Interviews > ExtraMile Video series

I was always breaking any electronic devices that I found. Later on, I also learned how to assemble it back and that's how it led at the end to start doing hacking and stuff like that. But I always like to challenge the boundaries and to understand why things is and how it's break.

And I think that once you have that mindset, that's also what led me to decide to go to become a CSO. Because I thought, like, maybe I can leverage my experience in offensive and do defense. And I thought that the biggest challenge is going to be a bank.

So that's why I went to Dell. And it was very interesting period of time. Dell in this period of time, it was started in 2008.

There wasn't a lot of tools back in those days. And I remember we've seen a lot of different type of attacks. And the existing tools didn't enable to do anything.

So, I leveraged my connection in the intelligence to speak with people that came with some ideas what we can do with that. And that's how it started to become like a design partnership and innovation. And I learned that I become passionate about solving business problems using technology.

And after eight years at the bank, I realized that's become my passion. And I thought, okay, I want to build my own company. But I also realized that I never did anything around business and never worked in the start.

So, then I decided that in order to learn that, I need first to learn how to do it. So I decided to resign my role as a CISO and cross the line to the dark side. I went to three different cybersecurity startups, each one, two years in order to learn how to build more.

So that was my evolution to that area.

Host: Great. What a journey, man. Your answer leads to another question.

Organizations invest in protecting their networks and data, though financial transactions remain vulnerable to human error, manual controls, and fragmented systems. Why is securing the actual movement of money the key challenge for businesses?

Shai: So, you know, for me, always security need to be enabled for the business. Okay, it's not need to be a blocker. It's not to be need to be a compliance.

And I always ask myself, what's really matter the most for the organization? And at the end of the day, the company funds is the key value. It's the current role of the organization.

And when I started to realize what organization doing, I was amazed because you are putting so many different solution and technologies and controls and everything. But when you're speaking about the organization, real key jewelry, at the end of the day, you're relying on a lot of manual controls and processes and nothing really sticking out. So, I've seen it happening multiple times.

I saw it happen in some of our corporate customers. And when I started to do the market research around it, I realized how big this problem is. And it was also post the pandemic, you know, just everything become more digitalized as part of that.

More digitalized, saying much more fraud. So obviously we've seen much more attempts, much more sophistication. And we realized that something that needed to be changed.

And that's the reason why I started there.

Host: Okay, well explained.

So, you mentioned digital after digital. So, AI is making social engineering attacks cost effective, convincing and easier to scale.

What would happen when AI agents begin communicating with one another and initiate or influence financial transactions with fewer human in the room?

Shai: So, I think that it will be even much worse than what we have today. So, think about that today we have one hand, you know, a lot of people doing manual controls and so on. But still, they have like volume that they kind of can work with because it's been pushed by another human being right at the end of the day.

When everything will be AI versus AI without the right mechanism and the right controls, it can be devastated. Because one of the biggest problems today is trust. And how can you make sure that you communicate with the right person?

And this is a person. But if it's an agent, it's layer below that. So, it's like this agent is supposed to be working on behalf of this company or behalf of this person.

So, to build a trust between all of that, that's going to be a very big challenge.

Host: So, moving ahead, how does Trustmi's behavior AI security solution help identify and prevent socially engineered fraud such as business email compromise and vendor email compromise before fraudulent payments are made?

Shai: Yes, I think we need first to understand why the problem is so big, and then what organization doing today. And then I can explain how we solve the problem. So, you know, big part of the problem at the end of the day is the complexity.

Okay, I think about repayment process, and especially for the security leaders in the audience, I'm not sure that you know how complex is this process. Okay, it's usually first complex, because it's involved a lot of different people, each one doing his own thing, right, some of them inside of the organization, some of them outside of the organization, almost all the communication, especially for global companies that have huge supply chains is based on email. Everyone knows that it's the source for evil, but we also use that as the source of all evil when speaking about the communication.

And then we have a lot of different systems from the finance side, you have supplier portals, procurement, treasury, ERPs, the payment itself, different API gateways, and each one of them are asylum. And on top of that, what the finance do is what they do know the best, adding more manual controls and processes based on their previous experience. So, at the end of the day, you have a classic people process technology problem, meaning very comprehensive process, a lot of technology involved in each part of the organization doing their own thing, but no one really connecting the dots to make sure that the process itself was intact.

So that's the core of the problem. Okay, when we took a look on that, again, we came from cybersecurity. So, the first question that we asked ourselves, what can we bring from our experience to solve the problem?

So first, if there are a lot of multiple tools, a siloed system, we know how to connect and integrate them. Then we can take and ingest all this data and create smart models around. But also, we know how to look on a process from start to the end and to protect it.

So, Trustmi, basically connect to the entire process. We're leveraging all this data point and leveraging AI to create a very strong fingerprint and assemble from that baseline for what's legit, what's not. And we connect it in a way to connect to the business process itself.

So basically, while we're doing that, we enable the organization to make sure first and basically answer a critical question before the money is leaving the organization. Does this payment need to go through? While doing it, we basically stop payment fraud by verifying that it's going to the right way, but also payment mistakes by verifying that it's in the right time and the right amount.

Okay, but that's the core of what we're doing. And when we thought about building a solution, two main things were very important for us. And we thought that will be foundation to our success.

First, to create a solution going to be effective. Okay, meaning we cannot, I mentioned email security, you know, there are a lot of email security today. Each one of them say we can detect BC and social engineering and so on.

But they are missing a lot. Okay. And usually when they detect something, they detect something and put a banner saying this email may be the first time that you communicate with and so on.

But you know, people become blind to those type of banners. It's not effective. So, we really wanted to be able to block that type of mistake before the money is leaving the organization.

So, when we spoke with a lot of finance people, we realized that even if we'll build the best tool ever, if we do it in a way that will change their business process, they won't use it. So, it needs to be your process, your way, and we'll protect it. So those are the two foundations that we thought will be important for us.

So, Trustmi, basically connect all those different systems, all this ecosystem, and we inject ourselves to the business process itself. So, we monitor everything in real time. But before the AP team run in their payment cycle, whatever is the frequent, we verify and correlate everything that we've seen to a very simple verdict.

Basically, green, yellow, red, green sign, everything is okay, go ahead and pay. Yellow, suspicious or payment mistake and we'll tell you why. And red, that's a fraud and we're going to block.

So that's what we do.

Host: Amazing, Shai. You have mentioned since we talked about the security, this shifts my focus to the next question. That is, as per the payment security report, organizations mainly face the threat of payment fraud.

What strategies and technologies can treasury teams adopt to boost payment security and protect financial transactions?

Shai: So, I think it's two important things. First, a big part of the problem is that you have a lot of manual controls. And you know, when you look on one thing, it doesn't necessarily mean that you know what will happen later.

Meaning, you need to connect the dots. You need to look on the entire process to really be able to pick those type of deviation and those type of fraud, especially in today's world, that everything becomes much more sophisticated. Like, think about what control they have today.

Callback procedure, reviewing of invoices, change bank account process with third-party tools that try to validate the bank account and microtransaction. All of those, again, are very complex processes with a lot of controls. But each one of the organizations doing their own thing, if you're not connecting it, it's very hard to really understand the clear picture.

And I'll give you a real example. You know, one of the biggest control that we've seen a lot is callback procedure. Okay?

The callback procedure is best practice if you make it effective. But there are two problems with that approach. First, it's a manual process, so it's very hard to enforce.

Second, the assumption is that you know who you're going to call. Now, let's say for a second that you onboarded a vendor five years. When they onboarded, they put their contact detail, everything there, right?

Five years later, the person that did it probably is not in that organization anymore. And now, if you need to call this guy to verify if this change was legit, who are you going to? He's not going to respond to you.

He's not there anymore. So, are you going to do a simple Google search? Are you going to call the number in the invoice, the number on the email?

It becomes very, very hard to make it effective. Now, the attackers have so many different ways to overcome it, from deepfake to simple changes of the contact detail before that. So, a lot of cases that they are, when they impersonate a company, they create a fake website and presence, and they promote it in Google Ads and SEO and Geo to be the first one to appear.

So, it's a really ineffective process. But from the other side, everyone feels that they are doing the right process. But at the end of the day, it's only compliancy.

It's not really secure.

Host: Very well explained, Shai. So, the next question. Beyond simply preventing financial losses, how does Trustmi help organizations reduce payment errors, enhance operational efficiency, and build trust in their finances?

Shai: Yeah, so it's going back to the point of how we operate and why we are so different, right? When I started the company, part of my validation, I have an identical twin brother, and he was a CFO at that period of time. So, I went to him to see how his team is working and what they do, and I saw a lot of the work that he did.

And I was amazed to see how manual it is, and how complex it is, and how much volume they need to possess. So, when you do so many volumes, and you're relying on mostly manual controllers and people doing their best, and you don't pay them to think, at the end of the day, you get a lot of issues and problems. And most of them, even the tools that exist today in that world, are very limited in the way that they are looking on the problem.

You have in the ERP a lot of controls that try to verify that there is no duplication, but they look at it in a very basic way. Trustmi is an AI. So, we are connecting the entire process, the invoice, the PO, everything.

And when you do that in that way, those mistakes are very clear, exactly like before, okay? So, that's very different from what we're doing, what traditional tools are doing. But more to that, if the AI started to do those type of verifications for the people, it's also saving a lot of time and energy.

So, it's not only saving payment mistakes, it's also saving the time that people were verifying each of them before. Now, one of the things that I hear a lot is like, we have controls and we catch a lot, but I'm like, okay, how much time and energy do you invest in that? We're handling only, you know, the deviation, okay?

The flags, right? But how many of those are positive, okay? And then you see that, at the end of the day, invest a lot of time and energy on those things.

So, it's really an ineffective process. Trustmi, just to give you an idea, we analyzed, in the last year, $240 billion for our customers. From that amount, able to prevent $1 billion of payment fraud and $5 billion of payment mistakes, like duplicate payment, typos, missed currencies, and so on.

Most of our customers seen between 10 to 15x return of investment between fraud prevention, efficiencies, and payment mistakes.

Host: Very well explained, Shai.

So, moving on to the last question of the day, you believe cybersecurity must evolve from protecting system to protecting business processes and transactions. What's your take on how the relationship between CISOs and CFOs is changing as organizations work to secure financial operations in today's AI-driven world?

Shai: Yeah, look, if we'll go back to what organization did and what security did in most of those cases, security implement best practices around education. They implement a secure email gateway. They did authorization and permissions.

But at the end, the core finance, like the ERP and those type of things, it's a black box to them. They didn't really do anything in that area, and they don't really understand the process to the letter, right? So, in order to really be able to solve the problem, it needs to be a joint venture.

It cannot be only security or only finance. That's the best way to do that. Also going to say that most of the finance people that I met, you know, their experience with technology, at least in the last 10 years, wasn't great.

It was a lot of the time, you know, ERP project forever, you know, cost a lot of money, never ended time. So, usually when they needed something, they went to, let's do it in spreadsheet, in a process, in the controls, because that's what they know. And from the other side, security know how to innovate.

They know how to implement technology. They know how to solve business problems. So, I think it's a real opportunity that security leaders can really become part of the business and enable the business.

You know, one of the reason that we founded that type of company around this problem is one of my biggest frustration as a CISO. It's very hard to quantify business value in cybersecurity. It's mostly people feel and how many alerts we have and how many attacks, but you cannot connect it.

How much money I save to the organization, okay? Really wanted to do something that will be first compelling to show real ROI, measurable ROI. But now when CISO team up with the finance, also get their own win because they get their sound in the table and they become enablement for business and really providing value to the organization.

Host: A perfect point to close today's discussion, Shai. On that note, we come to an end. Shai, it was an immense pleasure having you to join ExtraMile by SecureITWorld.

From being a teenage hacker to founder protecting every payment, your journey is truly inspiring. Security and finance leaders will have the best to take away from this conversation. Thank you for your time and for sharing your valuable knowledge with our audience.

Shai: Thank you so much. Have a good day.

Host: And that's a wrap on today's episode of ExtraMile by SecureITWorld.

Thank you to everyone who joined us for a super insightful conversation. Hope you will gain valuable knowledge that truly makes a difference. We will be back soon with another CISO leader changing the way tech and cybersecurity work.

Until then, stay secure, alert, and keep going with ExtraMile. Bye.

---