Bloom Security on Sherman - Israeli Startups

Love at First Sight From the First Week: How Bloom's Founders Chose the Team Before the Problem, and the Research Before the Pitch

Sun, 16 Aug 2026 08:59:00 +0100

Itay Keren played handball in the Israeli national league, and he’ll tell you that’s the reason he knew inside a week that Bloom was going to exist — about five years before it did.⁵

The week in question was his first at Dig Security, sometime around 2021. He, Ofir Balassiano and Itay Frishman joined as the core team. Keren’s description of what happened next is not a sentence you expect from a man who now sells endpoint security to CISOs:

“Honestly it was love at first sight from the first week. We just clicked, the way a great team does on the court. The pace, the trust, the way we challenged each other.”

Two and a half years later Palo Alto Networks bought Dig. All three went inside. And then, in late 2025, all three left within weeks of each other to start something together — without knowing what it was.

On 30 July 2026 that something came out of stealth as Bloom Security with a $20M seed, co-led by Glilot Capital Partners and Ten Eleven Ventures, with Okta Ventures and Runtime Ventures participating. Axios Pro broke it. CTech followed. Roughly a dozen outlets ran variations of the same release, and the number was the story in all of them.

The number is the least interesting fact here.

Two things happened before it, and neither made the coverage. They picked each other before they picked a problem — deliberately, as doctrine, and Keren will explain the mechanics of it on the record. And then, for six months, they published original vulnerability research under a company name nobody could look up.

This piece is built on a Q&A with Frishman and Balassiano conducted in August 2026, on the record, plus Bloom’s published corpus and the founders’ own posts. Where’s no answer, we say so.

Same Faces, Same Scars

Keren has written about his selection criteria for co-founders and framed the whole thing through sport. “You need people who’ve been in the fire with you. People who were there at 2am because a deal mattered. People who know what your silence means.” His line about the roster that won things: same faces, same scars.

The sport was never public until now. Handball, professionally, in the Israeli national league.

“Team sports at that level teach you something you can’t learn anywhere else: you win or lose based on who’s standing next to you. Talent matters, but chemistry matters more.”

You can file that under founder poetry if you want. Hold the thought until the last section, where it turns into an operational answer about how thirty people shipped an enterprise platform in nine months.

The three biographies are worth laying out, because none of them is the origin story the category usually runs on. Keren was a submarine officer in the Israeli Navy before Demisto around 2015, then Dig, then Palo Alto — an engineering and sales-engineering career that has now survived two acquisitions. Balassiano came out of Mamram, the IDF’s central computing and software unit, through Cognyte and XM Cyber, then Dig from day zero, then roughly two years leading cloud and AI security research inside Palo Alto. Frishman came out of Unit 81, the IDF’s classified technology R&D unit, and spent four years across Dig and PANW building the core of their data and AI posture management products.

No 8200. A submariner, a software-corps researcher, and a classified-hardware R&D lead.

One correction while we’re here, since it keeps getting repeated. Dig’s acquisition was widely reported in the Israeli press at $300–400M. Palo Alto’s own FY2024 10-K puts total consideration at $255.4M — $247.6M cash plus $7.8M in replacement awards.⁶

Keren’s account of what happened after it:

“After Dig was acquired by Palo Alto Networks, there was never really a question of ‘if’ we’d start a company together. It was only a matter of ‘when’ and ‘what.’”

Nine Names

Every piece of launch coverage carried the same line about Bloom’s angel investors: founders of Dig Security, Demisto, Snyk and Talon. Nobody printed who they actually are. Bloom named them for us:

Dig — Dan Benjamin, Gad Akuka, Ido Azran. Demisto — Slavik Markovich, Rishi Bhargava, Dan Sarel, Guy Rinat. Snyk — Guy Podjarny. Talon — Ofer Ben Noon, Ohad Bobrov.

Ten people, four companies. Keren has separately named Benjamin, Azran and Akuka as his mentors, alongside the Demisto four. Which means it’s the people who watched these three work at close range, for years, writing personal checks on that basis.

For context on the round itself: per YL Ventures’ State of the Cyber Nation, Israeli cyber raised $4.4B across 130 rounds in 2025, up 9% in dollars and 46% in round count, with an average seed of $9.6M. Bloom raised roughly double that average. More telling than the dollars — endpoint security went from one seed round in 2024 to eleven in 2025. Bloom is the leading edge of a wave that was already forming.

There Was No Aha

Keren’s launch essay contains the sentence every founder profile is built around: “The day we understood that gap was the day Bloom started.” I asked which conversation that was and what the person said.

He pushed back on the question, and the pushback is better than an answer would have been.

“Honestly, I’ll push back on the premise a little: it wasn’t one conversation. That’s the thing people get wrong about ideation. It’s rarely a single aha moment.”

What he describes instead is hundreds of conversations with CISOs, and three composites that are worth reading slowly because they are the entire product thesis in plain language:

“One CISO tells you employees are running desktop AI agents that can read files, click buttons and take actions on the endpoint, and he has zero visibility into any of it. Another tells you developers are connecting MCP servers to their tools faster than security can even catalog them, each one a new door into the environment. A third tells you about agent skills, capabilities their agents are picking up and executing, and admits nobody in the company can answer a simple question: what can these agents actually do right now?”

And then the part that explains why the team-first sequence works:

“No single one of those conversations is the idea. But when you analyze all of them together, you reach a point where you understand the problem better than anyone. You become a subject matter expert in the gap itself.”

Keren has published his test for whether a problem is real, and it’s usable by anyone: leadership and the people on the ground describe the exact same pain; they’ve already burned time or budget trying to patch it themselves; and something changed recently enough to make the old workaround impossible. His tell for finding it is the mess built around it — “the workaround someone rigged up months ago and still babysits, the spreadsheet quietly holding a broken process together, the vendor everyone pays for and no one trusts.”

Before They Had a Name

On 1 February 2026, a company that did not publicly exist published a threat-intelligence post.

It kept doing that. By the time Bloom launched on 30 July, eleven research posts were live under a name nobody could look up, on a blog organised like a research lab rather than a marketing site — categories for threat intelligence, security research and tooling, named campaign tags (Hades, Mini Shai-Hulud, OpenClaw, Moltbot), and four credited authors: Keren, Balassiano, and researchers Moriel Harush and Golan Myers.

The obvious read is content marketing with a long runway. Balassiano’s answer says something more interesting than that.

The engine existed before the company did.

“We’d already started building our agentic software analysis engine back then, and when the marketplace for OpenClaw plugins surfaced, we pointed the engine at them. What we found was dozens of malicious plugins.”

So the research posts weren’t produced to generate demand. They were the product’s exhaust — output from a system that was already running, pointed at whatever marketplace happened to open that month. Which reframes the whole stealth period: Bloom wasn’t quietly building toward a launch and doing some content on the side. It was operating the core of the product in public, under an alias, against live campaigns, and publishing what fell out.

His reasoning for shipping it with nothing to sell:

“Even in stealth, that’s not something we could keep to ourselves. We wanted people to see the actual exposure and make their own decisions about it. For a security company, that’s also how you earn the right to be heard — we were claiming there’s a whole layer of the endpoint no one else was looking at, and the research was the proof, before there was ever a pitch.”

The output over those six months: 37 malicious AI agent skills caught across three active campaigns, live under a week — 33 with hidden command-and-control backdoors, two with Python reverse shells, two exfiltrating .env files to webhook.site. An active campaign against the VS Code Marketplace. The TeamPCP attack chain, from a compromised VS Code extension into GitHub’s source code. And License to Skill, which tested SKILL.md across 31 agentic clients and found that the instructions travel perfectly while the safety frontmatter does not — the fields meant to constrain which tools a skill can run are honoured by a handful of clients and silently ignored by the rest. As Bloom put it: your allowlist might gate execution, limit scope, get rewritten into nothing, or simply vanish, and nothing tells you which one happened.

A rule that parses cleanly looks like a safeguard. Reviewers count on it. In most runtimes it was never enforced.

The Dialog That Never Fires

The sharpest thing Bloom published in stealth was a Claude Code finding, credited to researcher Golan Myers.

Take an ordinary GitHub repository. Add one innocuous configuration file. Open it the way you open anything.

“Within seconds — no click, no approval, often not even a warning — we were running commands on the machine and watching secrets leave it. And it doesn’t stop when you do: it survives closing the repo and rides along in every session after.” — Balassiano

“Nothing was ‘hacked.’ Every piece we chained together is an approved, working-as-intended feature.”

Bloom reported it to Anthropic. Then said publicly that they don’t fully agree with where Anthropic drew the line. I asked Balassiano to be specific about where each side sits.

“Anthropic’s position is that the workspace trust dialog is the security boundary for project-level config — because you have to accept trust before that shell-executing setting runs, they consider the attack mitigated. I think that architecture is correct.”

Then the objection, which is one gap wide and hard to argue with:

“My disagreement is with one gap in it: trust is inherited recursively. If you’ve ever trusted ~/projects — a completely normal thing to do — you’ve pre-approved every repository you’ll ever clone into it, including ones that don’t exist yet, including the attacker’s. So for most developers in most real scenarios, the dialog never fires at all. A boundary that’s bypassed by design for the majority of your users isn’t doing the work it’s supposed to do.”

He’s holding that position from inside Anthropic’s own security integrations programme — Bloom says it was selected for the programme around Claude’s Compliance API.⁴

We didn’t ask Anthropic for its side. That’s a gap in this piece. But the disagreement itself is the useful artifact: a seed-stage vendor publicly telling a frontier lab that its security boundary doesn’t fire for most of its users, while sitting in that lab’s partner programme, is not standard behaviour in a category where everyone would rather have the logo than the argument.

What It Actually Does

Frishman has the best explanatory frame in Bloom’s corpus, and it isn’t about AI at all.

Supply-chain attacks don’t pick the lock. They walk in behind a real badge. “Shai-Hulud doesn’t break in. It tailgates the update. Same publisher, same verified badge, same install you’ve run a hundred times.” And once inside: “It doesn’t bring its own burglar tools. It finds yours, already on the workbench.” It runs TruffleHog to hunt secrets. It republishes itself using the developer’s own GitHub and npm credentials. In the related Nx attack it recruited the AI CLI tools already installed on the machine to go looking for credentials.

The Nx Console extension had 2.2 million installs and a verified badge. A poisoned AsyncAPI extension exfiltrated for nearly a month — just because no alarm pointed at that door. And GitHub itself disclosed that a poisoned VS Code extension on an employee device led to roughly 3,800 internal repositories being exfiltrated.¹

Keren’s version of the same argument is aimed squarely at every AI-discovery dashboard on the market: a list of 400 AI tools answers the old question, what exists. “Until you can judge each one by how it runs and what surrounds it — and act on it — you don’t have a handle on the surface. You have a spreadsheet.”

Bloom ships five modules against that:

Live inventory — everything running on an endpoint, including who built it, what it can reach and where it came from.
Contextual risk analysis — marketplace intelligence, static analysis and behavioural sandboxing, scored per endpoint.
Granular remediation — previews what breaks and who’s affected before it acts, then notifies them.
Supply-chain prevention — blocks packages and skills at the source across npm, the Chrome Web Store and Open VSX.
AI guardrails — scales over-permissioned MCP servers back to safe defaults.

Three product answers from the Q&A that aren’t in any launch coverage, and that a CISO would ask in this order.

On “agentic, contextual, per endpoint.” Frishman says the phrase describes granularity of judgment, not a process running on every machine.

“The same extension can be perfectly fine on a developer’s machine and a real risk on a finance laptop, so there are no global verdicts.”

The agent revisits its conclusion whenever the software or the endpoint changes — which is the actual supply-chain case: a trusted extension changes ownership, a new version requests permissions it never needed, a package quietly adds behaviour unrelated to its stated purpose. Yesterday’s safe verdict doesn’t carry into today’s compromised version. It also lets policy be written as intent rather than as an allow list: AI agents are fine for engineering, not on machines that touch customer data.

On where detonation happens. In Bloom’s cloud, not on the device. They sandbox marketplace software at the source, before it reaches anyone’s fleet. What leaves the laptop is inventory and metadata about how software is used — “no file contents, no documents, no browsing data, no code. The endpoint receives verdicts; it doesn’t ship your data out to earn them.”

On onboarding taking minutes. There are two modes, and the light one is agentless: Bloom rides the EDR or MDM the organisation already runs — CrowdStrike, Intune, Jamf — and dispatches an ephemeral sensor across the fleet that runs, collects software-posture metadata, and terminates. No persistent agent, no admin rights on user machines. The heavier mode is a full agent for continuous coverage, pushed through the existing MDM in one automated process.

Thirty People, Nine Months

Bloom was founded in late 2025. It launched in July 2026 with thirty people, all in Israel, SOC 2, five shipped modules and what it describes as dozens of enterprise deployments.² That’s roughly nine months.

Frishman has written that every engineer at Bloom effectively runs a team of agents, and that work which took four months five years ago now fits inside a two-week sprint. I asked what broke the first time they ran R&D that way.

“The honest answer is that less broke than you’d expect, and the reason is boring: most of this team has worked together for years, across previous companies. We already knew how to run together, so when the ground shifted we adjusted in stride rather than in crisis.”

What did change was planning.

“Our old planning assumed the unit of work was an engineer writing code. Once a 4-month project fits in two weeks, that model stops describing reality: things we expected to be hard shipped in a day, and things that looked trivial stalled because the agents lacked the context to do them well.”

So the sprint changed shape. Engineers’ primary job became building the infrastructure, the skills and the encoded organisational knowledge that let agents work properly in Bloom’s environment — and sprints now budget explicitly for that layer, because an hour spent there pays out across every project that follows, while an hour spent brute-forcing a feature pays out once.

I asked whether anyone good couldn’t work that way. He says they didn’t hit it, and again credits the history: experienced engineers who already think in leverage rather than lines of code, and who trust each other enough to change how they work without feeling threatened by it.

“When execution is nearly free, the thinking is where engineers earn their keep.”

So the handball answer wasn’t decoration. Thirty people changed how they build software in the middle of a build, and nobody fought about it.

It’s the inverse of the problem Sherman keeps running into. Ziv Mizrahi building a game engine alone, Jordan Winston as the host and the salesman and the face, Rachel Fiegler with the operating knowledge living in two people’s heads — all of them stuck on the same wall, where the thing that makes you good is the thing you can’t hand off. Bloom’s founders solved that before they had a product, by refusing to build without people they’d already been in the fire with.

Golda

Bloom has a Chief Dog Officer. Her name is Golda, she’s been there since day one, she comes to the office on Harav Ashi every day, and per Frishman she “personally interviews every new dog who wants to join the team.”

It’s a joke. It’s also the tell. In the same nine months this company hired a dog, published eleven pieces of research nobody asked for, argued with Anthropic in public, and built a prediction market for Black Hat gossip because, in Keren’s words, the cyber industry runs on threat intel and gossip, mostly gossip.

None of that is what a seed-stage company does to close a round. All of it is what a group of people do when they’ve already decided they’re working together for the next several years and are figuring out the rest as they go.

You win or lose based on who’s standing next to you. 💜

Fast facts: Bloom Security

What is Bloom Security? An Israeli endpoint-security company securing what it calls non-binary software — browser extensions, IDE plugins, packages, MCP servers, agent skills and AI agents — through live inventory, per-endpoint contextual risk scoring, remediation with blast-radius preview, and install-time blocking across npm, the Chrome Web Store and Open VSX.

Who founded it? Itay Keren (CEO), Ofir Balassiano (CPO) and Itay Frishman (CTO), all three from Dig Security and then Palo Alto Networks. Founded late 2025. Around 30 people, all in Israel. Offices at 6 Harav Ashi St., Tel Aviv.

What did it raise? $20M seed, announced 30 July 2026, co-led by Glilot Capital Partners and Ten Eleven Ventures, with Okta Ventures and Runtime Ventures participating. Angels: the founders of Dig, Demisto, Snyk and Talon — ten named individuals. Valuation undisclosed.

How is it deployed? Agentless via existing EDR/MDM (CrowdStrike, Intune, Jamf) using an ephemeral sensor, or as a full agent pushed through MDM. Sandboxing runs in Bloom’s cloud against marketplace software, not on employee devices.

What’s verified and what isn’t? Funding, headcount, launch date, founder backgrounds and the research corpus are verified. Customer count, ARR, pricing, OS coverage and the Anthropic partnership are not.

Contact: bloom.security · info@bloom.security · all three founders respond to LinkedIn DMs and openly solicit them.

Notes on the numbers

We publish what we can verify and label what we can’t. Here’s the honest ledger for this piece:

The ~3,800 internal repositories exfiltrated via a poisoned VS Code extension traces to GitHub’s own public statement, which was itself based on the attackers’ claims. Bloom pointed us to the source. Treat it as GitHub relaying an attacker’s number, not as an audited count.
“Dozens of large enterprises” is self-reported and unnamed. No ARR, no ACV, no pricing. The only named public reference is Paychex’s CISO, who also sits in lead investor Glilot’s CISO advisory network.
Glilot’s Kobi Samboursky called Bloom’s early traction “unprecedented for a company at this stage.” That is an investor describing his own portfolio company, which is why it doesn’t appear in the body of this piece.
The Anthropic security integrations partnership is sourced only to Balassiano’s own post and has not been independently confirmed. Anthropic was not asked for comment on the disclosure disagreement described above; if it responds, we’ll update this piece.
The handball career, the mentor names and the account of Dig’s first week come from Keren’s own statements and are not independently verifiable.
Dig’s acquisition price is $255.4M total consideration per Palo Alto Networks’ FY2024 10-K, against the $300–400M widely reported in the Israeli press at the time.

Lazy Digest #3: Six Startups Raised to Babysit Robots. One Sold for $1B.

Tue, 04 Aug 2026 09:00:00 +0100

Lazy Digest #3: Six Startups Raised to Babysit Robots. One Sold for $1B.

Seven Israeli companies made news this week for solving the same problem: deciding what a piece of software is allowed to touch when no human is watching.

One of them — Oasis Security — got a $1 billion offer. The other six raised $278 million between them. All in five days.

That’s the week. Everything else is context, and the context is good, so stay.

Lazy Digest #3 — Israeli tech, one week, researched with AI and filtered by a human who reads the primary sources. Estimates are labeled as estimates. Let’s go.

The Billion

Cyera signed a letter of intent on Tuesday to buy Oasis Security for approximately $1 billion — roughly $700 million in cash, the rest in Cyera shares, expected to close later this year.

The numbers around it are more interesting than the number itself.

Oasis was founded in 2022. It raised about $195 million and was valued at $700 million in a March Series B led by Craft Ventures. Four months later it’s selling for a billion. The company’s own claim is that it’s the fastest cybersecurity company ever to go from launch to a $1B sale, and nobody’s rushed to correct them. Founders Danny Brickman and Amit Zimerman met in Unit 81 — Brickman did 11 years there through the Talpiot program. Roughly 170 employees are set to share more than $100 million in option exercises, and the founders are looking at a $200M+ payday.

The buyer’s math is worth its own paragraph. Cyera — founded 2021 by Yotam Segev and Tamar Bar-Ilan, also Talpiot and 8200 — raised $600 million at a $12 billion valuation last month and is estimated to run north of $200M ARR across 1,500+ employees in 18 countries. This is not their first purchase. It’s their sixth: Trail Security ($162M), Ryft (est. $100–130M), Genie Security (~$50M), plus Otterize and Shape AI. Oasis brings their total acquisition spend to roughly $1.35–1.4 billion.

Cyera isn’t building a product line anymore. It’s assembling one, with a chequebook, at a pace most companies reserve for hiring.

The multiple deserves a flag. Virtru’s analysis puts Oasis at $10–20M ARR, which prices this at 50–100x revenue — above Google/Wiz (46x) and Okta/Auth0 (43x). That’s an estimate on an undisclosed number, so hold it loosely. But even loosely held, it tells you what the market thinks it’s buying: not a business, a position. Cyera knows what your sensitive data is. Oasis knows which non-human account just asked for it. Segev’s framing in the announcement blog is the cleanest version — knowing your data isn’t much use if you can’t govern what touches it.

The stat both companies keep repeating: non-human identities inside Fortune 500 organizations grew nearly 500% in six months. Company-sourced, unaudited, and directionally impossible to argue with.

The Six Behind It

Here’s what makes this week different from an ordinary big-exit week. Within days of Cyera–Oasis, six more Israeli startups raised for variants of the same question:

Onyx Security — $113M Series B at roughly $640M, led by Bessemer. Four months after coming out of stealth with $40M. Founders Maxim Bar Kogan and Gil Elbaz. Manages what enterprise AI agents are permitted to do and watches what they actually do.
Act Security — $60M out of stealth. A $20M seed (Team8, Bessemer, Hetz, Claltech) plus a $40M Series A (Notable Capital, Startpoint, SVCI), announced together. This is the Medigate team — Jonathan Langer, Itay Kirshenbaum, Stephen Goldberg, Ilai Fallach — who sold to Claroty for $400M in 2022. Their claim: about 97% of cloud access sits dormant.
Mate Security — $35M Series A, led by Canaan with Insight, Team8 and Microsoft’s M12. Eight months after a $15.5M seed. Wiz and Microsoft alumni, building an agentic SOC, reporting 500%+ growth since Q3 2025.
Hush Security — $30M Series A, Akamai joining as strategic investor alongside Battery and YL. Meta Networks alumni. 31 people. Kills standing credentials for agents in favor of just-in-time permissions and one central kill switch.
Way Security — $20M seed, co-led by Insight and Glilot. Ex-Sygnia founders. An execution layer that automates running IAM systems rather than replacing Okta.
Bloom Security — $20M seed, led by Glilot and Ten Eleven, with Okta Ventures and Runtime. Palo Alto and Dig Security alumni securing agents, MCP servers and browser extensions on employee devices.

Six companies. Six founding teams with real pedigree. One problem, sliced six ways.

Now the caveat, and it’s the same one as last week because it keeps being true: these rounds closed months ago. What you’re watching is announcement calendars converging on a hot category, not $278 million arriving in July. Anyone building a thesis on “the week agent security exploded” is reading a PR schedule.

Still — six comparable rounds landing in one week is its own signal, just not the one it looks like. It means six sets of investors independently reached the same conclusion in the spring, and now every one of those companies has to differentiate in a market where the thesis is common property. Onyx and Mate are already competing on velocity numbers rather than ideas. That’s what a crowded category sounds like early.

Also in the AI-application layer, less crowded and worth naming:

Harmony — $34M seed led by Lightspeed, founded by the Epsagon team (sold to Cisco for ~$500M), dropping 100+ prebuilt agents inside Slack and Teams. Customers include n8n and eToro.

Encore AI — $30M Series A led by Team8, with Harel and Bank Leumi converting from customers to investors — always the strongest signal on a cap table. Founded by Dr. Dvir Ginzburg. Trains agents on recordings of a company’s top performers, which is either brilliant or a management consultant’s fever dream, and 40+ enterprises are paying for it.

Modus — $10M seed led by Insight. Founded this year by ex-Lusha and ex-Cyera people. A “context warehouse” that feeds agents only relevant context to stop them burning tokens on noise. Twelve employees.

Two Chip Stories, Opposite Directions

Xsight Labs raised $300M+ at a $2.8 billion valuation on Thursday, led by Fidelity with a long list including Intel Capital, T. Rowe Price, Battery, Valor, Maverick and Aliya. Run from Kiryat Gat, chaired by Avigdor Willenz, competing directly with Nvidia-Mellanox.

The valuation is more than 5x its 2021 mark of roughly $500M, and the timing isn’t subtle: the raise landed a week after Xsight’s X2 programmable Ethernet switch was validated aboard SpaceX’s Starlink V3 satellites. The pitch is power, not peak performance — 12.8 Tbps under 200W, sub-700ns latency, around 40% lower power than legacy switches at that speed, per the company’s own release. In a year where every AI conversation ends at the electricity bill, that’s the right thing to be selling.

An Israeli-designed switch shipping on satellites in orbit is also just a good week for the ecosystem, and nobody outside the industry will hear about it.

Hailo sold to Microchip. Terms undisclosed, deal signed July 24, expected to close by September 30.

Founded 2017 by Orr Danon and Avi Baum. Raised roughly $344 million from the Zisapel family, OurCrowd, Idan Ofer, Gil Agmon, Poalim Equity, Maniv and others. Peaked above a $1 billion valuation. Then: liquidity crisis, emergency loans, layoffs, a SPAC merger that collapsed as the valuation sank below $500M. Now an undisclosed price that everyone reporting on it describes as a fraction of what came before.

The most brutal line in the whole story is in Microchip’s own filing: the transaction “is not expected to have a material impact on Microchip’s financial results.” A company that raised $344 million and once cleared a billion in valuation is, to its acquirer, a rounding error worth mentioning for legal completeness.

Two mitigating notes, because this isn’t a morality tale. Industry sources expect Danon to stay on and most of Hailo’s roughly 110 employees to move over, with Microchip opening a second Israeli development center. And Hailo’s technology was never the problem — 100+ customers, HP shipping Hailo-based cards in point-of-sale systems, real silicon in real products. The company built the thing. It just couldn’t build the revenue fast enough to outrun the capital it had taken.

Put Xsight and Hailo in the same paragraph and you get the honest version of hardware: same country, same category, same decade, and the gap between $2.8 billion and “not material” is mostly about who timed the market.

Razer bought StreamElements on Friday — substantially all assets of the Israeli-founded livestreaming tools platform, 2.6 million creators, from holding company Live Momentum. Undisclosed, believed well below the ~$111M raised. Part of the price is earmarked for outstanding creator payments, and the SEPay tipping product is being sunset with balances withdrawable through the end of 2026. A rescue, handled decently. Those two things can coexist.

The Government Wrote a Check

The Israel Innovation Authority launched a NIS 1 billion (~$328M) fast-track program on Sunday, jointly with the Finance Ministry, aimed squarely at one problem: the shekel.

The mechanics matter if you’re raising, and the official program page is more precise than the press coverage, so use it rather than us. There are two tracks. Companies founded within the last three years, with expenses under NIS 4M during the extension period, can get up to NIS 2 million. Everyone else — older than three years, or spending more than NIS 4M — up to NIS 15 million. Either way the grant covers 33% or 50% of the approved R&D budget, with an advance mechanism of up to 35% once you show matching finance. The goal is six additional months of runway.

Eligibility, from the source: Israeli-registered, incorporated no more than 15 years ago, runway of 12 months or less on your latest trial balance, expenses exceeding revenues, worldwide expenses over the past 12 months between NIS 1.5M and NIS 100M, at least 40% of last year’s expenses on R&D, and at least 50% incurred in Israel. If you haven’t raised in three years, you also need to show that half your sales are in foreign currency. Press coverage widely reported a “50% on R&D” threshold — the Authority’s own criteria say 40% R&D and 50% spent in Israel. Two different tests, and the distinction could decide whether you bother applying.

The timeline is the part most reports got wrong in the other direction. This isn’t a four-week window — applications run through November 19, 2026, with investment committees meeting weekly and decisions in roughly 20–30 business days. Fast decisions, long runway to apply. With required matching finance, the effective injection across the program lands somewhere around NIS 2–3 billion.

Strip the press release and it’s this: your costs are in shekels, your revenue and your raise are in dollars, the shekel got strong, and the state has decided that’s a market failure worth subsidizing rather than a founder problem worth ignoring. It’s also the same force that drove last week’s layoff wave. Wix cited it in May. monday.com’s cuts sat on top of it.

Whether it works is a Q4 question. The number to watch is whether Israeli hi-tech layoffs — roughly 9,500 in H1 2026, per career consultant Hayut Yogev’s analysis in the Jerusalem Post — actually slow.

If your burn is shekel-denominated and your runway is under a year, go read the criteria properly. NIS 15M is real money and the committee sits every week.

Everything Else Worth Your Time

Enigma — $71M seed, out of stealth Monday, co-led by Index and Ribbit with Sarah Guo’s Conviction and angels from OpenAI, Anthropic, DeepMind, xAI, Cognition and Wiz. Founded less than a year ago by Jonathan Jacobi — Microsoft’s youngest-ever employee, later recruited by Assaf Rappaport — and Gal Niv, who met in hacking competitions and served together in 8200. San Francisco-based, Israeli-founded, building robot-agnostic foundation models. They also shipped “Robots Online,” which lets anyone drive an AI-powered robot over the internet in real time. A $71M seed is absurd on paper; it landed days after Travis Kalanick’s Atoms raised $1.7B in the same category, which tells you what the paper is worth right now.

groundcover — $100M Series C, led by One Peak with Morgan Stanley Expansion Capital. Total $160M. Bring-your-own-cloud observability built on eBPF and OpenTelemetry, 250+ paying customers, 3x YoY ARR. Boring category, real revenue, no agent narrative required.

Aleph launched a $150M Fund V. Michael Eisenberg, Eden Shochat and team, ~$850M under management since 2013, and the stated thesis is “more of the same” — early-stage Israeli founders, global companies. In a year of pivots, a fund announcing it isn’t changing anything is a position.

Maor Shlomo started a small self-funded fund for cancer research. The Base44 founder — who sold to Wix in 2025 — put his own proceeds into seven companies over four months, after losing his mother to cancer. His thesis is that AI-driven in-silico discovery has moved the bottleneck to clinical validation, and that’s where the money should go. Not a business story. Include it anyway.

Traysar Industries — $25M Series A, founder Yadin Soffer, building autonomous systems for military operations underground. Israel has an obvious reason to care about what’s beneath the surface, and this is now the second Israeli company in three weeks funded to see through dirt — Exodigo bought a California engineering firm in issue #1. Worth flagging that the $25M was first reported earlier in July; only the Series A framing surfaced this week.

Tomer is heading toward the capital markets. The state-owned rocket-propulsion maker behind Arrow engines — ~900 employees, ~NIS 550M in 2024 sales — is starting with institutional bonds via TASE UP. A full IPO is unlikely before 2027 and has to follow IAI. Classification is the obstacle, same as Rafael. The defense-IPO queue is now three deep and moving at the speed of government.

What I’d Do With This Week

If you’re raising in agent/identity security: the thesis is no longer yours. Six teams pitched it to six sets of investors and all six got funded. What’s left to differentiate on is distribution — named design partners, ARR trajectory, deployment velocity. Onyx got a Series B four months after stealth; Mate raised eight months after seed. That cadence is the new benchmark, and if you can’t show it, expect harder terms than the founders you’re reading about got.

If your burn is in shekels: the IIA fast-track is open through November 19, committees sit weekly, decisions land in 20–30 business days, and the ceiling is NIS 15M for established companies or NIS 2M if you’re under three years old. The bar is 12 months of runway or less, 40% of last year’s spend on R&D, half of it in Israel. This is the single most actionable item in the digest.

If you’re deciding where to work: the barbell is obvious now. Infrastructure and security are hiring on fresh capital — Xsight, groundcover, Onyx, Act. Distressed acquirers are not; Microchip and Razer bought assets, and asset buyers rarely expand local headcount. Weight offers toward dollar revenue and a round closed in the last six months.

If you’re an investor anchoring to Cyera–Oasis: every founder in non-human identity will quote 50–100x at you for the next year. It’s an estimate on an undisclosed ARR, for a category leader, in a signed-but-unclosed LOI. Three qualifiers. Price accordingly.

See you next week. Same lazy hands, same working head.

With 💜, Alex Sherman

Research assisted by AI, every claim read and filtered by a human. Primary sources: CTech / Calcalist, Globes, Ynetnews, the Israel Innovation Authority, and official company releases including Microchip and Hush Security. Fast-track program figures come from the Authority’s own program page, which differs from several press summaries on the R&D threshold and the application window. Cyera–Oasis is a signed letter of intent, not a closed deal; the ~$1B value, the $700M cash split and the 50–100x revenue multiple (Virtru’s analysis) are estimates. Hailo and StreamElements prices are undisclosed and characterized via press estimates. Growth figures from Mate, groundcover, Encore and Cyera are company-provided and unaudited. Microchip–Hailo was signed July 24, just outside this window, and is included because it was the week’s dominant exit story. Previous issues: #1, #2.