Johny Fernandez: This year, AI learned to hack. Anthropic’s Claude Mythos model found thousands of hidden flaws in the software the world runs on, and the number of published software flaws has more than doubled this year, far more than any company can fix. So which ones actually matter? My next guest used to lead Israel’s national red team, paid to break into his own country’s defenses, and now he’s building a company that shows defenders which flaws a hacker can actually reach. But first, a look at the company. The road from an idea to the opening bell starts right now.
Hackers only need to find one weak spot, but companies can have millions of security vulnerabilities. So how do you know which ones actually matter? That’s the problem Alon is trying to solve. After leading Israel’s national red team, where his job was to think like a hacker, he co-founded Astelia. The company uses AI to identify which security weaknesses hackers can actually reach and exploit. And Alon says that can narrow millions of potential vulnerabilities down to just a handful of real risks, and investors are paying attention. Astelia has raised $35 million and says it’s already working with Fortune 500 companies. But as AI makes cyber attacks faster and more sophisticated, can Astelia become the technology companies rely on to stay one step ahead? From Startup to Stock Exchange, Astelia co-founder and CEO Alon Noy is next.
So joining us now here on the floor of the New York Stock Exchange is Alon Noy, co-founder and CEO of Astelia. Hello. Thank you so much for being here, and welcome to the New York Stock Exchange.
Alon Noy: Thanks for having me. Very excited to be here again after a couple of weeks ago. It’s exciting.
Johny Fernandez: So people are just hearing about this company. For people that don’t know who you guys are, meeting you for the first time, you guys made the Fortune Cyber 60 list of the fastest-growing security startups. So what do you guys do? Let’s start with the basics.
Alon Noy: Basic question. The landscape has really changed because of what’s happening with AI. The time to exploit for attackers decreases towards zero. Originally, the defensive teams just don’t have time to fix it in their original cadence. [unclear: “They’ve done it before.”] And what we do at Astelia is just help organizations protect themselves in the age of AI, make sure they can prevent the attackers from exploiting vulnerabilities at a time when vulnerability exploitation is quicker than ever.
Johny Fernandez: So you have a very interesting background, because before Astelia, you led Israel’s national red team. So your job was literally to break into the country’s own defenses. What did those years teach you the most about security and security teams that you never learned in school? This is something that you learned on the job. So walk us through that.
Alon Noy: Yeah, it’s a great point. First of all, I wish in my offensive days I could have had the agentic capabilities that are available to attackers today. My life would have been much easier. But I truly believe that when my co-founders, Nadav and Roy, and I finished our military service in the national team of Israel, we really felt there was a huge gap between what defenders think the offensive guys can do and what they can really do, while the defenders are running after an endless amount of vulnerabilities. They don’t understand that the offensive guys can maybe exploit and leverage only a very small portion out of that. And we understood that there is a huge opportunity, and people in the world can be much more optimistic, actually, about what the defenders can do. But they don’t really look at things from the attacker perspective. And we had a huge motivation to solve this problem.
Johny Fernandez: So let’s keep it simple. How does Astelia work? And what does it mean for a security flaw to be reachable? Let’s break it into simple, normal terms.
Alon Noy: Amazing. Let’s start with reachable, and then it will be helpful to understand what the solution does. So there are a lot of vulnerabilities in the world, right? Every vulnerability can sound traumatic, and it seems like the world can crash because of a vulnerability. At the end of the day, for a vulnerability to truly be what we call reachable and exploitable, a lot of stars have to align. I mean, you have a running process in the machine, and so many network devices, all stars align for a vulnerability to be exposed. And my frustration as an attacker was actually my motivation to build this company, because most of the time those stars just do not align. What we do at Astelia is exactly that: being able to analyze the vulnerabilities and the exposures in the environment of the customer, along with how the environment looks, how to map and model the [unclear: “world infrastructure”], to understand for each and every vulnerability whether it’s reachable or not for attackers.
Johny Fernandez: Exactly. So let me ask you something, because for years companies have ranked security flaws by severity scores. What do most companies still get wrong about their security? Because security is top of mind for everyone.
Alon Noy: Especially these days, with the latest news about [unclear: “PHP and SSH”]. I totally agree. The industry didn’t really have any alternative to those basic risk scoring and risk modeling methods, a lot of stuff like CVSS grades and [unclear: “risk abilities or a few years ago”]. As an industry, we just didn’t have any other tools to use, to be able to analyze what really matters and not base it only on simple ranks and numbers, right? And to bypass this kind of guesswork across the largest enterprises in the world, that’s very difficult. It’s very easy to talk about reachability and what we should do as defenders, but really getting into it and doing it, that’s a huge challenge. I think now, with AI, there is a new opportunity to solve it.
Johny Fernandez: So let me ask you this, because I know AI, obviously you and I both know it’s everywhere, top of mind for everyone right now. This year, Anthropic’s Mythos models found thousands of previously unknown flaws, which is scary to think about in reality. So it showed that it could exploit them. And the question is, how is AI changing the balance between attackers and defenders?
Alon Noy: It’s a great point, and I totally agree. I think that Mythos and other frontier AI models in April were just the beginning of the game, and recently, now with all the latest zero-days published, we see it. Originally, in the problem space of vulnerability management, [unclear: “defensive teams had time to react with no vulnerabilities that went outside”]. You could have seven days to patch, 14 days to patch, whatever. Now we’re just living in a different era. Sometimes there is a new vulnerability out there, and it’s getting exploited the same day, even before the vendor has released a patch at all. What should defenders do? It’s not even a game of prioritization anymore, to focus on what really matters. Sometimes, even if you know what you should focus on, you don’t know how to fix it, and it creates a new, modern gap that we are aiming to solve.
Johny Fernandez: So here’s an interesting stat. Nearly 3 in 10 exploited flaws are attacked within a day of going public. So when attackers move that fast and there is no patch yet, what can a company actually do?
Alon Noy: That’s the most challenging question. In theory, everyone knows the theory, right? Compensating controls and virtual patching, using alternatives that would mitigate the risk if patching is not available. It can be EDR or other security controls like firewalls and WAFs. I think the real challenge we have in the industry is to understand, not how to turn on a firewall rule, that’s the easy part, but how to connect the dots and prove that for a specific vulnerability, the exploitation path would be prevented by this specific control. And to prove it in a way that you can be so confident that you can prove it to yourself as a risk manager and prove it to your auditor, right, from a compliance perspective. I think this is the huge challenge, how to do it and not only talk about compensating controls.
Johny Fernandez: So this is another very interesting stat, because Astelia is one of 29 Israeli-founded companies on this year’s Cyber 60. So that’s nearly half the list. Why does Israel keep producing so many cybersecurity companies?
Alon Noy: First of all, a very proud state. I mean, I’ve been 15 years in national service, and I’m the former leader of the Israeli national red team. I feel lucky and glad to be an ex-commander in the military of many of the other founders out there right now. I think Israel, we won’t get too much into the political situation, but Israel has a lot of challenges, and we are few against many. And I think our ability to create the cybersecurity pillar or something, that is an unfair advantage for us. To call it best of breed would be an understatement. It’s something that you get through this training and as a group that you grow together. And I was very lucky to work with hundreds of people over there on this journey. I’m not surprised that so many people out there are taking their skills and their ideas and taking them to the next level. It’s a very different game, but also a very similar game, sometimes the nation-state game versus protecting the largest global enterprises of the world. So there is a lot of interesting technology and things behind the scenes in both of those games.
Johny Fernandez: The record for published software flaws, broken and then some. Every publicly known security flaw has a tracking number called a CVE. Last year it set the record, about 48,000 of them. This year, by late October, that count has already passed 86,000. That’s nearly 80% above all of last year, with two months still to go to end the year. The third quarter alone brought more than 36,000, more than any full year before 2024. And the critical severity flaws are up nearly threefold. One big factor, analysts say, is that AI models like Anthropic’s Mythos are now finding bugs at a scale human researchers could never have found. So for security teams, the math is brutal, and no one can patch them all. So the question becomes, which ones can an attacker actually reach?
We’re back, and joining me to continue the conversation about this is Alon Noy, co-founder and CEO of Astelia. Hello. We were just having such a fascinating conversation about what you guys do, your background. So you just heard it on the record: published software flaws have nearly doubled this year. What does that flood do to a security team on the ground?
Alon Noy: I mean, if you think about it, even before this flood, after Mythos and all the AI stuff, that was a huge challenge, almost an unsolvable challenge. And then, even at the end of 2025, before April ‘26 with all the Mythos stuff, the industry understood that about 88% of the vulnerabilities that were actually exploitable, [unclear: “a cost bridge”], were not tagged as exploitable in the industry. So there was already a huge challenge before. I think what is happening now is that, with all the involvement of AI and the Anthropic stuff, the urgency level is not only across the technical teams, the vulnerability management leaders and security leaders who have been drowning in vulnerabilities for years already. Now the pace is much faster, but it doesn’t move the needle for them. It really moves the needle at the strategic level, the board level, and it’s a huge opportunity for the industry. We’re working with a Fortune 20 company whose CEO got a phone call from the White House asking what they do about Mythos and the new era of exploitation. So there’s a lot of energy and focus right now to help those teams solve this problem that seemed unsolvable before. And now we have no alternative as an industry but to do everything we can to solve it.
Johny Fernandez: And I think a lot of the questions that people are asking is, how do you solve it? But you guys had a customer that went from about 40 million flagged vulnerabilities to fewer than 2,000 that were actually reachable. That’s a big drop. So what does that change for a company day to day?
Alon Noy: It’s a great question. It has many different aspects. First of all, think about it. A CISO wakes up in the morning and needs to report the amount of vulnerabilities and exposures they have, and he has dozens of millions. I mean, of course, he has nothing to do with that. The patching team is across the IT department, and many times the IT and security teams are in different areas of the organization. They have nothing to do with it, and they know the risk. And at the board level, especially now with what’s happening because of Mythos, they are asking them every day what’s going on with this newly published zero-day. One of our customers actually described it as an opportunity to drive trust and credibility between security and IT, when they get this kind of glance from the attacker perspective and the ability to focus on what’s really reachable. Not only does it transform the problem into a manageable one, now they can really reduce their time to react to those vulnerabilities, in terms that would let them defend themselves against the next generation of attackers, but it also makes sure the whole organization is on the same page. It creates trust between all departments, from business to IT to security.
Johny Fernandez: So the other thing is, you guys are really solving a problem, because obviously this is something that’s ongoing. There are a lot of questions about it. So the question is, who’s using Astelia today? And what is the first thing a new customer usually discovers about its own network? Because that should be eye-opening in itself.
Alon Noy: Yeah. So first of all, from the customer base perspective, we’re glad to work with the largest customers in the world. I can mention Royal Caribbean as one of our flagship customers, and a few other Fortune 100, 200 companies. Mostly focused in the US, but also some very nice customers, like the second largest bank in South Asia, OCBC in Singapore. I think there are two kinds of aha moments with our customers. First, it has nothing to do with the traditional aspect of vulnerability management. When we are mapping and modeling their network topology, we uncover so many blind spots that are difficult to find even for the IT teams, not to mention the security teams that very much rely on those IT network teams. That’s kind of mind-blowing. Second, and this refers to the previous question you asked, is this funnel that we show, the ability of Astelia to get to less than 1% that are reachable, based on proof, not on a fluffy buzzword and marketing, and not on risk modeling and guesswork. Being able to prove the only ones that are reachable, it’s fascinating for them. And from an emotional perspective, it kind of lets the defender look at the network, at the environment, through the lens of the attacker.
Johny Fernandez: So you guys came out of stealth in February with $35 million. What has surprised you the most in your first year?
Alon Noy: Wow. It’s a very, very difficult question. This whole journey of being a founder is very challenging. I think the most surprising thing is to see how difficult it is sometimes for security teams to motivate the business units and the IT units, making sure they’re all aligned on the same page. Because many times, if you ask a security leader what’s top of mind, what are the challenges that you are coping with, it does not always align with his boss on the IT side, whether that’s the CIO or the leadership in the business unit. I’m glad, and I must say I feel very lucky, to run a company like Astelia in these specific days, where now I think everything is aligned and everyone is on the same page, because it’s a top initiative for everyone. Even the business leaders understand that if they do not tackle this problem, the business could shut down because of security reasons. And we just saw yesterday what happened with Microsoft around the world. Imagine that it would happen, no one knows, maybe it does happen because of a security problem, I don’t know, but just imagine a security breach causing that.
Johny Fernandez: Yeah, it’s definitely interesting. So this is another topic, because security is top of mind for everyone. AI agents that work the flow from disclosure to fix, you guys launched that specifically. So how much should an AI be allowed to change on its own? Safety is obviously top of mind. And where does a human stay in charge when you guys launch something like this?
Alon Noy: First of all, we have no choice. Let’s start with that. The only way to fight attackers that have machine speed is to have that same machine speed on the defenders’ side. Now my take, my personal and professional take with the Astelia team, is that most of the industry right now is talking about autonomous remediation and automated patching. I truly believe that letting AI agents run automated patching is very dangerous. That can break down a business much quicker than the attacker will. This is exactly why at Astelia our focus is on understanding truly how the attack path looks and finding multiple nodes across the chain, how to cut the graph and prevent the exploitation from the attacker. Because of the way we analyze the environment, we can truly prove that not only will it cut the attack graph, but it will be safe from the business perspective. And when you have this kind of knowledge and you can create this context from your customers, then truly driving autonomous remediation and mitigation by those agents, I think that makes much more sense.
Johny Fernandez: So let’s talk about the future, because right now we see big players moving into this space. Tenable is now using Anthropic’s Mythos to map attack paths out. So when giant companies enter your space, and obviously we’re going to see this more in the future, this is nothing that’s going to stop, how does a startup compete?
Alon Noy: It’s a very good question. I’ll take this question even to a more generic perspective. I mean, what is the moat of companies in the era of AI? Because everyone has access to those AI agents and to those models. And I truly believe that the only way to compete, and generally the moat in the AI era, is data, nothing but data. When you look at Tenable, CrowdStrike, Palo Alto, Check Point, Cisco, the largest security companies in the world, they have a huge amount of data that Astelia and other amazing startups don’t have yet. We will be that size one day and we’ll have it, but we don’t have it yet. Our ability to compete is generating data that only we can generate. That is our unique IP. In this case, it’s mostly around the exploitability analysis and the ability to figure out and map the network topology. This is a piece of data that, I see it in the market, a lot of people talk about it, it’s very easy to post on LinkedIn about it, but no one really has it and no one really proves it to the customer. This is my angle: I can leverage AI without tons of data like the incumbents have, but on a specific context that only I can drive, and that’s what’s great for me, an unfair advantage that allows me to penetrate the market as successfully as we’ve done so far.
Johny Fernandez: All right, and we have a couple of seconds left. So what do you see yourselves as in three years? And you’re here on the floor of the New York Stock Exchange, so is listing part of the plan? We just heard the ringing bell earlier.
Alon Noy: I mean, I’ll tell you something personal about myself. [unclear: “We ran a study for a couple of years.”] I’ve been in Israel, and I have an amazing wife and three kids. When people ask me how big it will go, I answer them back with a question: you tell me if, after [unclear: “a two years living in Israel”], you would move with a wife and three kids, ages 1 to 7, not to go all in and get to this incredible moment at the New York Stock Exchange. So we’re all in.
Johny Fernandez: Awesome. Well, listen, it’s exciting to see you guys and see what’s next for you. So congratulations, and thank you for joining us here today.
Alon Noy: Thank you very much.
