Security Researchers: Digital Fighters Series
Terra: “The researcher of the future isn't competing with agents on speed”
Ofek Haviv, Cyber Security Researcher at Terra Security, describes how building autonomous penetration testing today is operating without a playbook as part of CTech’s Security Researchers series.
“The researcher of the future isn't competing with agents on speed,” says Ofek Haviv, Cyber Security Researcher at AI-powered offensive security platform, Terra Security. “Their value is in being the standard the agents are held to: the one making sure velocity doesn't come at the cost of the integrity we talked about above.”
Within Israel’s cyber companies are small, highly specialized teams trained to think like attackers, find vulnerabilities and stay ahead of a threat landscape increasingly accelerated by AI. In this series, we meet the individuals and teams who make up this frontline of cyber: the digital fighters.
Haviv started his career as a red teamer in the army before transitioning into the AppSec world. Today, at Terra, he works with “a group of security specialists” whose output feeds directly back into the product. Consequently, he notes, “the team functions as something between a traditional research lab and the platform's ongoing ‘muscle memory’.”
You can read the entire interview below.
ID Card
Company name: Terra Security
Founders: Shahar Peled (CEO), Gal Malachi (CTO)
Year of founding: 2024
Current number of employees: 75
Company Description:
Terra Security provides Terra Platform, an agentic, AI-powered, continuous Offensive Security platform aligned with code changes and evolving attack surfaces, combining a swarm of trained AI agents with human supervision for safety and control. Fortune 500 organizations trust the Terra Platform to ensure every attack surface is covered across the web, AI, internal apps, APIs, mobile, networks, and the cloud.
About Terra's Security Research Team:
The Research Team sits at the core of Terra Security's product. Assembled from a group of security specialists – people with backgrounds in penetration testing, red teaming, and vulnerability research – whose job is at its core, to take the time and answer deep and meaningful questions in the technological side and in the methodology of the system.
That means constant deep-dive work: understanding deep technologies and how they work, how classic and new attacks work at their core, so agents can better test these, constantly red teaming the idea of how things work, internally (as a way to improve the system) and externally in offensive research.
The output of that work feeds directly back into Terra Platform, so the team functions as something between a traditional research lab and the platform's ongoing "muscle memory".
What is your background in cyber, and what led you to specialize in security research?
I started my career as a red teamer and then red team lead in the army, specializing in air gapped networks and constantly working against the top defense system the army has to offer while dealing with live human monitoring on the networks my team and I worked on. Later on, I transitioned into the AppSec world, specifically in shift-left and securing code factories, and led research at a previous AppSec company. Then I joined Terra to bring both worlds and specialties into working on and researching the peak of technology, which is what we do.
What does your security research team look like in action?
Every day looks different, but usually it involves two things: one being deep researching new capabilities and generating POCs to new solutions to never before solved problems. The other, part of being in a fast growing start up, is pressure testing previous research and helping with patches and implementation in the real world and outside the controlled environment of our research lab.
How does the research team influence your company at large?
The entire world of security testing with AI agents is still a new research field. There is very little established knowledge about how to build a truly capable autonomous penetration testing platform. There isn’t a playbook you can simply follow. A lot of it has to be discovered through research.
That means researching the agents themselves: how they reason, where they succeed, where they fail, what context and tools they need, and how much autonomy we can safely and effectively give them.
At the same time, we need to take attack techniques and knowledge that the cybersecurity community has accumulated over decades and break them down into methodological workflows an agent can understand and execute. An experienced red teamer might make ten decisions almost instinctively during an attack. Our challenge is to understand those decisions, formalize them, and determine which parts an agent can perform independently and which require human judgment.
This is why the Research Team is deeply connected to the product. When we develop a new testing methodology, discover a new attack technique, or learn something from a real-world pentest, we ask how that knowledge can be incorporated into Terra Platform. Sometimes that means giving our agents an entirely new testing capability. Sometimes it means improving their tools or reasoning, and sometimes it means designing a better way to bring a human researcher into the loop at exactly the right moment.
It also works in the opposite direction. Terra Platform gives us visibility into where agents perform extremely well, where they get stuck, and where an experienced researcher would make a different decision. Those gaps become new research questions for us.
So there is a continuous feedback loop between research and product: research advances the agents, the agents expose new research challenges, and what we learn goes back into the platform. In many ways, we’re not only researching vulnerabilities. We’re researching what the penetration tester of the future should look like.
What has been your team’s most significant security discovery to date?
We are living in a world where people are using AI to find vulnerabilities constantly. There is still incredible, sophisticated research happening and genuinely novel vulnerabilities being discovered. But I think part of the huge increase in CVEs we’re seeing has a simpler explanation: it has become incredibly easy to point agentic workflows at software that may have been outside the security research spotlight for years and systematically search for low-hanging fruit.
That’s great for the security ecosystem, but for us, finding another relatively simple CVE isn’t necessarily what moves the needle. We are more interested in asking how we can use these capabilities to fundamentally change security testing.
One example is an internal agentic system we developed around newly disclosed, one-day vulnerabilities. When a relevant vulnerability is published, the challenge isn’t simply knowing that the CVE exists. We want to understand it, reproduce it in a controlled local environment, determine the actual conditions required for exploitation, and develop a reliable and safe proof of concept to assess whether our customers are genuinely exposed.
Traditionally, that process can require a researcher to spend significant time reading advisories, analyzing patches or source code, building a vulnerable environment, understanding the exploitation path, and adapting a public proof of concept, if one even exists. We have been researching how much of that workflow can be performed by agents, while keeping a researcher in control of the critical decisions and ensuring that what ultimately reaches customer environments is safe.
To me, that’s a more interesting measure of progress. The goal isn’t to use AI just to generate more vulnerability discoveries. It’s to use AI to compress the distance between new security knowledge appearing in the world and our ability to safely test whether that knowledge actually matters to the systems we’re protecting.
Who or what is your 'Moby Dick'?
Closing the gap between our own expertise and what we actually manage to encode into the agents' architecture. Not in some final, generic sense – in a specific way: the details that feel too obvious to us as experts to even mention, the instincts we don't realize are instincts until an agent stumbles on exactly that step.
Every day we tune the needle a little – better context, clearer guidance, more precise process – and every day we find another thing we forgot we knew. We deliberately don't let ourselves land on an "absolute truth" here. The moment you think you've fully captured expert judgment in a spec, you've probably just stopped noticing what you missed.
How would you characterize the competition between research teams today?
I think it used to be that competition between research teams was about who could find the "cooler" vulnerability – the flashiest find. With today's capabilities, the challenge has shifted: it's about who can ship capabilities and deep research that are genuinely significant, at the quality bar that's actually required.
Everything moves incredibly fast now, and research teams have to operate at that speed, but the real competition, I think, is in who can combine the two: keeping pace with how fast the field is moving while still holding onto professional integrity and a real standard of rigor. That balance, more than raw speed, is where teams actually differentiate themselves today.
What is your take on the future of the human security researcher?
I think this connects directly to what I said about competition: if the differentiator today is combining speed with professional integrity and rigor, that's exactly where I see the human researcher's future.
Agents will keep taking over more of the fast, high-volume work: scanning, initial triage, even reproducing known vulnerabilities. But the judgment layer – knowing what's actually worth chasing, holding the line on quality when everything is moving fast, catching what "looks right" but isn't – that stays human. So the researcher of the future isn't competing with agents on speed. Their value is in being the standard the agents are held to: the one making sure velocity doesn't come at the cost of the integrity we talked about above.
