Security Researchers: Digital Fighters Series
Orion: “AI is the most interesting thing to happen to endpoint security in a decade”
Dan Shemesh, Security Researcher at Orion Security, explains how AI is changing the work of researchers "twice over" as part of CTech’s Security Researchers series.
“Research is the central nervous system of the product itself,” says Dan Shemesh, Security Researcher at Orion Security. He explains that in order to deliver on the company's value proposition of responding to suspicious data movements in real time, his team must turn "chaotic OS events and browser behaviors that differ across pages and technologies" into clear, "enforceable actions."
Within Israel’s cyber companies are small, highly specialized teams trained to think like attackers, find vulnerabilities and stay ahead of a threat landscape increasingly accelerated by AI. In this series, we meet the individuals and teams who make up this frontline of cyber: the digital fighters.
1 View gallery
Dan Shemesh, Kernel Engineer & Security Researcher, Orion Security.
(Photo: Yosee Gamzoo Letova)
“AI is changing our work twice over: it is both our tool and our subject,” Shemesh continues, commenting on the technology's impact on the field. “As a subject, AI is the most interesting thing to happen to endpoint security in a decade.”
You can read the entire interview below.
ID Card
Company name: ORION Security
Founders: Nitay Milner (CEO), Jonathan Kreiner (CTO)
Year of founding: 2024
Current number of employees: 50
Company Description:
Orion Security is an agentic data loss prevention platform. Using proprietary AI agents that analyze data in motion and detect indicators of data loss risk, Orion Security delivers context-aware verdicts across every channel, including endpoints, browsers, SaaS, email, and agentic AI workflows, without rules, policies, or manual tuning.
The result is dramatically reduced overhead and real incidents stopped before they become data leaks. Security teams gain visibility and control over data movement, with context-aware analysis designed to reduce false positives and adapt to changing business activity.
About Orion's Security Research Team:
At Orion, we practice security research in a nonconventional model – our team is built multi-disciplinarily, in a way that owns both the research, and the development under the same roof. Our team combines technical investigation with product development: exploring how operating systems, browsers, and applications actually behave.
Those insights become part of the broader engineering process, shaping how we understand complex behaviors and turn them into product capabilities. This approach keeps research closely connected to the product and lets what we learn at the technical level directly influence what we build.
What is your background in cyber, and what led you to specialize in security research?
I’ve loved computers and games for as long as I can remember, and I was always curious about what was happening beneath the surface. I began my career in a technology unit, with three years in product management, but I found that asking “why” often produced only surface-level answers. The real explanations were usually several layers deeper.
That curiosity led me into software engineering, where I spent the next five years specializing in low-level development and Windows internals. Working so close to the operating system taught me that systems don’t always behave as their documentation suggests. Once you begin noticing those gaps, it becomes natural to question every boundary and explore how it might be bypassed, which ultimately drew me to security research.
What does your security research team look like in action?
We own the endpoint from the kernel up. Typical Endpoint Detection and Response (EDR) research teams hunt for zero-days, vulnerabilities, or malware signatures. We act as an EDR for data: we research data movement, behaviors, and internal mechanisms.
Our research starts with a question: how do you know, with certainty, in real time, what a person is actually doing on their machine? The operating system doesn't tell you. There is no Windows or macOS event called "upload." There is no event saying "this file was pasted into a chat." The OS sees low-level actions: a file handle opened, memory mapped, a socket created. My job is to reconstruct the human-readable operation from those signals.
One of the central problems is what we call the "generics gap." Reverse-engineering every application is impossible, so we focus on generalizing how data moves at the OS level. We build behavioral models and deterministic state machines that turn those low-level kernel events into one high-fidelity lineage.
Research also sets the product's physics. We sit inline, with authority to block, on machines people use for their actual jobs. That imposes two constraints: an alert must cost near-zero resources and the model must be deterministic. A false positive doesn't just annoy a SOC analyst, it stops a real person's work mid-click.
We prioritize research based on the evolution of user behaviors. The driver right now is AI: how GenAI applications, browser extensions, and local autonomous agents touch local files and data, so we can catch unauthorized movement before it happens.
How does the research team influence your company at large?
Research is part of the product supply chain. Every capability in the product began as a research question.
Research defines how the endpoint sensor and browser extension operate. A new lineage tells engineering exactly what generic telemetry to capture, and those deterministic models scale into the prevention engine.
Findings can reach customer endpoints or SaaS integrations within weeks, so in practice the research agenda has a direct influence on the product roadmap.
For us, research is the central nervous system of the product itself. Our value proposition depends on responding to suspicious data movements in real time, and on the endpoint that means turning chaotic OS events and browser behaviors that differ across pages and technologies into the expected enforceable actions.
What has been your team’s most significant security discovery to date?
The OS never says "upload" and it doesn't need to. Those events don't exist. Our discovery is that the intent is recoverable anyway: a file leaving the machine leaves a deterministic footprint in ordinary operating-system activity, and that footprint belongs to the operation rather than to the application performing it.
Detecting an upload in one specific browser is useful, but anyone can special-case an app. We model the operation instead. One mechanism can therefore cover any browser, chat app, or meeting tool, with no per-application integrations and no need to know the app in advance. Software that didn't exist when we built it is covered on install. That shift, from recognizing applications to modeling the operation itself, is fundamental to how we approach endpoint research.
Who or what is your 'Moby Dick'?
Semantic exfiltration: data can leave as meaning rather than bytes. Imagine someone pastes a confidential paragraph into an AI assistant, asks it to summarize the text, and then copies the summary somewhere else. The original file may never have moved, but the sensitive information has.
Following data through every transformation, including copy, paste, renaming, and encryption, is the full-provenance problem which is still unsolved deterministically in real time. The hunt is getting even more complicated because the actor is changing. Browsers now ship with AI inside them, and agents browse, read, and upload using the user's own credentials and applications.
Our Moby Dick is a deterministic, real-time answer to "who intended this, and what does it mean?" especially when the hands on the keyboard might not be hands at all.
How would you characterize the competition between research teams today?
Traditional security research is fiercely competitive over talent and discoveries, and highly reactive: dissect the newest specific threat first.
Since we focus on data movement rather than malware, we're not really in that Common Vulnerabilities and Exposures (CVE) race.
Data movement can still surface malicious users, attackers, and malicious software, but we don't really see other research teams as the primary competition.
What is your take on the future of the human security researcher?
AI is changing our work twice over: it is both our tool and our subject.
As a tool, it is a huge booster. Diffing thousands of event traces, correlating logs, and cross-referencing undocumented structures can compress a week of manual analysis dramatically, though AI is not perfect and can also send you on a wild goose chase.
The job shifts to judgment: which question matters, which anomaly is a signal, and what separates causation from coincidence. That can't be delegated, least of all when real-time decisions must be high fidelity.
As a subject, AI is the most interesting thing to happen to endpoint security in a decade. Agents are first-class actors on the machine now, reading files, browsing, and uploading. We research their behavior the way we research human behavior, down to the kernel fingerprints they leave.
In that sense, users are being automated before the researcher is.
