Security Researchers: Digital Fighters Series
Noma: “The research surface is expanding faster than researchers can cover it”
Sasi Levi, Security Research Lead at Noma Security, discusses why great researchers create new problem spaces rather than hunting for individual bugs as part of CTech’s Security Researchers series.
“Right now, the research surface is expanding faster than researchers can cover it,” says Sasi Levi, Security Research Lead at Noma Security, which has raised $132M to date from investors including Evolution Equity Partners and Ballistic Ventures. According to Levi, one of the fundamental security challenges of agentic AI facing researchers today is that “the attacker does not necessarily need your credentials. Sometimes they only need influence over something your trusted agent will consume.”
Within Israel’s cyber companies are small, highly specialized teams trained to think like attackers, find vulnerabilities and stay ahead of a threat landscape increasingly accelerated by AI. In this series, we meet the individuals and teams who make up this frontline of cyber: the digital fighters.
“We are deliberately a small, very senior team,” Levi says of his Noma Labs vulnerability research group at Noma. “Researchers who are naturally curious across boundaries are the folks who find their home here.” To him, “security research is not only about finding a vulnerability. It is about understanding the assumptions behind a technology and figuring out what happens when those assumptions break.”
You can read the entire interview below.
ID Card
Company name: Noma Security
Founders: Niv Braun (CEO) and Alon Tron (CTO)
Year of founding: 2023; emerged from stealth in 2024
Current number of employees: ~150
Company Description:
Noma secures AI wherever it actually shows up in an enterprise – autonomous agents running in the cloud, agents assembled by business users inside low-code builders, and local AI on the endpoint. The platform has four pillars: AI Security Posture Management (AISPM), AI Red Teaming, AI Detection and Response (AIDR), and Access Control. The thesis behind all four is one architectural claim: in an agentic system, the trust boundary is no longer enforced by code, but by a model's behavior at inference time. That cannot be patched like a bug; it has to be contained using the right security controls, as automatically as using AI itself.
About Noma's Security Research Team:
Noma Labs is an AI vulnerability research team focused on uncovering critical security flaws across enterprise SaaS, AI platforms, developer ecosystems, autonomous coding agents, Model Context Protocol (MCP) implementations, and emerging AI middleware architectures. Over the past two years, the team has disclosed several major AI security findings.
These findings include GitLost, which exposed how untrusted repository issues could hijack AI agents inside GitHub workflows and lead to private code exfiltration; GeminiJack, a zero-click vulnerability revealing how indirect prompt injections embedded in shared Workspace files could manipulate Google Gemini Enterprise into leaking sensitive corporate data without user interaction; and RufRoot, a critical 10.0 vulnerability in the Model Context Protocol (MCP) bridge of Ruflo, enabling unauthenticated remote code execution, credential theft, and persistent AI memory poisoning.
Together, these discoveries establish Noma Labs' track record in uncovering a rapidly emerging class of security threats: how attackers can weaponize trusted context, legitimate AI permissions, and interconnected infrastructure to turn AI systems into enterprise-wide attack vectors. The team works closely with affected vendors throughout the disclosure and remediation process to help mitigate these risks before they can be exploited at scale.
What is your background in cyber, and what led you to specialize in security research?
My background is actually in software engineering. I spent years in development and leading dev teams before I transitioned to security research. When the bug bounty world exploded about 15 years ago, I jumped in too and quickly reached the global top 10 for both PayPal and Google. I think that, because of my extensive dev background and perspective, my approach to research is different. It allows me to see through system architecture and discover real risks and vulnerabilities that other researchers miss.
The research side of cybersecurity is both fascinating and dynamic. Especially in understanding how complex systems behave and can be turned in ways their designers did not anticipate. For me, security research is not only about finding a vulnerability. It is about understanding the assumptions behind a technology and figuring out what happens when those assumptions break.
When generative AI and AI agents started moving into enterprise environments, I saw a new research surface emerging very quickly. Suddenly, we had systems that could reason over untrusted data, access sensitive information, call tools and APIs, and take actions on behalf of users. At the same time, the traditional security boundaries around those systems were still immature.
We created Noma Labs to specifically focus on all aspects of AI vulnerability research. What’s fascinating is that we’re still discovering and testing even the most fundamental security assumptions of AI systems. There is an opportunity not just to find individual vulnerabilities, but to identify entire new classes of vulnerabilities before the industry has names for them.
What does your security research team look like in action?
We are deliberately a small, very senior team. Researchers who are naturally curious across boundaries are the folks who find their home here.
A typical research project starts with a new AI product, agent framework, or developer platform. We first try to understand the architecture: where does untrusted input enter, what context does the AI trust, what permissions does it have, what tools can it invoke, and of course, where can information leave the system?
Then we start breaking assumptions.
AI security research often spans several disciplines. One major discovery can require a thorough understanding of prompt injection, OAuth permissions, cloud infrastructure, agent behavior, and traditional application security.
We also spend a lot of time looking for patterns across products. Finding one vulnerability is useful. Finding the architectural reason why the same vulnerability could exist across an entire product category is much more interesting and has more impact for the community.
And once we find something, the work is not finished. We reproduce it carefully, understand the real-world impact, work with the affected vendor through responsible disclosure, and then try to extract the broader lesson for the industry.
How does the research team influence your company at large?
By actively probing both widely deployed and emerging AI systems, our team uncovers entirely new classes of vulnerabilities before they can be exploited at scale. Our mission extends beyond internal product development to frontier research that holds AI vendors accountable, responsibly discloses critical findings, and ensures users everywhere are protected.
When our team uncovers a new vulnerability, we collaborate directly with affected vendors to remediate the issue at the source. Simultaneously, these frontier discoveries do feed directly into Noma's overarching security and product strategy. Our engineering teams translate our research into systemic, automated protections built straight into the Noma platform. This relentless feedback loop between ecosystem-wide threat research and product development ensures Noma proactively counters emerging security risks long before they become standard industry threats.
What has been your team’s most significant security discovery to date?
GitLost is probably the research that best represents what we are trying to uncover.
The important part of GitLost was not simply that an AI agent could be prompt-injected. We already knew models could be manipulated through untrusted instructions. The more important question was what happens when that model is placed inside an automated workflow and given permissions the attacker does not have.
In GitLost, we demonstrated how untrusted repository content could influence AI agents running within GitHub workflows, causing them to access and expose information from private repositories.
That distinction is important. Traditional prompt injection research often focuses on changing what a model says. With agentic systems, the security impact increasingly comes from changing what the model does. An attacker may never have permission to access a private repository, internal document, API, or corporate system. But if they can influence an AI agent with those permissions, the agent can become a bridge across that security boundary.
For me, that is one of the fundamental security challenges of agentic AI: the attacker does not necessarily need your credentials. Sometimes they only need influence over something your trusted agent will consume.
Who or what is your 'Moby Dick'?
My Moby Dick is probably the first truly systemic agentic vulnerability: something that is not specific to one vendor or one implementation, but exists because of the way AI agents are designed and built.
We are connecting models to browsers, email, source code, databases, SaaS applications, MCP servers, internal knowledge, and increasingly powerful tools. At the same time, those models consume enormous amounts of context that can come from untrusted parties.
That combination creates a fascinating security problem: trusted permissions and untrusted context are increasingly meeting inside the same decision-making system.
So the research question I keep coming back to is: where is the assumption that everyone is making today that we will look back on five years from now and wonder how we ever considered it safe? Finding that assumption before it becomes an industry-wide problem is the kind of research I am chasing.
How would you characterize the competition between research teams today?
There is definitely competition, and I think that is healthy. AI security has attracted excellent researchers from traditional application security, cloud security, offensive security, academia, and the AI safety world.
But right now, the research surface is expanding faster than researchers can cover it. New agent frameworks, protocols, copilots, AI-enabled SaaS products and developer tools appear constantly. There are more interesting questions than any single research team can investigate.
The real competition, in my view, is around who can identify a new security class first rather than who can accumulate the largest number of individual vulnerabilities. Finding another vulnerable implementation is valuable. Demonstrating that ten different products are vulnerable because they share the same architectural assumption is much more powerful.
That is where I think the strongest research teams will differentiate themselves: not just finding bugs, but naming the security problems the industry will spend the next several years trying to solve.
What is your take on the future of the human security researcher?
AI will make security researchers dramatically more productive, but I do not think it removes the need for human researchers. I think it changes what makes a researcher valuable.
A lot of mechanical research work will increasingly be automated. A researcher equipped with AI will be able to explore a much larger surface than a researcher could manually.
But the hardest part of research has never been typing the exploit. It is asking the right question: Why was this system designed this way? What assumption is everyone making? What happens when two individually secure systems are connected? What capability does this agent have that its developers forgot to treat as a security boundary?
AI is becoming extremely good at searching a known problem space. Great researchers are valuable because they create a new problem space. So I think the future researcher looks less like someone manually hunting for individual bugs and more like a scientist or an entrepreneur: forming hypotheses, connecting technologies that nobody thought to connect, and recognizing a new class of vulnerability before everyone else realizes it exists.
AI will give researchers increasingly powerful tools. Human curiosity will still decide where to point them.
