- Red teamBreaking in
- MicrosoftSecurity engineering
- GoogleMachine learning systems
- CISO ×3Early revenue to IPO
- Investor10+ security startups
- FounderDefendermate, 2025
I started on the offensive side. Red teaming taught me that a vulnerability being present and a vulnerability being exploitable are different things: whether an attack works depends on conditions, like a feature being enabled, a port being reachable, or an identity having the right permissions. I carried that instinct into security engineering at Microsoft and building machine learning systems at Google.
Then I became the buyer
Three CISO roles later, at companies growing from early revenue through IPO, I was the one buying the tools I used to test. Every program hit the same wall. Scanners produced thousands of findings, my team triaged what it could, engineering pushed back on tickets nobody could justify, and the one finding that mattered sat somewhere deep in the list.
Log4j, the war room
- Five teams asking at once
- Leadership wanting the blast radius
- Engineers asking whether their service was affected
- My team checking conditions by hand, resource by resource
More data than ever, and still no answer to the only question that counted: are we actually exposed?
What I saw from the other side of the table
Investing in and advising more than ten security startups showed me which problems were worth building a company around, and how rarely anyone went after the hard one. Most tools got better at finding and scoring. Very few tried to answer whether something was exploitable here, in this environment, with evidence an engineer would accept.
Why now
Then
An expert and an afternoon to answer “is this exploitable here?” for one finding.
Now
Machine learning, generative AI and graph modeling answer it continuously, across everything you run.
At the same time, AI started doing the attacker’s side of the work faster than any team can triage. Vulnerability management stopped being a problem you could staff your way out of. It became a product problem.
So I built the product I wanted in that war room: one that knows what’s actually exploitable in your environment, shows how an attacker would get there, and helps your teams and their AI agents act on it.
Wrestling with the same war room?I’m happy to talk through your exposure and vulnerability program, whether or not Defendermate is the answer.
For current figures: What AI changed · The CTEM guide · Start free