense and defense, yet the recurring move is remarkably stable: stand where the other side stands. Remove the internal labels. Follow relationships. Find the least defended route. Finally, make the result actionable. Discovery without prioritization merely gives anxiety better typography.
The balcony nights, the disputed server and the modern AI-built app all point toward the same idea. Complexity does not announce itself when it escapes the spreadsheet. It simply remains online. Gurzeev has spent his career teaching systems to notice. The joke, if there is one, belongs to the forgotten machine. It knew where it was all along.