Profile / Founder + CTO
The kid who broke video games. The soldier who broke into networks. The founder who's building AI to break the attacker's speed advantage - for good.
He reverse-engineered a game at age 12 to give himself infinite coins. At 18, Israel's elite intelligence corps recruited him before he'd written a single line of academic code. At 40-something, he closed the largest Series A in cybersecurity history. The thread connecting all three moments is the same: he keeps finding the seam where the system bends.
The Origin
Around the age of twelve, Yonatan Striem-Amit sat down with a video game he wanted to play more of, but couldn't afford more coins to play it with. So he did what turned out to be a defining thing: he opened the binary, found the routine that decremented his balance, and inverted it. From that point on, buying items made him richer.
It wasn't that he was clever - most kids with enough obsession and time figure out a version of this trick. What was different was that he kept going. He kept pulling threads in systems, kept looking for the model behind the behavior, kept asking what happens when I press here? He taught himself systems programming before systems programming was a career path most teenagers knew about.
When the Israel Defense Forces came looking for recruits for Unit 8200 - the signals intelligence division that functions roughly as Israel's NSA, staffed not by credential-holders but by teenagers who had already proven they could navigate complexity - Yonatan was 18, and he had never taken a formal computer science class. He had, however, spent years taking software apart.
They took him anyway. The IDF usually did, for kids like that.
Unit 8200 is where careers in Israeli cybersecurity are forged. The alumni list reads like a who's-who of the global security industry - founders of Check Point, Palo Alto Networks, SentinelOne, and dozens of smaller companies that quietly handle the world's most sensitive networks. Yonatan spent four years there learning how offense actually works - not from textbooks, but from doing it, and watching it be done to others.
He came out the other side understanding something that most defenders never quite grasp: the attacker is always ahead, not because they're smarter, but because they only have to find one gap. Defenders have to cover everything. The asymmetry isn't a technology problem. It's a time-and-attention problem.
That insight would take another twenty years to fully pay off. But it was always the thing he was building toward.
Attackers share exploits and test new methods within their communities almost overnight. Traditional security teams still require years to adapt. That gap is the whole problem.
- Yonatan Striem-Amit
Act Two
In 2012, Yonatan Striem-Amit sat down with Lior Div and Yossi Naar - two other Unit 8200 veterans - and started Cybereason out of Boston. The timing was either very good or very bad, depending on how you looked at it. The security industry was dominated by perimeter defenses: firewalls, antivirus, the idea that you kept the bad guys out. The problem was the bad guys had already figured out that getting in was easy. What they hadn't figured out yet was what to do after they got in.
That's the space Cybereason occupied. Endpoint detection and response - EDR - as a category didn't really have a name yet when they started building it. The idea was: assume the attacker is already inside. Now what? You need to watch behavior, not just signatures. You need to understand the story a chain of events is telling, not just flag individual events. You need to hunt.
Yonatan spent eleven years as CTO, which in startup time is several careers. He watched the company scale from three people with a shared hypothesis to a global organization with customers across critical infrastructure, financial services, and government. He helped lead the team that achieved the best-ever results in the MITRE ATT&CK Enterprise Evaluation in 2022 - the closest thing the industry has to a standardized test for detection capabilities.
He also watched attackers get faster. Every year, the dwell time - the gap between when an attacker gets in and when defenders notice - shrank a little. But the defenders were still relying on humans to analyze alerts, humans to triage incidents, humans to decide what was real and what was noise. The throughput problem was getting worse, not better. There were simply too many alerts for too few analysts, and the analysts were burning out.
By 2023, he had an idea about how to fix that. It required starting over.
The Current Chapter
In February 2024, Yonatan and Lior Div - same partner, same intensity, new problem - started 7AI in stealth. The thesis was simple and hard: the only way to close the attacker speed gap is to automate the entire incident-response workflow. Not parts of it. All of it.
When a threat appears in a modern enterprise network, a human analyst has to wake up, log in, pull context from a dozen different tools, figure out what's real, decide on a response, execute it, and document it. That process takes hours. An attacker with ransomware can encrypt a network in minutes.
7AI builds autonomous agents that do that entire workflow - triage, investigation, response, documentation - at machine speed. The humans step in only when the situation demands it: novel attack patterns, ethical judgment calls, high-stakes decisions with uncertain outcomes. Everything else runs without them.
By December 2025, 7AI had closed a $130 million Series A - led by Index Ventures and Blackstone Innovations Investments, with all seed investors following on. SecurityWeek called it the largest cybersecurity Series A on record. Fast Company named 7AI one of the world's most innovative security companies in their 2026 ranking. Both assessments landed within months of each other.
The Timeline
Context
Unit 8200 is Israel's signals intelligence corps. It reports to Israeli Military Intelligence and functions roughly the way NSA's Tailored Access Operations unit functions for the United States - elite technical personnel, classified missions, access to the most sophisticated offensive and defensive techniques their era can produce.
The unit recruits teenagers, typically through a combination of aptitude tests and direct talent spotting. Once in, recruits work on live systems with real stakes from very early in their service. The combination of high pressure, deep technical challenge, and early responsibility produces - with unusual frequency - the founders of cybersecurity companies.
Yonatan was recruited before he had taken a single university-level computer science course. He went in at 18 and came out four years later knowing how adversaries actually operate - not the theoretical version described in textbooks, but the operational version practiced by people whose jobs depend on it working.
That knowledge is the unfair advantage he's been spending his career converting into products.
The Philosophy
We're redrawing the line between what needs human brilliance and what machines can handle in security. By letting smart agents take care of the daily grind, we free our minds to do what they do best.
- Yonatan Striem-Amit on 7AI's mission
Notes from the Field
In His Own Words
"With attackers harnessing the power of AI to unleash unprecedented levels of cyber assaults, the time has come to equip defenders with the same cutting-edge technology."7AI Launch Statement, February 2025
"We're redrawing the line between what needs human brilliance and what machines can handle in security. By letting smart agents take care of the daily grind, we free our minds to do what they do best - tackle the wild, complex challenges that only human creativity can crack."On 7AI's Agent Architecture
"Threat hunting relies on human intuition to discover threats - instead of using indicators of compromise and security tools. You need to understand the story that a chain of events tells."Dark Reading Interview
"Traditional security teams remain static, often requiring years to adapt their tools. In contrast, attackers share exploits and test new methods within their communities almost overnight."On the Defender Speed Problem
Academic Foundation
Go Deeper