105. Shrink what a breach can reach (with Yair Grindlinger)

If your security budget goes almost entirely to keeping attackers out, Yair Grindlinger thinks you're underfunding the part that's becoming more and more urgent. The co-founder and chief executive of Surf AI says artificial intelligence changed what happens after someone gets in. For years it was hard to turn a crack into meaningful data exfiltration. Now, once an attacker is inside, getting to the valuable information and pulling it out is much, much easier than it used to be. His answer is to split the spend. Do everything you can to reduce the risk of a breach, then put just as much, if not more, into limiting the blast radius. Jon's name for the threat is internet security weather, the storms of bots that used to spray known vulnerabilities at random and now come back intelligent, backed by capable agents. Asked how long a system online has before a breach, Yair says he thinks it's already happening right now, in ways we don't know about. He's still an optimist. Once defenders have the better technology and cover their assets, he expects security to end up in a better place than it's ever been. There's also a moment security leaders will recognize. Asked how security teams take to the agents, he gives the expected answer about strategic work, then corrects himself. What they mention first is getting rid of the chasing and the ticket follow-ups, the part of the job he calls burger flipping. Surf AI launched in March 2026 with $57 million to run the whole security program with a system of agents, and it's hiring in Israel and the United States. Episode page and transcript: ysecurity.io/podcast/105-shrink-what-a-breach-can-reach/ Brought to you by YSecurity, the security team that works next to yours. Your first 8 hours of chief information security officer work are free at ysecurity.io/startups