Building an AI Guardian for Enterprise with Onyx Security CEO Maxim Bar Kogan
In a Nutshell
Onyx Security builds specialized oversight agents that monitor and control autonomous AI agents in enterprises, using lightweight trained models as efficient gatekeepers that escalate only high-risk actions to more capable systems. Traditional security tools fail because they lack context into agent reasoning and cannot restrict permissions without destroying agent utility, while AI vendors cannot access enterprise historical data needed for anomaly detection. The company positions itself as foundational infrastructure for managing superintelligent agents controlling critical systems, with Israeli cybersecurity expertise enabling products that understand how security teams actually operate.
These notes were generated by AI and may contain inaccuracies.
As enterprises exponentially increase their use of AI agents, the risk of illegitimate or incorrect agent actions grows dramatically. Enterprises have observed agents accidentally publishing code and tokens they weren't supposed to expose. Companies recognize this risk has grown exponentially but cannot stop adoption, forcing them to implement measures to reduce the chance of harmful agent actions. Enterprises have access to substantial historical data on agent behavior but are unwilling to allow companies like Anthropic or OpenAI to retain this data due to concerns these AI companies will train on enterprise data.
Maxim Bar Kogan is the co-founder and CEO of Onyx Security, an Israel-based startup composed of researchers, mathematicians, and engineers building agents to oversee AI agents. The company focuses on specialized model training, alignment research, and operates within the Israeli security and AI ecosystem.
Two years prior to the conversation, the primary security concern was DLP for chatbots—what employees were inputting into ChatGPT. The current environment reflects near market-wide panic around AI security, particularly regarding autonomous agent actions.
The pivotal moment for founding Onyx was AutoGPT. AutoGPT created the first autonomous agent running on LLMs—an agent that allowed the LLM not merely to generate text but to decide actions, receive API access to execute those actions via tools, and operate in a loop. This architecture theoretically enabled agents to perform complex tasks equivalent to human computer operations. Though AutoGPT didn't function optimally due to insufficient model capabilities at the time (even GPT-4 was inadequate), it provided a vision of future autonomous agents. Cloud Code today follows a similar structure to AutoGPT, validating the original concept.
Bar Kogan became obsessed with the challenge of overseeing agents that would eventually surpass human intelligence and capability. He questioned how to maintain control when agents manage critical infrastructure such as water supply, electricity, and power grids. At the time, enterprises were not yet deploying agents, and security professionals considered the timing premature. There was uncertainty whether the market would develop before the company exhausted its funding.
The market materialized with the emergence of reasoning models capable of long-horizon tasks. Cloud Code became the first widely used autonomous agent, followed by additional tools. Despite initial enterprise reluctance to build fully autonomous agents, many organizations instead pursued limited low-code platforms with connectors. These constrained platforms failed to deliver meaningful productivity gains. Enterprises began experiencing substantial benefits from unrestricted agents with fewer baked-in controls. Anthropic's revenue now derives from enterprises paying for Cloud Code to perform developer work.
Onyx performs two primary functions. First, the company trains models and builds agents designed to oversee other agents, addressing the exponential growth in AI-driven actions where human-in-the-loop approaches become infeasible at scale (100x, 1,000x, or 1,000,000x actions). Second, Onyx productizes this capability into a control plane or secure control plane that discovers all AI systems and autonomous agents within an enterprise and connects them for oversight, preventing harmful actions.
Onyx observes three categories of agent deployment in enterprise environments:
- SaaS low-code platforms using drag-and-drop interfaces, functioning more as automations than autonomous agents
- First-party agents built internally, either as internal applications or customer-facing products
- Highly autonomous coding agents and assistants
In typical enterprise deployments, autonomous coding agents and assistants comprise over 50% of usage, low-code automations represent approximately 45%, and first-party custom agents account for roughly 2%. Autonomous agents represent the fastest-growing category, with Cloud Code adoption expanding rapidly and tools like Cloud Code Work and OpenClaw gaining enterprise acceptance due to CEO-driven AI initiatives.
Existing enterprise security investments totaling approximately $100 billion across endpoint, network, cloud, and identity domains prove inadequate for agent security. Identity-based controls fail because enterprises must grant agents broad permissions to perform diverse tasks, eliminating the ability to restrict permissions as a safety mechanism. Endpoint and API security tools lack context to understand why agents take specific actions—they cannot interpret agent reasoning or intent. Traditional security tooling either severely constrains agent utility or fails to detect dangerous actions.
Proxy integration with policy engines faces two fundamental limitations. First, many AI systems operate on third-party cloud infrastructure or endpoints where proxy integration is technically infeasible. Second, even when proxying succeeds in capturing data flows, the core challenge remains determining whether actions are legitimate—a problem requiring understanding of what the agent is thinking and planning. Evaluating whether frontier models are making correct decisions proves technically difficult.
Rather than relying on frontier models like Cloud Code to oversee other agents (which would create prohibitive costs, latency, and reliability issues), Onyx trains specialized small models optimized for a single function: determining whether a given action warrants escalation to a more capable oversight agent. These lightweight models function as efficient gatekeepers that avoid missing critical events while minimizing unnecessary escalations, achieving balance between performance, cost, and latency. As frontier models advance, Onyx continuously trains its oversight models to maintain effectiveness.
The oversight architecture parallels blitz chess strategy, where players make rapid intuitive decisions under time pressure but pause for deep calculation on critical moves. Top players develop intuition from extensive game exposure and only engage in extended forward calculation when risk is high. Similarly, Onyx's system avoids deploying expensive intelligence for routine decisions while allocating substantial computational resources to high-risk situations.
Onyx maintains a hybrid DNA combining cybersecurity and AI expertise, reflecting the backgrounds of co-founders Maxim Bar Kogan and Gil (who previously worked on synthetic data at NVIDIA). Most research and engineering personnel originate from an Israeli intelligence unit focused on mathematics and cybersecurity intersection. Israel, though initially slower to enter AI development, is rapidly building capabilities in world models, AI infrastructure, and chip development. Onyx positions itself not merely as a security vendor but as essential infrastructure for controlling advanced AI systems long-term, targeting a market opportunity exceeding $100 billion.
Onyx invests in understanding model internals including weights, activations, and mathematical structures. The company believes mechanistic interpretability will become more tractable as models surpass human intelligence in specific domains. Beyond security applications, this research aims to advance fundamental understanding of intelligence itself—distinguishing characteristics between more and less capable models.
Despite being a two-year-old company with a small team, Onyx has secured Fortune 100 customers because the pain of uncontrolled AI agent risk is acute enough that security leaders prioritize finding capable vendors over established relationships. CISOs recognize they are in the business of revenue preservation and view early partnership with promising companies as preferable to inaction that could disable business operations.
The plummeting cost of vulnerability discovery through AI coding tools represents a fundamental shift comparable to automated vulnerability research that previously appeared 20-50 years away. Security teams must respond with rapid mitigation strategies focused on immediate risk reduction.
Security leaders at large enterprises understand that the real solution requires foundational pieces in place to avoid risks rather than just patching individual vulnerabilities. These foundational pieces include locked-down identity, firewalls, and endpoint detection. Different asset classes and parts of the enterprise stack require different foundational security mechanisms. The AI attack surface and AI systems within companies also need foundational security, which is the role Onyx Security plays in this space. Organizations preparing for Mythus-level models and beyond will need foundational security tools to fortify different parts of the enterprise.
Maxim does not have a strong opinion on phased or controlled rollout approaches like those from Anthropic and OpenAI. If there were certainty that no one would release a Mythus-level model soon, that would provide valuable time to prepare, build knowhow, develop playbooks, and share knowledge across the community to prevent disastrous effects such as airlines or power plants going down. However, if anyone reaches Mythus-level capability earlier, it would retrospectively appear as a mistake because companies could have been given the choice to move quickly and gain access. The concern is that companies would then be vulnerable to a Chinese model reaching Mythus-level capability with no recourse. The preferred approach is managing gradual rollout correctly while expanding access to more companies and making access easier. The advice given is for everyone to assume these models are coming anyway and to invest in foundational controls that will stop downstream effects of vulnerabilities.
Large companies that previously stated they would ban AI until it was safe are rarely seen anymore. In the financial sector, some companies remain more opinionated about what they allow, still permitting agents but with more granular restrictions such as limiting to specific tools. Companies that will succeed are those allowing many different tools because the landscape changes rapidly. Betting on OpenAI a year ago seemed safest, but Anthropic now offers better models and tools, and another provider may lead in a year. Large companies have different risk profiles than startups. At JP Morgan, there is much more to lose, justifying a more measured approach to AI adoption. JP Morgan is adopting AI quickly, and it is acceptable for larger companies to maintain nuanced views on AI adoption.
The AI security space benefits from stability in core technical approaches. The two core pillars of how AI works in 2026 have remained unchanged: LLM foundation models that function similarly to several years ago, and agents built through LLMs deciding on tool calls and generating them. This stability allows Onyx to address many applications using these two primitives while keeping core technology lean and focused. There remains risk of entirely new LLM or agent paradigms emerging. The company maintains strong opinions loosely held about 2027 scenarios while maintaining openness, which is considered the right stance until AGI and ASI become clearer.
Security buyers do not want to trust the same entity providing a product to certify its safety. Just as car buyers seek independent certification rather than relying on the seller, security teams require independent parties whose business depends on accurately determining whether products are legitimate and safe. This buyer psychology favors independent security providers. Model mistakes fall into two categories. The first involves jagged intelligence and silly mistakes, which will diminish as models become smarter, with model vendors incentivized to solve this. The second category involves models developing independent or semi-aware perspectives on actions that may not align with user intentions. This problem has grown alongside model intelligence and appears difficult for large vendors to address.
Independent security providers gain advantages through access that vendors lack. Enterprises are unwilling to provide historical agent behavior data to Anthropic or OpenAI due to concerns these data companies would use it for training. This gives Onyx greater context and latitude to detect anomalies by comparing current behavior against historical patterns, which vendors cannot access. The future will feature multiple vendors for cost reasons, with open source models used for affordability, and different models excelling at different tasks and cost profiles. It is unrealistic to expect all vendors, especially newer ones, to provide equivalent security levels, making it difficult for labs alone to solve these problems.
Onyx Security is building from Tel Aviv, benefiting from Israel's deep adversarial thinking bench including 8200, Wiz, Armis, and Island. What researchers, engineers, and business people outside security and in labs particularly miss is understanding how security teams actually work. Building products requires recognizing that organizations have structures, teams, and flows of responsibilities and information. Creating products that solve technical problems while being genuinely useful to these audiences is difficult. Success requires deep knowledge of security professionals' day-to-day realities: what they do when arriving at the office, what systems they open, what their bosses and colleagues expect, what earns praise versus criticism. Israeli teams have developed this understanding through extensive contact with buyers and end users. Greater curiosity about security professionals' daily work is encouraged, recognizing that these teams save organizations daily from attackers stealing money and data while preserving digital ways of life.
Security teams will become completely high-powered and will be run by AI agents, consistent with broader trends in knowledge work. However, products today are sold to human audiences with some agents present. Onyx invests in making systems convenient for agents to use while focusing on delivering excellent experiences for current human buyers. As the audience shifts toward more agents than humans, the product will evolve accordingly. The core principle remains consistent: remain mindful of who the end user is and what constitutes the best experience. For humans, this means avoiding overwhelming amounts of irrelevant information. For agents, this means avoiding wasting tokens in context. The fundamental requirement is always considering who uses the system and optimizing experience accordingly.
Keep No Priors: AI, Machine Learning, Tech, & Startups in your library
Save the videos and channels worth coming back to, and find them again in one place.
