Shift AI Podcast

The episode contains solid technical insights about the shift from legacy SIEM to federated, in-place security analytics, and the role of frontier models in forcing architectural change. However, much time is spent on personal background (military service, first job in meat factory, Granulate exit story) that doesn't directly inform B2B operators about security operations. The core product/architecture explanations are substantive but somewhat repetitive, and the host doesn't push for deeper specifics on implementation challenges.

“The SIEM approach for it like didn't really change. It's like, okay, duplicate all this data from all those different sources and move it to the siem. You also need to transform it to a particular format.”

“frontier models with amazing reasoning capabilities that can generate zero day vulnerabilities very quickly... the teams are, you know, Nobody will bet his career that one attack path that seems to you like it's probably redundant or probably nobody will attack us from that vector, nobody will do it anymore”

The federated, in-place querying architecture is genuinely differentiated from legacy SIEM vendors, and the framing of AI adoption through a transparency/auditability lens (NL-to-KQL translation) is thoughtful. However, the core narrative about AI-native tools, threat actor models, and the speed/velocity imperative are now widespread in security discourse by May 2025. The positioning of AI as 'scalable engineering capability' is interesting but not deeply explored.

“we enable the customers to index the data in place, meaning that you don't need to egress data, you don't need uh, to transform it anything it just in bucket”

“it creates actually like an abstraction layer which is very powerful because like agents, how they interact in natural language and then you have a deterministic layer that it's completely exposable to an agentic layer”

Sandler is a credible practitioner: 6 years in an elite Israeli military intelligence unit (Unit 8200), early employee #1-10 at Granulate (exited to Intel for $650M), and now CEO of a funded security startup actively selling to Fortune 500 banks. He has lived the problem space across defensive/offensive and cloud cost optimization. However, his primary operating experience predates the agentic era he's now building for, and much of the episode is devoted to background rather than demonstrating deep ongoing customer/operational insights.

“Spent there six years in a very high intensity environment in the military... really leaving that thrill”

“being one of the first 10 employees in such an amazing company... acquired by intel for $650 million”

The episode lacks concrete customer examples, specific metrics on cost/performance improvements, exact timelines for feature rollouts, or data on adoption rates. Sandler mentions 'Fortune hundreds' and 'huge banks' but never names a single customer or provides a case study. The technical description of in-place indexing is conceptually clear but devoid of benchmarks (e.g., query speed improvements, egress cost savings %). The '140 employees' headcount is mentioned, but no data on revenue, traction, or deployment scope.

“we're seeing this amount of energy in the highest point I ever seen it”

“we sold to Fortune hundreds and to huge uh, banks and this was like our first customers”

The host asks reasonable setup questions and some intelligent probes (e.g., about egress costs, the timing of agentic talk), but rarely pushes back or challenges claims. When Sandler makes broad assertions ('nobody can stay in place,' 'the biggest thing is post-Mythos'), the host mostly affirms rather than interrogate. The host also allows long personal tangents (meat factory job, military service) without redirecting to business substance. A few good moments of follow-up (about Mythos/Daybreak and small teams, about velocity), but overall conversational energy is polite rather than probing.

“Got it.”

“Yeah, absolutely.”