Security Researchers: Digital Fighters Series
Semperis’ Security Research AVP: “AI is the main facilitator and threat at the same time”
Tomer Bar explains why the research team is the brain of the cyber company, as part of CTech’s Security Researchers series.
“AI is the main facilitator and threat at the same time,” says Tomer Bar, AVP Security Research at identity-driven cyber resilience and crisis response company Semperis, which boasts a security research team of around 10 researchers. On the one hand, Bar argues, “we've built a fully automated research pipeline,” and yet, “AI agents and nonhuman identities are now present in larger numbers than humans within some of our customers' organizations.”
Within Israel’s cyber companies are small, highly specialized teams trained to think like attackers, find vulnerabilities and stay ahead of a threat landscape increasingly accelerated by AI. In this series, we meet the individuals and teams who make up this frontline of cyber: the digital fighters.
Bar established and managed the first Israeli national Red Team for critical national systems like power plants, gas, water, and trains. According to Bar: “If we take the human body as an analogy to the company, the research team is the brain.”
You can read the entire interview below.
ID Card
Company name: Semperis
Founders: Mickey Bresman (CEO), Guy Teverovsky (CTO), Matan Liberman (General Manager Israel)
Year of founding: 2015
Current number of employees: Approximately 645 globally, of whom approximately 145 are in Israel
Company Description:
Headquartered in Hoboken, New Jersey, with its main research and development center in Israel, Semperis protects the identity systems that enterprises run on: Microsoft Active Directory, Entra ID, Okta and Ping. The product portfolio covers the full lifecycle of an identity-based attack, and alongside the commercial products, Semperis maintains free community tools used by more than 65,000 organizations worldwide.
About Semperis’ Security Research Team:
The security research team is around 10 researchers. The team is responsible for the security research for all Semperis products including security posture, real time detection and response and safe recovery.
What is your background in cyber, and what led you to specialize in security research?
xMy background is not the usual route. I started out as a young gamer. In the army, I didn't serve in a technical unit, but a combat unit instead. For my academic studies, I pursued a BA in computer science, followed by an MBA.
I worked for the Prime Minister's Office for more than a decade in cybersecurity research (even before it was actually called “cyber”). I established and managed the first Israeli national Red Team for critical national systems like power plants, gas, water, and trains. Later on, I spent 20 years mostly in Windows vulnerabilities and APT research for large enterprises and startups in the EDR and breach and attack simulation domains.
I've led one of the most productive original research teams in the world focusing mostly on Microsoft vulnerabilities, and spoke at the most important cybersecurity conferences like Black Hat and DEFCON four times each. I’ve also been selected as a Black Hat Europe Review Board member, which selects the best research of the year to be presented on the main stage.
What does your security research team look like in action?
The security research team is responsible for the research behind all Semperis products across different domains. It starts with on-prem AD, where our researchers first discover and report critical vulnerabilities to Microsoft that could allow a malicious threat actor to take control of domain controllers used by most S&P 500 enterprises.
Then, our research team publishes open-source tools to be used by CISOs across the world, along with tools for our customers to test their security posture.
Because many enterprises also have cloud-based infrastructure, other security researchers on the team are experts in detecting potential attacks against cloud identity providers like Entra ID, Okta and Ping.
How does the research team influence your company at large?
Security research is an essential part of any cybersecurity company. If we use the human body as an analogy for the company, the research team is the brain. As experts in identity cyber attacks and vulnerabilities, they analyse the threat landscape and produce content for our products to harden systems, detect real-time attacks, and recover quickly and securely from data breaches.
The product team is more like the heart, understanding the customer's needs and working with engineering (the hands and legs) to build the product and code that uses this provided content.
What has been your team’s most significant security discovery to date?
The team discovered two critical vulnerabilities, ResetNightmare and KerberLoss, which were fixed by Microsoft a few months ago and presented at the Black Hat USA and DEFCON cyber conferences this year.
These discoveries were the result of long-term original research by Shai Laron – a team member and expert in Active Directory, particularly domain controllers and authentication protocols.
Who or what is your 'Moby Dick'?
The Semperis security research team’s 'Moby Dick' can be described as a five-headed adversary: threat actors from China, Russia, Iran and North Korea, alongside cybercrime threat actors. Once we understand their motives, tactics and techniques, we can help build products to protect our customers' most precious crown jewels.
How would you characterize the competition between research teams today?
I believe that all research teams are on the same good side of the cyber world. If we’re speaking about technical competition, the best comparison is probably how many talks were accepted into global conferences, the number of CVEs (discovered and fixed vulnerabilities), the vulnerabilities' CVSS scores, and global competitions like CTFs, Pwn2Own and Pwnie awards.
I can share that during the first half of 2025, Semperis reported six Microsoft vulnerabilities, which ranks it among the top 20 security research teams in the world.
What is your take on the future of the human security researcher?
AI is the main facilitator and threat at the same time. All the team members use AI agents and technology to facilitate and scale the output of the team. We've built a fully automated research pipeline that analyses threats according to a given prioritization, builds security indicators and real-time attack detection logic, tests the output, and sends it for final approval by a security expert.
AI is also a threat. AI agents and nonhuman identities are now present in larger numbers than humans within some of our customers' organizations, and are projected to be 10 times that in the upcoming years. Our research team is on a mission to allow our customers to map AI agents' identities and make sure they are managed in a safe manner.
