Doti

Doti develops browser-layer security controls designed to enforce policy and mitigate token, session, and data exfiltration risks in web-native enterprise environments. The core technology stack targets browser session compromise, which represents a critical attack surface in organizations that rely on cloud SaaS, identity platforms, and web-based collaboration tools. Rather than enforcing device-level lockdown (which is brittle in hybrid and remote work), Doti operates at the session and policy layer to control what browser-mediated actions are permitted, what data can be extracted, and how identity context flows across web applications.

The commercial problem is well-defined: enterprises increasingly handle sensitive data and mission-critical workflows in browser-mediated cloud applications (Slack, Google Workspace, Microsoft 365, Figma, GitHub, etc.), yet browser compromise (phishing, malware, insider threats, SIM swap into federated identity) bypasses traditional endpoint and network controls. Security teams face a choice between blocking cloud tool adoption entirely (operationally infeasible) or accepting residual browser-layer risk. Doti's positioning addresses this gap with session-aware policy enforcement, reducing breach surface without requiring wholesale replacement of modern application ecosystems.

The dual-use and strategic defense relevance is substantive. Defense contractors, intelligence agencies, and government-adjacent organizations increasingly operate on cloud platforms for operational speed and cost efficiency, but carry regulatory and security obligations that exceed commercial enterprise requirements. Browser security controls that can enforce segregation of duties, prevent token exfiltration, and log/audit session activity at fine granularity are directly applicable to defense supply chain security (Federal Acquisition Regulation requirements, CMMC, NIST SP 800-171 implementation), intelligence community secure access, and law-enforcement digital forensics workflows. The technology is not defense-specific, but the regulatory and operational context creates meaningful strategic value.

Competitively, the browser-security space is nascent but consolidating. Established firms like Cloudflare and Okta have added browser-isolation features; specialized browser-security vendors (Island, Surf Security) have raised capital and are scaling. Doti's differentiation rests on early-mover architecture optimized for session-level granularity and policy orchestration rather than general-purpose browser isolation. The company's Israeli origin provides access to both the talent pool and regional investment ecosystem (Israeli cyber has produced Island, Wiz, SentinelOne, among others), though competitive advantage depends on product-market traction and customer proof points rather than geography alone.

Market adoption signals remain to be demonstrated. Seed-stage startups in enterprise security face long sales cycles and require proof of enterprise deployment, regulatory alignment, and integration with existing SIEM/SOAR platforms. The company's ability to acquire and retain customers, particularly in defense-adjacent segments, will determine viability. Key diligence questions include current customer count and revenue stage, product roadmap alignment with CISO priorities, integration maturity with existing enterprise security tools, and clarity on whether the core thesis (session-level control plus policy) delivers meaningful risk reduction relative to browser isolation or endpoint detection-and-response alternatives.