S12 E20: The Agentic Privileged Access Crisis: Why Making AI Agents "Well-Behaved" Fails and How to Structuralize Their Blast Radius with Ofir Stein, Co-Founder & CTO of Apono

0:00 [SPEAKER_01]: What I believe in is that there is a trade-off that we all know between putting a bandaid on a solution if I want to solve something, right? [SPEAKER_01]: I can put a bandaid, do something very fast bandaid in like the bad way to describe it, but there is like a key support, right? [SPEAKER_01]: Keep it simple stupid. [SPEAKER_01]: But you can also do it scalable and good solution that a lot of the time this is the good way to say that overengineering is the second piece, like if you do that.

0:29 [SPEAKER_01]: So you always move between, do I do it in scalable and good a critical way or in doing that come in overengineering? [SPEAKER_01]: Oh, I need to look on the kind of key approach. [SPEAKER_01]: My name is I first staying in the city and co-founder at the panel.

0:46 [SPEAKER_00]: This is code story. [SPEAKER_00]: A podcast bringing you interviews with tech visionaries. [SPEAKER_00]: 6 months moonlighting goes. [SPEAKER_00]: I was lossing on the backhand. [SPEAKER_00]: Who share what it takes to change an industry? [SPEAKER_00]: I don't exactly know what to do. [SPEAKER_00]: It's all too many girls to get right. [SPEAKER_00]: who built the teams that have their bad company is its team's help each other, which is proud of our team. [SPEAKER_00]: Keeping scalability top of mind, all that infrastructure was up there.

1:13 [SPEAKER_00]: Yes, we've been fighting it as we grew up. [SPEAKER_00]: Total waste of time. [SPEAKER_00]: The stories you don't read in the headlines. [SPEAKER_00]: It's not an easy thing to achieve. [SPEAKER_00]: To get yourself a deficit of off, try to begin to ride the ups and downs of the start-up line. [SPEAKER_00]: To really want it. [SPEAKER_00]: Not just about technology. [SPEAKER_00]: All this and more on code story. [SPEAKER_00]: I'm your host, Noah Labpart, and today how Ophierstein is giving you a way to provide a gentle, privileged access, built for your current and future environments.

1:49 [SPEAKER_00]: Ophierstein is based in Tel Aviv Israel, born and raised in Jerusalem. [SPEAKER_00]: He spent many years in the Israeli Air Force and Infrastructure and Security before he moved to Tel Aviv. [SPEAKER_00]: He's a tech guy through and through, bragging about his Raspberry Pi set up at home, which adjusts the AC settings based on the temp outside. [SPEAKER_00]: But outside of tech, he's married with a daughter and a dog. [SPEAKER_00]: He's connected and close to his family, which he notes as how he refreshes and reloads as a founder, alongside playing tennis from time to time.

2:20 [SPEAKER_00]: Ophiren is co-founder, started interviewing C-Sos and security professionals on how they feel about access management. [SPEAKER_00]: They found out that this was the first line of attack for bad actors, but from a business standpoint, Axis Management is a slow to value feature. [SPEAKER_00]: They decided to build a platform that was based on just-in-time access over the slow to value setup, plaguing the industry.

2:46 [SPEAKER_00]: This is a creation story of a Pono.

2:54 [SPEAKER_01]: My partner is a modern access security platform. [SPEAKER_01]: So we combine the business context and the different aspects of context in the customer environment. [SPEAKER_01]: And we help customers to reduce their risk, but also allow them to move fast and move fast in their environment and be able to get a fast time to value. [SPEAKER_01]: So, access management is akin between those two, and it's definitely something I really love about the problem that we are solving in that space.

3:25 [SPEAKER_01]: If we go back, five years back, me and my co-founder, and the CEO, my co-founder, and rom-com else, he is the CEO of the company come from cybersecurity background. [SPEAKER_01]: more of the offensive side than I shared a little bit about my background, so it's infrastructure security DevOps but at the time that you need to take a lot of infrastructure and move them to the cloud and that kind of situation. [SPEAKER_01]: So we started to walk together and we started interviewing unread of ceaseless and dozens of inform managers.

3:56 [SPEAKER_01]: Asking, what you do today on Axes Management, how you care about that, and what we discover is something we've felt on ourselves, is that Axes Management is like in between security and productivity when we talk about organizations. [SPEAKER_01]: The first thing that the attacker is going to abuse in the environment and identity is like the first line that it's going to exploit and it's created huge risk for the organization, but in the other end it's to load the business from going fast, because if I need access, [SPEAKER_01]: I just need the access, I don't care if it's risky or not.

4:33 [SPEAKER_01]: Without the access, I'm going to weigh this weight, be it slow, time to value, and when we started, I actually come to my co-founder saying, let's make a future when everyone have access to anything. [SPEAKER_01]: And as a security eye, he too looked at me as insane, saying, no, you didn't get it. [SPEAKER_01]: We need to remove access from everyone, not give access to everyone. [SPEAKER_01]: And this was the take the beginning of Apollo, and today we are dynamic access management platforms, so we provide access just in time to the right time, to the right amount of access to do your work, without thinking about that this organization grow and need to move fast, but stay secure.

5:18 [SPEAKER_00]: Tell me about the MVP, the first version of the product you built, how long it took to build and what sort of tools were you using to bring it to life?

5:28 [SPEAKER_01]: So it's five years ago, and we all know what's happened in the last five years from technology perspective and all of the LLMs and the data to our world. [SPEAKER_01]: But back then, it's still a word when NVP is that we wanted to do is a very unique NVP. [SPEAKER_01]: So we started with only Figma, like the build that kind of a big mystery that is look like a app. [SPEAKER_01]: Without code, we took prospects and different companies and ceasers and we walked through what we are going to do or what we are planning and get their reaction.

6:03 [SPEAKER_01]: And I think it's really important when we think about building a product. [SPEAKER_01]: We always look on MVP as a minimum valuable product. [SPEAKER_01]: So what is the minimum set of features that are going to provide the value for customers? [SPEAKER_01]: I go to add to that something that I really believe is not just the MVP, it's the NWP, and even a wallable product. [SPEAKER_01]: So add that wall effect that you see in the eyes of the customer, when you see the disability of a new thing that he didn't have today.

6:32 [SPEAKER_01]: Because what you search is a real pain. [SPEAKER_01]: It's a real value that you can provide on that kind of LVP. [SPEAKER_01]: And it's really hard to get this meaningful. [SPEAKER_01]: A lot of people just going to add more and more features, more and more capabilities that just make everything slower. [SPEAKER_01]: And what we are want to search is DeepBecroop. [SPEAKER_01]: We started with all the fake ones getting that feedback and from that we recruit some developers we start walking on the cold MVP and we really try to keep it iterative with the customer to get their feedback and their ideas on anything that we do to measure how we build that.

7:12 [SPEAKER_00]: Let's stay on that for just a minute, I'm curious about a decision or trade off you had to make in the beginning that sort of shaped how you moved forward and I hear the, I hear the decision to do Figma. [SPEAKER_00]: Maybe I'm, maybe I'm curious about one or two in the product itself that you had to, that you had to make and how you were going to go build it and how you cope with that decision. [SPEAKER_01]: So I think that it's really a difficult question to bring one answer, but what I believe in is that there is a trade-off that we all know between putting a band-aid on a solution right if I want to solve something, right?

7:47 [SPEAKER_01]: I can put a band-aid, do something very fast band-aid in like that. [SPEAKER_01]: The bad way to describe it, but there is like a key support, right? [SPEAKER_01]: Keep it simple, stupid. [SPEAKER_01]: so you can go with the keep it simple stupid approach and do that but you can also do it scalable and good solution that a lot of the time this is the good way to say that over engineering it's the second piece like if you do that so you always move between [SPEAKER_01]: Do I do it in scalable and good, the architecture way, or in doing that come in over engineering, or I need to look on the kind of key approach, and do that like a very simple stupid in the environment, and you ask yourself this question for every decision you do.

8:29 [SPEAKER_01]: I'm still asking myself this question, and then a lot of the thing I wanted to learn in the beginning, and I give you, [SPEAKER_01]: is how to decide. [SPEAKER_01]: How to decide if I need to go the key approach or the kind of like the scalable solution approach. [SPEAKER_01]: And what I learned is that and I actually heard that from other founders a successful founder for, I actually heard that from the founder of checkmops. [SPEAKER_01]: And I really, it really took that to myself.

8:56 [SPEAKER_01]: is that you need to find what makes your special against your competitors against the market. [SPEAKER_01]: And on those things that make you special, you need to do a scalable and very good solution. [SPEAKER_01]: on other stuff that are part of your product, you need to do them, but they're not what can make you special, go kiss and go forward, go fast. [SPEAKER_01]: And I think this really helped me to get those kind of decisions and to decide what to do, what to invest. [SPEAKER_01]: And if I take you back to that time in a panel, we had a very important decision to make if we're going to take the product to solve one of all the other use cases.

9:38 [SPEAKER_01]: And this is what a focus is really important. [SPEAKER_01]: We started with the product that we had to use cases. [SPEAKER_01]: And one of the use cases was more of the dynamic just in time access like what we do today and other was more about reviewing access. [SPEAKER_01]: And it's again, from people out of the market, it's maybe sound really close, but it's actually two different use cases for companies. [SPEAKER_01]: And when we discovered that we needed to choose what we do, we do one of them, we do both of there.

10:06 [SPEAKER_01]: We had prospecting both of them. [SPEAKER_01]: who are the right design partners. [SPEAKER_01]: And we needed to choose between this in the beginning, and I think this is the second piece, is be focused about what you're doing, and we needed to choose and we actually fired customers in the beginning of the company, just to make sure that we are focused about what we're doing.

10:31 [SPEAKER_00]: I'm curious about road map, right? [SPEAKER_00]: I'm curious about how you progress in matured opponent and how you go about building that roadmap. [SPEAKER_00]: Mainly like, how do you go about deciding that, okay, this is the next most important thing to build or to address? [SPEAKER_01]: There is always the excitement that you have in mind that you hear about and you think about more capabilities you can hear and you can add and you excited about them and then you try to remember what your focus and in it to myself it was my focus is to create as much as value that they care to my customers so [SPEAKER_01]: building process need to take that kind of like a thin-dic loop from the customer back to pick the road that they're going to build.

11:15 [SPEAKER_01]: So what we did, we took that into our process and saying, okay, let Paul creating those road map, let's build the mechanism. [SPEAKER_01]: Again, I really like methodologies. [SPEAKER_01]: So we build that kind of like a methodology of how to choose what to build, based on known ice framework. [SPEAKER_01]: They talk about the impact, the cost, [SPEAKER_01]: and our confidence you are about them. [SPEAKER_01]: And we took that and we put them on top of what we care about our vision, about how customer requests, about the opportunities that we have.

11:50 [SPEAKER_01]: And we use this framework to get different scores for what we want to build and we took that. [SPEAKER_01]: into the hypotheses that we are building with the measurement. [SPEAKER_01]: So a lot of the lot of the walk in the beginning it was to create this loop that I'm just describing indeed an happening that they were right. [SPEAKER_01]: So to build this framework of how we measure our success, how our path [SPEAKER_01]: I prophesies we needed to build the analytics frameworks for that, that measure the customer usage, that measure how customer use the product, that asked the customers those questions, and then back to our framework that actually create those new hypothesis and prioritize between them.

12:32 [SPEAKER_01]: And it's really help us and we still use the same framework today in the different scale but definitely the same framework from there. [SPEAKER_00]: Let's flip the team and you're saying we, how did you build that team? [SPEAKER_00]: And what do you look for in those people to indicate that they are the winning horses to join you? [SPEAKER_01]: It's actually very important piece, right? [SPEAKER_01]: Like in the end, the team is everything and we're able to get the right people with you.

12:57 [SPEAKER_01]: It's the only way to go forward because it's your really limited. [SPEAKER_01]: So when we search for the right people, what we looked at is like a culture and vision. [SPEAKER_01]: And those two are the ones that we look at when we look for people to join. [SPEAKER_01]: Of course, the core team was people that I knew and we know from the industry and they join us. [SPEAKER_01]: But what we ask ourselves is one, do they see the same vision like us? [SPEAKER_01]: Do they see this problem as a problem they want to solve?

13:28 [SPEAKER_01]: The day exciting about it. [SPEAKER_01]: You need people that they are excited about the problem. [SPEAKER_01]: Not always, but in the beginning, it's really important. [SPEAKER_01]: They want to solve it, they want to break stuff with you about this problem. [SPEAKER_01]: It's going because if you don't know how the solution is going to look like, you explore the problem space and you learn more and more with time. [SPEAKER_01]: The second piece is culture. [SPEAKER_01]: You want people that they are in your culture and culture is a different thing.

13:55 [SPEAKER_01]: Different people, different companies of different culture. [SPEAKER_01]: Much better than any other culture, it's more about building the culture you believe in, and we know that we want to mark two important pieces one, that we are here to win together. [SPEAKER_01]: We are healed to win as a team. [SPEAKER_01]: We healed to walk out, but walk together and make sure that we understand that we are trying to win the market and get all in about what we are doing. [SPEAKER_01]: In second, it's the end-to-end responsibility.

14:23 [SPEAKER_01]: Everyone of us have the end-to-end responsibility and the idea that you are responsible to provide true value. [SPEAKER_01]: It doesn't matter if it's for the customer or to your teammate, but you are the one that take that care and responsibility. [SPEAKER_01]: these people to the company and those people are stealing the company and they help us to grow and kitticky scar true.

14:50 [SPEAKER_00]: Let's flip to scalability. [SPEAKER_00]: I'm curious how you approach scale from the beginning and I can provide cherry picks to my ideas from some of what you've said already. [SPEAKER_00]: But I'm also curious about as there have been interesting areas we've had to fight scale as you've grown. [SPEAKER_00]: The scale is always with you, right? [SPEAKER_01]: So you always think about scale. [SPEAKER_01]: And again, for different products, scale mean different things. [SPEAKER_01]: But in the end, you want to be able to provide your offering in a way that fits to the customer that you're talking with.

15:22 [SPEAKER_01]: So in some businesses, you start with customer that need a huge scale from your system and in another customer, it's a smaller scale. [SPEAKER_01]: The problem with scale is in the early stage, is that you need to be focused about make sure that you find the right problem to solve. [SPEAKER_01]: and scale is something you will need to solve, but it's not the unique unless it is, right? [SPEAKER_01]: But it's not, you can probably, for us, it's not the unique value or problem that we are solving.

15:52 [SPEAKER_01]: So, you build the full scale, but you put that, not that in a code, you put it in a backup. [SPEAKER_01]: And then you think about solutions, but again, if we go back to this versus scalability, you if it's your call offering, if it's the area that you know that you're going to win about, and you already believe in that, put the effort on do it in a scale way, but if it's just what you need to get. [SPEAKER_01]: 1,000 of APIs request or 100,000 of API requests, you will need to do that and your database need to store those records.

16:25 [SPEAKER_01]: So keep scale for the future and do keys. [SPEAKER_01]: On going, you're going to improve the scalability and it's definitely something you will need to do. [SPEAKER_01]: So this is how women scale. [SPEAKER_01]: And we still walk in on scale today, right? [SPEAKER_01]: With your larger customers and more customers, we're still walking to make our resiliency and scale better every day. [SPEAKER_00]: as you step out on the balcony and look across all that you've built with a Pono. [SPEAKER_00]: What are you most proud of?

16:54 [SPEAKER_01]: I think when I think about a Pono, in the end, we are a product company, right? [SPEAKER_01]: There is two world in a product company, there is a product, and I really proud about our products and to be more specific, I proud about the value that we succeeded to provide a customer. [SPEAKER_01]: Every time customer is saying that he loves the product, that he's the product, really help them, and they walk with that. [SPEAKER_01]: I feel very good. [SPEAKER_01]: I really proud about that.

17:23 [SPEAKER_01]: And the second piece is company. [SPEAKER_01]: And company, for me, it's the people. [SPEAKER_01]: It's the people that live in the company. [SPEAKER_01]: Company, we dark the people of the company, not exist, right? [SPEAKER_01]: So I really proud about our people, our culture, and I really see that. [SPEAKER_01]: So every time I see people, [SPEAKER_01]: do that kind of bring themselves into the kind of epolonial and provide their ideas. [SPEAKER_01]: It's really exciting.

17:50 [SPEAKER_00]: Let's flip the script a little bit. [SPEAKER_00]: Tell me about a mistake you made and how you and your team responded to it. [SPEAKER_01]: I do a lot of mistakes, I did a lot of mistakes, I will do a lot of mistakes and I think and if I go back to what you asked me about the people that I bring in a company and we talk about the winning together, so one of the conflict translation for us as a culture of winning is the ability to learn, right, we will do mistakes and we need to learn from that, we need to create the right processes, retrospective to be able to learn from that.

18:24 [SPEAKER_01]: When I didn't, it would do mistakes. [SPEAKER_01]: I do exactly what I expect from everyone to do mistakes in the company to do, and it's to share the mistake and make that. [SPEAKER_01]: So I did the product mistakes. [SPEAKER_01]: We get into one of the direction that didn't succeed, and I needed to sit with the company and I sure. [SPEAKER_01]: We did an estate. [SPEAKER_01]: I chose the wrong path and we learned from that and this is why we each took a two more time that we wanted and this is what we're going to do for going forward and this is how we're going to improve and the next time.

18:57 [SPEAKER_01]: Everyone here and myself keeping ourselves accountable to make sure we don't do the dismaystake quest, right? [SPEAKER_01]: So it's like learning process more than for a friend and because this is our culture, I feel that people that just see that. [SPEAKER_01]: as, oh, myself, as a human being, as I can take them, that we all do mistakes. [SPEAKER_01]: And, hopefully, it's give them your opportunity to do mistakes, because I don't know anything good that is created without songstakes.

19:25 [SPEAKER_01]: And even sometimes the best thing are happening by mistakes. [SPEAKER_01]: So, I really believe in that. [SPEAKER_00]: let's look into the future then. [SPEAKER_00]: This will be exciting. [SPEAKER_00]: What does a future look like? [SPEAKER_00]: Or a Pono for the product for the company, the team, all the things? [SPEAKER_01]: It's definitely exciting times, like we see that every week, we have a new by a announcement that creates a different earthquake in a different sector. [SPEAKER_01]: And we see this kind of evolution revolution.

19:58 [SPEAKER_01]: on AI and agents coming and then the opportunity it's going to create and the change is going to create but that opportunity and potential it's also create a huge risk with two organizations and it's like a paradox. [SPEAKER_01]: So there is a very strong technology you can adapt. [SPEAKER_01]: but it's create a huge risk in your organization as well and I believe that the panel today is in the best place to be able to lead this ability to leverage this technology in a safe way and I will see us growing and getting into that frontline in the coming years.

20:35 [SPEAKER_01]: and it's going to be interesting because with the technology is moving very fast, but our way to adapt technology always was slower than technology itself. [SPEAKER_01]: So we are seeing technologies, but we don't dare yet with that option. [SPEAKER_01]: We don't even know if we're going to see new technology to model and we need to adapt to that as well. [SPEAKER_01]: So we really into the frontline of helping customers adapt that in a safely. [SPEAKER_00]: Let's wish you a few who influences the way that you were.

21:07 [SPEAKER_00]: Name a person or many persons or something you look up to and why. [SPEAKER_01]: So, first of all, I think I said at the beginning, I really have family definitely attacked and provide me the strength and that kind of a mindset that we can do anything. [SPEAKER_01]: I raised about that kind of mindset. [SPEAKER_01]: My mother specifically building your own business and fighting in a very hard times. [SPEAKER_01]: I really took that to myself. [SPEAKER_01]: be curious and patient and be able to leverage that.

21:39 [SPEAKER_01]: So it's definitely affect me. [SPEAKER_01]: And I must say that in the founder journey, the founder ecosystem, there is many, I don't know if it's one, but the founder ecosystem, it's really, they really help. [SPEAKER_01]: And it's so important to be able to, [SPEAKER_01]: As other founders that already did and will feel a lot of what you are doing, or what you are feeling, and ask for opinion, for the advice and it's really helped for me. [SPEAKER_01]: It was a very helpful thing.

22:08 [SPEAKER_01]: So the founder community here in Israel is definitely stressed. [SPEAKER_00]: Okay, if you're last question, so you're getting on a plane. [SPEAKER_00]: And you're sitting next to a young entrepreneur who's built the next big thing. [SPEAKER_00]: They're jazzed about it, but can't wait to show it off to the world and can we show it off to you right down a plane? [SPEAKER_00]: What advice to give that person? [SPEAKER_00]: Have been gone down this road a bit. [SPEAKER_00]: Are you sure you want to do that?

22:31 [SPEAKER_01]: I think first of all, do what you love. [SPEAKER_01]: don't do it just because someone told you it's all you in a situation you need to do it. [SPEAKER_01]: Make sure you do what you love and then do it 1,000%. [SPEAKER_01]: Right? [SPEAKER_01]: Do it in an extreme way. [SPEAKER_01]: Don't let people to pull you or make you move slower and remember that no one else knows. [SPEAKER_01]: This is one of the things that I really excited about, is I always ask for other people of the opinion.

23:00 [SPEAKER_01]: But you get different opinion from different people. [SPEAKER_01]: All of them are really smart people, you get different opinion, different side. [SPEAKER_01]: No one else knows how to make your business work. [SPEAKER_01]: No one else. [SPEAKER_01]: No, the VC, no, the other founders, no, your friends, they're saying, it's so obvious, so make sure that you get those ideas and decisions that also form other opinions, but make sure that you choose your own journey. [SPEAKER_01]: And then, right to enjoy, it's really fun to build and do that kind of thing you think, and also when it's challenging, still try to enjoy it, and I really [SPEAKER_01]: was a very unique and a very impactful step for myself, so it is what I will say for all Jessica.

23:47 [SPEAKER_00]: That's fantastic advice. [SPEAKER_00]: Well, if you're, thank you for being on the show today, thank you for telling the creation story of Oppo No. [SPEAKER_01]: Thank you.

23:57 [SPEAKER_00]: And this concludes another chapter of Coat Story.

24:11 [SPEAKER_00]: Code Story is hosted and produced by Noah Labhart. [SPEAKER_00]: Be sure to subscribe on Apple Podcasts, Spotify or the podcasting app at your choice. [SPEAKER_00]: And when you get a chance, leave us a review. [SPEAKER_00]: Both things help us out tremendously.

24:28 [SPEAKER_00]: And thanks again for listening.