Bold Security 行政總裁兼共同創辦人 Nati Hazut 專訪

Nati Hazut is CEO and Co-Founder of Bold Security. He previously co-founded SAM Seamless Network and Polyrize, building experience across connected-device security, identity, cloud permissions, and data protection. His work at Bold applies those lessons to securing interactions between employees, AI agents, and sensitive enterprise data.

Bold Security develops endpoint data protection technology that uses small language models running directly on devices to classify sensitive information and understand how it is being used. Its platform gives security teams controls to coach users, redirect activity, or block risky actions across browsers, desktop applications, and AI agents. In this interview, Hazut discusses shadow AI, on-device intelligence, autonomous agents, and the changing security boundary around enterprise data.

You previously co-founded SAM Seamless Network and Polyrize before starting Bold Security with Hadar Krasner and Omri Mallis. What did you see changing in enterprise security and AI that convinced you there was a need to build another security company from the ground up?

The main thing that AI has done is move where work happens. For decades, the most sensitive things people did with company data happened in browsers and SaaS applications, which is exactly where the security stack was focused. Now more of that work happens on the device itself: people drafting in a desktop AI assistant, pasting source code into a native app, running agents that touch files, applications, and company systems directly on the laptop.

That shift broke the assumptions most security products were built on. Network inspection only sees traffic that routes through it, and desktop applications encrypt theirs and bypass the proxy. CASB sees sanctioned cloud apps. DSPM sees data sitting in cloud storage. None of them see a local file going into a desktop AI app, or an agent moving data with no person at the keyboard.

We started Bold because the endpoint is the one place where all of it comes together. You can see the data, the employee or agent interacting with it, what they are trying to do, and where the information is going. And you can do something about it before sensitive data leaves the company’s control.

Shadow AI can range from employees using personal ChatGPT accounts to desktop applications, browser extensions, APIs, Model Context Protocol connections, and increasingly autonomous agents. Which forms of shadow AI are proving most difficult for enterprise security teams to detect and control today?

A year ago, everyone was concerned about “shadow AI,” but that conversation is starting to go deeper. Enterprise security teams are coming to terms with the fact that employees are adopting new AI tools faster than ever. So the question is less about the inventorying of tools, and more about controlling the data going through them.

Of course you can’t control what you can’t see. And the hardest channels to see are the ones that never touch a network path anyone is watching. Desktop applications read files directly off the device and encrypt their traffic, so nothing routes through the tools built to inspect it. Agents hold access to company information and keep using it without an employee handing them something each time.

All of those are new data exfiltration channels, and what moves through them is the whole question. A public document going into an approved corporate account is not the same event as a customer database or proprietary source code going into a personal one, and that difference is only visible where the data lives and the action happens. So the shadow AI you can’t see is also where the data question matters most.

Bold takes an endpoint-first approach, running AI locally on the device rather than relying primarily on network or cloud monitoring. What can an on-device model understand about an AI interaction that traditional Data Loss Prevention cannot?

Bold does two things differently. First, we use AI to protect sensitive data without having to send that data to another AI service for analysis. Our small language models run directly on the device, where they can understand what data is sensitive, who’s accessing it, and where it’s going. That lets us identify and stop risky actions in real time, without the latency and cost of sending everything to the cloud.

Second, we go beyond the channels traditional security tools monitor. Most of the market is still focused on browsers and network traffic, but increasingly, sensitive data is moving through desktop AI applications, coding tools, terminals, and autonomous agents. These are much harder for conventional DLP and cloud security products to see.

By operating at the endpoint, we can protect data across all of these environments and intervene before sensitive information leaves the company’s control.

Your technology is designed to understand not only what data is being accessed but also the context and intent behind an action. How do you distinguish between legitimate use of sensitive information and behavior that represents an actual security risk without generating excessive false positives?

Context is everything here. You can’t treat every file upload or every agent accessing data like a security incident, or nobody gets any work done.

The same file can be routine in one place and serious in another. A customer list is expected inside the support tool and a real problem in an upload to a personal account. Source code belongs in the repository, not in a prompt to a consumer AI tool.

A tool that only knows the content matched a rule has to flag both cases or neither. That’s where false positives come from. Knowing what the data is, who’s moving it, and where it’s going is how you separate normal AI use from real risk.

AI agents introduce a different security model because software can increasingly access files, invoke tools, connect through MCP servers, and take actions with limited human involvement. How does endpoint security need to evolve when the actor interacting with sensitive corporate data may be an autonomous agent rather than an employee?

Security has largely been built around people, but agents can now act at machine speed, opening files, calling tools, and moving data without someone approving every step. Security needs to operate at that same speed. Many products use AI to analyze incidents after the fact. We use it to understand and stop risky actions in real time, including actions that happen outside the browser.

An agent could work through a desktop application, a terminal, or another tool it discovers while completing a task. Security needs to follow the data and the action across those environments, whether a person or an agent is responsible.

It also raises a question security teams haven’t had to ask before. When something risky happens, did the person mean to do it, or did the agent get it wrong? Those call for different responses. If an employee is making a bad call, you coach them. If an agent is doing something nobody asked for, you stop it.

The endpoint is where you can tell the difference, because it’s where the data, the process, and the action show up together.

Many enterprises have responded to generative AI risks by restricting or banning certain tools. Do you think organizations are moving toward a model where virtually any AI tool can be permitted as long as controls exist around the data it can access and where that data can go?

Blanket bans aren’t going to solve this. Employees can find a new AI tool and start using it in seconds, and most of them aren’t trying to get around security. They’re trying to get their jobs done faster.

The better question is what happens to company data when they use those tools.

If someone is using a personal AI account for harmless work, maybe you just point them toward the corporate account. If they’re about to send source code, customer information, or credentials somewhere the company doesn’t allow, then security needs to step in.

That’s where I think this is going. Give people room to use AI, but put controls around the data. Know what’s being accessed, where it’s going, and when you need to intervene.

Running AI locally has potential advantages for latency and privacy, but endpoint devices also have finite compute and memory. What technical trade-offs did you encounter when building models capable of semantic data classification and real-time enforcement directly on employee devices?

You can’t put a giant model on someone’s laptop, burn through their CPU and memory, and call that security. If your security product makes the computer miserable to use, employees are going to hate it, and IT is going to turn it off.

So there are very real trade-offs. The model has to understand data well enough to tell the difference between something harmless and something sensitive, but it also has to be fast, small, and reliable enough to run continuously in the background.

The initial work was building models that could deliver useful classification on different types of computers without slowing them down. We have already done that engineering work, so customers don’t have to make those trade-offs themselves.

User experience has been our top priority throughout development. Our product uses about 20% of the computing resources that legacy competitors’ non-AI agents use, while making decisions locally as an action happens. Sensitive data doesn’t need to leave the device just to determine whether it’s sensitive.

Bold can identify AI tools, accounts, and agent activity while coaching, redirecting, or blocking risky actions. How do you determine when the system should simply warn a user versus automatically stopping an action?

Think about how a good colleague would handle it. If you’re about to paste a draft into your personal ChatGPT, they’d lean over and say, “Hey, we have a company account for that.” If you’re about to upload the customer database to your personal Drive, they’d grab your arm.

We try to work the same way, and we find coaching is at least 90% effective at redirecting users to the safe alternative. Most cases are someone in the wrong account by accident, or someone who doesn’t know the company’s policy on where data can go.

Where to block is ultimately the customer’s call, and every company draws that line differently. Our job is to give them the context and confidence to make the right one. For more complex risky flows, that means the context we talked about earlier, measured against the user’s own history and even their peer group.

Your career has moved from securing connected devices at SAM, to identity and cloud permissions at Polyrize, and now to protecting interactions between people, AI agents, and enterprise data at Bold. How has your view of the fundamental security boundary changed across those three generations of cybersecurity?

My view of the fundamentals has sharpened. The common thread is bringing security close to where the action happens and making it work at scale.

At SAM, we brought enterprise-grade security to routers with very limited resources. That taught us how to bring advanced technology to the edge efficiently. At Polyrize, we focused on protecting data across cloud and SaaS environments through visibility and security posture management. Understanding exposure is essential, but it doesn’t necessarily let you prevent a risky action.

Bold brings those lessons together. We put intelligence on the endpoint, where people and AI agents interact with data, and give security teams the context to understand risk and intervene in real time.

Network and cloud security still matter, but the endpoint can see activity through desktop applications, local files, personal accounts, and agents running on the device. I’ve learned that where and when security operates matters as much as how intelligent it is.

Looking three to five years ahead, as employees work alongside increasingly autonomous AI agents, what do you expect the enterprise endpoint to become? Could we reach a point where every device effectively operates its own intelligent security layer that continuously decides which humans and agents can interact with particular data?

I think that’s exactly where we’re heading.

The endpoint becomes an intelligent security layer that understands the data on the device, knows whether a person or an agent is interacting with it, and makes decisions locally about what should and shouldn’t happen.

That matters more as agents get more autonomous. Someone could have several agents working on their behalf at once, across files, applications and company systems. Security can’t depend on that person approving every step, because increasingly they won’t be watching.

The data still needs protecting, but the number of actors accessing it will grow well beyond one person at a keyboard. Security systems will need to communicate with agents, make decisions, and respond autonomously as actions happen. The people operating those systems will increasingly supervise the controls and decisions rather than review every individual event. The endpoint is where those decisions can happen while the data is still under the company’s control.

Thank you for the great interview, readers who wish to explore endpoint data protection and secure enterprise AI adoption should visit Bold Security.