Itamar Golan

The through-line

Itamar Golan's account of building Prompt Security keeps returning to two things: that the deciding factor in an entrepreneur is hunger rather than brilliance, and that a good idea is worthless until the market clock catches up with it. He describes knowing five or six years ago that security for AI would be needed, and then deliberately doing nothing about it, because "not enough AI deployments were in production" to sustain a security product around them [2]. The company only started when he judged the curve steep enough. Since then the emphasis in his commentary has shifted with the market: early on the work was almost entirely education, convincing buyers that a category needed to exist at all; more recently he describes a market that has arrived, with dedicated 2025 budget lines and formal RFPs, and a job that has become one of out-executing rivals rather than out-explaining them [2].

On hunger as the founder's differentiator

Asked how he came to lead more than 100 people across four groups in 8200 at the age of 20, he does not credit intellect [2]. "I was smart but I'm not sure I was the smartest and I had good ideas but I'm not sure they were the brilliant the most brilliant but I think I wanted it more than anyone uh I was the most hungry man in the room" [2]. He has since converted that into advice he gives VCs and investors screening founders: intelligence, a good market, a good product and a good team are baseline, and "the fact that is going or she is going to be smart this is Trivial" [2]. What actually separates people, in his framing echoing a remark he attributes to Sam Altman, is being several standard deviations above average in "persistency and ambitiousness and hungriness" [2]. He accepts without argument the suggestion that running a company this way requires a degree of insanity, and takes it "on myself" [2].

He is also clear about why the army produced him so early: military organisations cannot go and hire an experienced executive from elsewhere, so they have "one choice they need to find the ideal one among you know the juniors in the team and to promote him" [2]. The compression teaches technical and managerial skills at once, including how "to remain calm under stress" [2]. On why 8200 keeps producing security founders, he points to necessity rather than mystique: Israel sits in a complicated region, the intelligence unit has no choice but to be on top of everything, and it therefore recruits the strongest mathematics, statistics and coding talent to solve cyber problems [2].

On timing, luck and reading the slope

He treats timing as an underrated variable in entrepreneurship, and describes waiting deliberately: "I waited on the sidelines quietly for around two three years" until shortly before the launch of the ChatGPT web application, at which point he and his co-founder "felt like this is going to be exploded in the next few months then we push the gas" [2]. Pressed on whether that was luck or calculation, he refuses to separate them cleanly, calling it "a very mixed combination of Intuition or luck you can phrase it whatever you would like Along by some reasoning and calculation" [2]. The calculation had specific inputs: how many AI projects were reaching production, how many data scientists organisations were onboarding, and the measured capability of LLMs, which he was tracking personally by running Transformers on his own machine while they were still, in his words, "literally very bad" [2]. He moved when "the slope was positive enough" [2].

The market signal he cared about was commoditisation. AI security could not be sold while AI was "something you know niche in the basement of some data scientists", and became sellable once "any bloody marketeer or a financial guy" was using ChatGPT, Jasper and Notion AI [2].

On why he chose security for AI specifically

His own career sat at the intersection of AI and security long before Prompt Security existed: he led AI initiatives inside security organisations and data initiatives inside 8200, and his first love was mathematics and statistical modelling, playing with logistic regression before neural networks were on anyone's agenda [2]. That produced a deliberate constraint. The company had to be in security, because that is where Israel is strong, where he had experience building products and where he knew how to construct go-to-market motions and sell to CISOs; it also had to be in AI, because that is what he loves. "Practically there is no other choice building a security solution for AI" [2].

On building a platform rather than a wedge

He is emphatic that Prompt Security was architected from day one as a comprehensive runtime platform rather than a single feature. "We didn't want to build a browser plugin for shade AI only like some of my competitors we didn't we didn't want to build only prompt injection protection like some other competitors" [2]. The bet was that AI would be big enough to justify a single vendor solving 80 or 90 percent of a CISO's needs around privacy, security and compliance for AI within six to twelve months [2]. He notes that multiple VCs told him it could not be done on seed money and that he needed a narrower starting point; he had a wedge and a path, but the DNA and architecture were built for the full package [2].

He argues the team composition is the underlying differentiator, and invites people to check the claim: Prompt Security is, he says, the only team built from both AI experts and cyber security experts, where competitors are one or the other moving into the space [2]. He adds that he and his co-founder had both built and scaled security products sold in multimillion-dollar ACV deals at Check Point and Orca, and that the first core engineers came from Nvidia, F5 and Check Point [2].

On competition and winning bake-offs

Competition is not something he tolerates, it is something he seeks. "First of all I love competition it makes me uh being more ambitious and to want it more I think if I wasn't in the cyber security space I was going to Formula 1" [1][2]. The high point of company life for him is a head-to-head POC against Lasso, Aim, Harmonic or Protect, and winning it, because winning a bake-off proves execution rather than shelter: "it's one thing to build something in the dark in a vacuum and to sell it to somebody who really didn't have another option and it's really different than being the best in terms of execution in terms of product in terms of the sale process" [1][2]. He also expects the crowded field of twenty or thirty startups to thin out, with some failing to raise seed or Series A rounds and the market converging on the companies offering something genuinely unique [2].

On the category becoming real

His view of the market's maturation is concrete. At the start the go-to-market was "all awareness", including co-authoring the OWASP Top 10 for LLM and arguing why DLP and web gateways were not sufficient [2]. Now companies have dedicated functions for AI security and understand that incumbent tooling does not cover it, so the work is shifting toward selling better, easier onboarding and stronger customer success [2]. The clearest evidence he cites is budgetary: he sees dedicated 2025 budget lines for AI security with full RFP processes, not reallocations from DLP or endpoint budgets, which for him marks the arrival of a real category alongside CSPM or endpoint security [2]. He notes Gartner moving faster than he has ever seen, with a large dedicated team publishing at an unusual pace [2]. Internally his message is simple: "go get it the market is ready" [2]. He points to two deals closed in a single month, each larger than anything he saw at Check Point or Orca, as proof, alongside a Series A that funds R&D, product and a US-focused go-to-market team of reps, channels and alliances [2].

Among the concrete risk areas he has worked through publicly is the developer surface: the threats emerging from generative AI tools already widely used by development teams, code leakage, the risks of AI-generated code, and the policies needed to contain them, which he discussed in the context of Prompt Security's partnership with Checkmarx [7].

On attracting talent

He dismisses perks quickly. Compensation, options and office conditions matter, but "if we have enough pastes of I cream and things like that but that's pretty negligible" [2]. What closes candidates is founder conviction delivered in person: "they need to look at your eyes", and at over 30 people he still interviews every person who joins [2]. The pitch is that the vision is important and interesting, the company is a rocket ship that is growing and selling and inventing a category, and the scope beats being "another uh developer in a huge corporate" responsible for a narrow slice. At Prompt Security an ambitious engineer can work on AI one day, LLMs next, then DevOps, Kubernetes, cloud, servers, frontend, which he calls "the perfect playground" [2].

On brand, content and community

He treats his own public presence as a strategic asset rather than vanity. Over the last five years he has invested heavily in LinkedIn and Twitter, and stresses that the point is not visibility but substance, giving real content about security and AI [2]. The by-product was a community of people obsessed with the same problems, which he credits with keeping the company ahead [2]. That instinct extends to hosting PromptCast, a podcast covering AI, security and everything in between [5][6], where he has taken up questions such as how AI has reshaped marketing timelines and made hype easier to produce than clarity, in conversation with Prompt Security's Head of Marketing [4].

On what the job actually feels like

His single biggest lesson is about endurance, and he pushes back on the usual metaphor. A marathon is hard, but "the all 42 kilometers are the same" and the external environment stays constant while only your own biology changes [2]. Being a CEO is not like that, because the outside is in constant flux and obstacles keep arriving in unfamiliar forms [2]. He quantifies the emotional texture of the role bluntly: he once counted, and found that "in around 95% of the time somebody is entering my room it's with something negative", with good news like a closed million-dollar deal or a drop in production costs rare enough to count on two hands [2]. He also notes that founders working around the clock rarely stop to celebrate, and that milestones such as a funding round deserve a deliberate pause to appreciate them [2].

Takeaways

• The decisive trait in a founder is not intelligence but being "a few standard deviations" above average in persistency, ambition and hunger; smartness is treated as table stakes [2].
• He knew security for AI was coming five or six years before founding Prompt Security and deliberately waited two to three years on the sidelines until AI usage was commoditised beyond data science teams [2].
• Timing was judged from measurable inputs: AI projects reaching production, data scientist hiring, and LLM capability tested personally, with the trigger being "when the slope was positive enough" [2].
• Prompt Security was designed from day one as a comprehensive runtime platform covering privacy, security and compliance for AI, against VC advice to start with a narrow wedge such as a shadow AI browser plugin or prompt injection protection alone [2].
• He claims the team is the only one combining AI and cyber security expertise, where competitors come from one discipline or the other, with early engineers from Nvidia, F5 and Check Point [2].
• Competitive POCs against Lasso, Aim, Harmonic and Protect are the part of the job he enjoys most, because winning a bake-off proves execution in a way that selling to a captive buyer does not [1][2].
• The category has crossed from education to procurement: dedicated 2025 budget lines with RFPs rather than reallocated DLP or endpoint budgets, plus unusually fast Gartner coverage [2].
• At over 30 employees he still personally interviews every hire, arguing that top talent joins for vision and breadth of scope rather than perks [2].
• Roughly 95 percent of what reaches the CEO's desk is a problem, and he warns that the entrepreneurial version of a marathon has no constant environment to settle into [2].