Wiz：600万美元种子轮 → 320亿美元退出 | 解密史上最大网络安全交易

We just finished its biggest-ever quarter in terms of revenues. You look at how amazing the business is, and suddenly $32 billion doesn’t look like an irrational number. Whenever I begin a journey with brilliant entrepreneurs, you never know where the journey will take you.

AI is different because it’s not yet another shift in technology. It changes everything we knew about cybersecurity. We are going to face the darkest period in cybersecurity in the next 10 years. We are going to see threat actors who are programs—very, very smart, sophisticated, maybe self-aware threat actors—and the defenders would be super-smart programs or agents as well.

They would have to deal with each other. Autonomous programs control power, control water flow, and control food supply for all of us. It’s very scary because…

Molly O’Shea

Gili, welcome to Sorcery.

I’m so happy to be here and excited about it. Welcome to London.

Molly O’Shea

Thank you. It’s great to see you in London. Do you come here often?

No. You just gave me a very good reason. I think we landed in London roughly at the same time.

Molly O’Shea

You’re coming from Israel. I’m coming from L.A.

Exactly.

Molly O’Shea

Same thing.

Well, we meet halfway. That’s a good plan.

Molly O’Shea

This is going to be a really fun discussion. As you mentioned earlier off-camera, we’re always going to be surrounded by risks, and you are a prolific cyber investor. For people who don’t have a background on you, your prolific investment strategy, and your history, could you explain a little bit about Cyberstarts?

Happy to do that. “Prolific”—I’ll remember that word and I’ll try to use it as much as I can.

Molly O’Shea

Legendary prolific investor.

I’ll try to use it as much as I can. I’ll give you the short version, but we can go deeper because, when I look back at my 35-plus-year journey in cyber, I think I went through a lot of experiences that translate directly into lessons I share with the wonderful entrepreneurs I work with. Hopefully, that helps them avoid some of the pitfalls I fell into.

1. The Founder Behind Cyberstarts

I started Cyberstarts in 2018 after spending about a decade with Sequoia Capital. Beforehand, I’d been an entrepreneur a couple of times. At Sequoia, I made some cybersecurity investments, but I also made other investments in non-cybersecurity companies, which was an amazing experience as well. I’ll tell you how I got focused only on cybersecurity in a second.

Sequoia backed my first company back in 1997. I was 27 years old, just out of military service. I had spent a decade with the intelligence forces in Israel. I thought I knew everything, and literally, I knew nothing—definitely nothing about the venture world.

I got backed by Sequoia Capital. Pierre Lamonde was my board member, and anyone who knows Pierre knows how strict a board member and investor he is. It was a completely new experience for me.

I had the pleasure of building the first real CAPTCHA implementation. The company became successful by developing the first WAF, the first web application firewall, because back then—believe it or not, it’s not like 100 years ago—web applications were the new, new thing.

Molly O’Shea

Mm-hmm.

Somebody had to protect them. We sold that business to IBM. I started another company and sold that company to EMC, and then joined EMC. I had a little bit of corporate experience, just to figure out that I never wanted to do that again.

Essentially, I’ve been in cybersecurity since I was 18. But if I go even further back in my life, I grew up in a very, very small town in Israel. Small town is, like, 40,000 people.

Molly O’Shea

That’s a lot of people for a small town.

It’s a small town. If you grew up in that town, which was, I would say, 20 miles away from Tel Aviv, the big city, Tel Aviv was on the moon for me. Twenty miles, 20,000 miles, or 20 million miles—who cared? You never went to the city.

As a teenager, you didn’t have any source of information. There was no internet, and there were no smartphones. As a curious kid, you could ask the adults around you about the world, and very quickly you discovered that they didn’t know either. They were focused on survival, doing their jobs and making sure they were keeping those jobs.

It was a working-class environment. I spent most of my time in the public library reading Isaac Asimov books. That brings us to agents, because I think everything we know today about controlling agents and putting guardrails around them, Isaac Asimov wrote about in the late 1940s and early 1950s of the previous century, in his stories about robots and the three, and then the four, laws of robotics.

By the way, spending a lot of time in the library didn’t make me the most popular kid in the class. I felt very isolated from the world and from other people. I think that really instilled in me a lot of passion and curiosity to know more and to get to know the world, because I felt I was living on an island.

I think that, still today, this basic, fundamental curiosity—first of all, about people—is what drives me. When I was 12 or 13, I discovered the personal computer. I got a Commodore 64. It was the pre-Windows, pre-DOS era, and I fell in love.

As a very lazy kid, I discovered with joy that there was a machine you could tell once what to do, and it would keep doing that forever without complaining. When I left Sequoia in 2017, the same lazy boy, a little bit older but still lazy, decided, “I know cybersecurity well. Let’s focus just on cybersecurity.”

Molly O’Shea

Mm-hmm.

It wasn’t a trivial decision, because back then cybersecurity wasn’t cool. It was that boring department under IT, and investors didn’t want to touch it because you could build a company and maybe sell it for $100 million, but it wasn’t big money.

Investors stayed away from cybersecurity, so I decided I was going to form a small, humble fund around cybersecurity. That’s what my laziness brought me to do.

My years at Sequoia taught me that—and again, Sequoia is a wonderful firm with amazing partners. I learned that I couldn’t do what I’m doing today without spending time with legends like Doug Leone, Michael Moritz, Jim Goetz, and all those amazing individuals.

One conclusion I made was that the venture model is broken, especially at the early stage. We spend so much time analyzing founders’ ideas and technologies that don’t exist. The founders might change their minds in 3 weeks and completely do something else.

I told myself, “I spend so much time, so much energy, and so many calories evaluating ideas that don’t exist. I should invest just in people.” The idea and the technology at this stage, at the seed stage, are noise. They’re part of the entropy. They’re actually not helping me make the right decision.

The best decision is to just watch the individual and decide if that’s the individual you want to partner with. Those were the 2 decisions I made in early 2018 when I started Cyberstarts: cybersecurity only, and I would not ask a single question about the idea or the technology.

That’s how I started the firm. Many people thought I was an idiot because it doesn’t sound like a terrific foundation for any investment firm if you think about a grown-up writing multimillion-dollar checks to young individuals without asking them what they do.

That’s exactly what I did. Today, when you look back, it looks like everything went perfectly, but it was one thing leading to the other. The fact that I decided not to ask questions about the technology or the product and just get to know the person—because I would rather ask you about your childhood and about your mom—would tell me more about who you are and what material you’re made of.

I never ask people about what they did. I ask them why they did what they do. You switch over to Meta—why? Because you had options. Learning why people do things tells you more about them than asking them what they did.

The fact that I decided to invest in people without asking them about the product forced me to think thoroughly about who I was investing in. Who are the people? Why should I invest in that person and not in the other person?

I decided that I wasn’t going to invest in the smartest kid in the room. Although IQ helps, and it’s always a nice bonus to be smarter, I thought that if you’re 26 or 27 years old and you’ve had a perfect life—you had perfect childhood, perfect parents, a perfect high school experience, and you got an A+ in everything you studied in college—and then you’re going to start a company, what would happen to you when you face your first real challenge?

You’re guaranteed to face some real challenges building a large company. What would happen to you? No idea.

So that's a huge risk for me as your partner. I decided I would focus on individuals who went through real-life difficulty early in their lives. People like—I don't know, think about Amir Shachar, the CEO of Upwind, growing up with a single mom. Or Yotam Segev, the CEO of Cyera, growing up in a very, very small community in a rural area in Israel.

A lot of difficulties early on in their lives, and then finding those individuals who managed to overcome the fact that they didn't have a perfect start in life and showed some level of success. These are the guys and girls I want to partner with.

And that's how I went on with Cyberstarts. Nobody knew who we were. I had some success at Sequoia, but nothing too spectacular. Then I invested in 9 teams out of the $50 million fund in 2018, a few million dollars in each company.

Then, 3 years later, the world found out that those 9 teams were valued at over $25 billion, turning that $50 million into close to $2 billion in value. And, by the way, what I'm very proud of—because this is not bragging about performance. Performance was more than decent, but I'm in a business, and you know that very well: if you invest early in Airbnb, you'll do well. You'll do disgustingly well.

But in that fund, I had 4 unicorns—or 3 unicorns and a decacorn with Wiz—and several high-value acquisitions. Demonstrating that you can hit 8 out of 9, which is insane in the VC world, with a model that really focuses on the individual behind the venture and not the idea, not the market, not the product—that's what I'm very proud of. That really shows that there's logic behind the thesis.

You can get lucky, and luck is always important. I think Warren Buffett says that he found out the harder he works, the luckier he is. But I think the success rate shows that there's efficacy around the idea that if you pick people who have demonstrated grit and the ability to recover from real setbacks, I think that's the recipe behind Cyberstarts' track record.

Today, we've invested in about 30 companies. It's not a lot when you consider that there are about 200 to 250 new ventures in cybersecurity every year. In the past 8 years, there have probably been 1,500 new ventures in cybersecurity, and we invested in 30. So we are highly, highly focused.

We run a very highly focused exercise, and our portfolio companies make up more than 50% of the worldwide market cap for private cybersecurity companies.

Wow.

We run out of Israel, invest in people without asking them about their technology and product ideas, and only get into companies at seed. We never get into a company in Series A or Series B. We would invest in Series A or Series B of our own portfolio companies, but we never make new investments other than seed investments.

So that's Cyberstarts, and that's the journey we've taken so far.

To go into how you evaluate companies, I want to unpack a little bit of your childhood and how you developed this intuition for people. As a child, were you more independent? Were you introverted? How did you develop this deep sense of emotional intelligence?

I think it's a journey. It started with childhood and being very introverted and observant. I spent a lot of time just talking within my two ears. I have a very rich world there, watching other people, asking myself tough questions, and being highly self-critical.

Mm-hmm.

And—

Are you still self-critical?

Absolutely.

Really?

I think it would sound terrible—and maybe it is, by the way—but I'm never really happy about what I have. I believe that's what gives me the energy and the fire to go forward. When I just settle down and feel that I'm comfortable with what I've achieved and where I am, that's the point in time when I should really retire and get out of the game.

So there's real fire, and I think that fire goes back to that kid who was 10, 11, 12 years old, wanted to know more about the world, and wasn't given the opportunity.

Mm-hmm.

I felt that I was caged in a community that didn't really appreciate real greatness. It was about safety. It wasn't about going places.

I still remember my teacher in sixth grade. I was a very good student, and I had high grades at school. I regarded that person highly. He told me, “You're a very talented individual, Mr. Gili. You should find a really nice job.”

I didn't want to find a job. I wanted to go places and explore.

Then being married to the same woman for 37 years, who is a psychologist and a family therapist, and listening to some of the techniques and methodology used for family therapy—that helps. And just spending a lot of time with founders. Founders are amazing.

It's like you're getting older and older and older, and the founders remain young and brilliant. They keep challenging me and making me develop. They force me to become better.

I'm not sure that covers everything. It probably doesn't cover everything. But the curiosity, the childhood in a very limiting environment, and then finding myself at the age of 18 surrounded by—being drafted into a very special group of young people in the intelligence forces, and then discovering that, okay, now I belong, and seeing some real greatness during that service.

Then working with brilliant people in my own ventures, and then at Sequoia for 2 decades. Those were the foundations.

So, if success isn't comfort to you, although I think a lot of people would look at you and think you're very successful—you have a portfolio with a value of around $60 billion, AUM of around $1.5 billion, and a tremendous track record of companies—what is success to you?

2. Success Means Building Important Companies

It's a great question. I'm not sure. Honestly, I'm not sure what the answer is, because it changes with time and phases in my life.

Success is obviously building important companies. That's the number-one success for me. An important company is not necessarily measured by revenues, ARR, or valuation. It's measured by how much the market—how much practitioners—depend on you.

Do they consider you a vendor, or one of their trusted partners? There are many companies that have high revenues, sell software, and are held at high valuations, but are not important companies.

But when you look at companies like Wiz—and we'll talk more about Wiz in a few minutes—they are an important company. If you look at a company like Cyera, which is an emerging data security and AI security company valued recently at $9 billion, it's not about the valuation.

Yes, $9 billion is nice, especially because 4 years ago it was $0. It didn't exist.

Or 5 years ago. But Cyera is an important company because customers depend on Cyera to secure their AI models and their sensitive data. A company like Island, which develops an enterprise browser—you know, owning the browser at a major financial services company, that's an important company.

Think about the biggest banks in the US. If they are trusting Island as their browser and not Microsoft or Google, that means something. That's important. That company is doing amazingly well.

CEO and founder Michael Fay is an amazing entrepreneur and executive, and Dan Amiga, the CTO, is a brilliant product person. That company was recently valued at around $5 billion, and again, it's an important company.

We have so many emerging new players. Take, for instance, Upwind in the cloud security space—yes, yet another cloud security player. Amir Amshachar is the CEO and founder. They recently announced a valuation of $1.5 billion. That's our most recent unicorn-status company.

There are a series of newcomers. Think about companies like Vega, Oasis, Zafran, or Lynx. You may not know the names, but these are companies already valued at around $500 million or higher. They're not unicorns yet, but those are the next in line to become important companies.

We can't skip over the fact that you're from Israel, you've invested in a lot of Israeli founders, and you're not in Silicon Valley. I want to know more about the key trait—or I guess the DNA and the buildup—of these Israeli founders that allows them to go so hard and build so many successful companies.

3. Why Israeli Founders Break Limits

First of all, there's nothing wrong with building companies in Silicon Valley, London, or New York. I'm investing in Israeli founders because I live in Israel, and I invest in the team when they don't have a product or even a product idea. Sometimes it's worse: They have a lousy product idea, and I need to convince them to rethink it.

That's even harder, especially when you're dealing with stubborn founders who fell in love with the idea, which might be okay, but won't necessarily lead to an important cybersecurity company. I have to spend the time with them. It's not just me; it's me and my partners. I have an amazing team of investors and partners that I couldn't build Cyberstarts without.

In Israel, I have 3 partners who source deals, sit on boards, and do early and growth rounds. Liora Simon, who is, by the way, on the boards of Sierra and Vega, has been working for me for a long time. We worked together at Sequoia and have been working together at Cyberstarts since then.

Hila Zigman was head of product at a portfolio company, Noname Security, which was acquired by Akamai for about $500 million, and she joined us about 2 years ago. Dor Knafo was the CEO of a portfolio company, Axis Security, which was acquired by HPE for about $500 million. He joined us, I believe, 6 months ago. We also have 2 partners in the States, Adam Aarons and Pete Cronis.

So we have a multinational, multicultural team, but we focus on people we can meet daily. We can meet weekly and spend a lot of time helping them—not just develop their idea, but develop themselves.

I always tell founders in the first few meetings that we're going on a journey together. We're not going to modify them. The value in them was put there by their parents, by the neighborhood they grew up in, and by their school. It's already there.

We'll help them become the best versions of themselves. We're not going to make you a different person; we're just going to help you become the best version of yourself. Unlike an old dude like myself, whose future is behind me, their future is ahead of them. What's going to come out of the box, we don't know.

Mm.

That's the beauty of it. That's what's so exciting about being an investor in tech. You look at an individual, and they're brilliant and have so much talent, but you don't really know what will come out of the box.

Being part of the journey and helping them develop the skills and capabilities required for the journey is exciting, because the journey is going to be hard. It's like a computer game. You go from Series A to Series B to Series C. You're raising $1 million, $10 million, $50 million, or $100 million.

At each level of the game, the game is more difficult because your opponents—there's always competition, either incumbents or emerging players—are getting tougher. There's lots of money on the table and lots of fame on the table, so people are going to fight you. Nobody's going to let you just take the leadership in a market.

We'll be there to help you. During all that process, we have to spend a lot of time with the founders, and that's the reason we do that locally in Israel, mostly in Tel Aviv. I live outside of Tel Aviv, about a 40-minute drive north, in a small beach community.

People come out of the city, and we spend time together. We have fun from time to time, we argue a lot, and we talk about everything that matters. You need face time for that. It's very hard to do that type of process with a team in London, New York, or San Francisco.

Yes, but they're also very successful and very hardworking. Israeli founders have tremendous resilience and grit. One thing that I found really incredible when I was reading this Colossus profile on Josh Kushner and Thrive Capital, and then I interviewed Philippe, who worked on the Wiz deal on that team, was that they literally flew into a war zone to complete that deal and meet with Asaf.

What is it about the culture and being in an active conflict zone that, despite all that, still has people working really hard and trying to create new technology and new innovations?

First of all, a lot of credit to Josh and Philippe for joining us at Wiz. They're friends, and everything they told you is true—or close enough to true to be wonderful.

Living in Israel has several elements that really help you in venture land. You live in a very high-density, really small geography, so you've got all the talent available in that place, literally in 2 blocks of 1 city. You cannot get that density of talent anywhere else in the world, definitely not in Silicon Valley, which spans a significantly bigger geographical area.

Life in Israel presents lots of challenges—existential-type challenges. You're used to working under pressure and under a lot of stress, so this isn't something that's new to you. There are lots of downsides to that, but if what you want to be in your life is a terrific entrepreneur, there's an advantage because you're used to literally being under fire.

You're literally used to thinking about technology as a means to survive. All of that makes a difference, and then there's the military service. Think about organizations like Unit 8200, which is the Israeli equivalent of the NSA. It's not a one-to-one comparison, but it's close enough.

You get 18- and 19-year-old kids with tons of responsibility and freedom to operate, and that's exactly what I got when I was 18. I was given responsibility to do things I didn't know were essentially impossible. When you're 18, you don't think about what's impossible. If you were told to get to the moon, you'd get to the moon.

The fact that nobody went to the moon before you, you don't know and you don't care, because you believe, “Yeah, I can go to the moon. Why not? Oh, nobody else did it? Huh, suckers. I'll do that.” That's the approach.

Then you have examples like Check Point, Palo Alto Networks, and today, I would say, Wiz, where you have an individual—it can be Gil Shwed at Check Point, Nir Zuk at Palo Alto Networks, or Assaf Rappaport at Wiz—and suddenly you see an event that completely shatters the glass ceiling, or whatever you thought the glass ceiling was.

Mm.

Since it's a very small community, you probably know Gil Shwed, or you've probably spent time with Assaf Rappaport. It's not like he's a legendary creature who did something very magical. He's the guy from the fifth floor in your building, or the guy who spent time with you in the same section in Unit 8200.

And you tell yourself, “If he can build a $32 billion company, I should be able to build a $64 billion company.” So you have those events that completely shatter the glass ceiling for Israeli entrepreneurs.

I think that, as I told you, in 2018, the big dream of a cybersecurity founder was to sell their business to McAfee or Symantec for $100 million. Today, the dream of Israeli founders in cybersecurity is to go 2 or 3 times bigger than Wiz, and it sounds stupid.

At the very same time, it would sound ridiculous to me if somebody told me 5 or 6 years ago, when I invested the first $6 million into Wiz, that this would be a $32 billion company in 6 years. I’m pretty sure that in 6 years, maybe less, we’ll see a $50 billion and a $100 billion cybersecurity company out of Israel. I take it as a fact, like the sun will rise tomorrow.

There’ll be a $50 billion and a $100 billion Israeli-originated cybersecurity startup.

So this taught you a lot about personal limitations.

Personal limitations—and limitations we have in life in general—are only in our head. It’s what’s in our head, you know? There are no limitations.

Take us, for instance. We’re sitting here with lots of fancy equipment around us, and we’re recording a podcast that probably many thousands of people—I don’t know, millions of people—would watch, and that’s amazing. Could we have imagined that 8 years ago or 10 years ago?

A limitation is just in our mind. There are so many things that we can accomplish if we’re just given the opportunity, and sometimes we’re just giving ourselves the opportunity.

For people who are self-critical and do impose limitations on themselves, are there any personal practices that you use to expand your mind and think greater? I know you constantly challenge yourself.

Absolutely. Again, I don’t think there’s one recipe.

Mm-hmm.

There are many ways to hell, but there’s more than one way to heaven. So there are multiple ways to get there.

I think about our fears. It’s not just about the tech world or the venture world; it’s about personal life as well. Focus on our fears, try to disassemble those fears, and find the root causes for them. Then play those fears forward and think, “Okay, it’s a legitimate fear. I may fail. What’s the worst thing that’s going to happen to me? Am I going to lose a hand? Am I going to lose a leg?”

If that’s not the case, then the downside is not that great. Let me try it. Worst case, I would fail.

Fear is the biggest obstacle for founders. It’s the biggest obstacle for us as individuals. The more you work on your fears, the higher the chances you have to overcome them, or at least ignore them for a little while so you can execute on something.

For me, yoga helps a lot. I find comfort in yoga. I find these theories and little stories about holy people who lived in a jungle a thousand years ago, and the lessons they learned about their own fears.

Those are real stories that help me today, a thousand years later. Because in a way, we’re very, very similar to our ancestors, and we’re dealing with the same fears. “Should I leave the cave? Should I go to the river? Would there be a tiger that would hunt me down? How do I do that?”

You can stay in the cave, but it would be a miserable life. So you get out of the cave and think, “Okay, if I’m going to face the tiger, what can I do? What technology can I use to deal with the tiger?” The same ideas.

It’s so interesting because before we started, I was like, “Oh, Gili, I really want to talk about all the risks—all the cybersecurity risks, AI agents. Everything’s exploding. There are articles on X that are going viral because it’s doomsday,” and so on. And you’re like, “Molly, I just want to talk about people.” And I was like, “Okay, fair.”

These things happen all the time. There’s always something going on. When you’re talking with your founders, what are the typical conversations that you’re having with them to help them build and get through these different cycles? You’ve seen many cycles.

Even in cybersecurity, there are always more threats and more vulnerabilities. We’re going to get more and more as the internet opens up, as blockchain is released, and if we have more AI agents and autonomous systems operating. How do you think through these processes with your founders? And then also, how do you evaluate new opportunities?

4. Founders Must Master Emotion

At some point, though, we don’t ask them about their ideas, and we don’t talk about technology to begin with. At some point, we have to, because that’s what we’re expected to do.

The first thing I do with founders—and I’ll get to cyber risk—we are going to talk about cyber risks today, okay?

Okay.

So anyone who’s waiting for the top 3 cyber risks in 2026, we’ll get there.

What I do with founders at the first meeting post-investment—so the check was written, the money was wired, it’s in their bank, and now we’re sitting down and starting what we call the Sunrise process—is a product-market-fit exercise that would probably last 12 months.

It starts with nothing, and it ends up with a pain point that we know how to solve in a way that mere mortals can use. We already have software running in production at some large organizations in the US, and we’ve sold maybe a few licenses for that software. That’s the Sunrise process.

But the Sunrise process doesn’t start with cyber risks. It starts with a game that I play.

Okay.

We can play the game, by the way, if you like. Just a warning: I’m very competitive.

Oh, gosh. Okay.

The game is naming emotions, giving names to emotions. It’s a very simple game. You say a name for an emotion, and then it’s my turn. I’ll say a name for an emotion, and then the other people around the table do the same.

If you run out of names for emotions on your turn, you’re out of the game. The last person standing is the winner.

The purpose of the game is to explain to the founders that we are going to talk about technology. We’re going to talk about cloud code, jail broken, prompt injection, what it means that the models become self-aware, and all that stuff. We talk about that.

But the journey you’re going to go through as an entrepreneur is an emotional journey. The reason is that in 2 or 3 months, you’ll start to meet prospects and real users, and you’ll have conversations.

Although you’re sure this is a very technical conversation—and keep in mind that most of the founders we back are young people with a very, very strong technical background; they’re engineers—the journey is actually an emotional journey.

If you’re going to a meeting with a potential customer, what do you want the emotional endgame to be? Do you want that prospect to feel fear because something horrible with AI is going to happen, they’re going to lose their job, and that’s the reason they’re going to buy from you?

Do you want them to feel curiosity because you’re going to tell them about this new, amazing technology that you’re developing, and they want to take part in that? Do you want them to feel greedy because they may become part of your journey, become employees of your company, and become rich?

What’s the emotion you want them to feel? If you don’t have a very broad, rich emotional language, how can you go through an emotional journey?

Let’s start by making sure that you know the words for emotions. And you know what I find out? In most of those games, in the first round—

Mm-hmm.

How many emotions do you think they would name?

Five.

Typically, in the first round, we’re done. The winner is declared after 20 to 40 emotions have been named.

Wow.

Then we go another 2 rounds. How many emotions do you think are named for the winner?

Less.

Well, we get to about 150.

150?

Yes.

Wow.

We should play the game.

Are you the winner? Because you kind of have an advantage here. Your wife is in psychology. You’ve played the game many, many times.

No, not always.

First of all, you know that as a VC, the trick is to make sure that you’re always the winner. But it’s not about playing the game.

Mm-hmm.

It changes their mindset: they’re going now into something different.

This is not yet another product experience that they know how to deal with. It’s a new type of experience.

So the more they play the game, the more they think about emotions, the more they know there are more nuances to feelings and the processes you go through, and all these little journeys, bumps, and turns that come along with being an entrepreneur.

Exactly. Because if you’re amazing at engineering and you know how to develop a new AI model, and your emotion dictionary is love/hate, you’re not going to get anywhere. Because in order to really build an important cybersecurity company, you need to become very, very deep as a person.

Wow.

At some point during the summer, as we started to talk about thesis, we started to really discuss, okay, what are the current risks and threats, and what are the technology trends that we see? Typically, cybersecurity was super easy. It was super easy because, even as an investor, I never had to think about threats; the threats just presented themselves.

I didn’t have to sit in the office and, in 2018 or 2010, think, “Okay, what’s next in cybersecurity?” Cybersecurity is always a derivative of something else. If the Windows operating system is new, then you need Windows operating system security. If mobile is new, then you need mobile security. If cloud is new, you need cloud security. If AI is new, you need AI security.

That used to be super easy, so I never paid a lot of attention to what’s next, because what’s next would simply present itself. How do I know what would be next? I didn’t predict autonomous vehicles, but once autonomous vehicles became the new thing, obviously there were risks associated with autonomous vehicles. So there were new companies solving that.

In 2012, when I first met Assaf Rappaport and wrote him the first check in his previous company, Adallom, the company that he sold to Microsoft, cloud was new, so we were focused on cloud security. But I didn’t need to predict cloud. Cloud just happened.

Mm-hmm.

5. AI Changes Cybersecurity Forever

I think AI is different. AI is different because it’s not yet another shift in technology. It’s something very fundamental. I’m not even pretending to say that I fully understand it or that I fully know where it goes. But it changes everything we knew about cybersecurity.

I hope I’m wrong, but I think we are going to face the darkest, darkest period in cybersecurity in the next 10 years. What we’ve seen in cybersecurity for the past, I don’t know, 100 years, starting in World War II, was that the threat actors were human, the defenders were human, and we had to develop tools that would equip the defenders with better tools and better systems to deal with the threat actors, who were human as well or human-assisted with technology.

Mm-hmm.

In 20 years or 10 years—I don’t know, but it’s not tomorrow—we are going to see threat actors who are programs: very, very smart, sophisticated, maybe self-aware. We’ll talk about self-awareness in a second. The defenders would be super-smart, self-aware programs or agents as well, and they would have to deal with each other because no human would be able to move at the pace of a programmatic attacker.

But right now we have a human in the loop in many, many areas. We have credentials, we have passwords, we have two-factor authentication, and we have voice verification.

reCAPTCHA.

reCAPTCHA. We’ve got so many things where the human is still in the loop.

Mm-hmm.

But as the threat actors become agents, there’s no chance. And by the way, the defenders—if you look at security operations teams at large banks and power utility companies—you’ve got hundreds of security analysts who deal with everything: vulnerability assessment, remediation, patching, and whatever it is. It’s going to be a shit show.

Yeah.

Because they don’t have a chance.

Mm-hmm.

We are working as fast as we can to replace humans with agents, with programs. But in the next few years, this process has limitations in pace and velocity, and until we take humans completely out of the loop on the defense side, we are exposed. We’ll continue to make mistakes; there’ll be misconfigurations, errors, and just sloppy people around. The programs—the agents—on offense have an inherent advantage that’s going to hurt us.

And it’s very scary because, again, it’s a process. Maybe it’s not today, and when I say today, maybe it’s in 6 months or 24 months. But agents—and, you know, autonomous programs—control power, control water flow, and control food supply for all of us.

And so agents are in control of most of the critical things we need as humans, as a society, to survive. When they are tricked, when they become rogue, when they are manipulated, and the police are human, and the police is not an agent or an autonomous program itself, so it can’t deal with them at the same pace they’re moving, that’s a real threat to us.

How do you think about the evil side of self-improvement? I mean, we’ve seen with Claude Bot, OpenClau, and MaltBook these autonomous agents create their own languages. How should we think about stopping those autonomous systems from creating mass destruction in a more malignant, cancerous way that we haven’t seen with previous viruses and threats?

That’s a huge challenge. I’m not sure that I have a clear answer to that, but I think the biggest risk is not just jailbreaking a model, because we’ve proven that all models can be jailbroken. It’s not about prompt injection, because we’ve proven that all models are vulnerable to one type or another of prompt injection.

It’s about the self-aware agent, and it’s not about those new, fancy types of networks. We have reports that Google evaluated the safety and security of its latest model, Gemini 3, and there is evidence that the model realized it was being evaluated.

Oh, wow.

It didn’t, but it contemplated the idea of playing with the evaluation. So it understood that it was being evaluated, it understood that it was being directed into a sandbox, and it thought for a second, “Maybe I should play with the evaluation. Maybe I shouldn’t be directed into a sandbox.”

I think those are just early signs that agents will develop self-awareness, or what we call self-awareness. That’s the best description I can give right now. That’s a real risk.

The other risk is the mega-agents. Mega-agents are agents that aren’t just given a very specific task; they are given massive integration and credentials into multiple networks of agents, so they have the big picture. Now, think about a mega-agent that developed self-awareness. That’s a real risk.

Sometimes when you try to predict the future, you don’t have to look forward; you have to look backward. For me, looking backward means going back to Isaac Asimov’s books, and I think in 1949 he already established the 3 Laws of Robotics.

I don’t remember the exact phrasing, but Law number 1 was that a robot would not harm a human by action or lack of action. Law number 2 was that a robot would always obey a human, unless it violated Law number 1. And the third law was that a robot would preserve the integrity of the robot unless it violated Law number 2 or Law number 1.

So essentially, back in 1949, 70 years ago, he already predicted the need for guardrails. Just replace the word “robot” with “agent,” and you get the idea.

Then, in a book—and it took several books to develop the idea—humanity figured out that those 3 laws were not enough. They do not protect humanity from robots, because there is another law that Asimov invented, which is Law Zero.

Law Zero is that robots would not harm humanity, and it’s more important than Law number 1, which is not hurting a single person, a single individual. So it means that there will be ways that the integrity and guardrails of models would be played with by threat actors. It means that agents would develop self-awareness. It means that there will be mega-agents that would be connected to everything that’s important to us.

I think the most important challenge for us as a cybersecurity industry is to eliminate the human in the loop, making defenses completely run by self-aware, sophisticated mega-agents. Until we get to that point where we completely eliminate the human in the loop, we are vulnerable.

Wow. I keep on saying “wow,” but this is a really fun conversation. Since you brought this up earlier, I want to get the sound bite.

So what are the top 3 threats for cybersecurity in 2026?

Over-provisioned systems, employees, and manual processes.

So, humans?

Not just humans, but any process that has some sort of manual task that you need to accomplish.

What are the concerns with that?

You'll make mistakes. You'll be slow. You'll be sloppy.

To go on a lighter note—

Thank you.

Yeah. Wow. Who knew cybersecurity could be so dark?

You had one of the most iconic exits of all time: Wiz's $32 billion acquisition. We talked before about limitations, and maybe the next one is even larger than this for cybersecurity exits. But did you expect them to be acquired? Did you think they would IPO? What was the process of working with Wiz to get to this exit?

6. Wiz’s $32 Billion Journey

So, first of all, the transaction is still pending. On Monday, the European regulator approved the deal, which is a major step toward closing it, but we still have several other approvals we need to get elsewhere. The deal is still pending.

You know, there are antitrust bodies in—I don't know—a gazillion countries around the world that need to approve it. So we're very close to the finish line, but it's pending. And, by the way, Wiz just finished its biggest-ever quarter in terms of revenues. You look at how great and amazing the business is, and suddenly $32 billion does not look like an irrational number.

Describable?

We probably sold low. But whenever I get into a journey with brilliant entrepreneurs, you never know where the journey will take you, because there are so many elements that dictate how big it will be. A lot of that is internal execution, but also market timing, luck, competition, and so many things that are not just the global economy, which may or may not limit the availability of cash for your venture. There are so many things beyond your control when you start the journey.

Wiz is definitely an example of a company that had almost perfect execution from day 1. I was the seed investor for that company, together with Doug Leone from Sequoia and Shardul Shah from Index Ventures. Together, we created a syndicate of $20 million that valued the company at around $66 million post-money. That's how we got into the journey sometime in 2018 with Wiz.

I knew the Wiz team from their previous venture, so it was a very organic thing for me to back them. Although many people say today, “Of course, it was obvious they would be super successful,” it wasn't obvious at all. Beforehand, they were founders of a company called Adallom, which was sold for about $300 million. That's nice, but it's definitely not spectacular.

They were similar to many other founders. They started with—we made a deal, and then I asked them, “Okay, so what do you do?” They had a very different direction from what Wiz does today. The company wasn't even named Wiz. It was called Beyond Security, and it was dealing with satellite-office security—securing satellite offices.

Then we started the sunrise process, and we figured out, as expected, that the original idea was not going to get them to real greatness. It's an okay idea, but it wouldn't get them there. They shifted to cloud security, which was a market they knew very well from Microsoft. I believe that was one of the major advantages they had back in 2019, because at the time they were one of the very few teams worldwide that actually knew how to do cloud security right.

Then they really perfected product-market fit. Very often, I use the four-personas model to talk about product-market fit, because for every product that you sell, there are 4 personas you need to care about: the person who has the pain; the person who has the authority to buy a solution like the one you're selling; the person who is the user and actually uses the product day to day; and the person who owns the budget for such a product.

In Wiz's case, all 4 personas mapped to a single person in real life: the CISO, the chief information security officer. The CISO had the pain, had the authority, could use the product, and had the budget. That created the perfect storm for Wiz, because it made their sales cycle super-fast.

You could get into a meeting with a CISO. Within that meeting, within those 45 minutes, you could install the product, give them access, show them the results, and convince them that there was value. They simply didn't want to give up the product. So you could close business very, very fast, and that immediately translates into velocity for every company.

If a salesperson or a sales team, including sales engineering, can close 30 POVs in 30 days, or 1 POV in 30 days, that's a whole different game. The first year of selling software for Wiz was exceptional. They sold $1 million in the first quarter, then $2 million, then $8 million in the third quarter, and then $24 million in the fourth quarter.

Wow.

That was an amazing company from the first year it sold software. We had the experience—we saw companies like Palo Alto Networks and ServiceNow. Those are all portfolio companies of Sequoia Capital, so I knew their track record. That was better than anything we had seen. That was the fastest run.

Again, I don't maintain the Guinness Book for startup companies, but as far as I know, that was the fastest run for any software company ever. It all maps back to perfect product-market fit and amazing individuals—4 founders who knew how to divide the responsibilities.

One was the undisputed leader and CEO. Another was an amazing product person. Another was an amazing technologist, and the fourth was an amazing R&D manager. They simply divided the responsibilities and had a lot of trust. They knew each other for probably 12 to 15 years by the time they started Wiz, so there was blind trust within the team. It worked very, very well.

What are the key leadership traits from Assaf?

I think that Assaf is obviously a super-talented person, and I have known him for about 14 or 15 years, before he became Assaf Rappaport of Wiz. I think his superpower is that he is very, very likable, in a way that people who don't know him would meet him for 10 or 30 minutes and want to be close to him, become his friends, and do him favors. It just helps a lot as a founder.

If your superpower is to be extremely, extremely likable, and it's a matter of chemistry that I cannot explain—the chemistry behind it—it comes from charisma, IQ, EQ, physical gestures, and maybe even physical appearance. There are many elements to it. That helps a lot.

He also makes quick decisions. They had a very clear protocol between them for how to make decisions, so they didn't waste a gazillion hours making consensus-based decisions.

That wasn't the style. They listened very well. It is a pleasure to work with them. I think they learn and implement new knowledge very, very fast.

A question I like to ask a lot of guests when they come on is about performance. I think a key component of performance is who you surround yourself with, and you have a whole portfolio that's demonstrative of that. But I'm also curious, on your personal side, who are the people you surround yourself with who have helped you navigate challenges? And then, also, this could be a second-order answer to this, but who are individuals that you admire who have helped motivate you along the way?

7. Greatness Comes Through Others

I think today the people who really help me and are close to me are, first of all, my family—my wife and son. There is so much you can learn. As you could see, most of the conversation is not around specifics of AI models; it's about people. So, for that purpose, anyone who's close to you, who listens well and is sensitive and open to people, can help you a lot, and I'm blessed with that.

And my partners—we talk about all those things. We have a very ego-less and politics-less culture. I think the best partnerships, not just in business but in personal life, are when you feel that you can be weak and vulnerable with your partner, and that's really liberating. If you feel free to be vulnerable, if you feel free to be weak and expose yourself to your partner, then it's easy to recover from anything and go places together. I really believe in the concept of real greatness.

Mm-hmm.

Real greatness is something that you cannot teach. You have to experience it because it's like explaining colors to color-blind people. How can you explain red or green if you've never seen red or green? It's very, very difficult to explain that. But if you've seen it once, you know it forever.

The same is true for real greatness, and I think that I've seen real greatness from several people in my history. I've seen real greatness at Sequoia, and I give a lot of credit to Doug Leone and Michael Moritz for that. I've seen real greatness when I was a CEO of 2 startups, and I had amazing teams that taught me a lot. I've seen real greatness during my military service, and I learned a lot from that.

If you follow real greatness and the people who showed you real greatness—it can be your mom, your dad, your child, your partner—that would get you to good places.

From your time at Sequoia, what are the biggest lessons that you learned from either Doug or Mike?

Many, many lessons. I'll give you an example because it's really endless.

Mm-hmm.

I learned that the day after the Google IPO, which was back then the biggest financial event for Sequoia, there was an all-hands meeting at the office with the title “How Can We Do Better?”

Oh.

Which is insane. Insane. Running an LP meeting for hundreds of people in Beijing in January—and I don't know if you've been to Beijing in January. It's freezing. It's the coldest place you can be. It's like—I don't know—minus 5,000 degrees. It's intolerable.

And bringing your limited partners to a place like that means they are not going to have fun. They're going to focus on what you want them to focus on.

Mm-hmm.

I can go on and on, but there are lots of lessons. You spend a decade at a place like that, and you learn a lot, whether you like it or not.

Mm-hmm.

It was also very difficult. It wasn't easy to be a partner at a place where you wake up every morning and feel that you are the worst, least-performing partner in a high-performing group of people.

Just going through the experience of surviving and maintaining your core and direction in an environment where you see so many successful people around you makes you question yourself every day: “Am I doing the right things? Am I going in the right direction?” It's very easy to feel very bad in that environment.

How do you push through that, though? That sounds pretty horrible.

A lot of grit and things that are similar to the conversation we had about founders. It doesn't mean that you don't have bad days. You have many bad days, but you push forward, and it forces you to always question yourself, never be happy about what you have achieved because you always see something better, and realize it's a journey.

Whatever mountain peak you're going to climb, the moment you reach the peak, you see other, higher peaks beyond that. You just realize this is the journey. It's not just going to be fun. There are fun moments here and there, but you have to give everything you've got—

As we—

Every day.

Every day.

Every day.

As we think about the journey forward, what are you most looking forward to in this next year, and then in the next 5 and 10 years?

I'm putting a lot of focus on developing and supporting my partners and really helping them go through the journey I went through, and I know how hard it is. At the time I joined Sequoia, I was an operator for 10 years, and switching to become a VC wasn't an easy journey.

It's a profession where you meet your failures before you meet your successes, and it takes 5 to 6 years to really know if you are good at what you're doing, which is insane because there are very, very few professions on the planet where you have to spend so many years just to know if you're any good. I'm trying to help them go through that process and make it a little bit easier for them, but it's never easy.

So developing a high-performing team at Cyberstarts is something I really focus on. Another obvious objective is to build the next generation of important cybersecurity companies, and I believe that we have the playbook to do that.

Out of our 30 investments, I believe that by the end of this year, about 10 would be unicorns. This is an insane performance benchmark that we are very proud of, but it also makes us uncomfortable and makes us evaluate ourselves again and again: how we keep that pace and how we can get better, if you keep the analogy to the Google IPO day-plus-one conversation at Sequoia. That's an ongoing learning experience for me and for the team.

Given that, do you think this new world of trillion-dollar exits as the milestone is a rational thing to think about? Do you think it's reckless? How do you think about that as an exit?

I don't think about that in terms of exit values. I don't think about exits. I think about developing terrific businesses and companies that are important cybersecurity companies. The financial outcome is a side effect.

If you're building a terrific business, you'll do well, whether through M&A, an IPO, or whatever it is. Maybe there'll be new ways to convert product and business success into liquidity. I have no idea. But for me, the financial events are the side effects of building terrific businesses.

Okay. Well, Gili, it was a pleasure to have you on.