Key Takeaways
- Sweet Security builds a runtime‑first cloud and AI security platform that couples lightweight eBPF sensors with cloud‑control‑plane data to give a unified detection‑and‑response view.
- The security research team is split into infrastructure (data pipelines) and research (adversary work), but both groups consist of senior contributors with deep security backgrounds.
- Omer Nissim emphasizes that defenders already have all the telemetry they need; the real challenge is stitching events into a coherent attack story.
- Sweet Attack, an AI red‑team agent, continuously chains weaknesses into realistic attack paths, turning research into a product feature rather than just informing it.
- The team’s most notable finding turned a seemingly innocuous blind SSRF into a full cloud‑admin takeover by exploiting an internal cluster‑management tool’s AI assistant for reconnaissance.
- Nissim’s “Moby Dick” is catching attacks that consist solely of authorized API calls made by over‑privileged non‑human identities—especially when AI agents sit in the middle.
- While there is healthy competition to publish first, the deeper goal is to be right; sharing indicators of compromise during supply‑chain incidents shows a cooperative undercurrent.
- AI acts as a force multiplier for research (deobfuscation, triage, drafting) but cannot replace human judgment; it also expands the attack surface via new AI‑related services and agents.
- The future of the human security researcher lies in deciding what is worth investigating, validating AI‑generated findings, and remaining accountable for alerts that wake engineers at night—tasks that are becoming more, not less, human‑centric.
Background and Role
Omer Nissim, a Security Researcher at Sweet Security, brings a distinctive blend of operational and architectural experience to the team. He spent six and a half years as a cyber‑security specialist in Israel’s Special Operations Division, where the work itself resembled research—solving undocumented problems by understanding systems deeper than their creators. After his military service, Nissim spent a year at NVIDIA as a software architect on a flagship AI‑infrastructure project, learning firsthand what “high volume” truly means and why logic that works on a laptop often fails in production. This combination of hands‑on threat hunting and large‑scale system design prepared him for the challenges of cloud‑native detection engineering.
Telemetry Versus Narrative
Reflecting on the state of security research, Nissim argues that the industry is not lacking telemetry; rather, defenders are missing the story that the events tell. “Nobody is missing the events,” he notes, “they’re missing the story the events add up to.” In cloud environments, virtually every attacker action leaves a trace in logs such as CloudTrail, Azure Activity Log, or managed identity sign‑in streams. The difficulty lies in correlating those disparate signals—identity, control‑plane activity, runtime behavior—into a coherent narrative that reveals intent before damage occurs. This storytelling problem is where Nissim’s research focus resides.
Company Overview and Team Structure
Sweet Security, founded in 2023 by former IDF and Unit 8200 leaders Dror Kashti, Eyal Fisher, and Orel Ben‑Ishay, employs roughly 120 people across Israel and the United States. The company delivers a runtime‑first cloud and AI security platform that deploys lightweight eBPF‑based sensors to capture live execution data, then unifies it with cloud‑control‑plane, identity, API, and vulnerability information into a single detection‑and‑response picture. Its AI red‑team agent, Sweet Attack, continuously attempts to chain environmental weaknesses into viable attack paths and reports only those that hold up.
The security research team, larger than one might expect for a company of this size, is divided into two functional groups: infrastructure, which builds the data‑pipeline and processing backbone, and research, which conducts adversary‑centric work—understanding how attacks unfold in cloud and Kubernetes settings and translating that insight into detection, response, and offensive validation. Despite the split, both groups share a common denominator: senior individual contributors with deep security‑oriented backgrounds.
Research in Action
The research team’s output is not a static report but logic that runs in production for customers. It owns three intertwined deliverables: the detection that catches an attack, the response that stops it, and the offensive validation that finds the attack path before anyone else does. Research operates as a continuous loop: studying real‑world attacker behavior in cloud and Kubernetes environments, letting observed telemetry drive the next investigative round, and feeding findings back into detection and response engines. Topics are sourced from repeating patterns in customer data, telemetry gaps where adoption outpaces monitoring, and live threats that demand immediate attention.
A cornerstone of this loop is Sweet Attack, the AI red‑team agent that autonomously chains weaknesses into realistic attack paths, discarding those that do not hold up. The agent applies the same knowledge used in detection research but points it offensively, providing a relentless, tireless perspective that no human team could match. Crucially, the team does not silo detection, response, and offensive validation; effective identity detection, for example, requires understanding what a workload was doing at the same moment, so the same researchers handle all three facets.
Impact on Product and Company
Research at Sweet Security is not a peripheral function; it is upstream of the product and, in many places, is the product. The detection content, response logic, and attack paths validated by Sweet Attack translate directly into customer value, making research velocity almost synonymous with product velocity. Day‑to‑day, this influence appears in three ways: first, the research team shapes the growth missions for Detection & Response—defining what can be caught next quarter and what can be acted on automatically based on current investigations. Second, findings feed backward into platform requirements; for instance, if a detection needs live behavioral state for every identity, that becomes a data‑platform mandate rather than a simple rule. Third, through Sweet Attack, research shapes the offensive side of the product, exemplifying how research can become a feature rather than merely informing one. Externally, the team’s depth earns trust from practitioners; CISOs purchase not a feature list but the confidence that the builders understand attacks better than they do.
Notable Discovery: SSRF Chain via AI Assistant
When asked about the team’s most significant security find, Nissim points to a complete unauthenticated‑to‑cloud‑admin chain uncovered by Sweet Attack. It began with a blind Server‑Side Request Forgery (SSRF) in a customer‑facing application—a low‑severity flaw that returned no response and would typically be ignored. However, the SSRF could issue POST requests inside the cluster, where an internal cluster‑management tool ran without authentication and executed actions upon receiving a POST. Chaining the two turned a seemingly innocuous web bug into code execution on a pod.
The pod’s identity possessed permissions that spanned the wider cloud environment, effectively granting cloud‑admin rights from an unauthenticated HTTP request. The critical reconnaissance step involved obtaining the pod’s randomized name, which is not guessable from outside. The internal tool shipped with an AI assistant; by querying the assistant for the pod’s name, the attackers received the exact piece of information needed to proceed. Notably, no zero‑day was involved; each component operated exactly as designed. The attack only became visible when viewing the environment across application, cluster, and cloud layers simultaneously—exactly the perspective the research team cultivates.
Moby Dick: Non‑Human Identity Chains
Nissim’s personal “Moby Dick” is detecting attacks that consist solely of authorized API calls made by over‑privileged non‑human identities, with no malware, binaries, or processes to catch. Such attacks move from a compromised token to data entirely inside the control plane, leaving only the relationship between identity, action, and timing as a signal. Catching these chains early—before exfiltration—remains a primary goal.
The challenge is accelerating with the rise of AI agents. An agent equipped with broad permissions and an MCP (Model Context Protocol) server that has not been threat‑modeled becomes a non‑human identity with an unpredictable decision‑making process attached to it. This new hunting ground demands research that can reason about autonomous AI behavior in cloud environments, extending the traditional focus on human‑driven tactics.
Competition Among Research Teams
The competitive landscape among cloud security research teams is sharp and, on the whole, healthy. Israel’s high density of specialized teams creates a real race to publish first on live campaigns, which can incentivize speed over depth and occasionally lead to inflated findings branded with logos and names. Yet the competition that truly matters is not for headlines but for being right. When a supply‑chain incident occurs, vendors often share samples and indicators of compromise within hours because collective defense benefits everyone. Nissim characterizes the dynamic as “competing on publication and cooperating on defense,” a balance he views as optimal. The healthiest metric, he adds, is not who published first but whose detection fired in a customer environment before any damage occurred.
Future of the Human Security Researcher
Looking ahead, Nissim frames the role of the human researcher around four AI‑related dimensions, dismissing the simplistic notion that “AI helps us work faster” as the least interesting aspect.
-
AI as a force multiplier – AI assists with deobfuscating scripts, triaging samples, and drafting detection logic. Nissim uses it daily, but insists that nothing reaches production without human review, as AI can over‑fit to superficial details and miss broader context.
-
AI as a new attack surface – Services such as Bedrock, Vertex, model‑provider API keys, MCP servers, and autonomous agents with cloud permissions did not exist two years ago. A leaked OpenAI key or a broadly scoped MCP server now constitutes a directly monetizable asset, expanding the research workload rather than shrinking it.
-
AI on the attacker’s side – Lowers the barrier to entry, increasing attack volume and variant proliferation. This trend reinforces the value of behavioral detection over static signatures.
- AI as a researcher on our side – Sweet Attack exemplifies this dimension: an AI agent that continuously performs work once reserved for occasional human red‑team engagements. The humans did not automate the researcher; they encoded how a researcher reasons and pointed the agent at a scale no human could cover. While the agent is fast and tireless, it lacks taste—humans still decide what constitutes a valid attack path, what evidence suffices, and what warrants a customer’s attention.
In Nissim’s view, AI is eliminating the routine, mechanistic parts of the job that were never the core of security research. What remains—and indeed grows—is the human responsibility to judge which anomalies represent genuine stories, to validate AI‑generated findings, and to stay accountable for alerts that wake engineers at night. This makes the human researcher more essential than ever, even as their toolkit evolves.