Shay Sandler

The Vega pitch, delivered in variations across three financing rounds and reported by half the Israeli tech press, is short enough to fit on a receipt: your security data is scattered across cloud object stores, data lakes, identity systems, and endpoint agents; the industry's response for twenty years has been to charge you to copy all of it into one central SIEM; and the industry's response has been wrong. Vega, run by 34-year-old-ish co-founder and CEO Shay Sandler, proposes to leave the data where it is and send the query to it. This is the sort of idea that sounds obvious the moment you hear it and slightly maddening once you consider how many billions of dollars have been spent doing the opposite.

Sandler and his co-founder Eli Rozen started Vega in early 2024. This is a fact you have to be told twice because of what has happened since. Vega raised twenty million dollars in seed funding, then forty million in a Series A, then, in December 2025, a hundred and twenty million dollars in a Series B led by Accel. The reported valuation is somewhere between seven hundred million and eight hundred million dollars, depending on which Calcalist story you read and which week you read it. The company has more than a hundred employees, offices on two continents, and a customer list that already includes Fortune 500 banks and a global healthcare provider. It exited stealth by announcing the customers before announcing the product.

Sandler's biography follows the well-worn Israeli cyber-founder arc, but with a specific and useful footnote. He served as an officer in Unit 8200, the signals-intelligence corps that has functionally been Israel's most prolific startup accelerator for two decades. He met Rozen there. After service he joined the founding team of Granulate, a performance-optimization startup that Intel acquired in 2022 for around six hundred and fifty million dollars. In the ordinary course of things this is where a founder's story ends and their venture-capital career begins. In Sandler's case Intel then shut Granulate down, as part of a broader consolidation, and Sandler and Rozen took the shutdown notice as a starting gun.

What Vega is technically, if you squint, is a federated query engine wearing the coat of a security product. The company's own materials cite a set of primitives - Bloom filters, cuckoo filters, HyperLogLog++, finite state transducers, inverted indices, predicate pushdown - that are less the vocabulary of a marketing team and more the reading list of a database class. Sandler has repeatedly framed the problem in operational rather than technical terms: analysts spend most of their day looking for data before they can look for threats. Vega's job is to make that first part disappear. When a customer runs a detection, the platform routes the query out to wherever the data physically lives - a Snowflake warehouse, an S3 bucket, an existing SIEM, a security data lake - and brings back an answer without moving the underlying logs. The economic implication is severe. Traditional SIEM pricing scales with ingest. Vega's does not.

It is worth pausing on how quiet the company was for how long. Vega spent most of its first eighteen months in stealth, which in the current cybersecurity market is unusual. The genre norm is to announce a seed round with a Techmeme-friendly headline and then spend twelve months building an MVP in public. Sandler chose the opposite. When Vega finally did surface, in September 2025, it did so with sixty-five million dollars already banked, a four-hundred-million-dollar valuation, and Fortune 500 logos in the deck. Three months later it added another hundred and twenty million from Accel. The reveal, in other words, was the receipts. If you want to know what Sandler's operating theory looks like, that sequence is it: build the customer base first, do the interviews later.

The founder himself is not, based on his public footprint, given to overexposure. His LinkedIn presence is regular but restrained - product notes, hiring calls, the occasional "we're building" post, and, in one telling instance, a post tagged #BillsMafia, which suggests that the CEO of a very stealthy Israeli security company is quietly a Buffalo Bills fan. Sandler has appeared on a podcast episode titled, roughly, "Most Founders Quit at Mile 18," a framing that says something about how he sees his own job. Vega is a marathon problem to him, and the mile 18 wall is real, and the way through it is not enthusiasm but organization.

There is a version of this story in which Vega is the next Wiz - a comparison Sandler has invited, at least implicitly, by telling Calcalist that he wants Vega to reach the scale of Cyera and Wiz within two years. Wiz went from founding to a public multi-billion-dollar valuation in roughly the same window Vega is currently in. The comparison is flattering but also load-bearing: it explains why Accel, Redpoint, CRV, and Cyberstarts have all written checks, and why the valuation trajectory is what it is, and why nobody in Israeli cybersecurity is surprised by any of this. The comparison is also useful for Sandler because it presets an expectation - the ceiling is not another SIEM vendor, the ceiling is Wiz.

There is a version in which it is not. The federated approach that Vega has bet the company on is elegant in a slide deck and complicated in a production environment. Customers have to trust that a distributed query executed across their storage, on their timing, will return complete and correct results. Analysts have to unlearn a decade of habit that says the data lives in one place. Regulators, in some industries, still ask questions that assume the SIEM model. None of this is fatal, but all of it is friction. It is why the "federated Security Analytics Mesh" pitch, in Sandler's telling, is less about technology and more about permission - permission for security teams to stop copying their data around.

What is genuinely interesting about Sandler, if you spend enough time reading his own words rather than the trade press about him, is that he does not sound like a founder in the middle of a mania. He sounds like an operator. He talks about analyst workflows more than he talks about total addressable market. He describes Vega as a platform that "investigates" rather than one that alerts, which is a subtle but real distinction in a category that has been in an arms race of alerts for a decade. The product roadmap, insofar as it is public, is preoccupied with reducing the number of tabs an incident responder has open at any given moment. This is not glamorous work. It is the work of a person who thinks the industry has confused sophistication with usefulness.

Whether Vega ends up at Wiz scale or something quieter and more specialized, the trajectory as of the end of 2025 is unusual enough to be worth watching. A hundred and eighty-five million dollars in twenty-two months is not a normal fundraising cadence. Landing a global bank as a customer before you have a marketing site is not a normal go-to-market. And building a company whose core value proposition is that customers should stop paying incumbents to move their data - in a category where those incumbents are entrenched and cash-rich - is not a normal wedge. Sandler is running an uncommon race at an uncommon pace, and the current mile marker suggests he has some idea what he is doing.