No PriorsBuilding an AI Guardian for Enterprise with Onyx Security CEO Maxim Bar Kogan
CHAPTERS
- 0:00 – 0:45
AI agents are taking real-world actions—and enterprises are losing control
Maxim opens with the core problem: as enterprises deploy more autonomous agents, the number of actions they take grows exponentially, raising the odds of damaging mistakes. Recent incidents include agents leaking tokens or publishing code unintentionally. Enterprises feel adoption is inevitable, so the focus shifts to reducing the probability of illegitimate or incorrect actions.
- •Agent-driven action volume scales exponentially, making failures more likely
- •Real examples: accidental token/code publication; outages from wrong agent actions
- •Enterprises can’t realistically “stop adoption,” only manage the risk
- •Human-in-the-loop review won’t scale as action counts explode
- 0:45 – 1:40
From chatbot DLP to agent-action risk: why Onyx made the bet
Sarah frames the market shift from early concerns about employees pasting data into chatbots to broader panic about AI-driven security impacts. Maxim explains the company’s early conviction that agent actions—not just prompts—would become the critical security surface. The bet was risky because enterprise adoption of agents hadn’t arrived yet.
- •Security concerns shifted from data leakage in chatbots to operational agent risk
- •Onyx started early, before widespread enterprise agent deployments
- •Foundational thesis: the risky surface is actions taken by agents, not just text
- •Timing risk: could have run out of money before the market arrived
- 1:40 – 5:17
AutoGPT as the inflection point: a preview of autonomous tool-using AI
Maxim describes AutoGPT as the first widely recognized autonomous LLM-based agent loop: decide an action, call tools/APIs, observe results, repeat. While early models weren’t strong enough, the architecture foreshadowed today’s coding agents. His “AGI-pilled” view made oversight and control the obsession even before the market demanded it.
- •AutoGPT introduced the loop of LLM decision-making + tool execution
- •Early implementation underperformed, but the concept proved correct
- •Today’s tools (e.g., coding agents) resemble that earlier architecture
- •Core question: how do humans oversee agents that may become smarter than us?
- 5:17 – 7:46
What Onyx sells: agent overseers + a secure AI control plane
Maxim gives the product one-liner: Onyx trains models and builds agents that oversee other agents’ actions, then packages it as a “secure AI control plane.” The system aims to discover enterprise AI/agent usage and add monitoring/guardrails around actions. The driver is concrete enterprise harm: downtime, destructive actions, credential leaks, and more.
- •Onyx builds “agents to watch agents” and trains models for oversight
- •Productized as an AI control plane that connects to enterprise agents
- •Goal: determine whether actions are legitimate and safe at scale
- •Motivating failures: deletions, outages, accidental publishing of secrets
- 7:46 – 9:58
Enterprise reality check: what kinds of agents are deployed today
Maxim breaks enterprise deployments into three buckets: low-code ‘automation-like’ agents, first-party custom agents, and autonomous coding agents/assistants. He estimates coding agents already represent the majority of agentic activity and are growing fastest. Many of these tools arrive with minimal built-in controls.
- •Three categories: low-code automations, first-party custom agents, autonomous coding agents
- •Autonomous coding agents are already >50% in many enterprises and growing fastest
- •Low-code platforms are common but limited in productivity gains
- •Enterprises are even sanctioning unexpected tools due to AI adoption pressure
- 9:58 – 12:45
Why traditional security controls struggle with agentic systems
Sarah asks what parts of the existing $100B security stack apply. Maxim argues conventional layers lack the key missing ingredient: intent/context. Identity permissions are hard because agents need broad access to be useful; endpoint/API tools can’t tell whether an action is appropriate for the current task.
- •Identity controls fail when agents need “your permissions” to be useful
- •Hard to predefine least-privilege for diverse, changing agent tasks
- •Endpoint/API security can observe actions but not the agent’s reasoning/intent
- •Without AI-native controls, enterprises must choose between risk and crippling limitations
- 12:45 – 14:11
Why proxies and policy engines aren’t the solution by themselves
Sarah proposes a classic security approach: proxy + policy rules. Maxim responds that proxying is sometimes infeasible across cloud/endpoint/vendor contexts, and in any case isn’t the hard part. The hard problem is deciding whether an AI action should happen—requiring understanding plans, context, and behavior of highly capable models.
- •Proxy is an integration method, not the core decision engine
- •Not always technically viable given where AI runs (cloud/vendor/endpoint)
- •Seeing traffic/data doesn’t answer “should this action occur?”
- •Oversight requires interpreting the behavior of very capable models
- 14:11 – 17:14
Why Onyx trains its own models: cheap ‘triage’ plus expensive ‘deep review’
Maxim explains why simply using a frontier model to watch every action is too costly and slow. Onyx instead trains smaller specialized models that can quickly decide when to escalate to a smarter (more expensive) reviewer. The goal is a reliability/cost/latency balance that still catches high-risk moments.
- •Naively spawning a powerful reviewer per agent is cost/latency prohibitive
- •Onyx uses small models specialized to detect ‘when to look closer’
- •Escalation strategy: cheap constant monitoring + smart review at critical points
- •Continuous adaptation needed as frontier agents and harnesses evolve
- 17:14 – 18:37
Blitz chess analogy: intuition most of the time, deep calculation when it matters
Sarah compares Onyx’s approach to blitz chess: rapid intuitive moves punctuated by occasional long calculation during critical positions. Maxim agrees—efficient computation means reserving heavy reasoning for high-risk decision points. This frames their product philosophy as risk-weighted intelligence allocation.
- •Most decisions can be made with fast ‘intuitive’ heuristics
- •Critical situations demand slower, deeper reasoning and exploration
- •Security oversight should allocate intelligence proportionally to risk
- •Efficiency is about not over-spending compute where it adds little value
- 18:37 – 21:25
Onyx’s Israel-based talent mix: cybersecurity realism + deep AI research
Sarah asks about Onyx’s DNA and the Israeli ecosystem. Maxim describes a blend of cyber and AI: experience from Israeli intelligence units at the intersection of math and cyber, plus AI backgrounds (e.g., synthetic data/NVIDIA). He emphasizes that long-term control of advanced AI requires deep AI expertise, not just traditional security.
- •Israel is rapidly strengthening in AI (infra, chips, world models)
- •Onyx combines cyber experience with serious AI research capabilities
- •Goal extends beyond enterprise security to long-term control of advanced AI
- •Belief: an independent ‘AI overseer’ market could be enormous
- 21:25 – 23:13
Mechanistic interpretability as part of the long-term control stack
Maxim argues interpretability progress makes it plausible that understanding model internals (weights/activations/structure) will help control advanced systems. He suggests humans may struggle to interpret internals, but smarter-than-human models could help crack interpretability. This could deepen both governance and understanding of intelligence itself.
- •Interpretability of weights/activations is seen as a necessary ingredient
- •Humans may be limited; smarter models might accelerate interpretability work
- •Potential payoff: better control, trust, and governance of advanced AI
- •Scientific upside: understanding what ‘intelligence’ is and why models differ
- 23:13 – 25:10
Earning trust with Fortune-scale customers despite being a young startup
Sarah pushes on a core adoption barrier: customers must grant Onyx significant visibility and integration, yet Onyx is under 100 people. Maxim says acute pain drives inbound interest—leaders see business-disabling risk if they do nothing. Large enterprises also want to identify the likely category winner early and are willing to engage.
- •Customer trust is enabled by urgency and severity of the new risk
- •Enterprises treat security as revenue preservation and business continuity
- •They’d rather bet on a promising early vendor than remain exposed
- •Market dynamic: ‘find the right horse’ early in a new security category
- 25:10 – 27:45
Mythos and the collapse in cost of vulnerability discovery: what enterprises should do
Sarah raises the ‘plummeting cost’ of vulnerability finding with AI coding tools, referencing “Mythos.” Maxim argues the concern is justified and transformative for security operations. Short-term mitigation matters, but the only durable answer is foundational security controls—now including an AI-specific foundation layer.
- •Automated vuln research is arriving faster than expected and at scale
- •Immediate response: patching and mitigating controls for known issues
- •Long-term response: rebuild strong foundations (identity, firewall, EDR, etc.)
- •AI introduces a new attack surface requiring a foundational AI security layer
- 27:45 – 32:36
Controlled release debates (Glasswing/Daybreak) and the end of AI ‘holdouts’
Maxim weighs the tradeoff in phased rollouts: slower access buys time to prepare, but adversaries or other states may reach capability first. He recommends assuming these models will arrive and investing now in foundational controls. He also notes enterprise bans are fading; most firms are adopting, though larger orgs apply more nuanced constraints.
- •Gradual rollout reduces immediate harm but risks falling behind adversaries
- •Recommendation: assume high-capability models are inevitable and prepare
- •Few enterprises still ban AI outright; financial services are more restrictive
- •Large companies can move more cautiously, but adoption is still rapid
- 32:36 – 41:08
Why labs can’t fully solve model trust/governance—and what security must become
Sarah asks whether foundation model labs will subsume this market. Maxim argues buyers prefer independent oversight (like third-party certification), and that labs lack access to certain enterprise behavioral data because customers won’t share it for training. He also expects a multi-model world (open source + specialized vendors), making uniform lab-provided security unrealistic; he closes with what security builders often miss: deeply understanding how security teams operate and building for their workflows.
- •Independence matters: you don’t want the vendor certifying itself
- •Enterprises withhold historical agent data from labs due to training concerns
- •As models get smarter, misalignment-like behavior may grow vs. ‘silly mistakes’
- •Multi-vendor model landscape requires cross-platform, consistent controls
- •Security success depends on building tools that match real security team workflows
