Onit Security

**Product and the concrete problem it solves.** Onit Security attacks one of enterprise security's oldest and least-glamorous failures: the vulnerability backlog. Modern security teams are buried under tens of thousands of "exposures" — unpatched software flaws, misconfigurations, and known CVEs — surfaced by scanners that rank them on generic severity scores (CVSS) rather than on what actually matters to a given organization. The result is a queue that never empties. Onit and its cited industry data frame the scale bluntly: mean time-to-remediation runs into the hundreds of days (the company cites an industry average it puts as high as ~243 days, and third-party context of ~32 days average with nearly half of vulnerabilities still unresolved a year later), while attackers need only one deprioritized flaw. Onit's origin story is precisely that failure mode: the company was conceived after Iranian state-sponsored hackers breached a firm previously run by co-founder Ofer Amitai by exploiting a *known* vulnerability that had been buried in the backlog behind thousands of higher-"severity" items. Onit's pitch, captured in CEO Elad Ben-Meir's line that "vulnerability management has been broken for 30 years," is to convert an unmanageable task queue into a small set of durable decisions that software agents then execute continuously. Its tagline — "Security by decision / Decide once. Resolve forever." — encodes the product philosophy.

**Core technology and how it actually works.** Onit describes itself as a **Decision-Based Exposure Management** platform, an agentic layer that automates the full lifecycle "from ingestion and prioritization to remediation execution." Mechanically, the platform runs several coordinated functions: (1) *decision surfacing* — collapsing thousands of individual exposures into the handful of underlying decisions that actually drive resolution; (2) *impact assessment* — ranking exploitability against the real environment and business context rather than raw CVSS, so a "medium" flaw on an internet-facing crown-jewel asset outranks a "critical" one on an isolated box; (3) *owner assignment* — polling fragmented systems of record (CMDB, ticketing, and communications/collaboration tools) to automatically resolve who actually owns a vulnerable asset, a step that traditionally consumes enormous manual coordination; and (4) *continuous resolution* — turning each human decision into a persistent rule that agents apply automatically to all similar future exposures, so the backlog shrinks over time instead of regenerating. The architecture is explicitly integration-first ("works with your existing stack," no rip-and-replace), sitting on top of an organization's existing scanners, asset inventories, and workflow tools rather than replacing them. The company reports current customers achieving mean-time-to-remediation reductions of "up to 87%," compressing month-long processes to minutes or hours — claims that are vendor-reported and not independently audited, and should be treated as directional.

**Market, customers, and go-to-market.** Onit sells into the fast-growing exposure management / Continuous Threat Exposure Management (CTEM) category, a space Gartner has helped popularize and that overlaps risk-based vulnerability management, attack-surface management, and security automation. Its go-to-market appears to be direct enterprise sales aimed at large, complex organizations where backlog pain and ownership fragmentation are most acute — it says it is already "working with Fortune 1000 customers." Notably, the company's website surfaces outcome statements attributed to security leaders at **Honeywell, Marvell, Dell Technologies, and SAP** — an unusually blue-chip reference set for a company only just out of stealth, and plausibly connected to the founders' prior relationships (Honeywell acquired the founders' previous company, SCADAfence). These should be read as reference/testimonial relationships rather than confirmed at-scale commercial contracts, but they are strong early social proof. The land-and-expand logic is favorable: an integration-first platform that plugs into existing security stacks lowers adoption friction, and a decisions-become-rules model creates compounding switching costs as an organization encodes more of its remediation policy into Onit.

**Traction, funding, and third-party validation.** Onit emerged from stealth in March 2026 with an **$11 million seed round announced March 24-25, 2026**, led by **Hetz Ventures and Brightmind Partners** with participation from prominent (unnamed) angel investors; Onit appears in Hetz Ventures' portfolio, corroborating the lead. Brightmind's Gur Talpaz publicly framed the thesis — enabling defenders to "respond at the speed of attackers, turning millions of unmanaged exposures into a problem that actually gets smaller over time." The most substantive third-party validation, however, is the founding team's track record rather than the round size: this is a group with three prior acquisitions to its name. The combination of a hot category, a proven team, name-brand early references, and tier-one Israeli/global seed investors is a credible early signal, though it remains a pre-Series-A company with no disclosed revenue, ARR, or headcount, and a product only recently in the market.

**Founders and team background.** Onit's differentiator is heavily a team story. **Elad Ben-Meir (CEO)** was previously CEO of **SCADAfence**, an OT/ICS critical-infrastructure cybersecurity company acquired by **Honeywell** in 2023. **Ofer Amitai (CPO)** founded **Portnox**, a network access control (NAC) company later sold to private equity, and it was a breach of a company he ran that seeded Onit's thesis. **Tom Winter (CTO)** is tied to **For-Each**, acquired by **Autodesk**. Collectively the founders are described as serial entrepreneurs with three exits across OT security, network access control, and developer tooling — a rare combination of enterprise-security domain depth, prior scaling experience, and a lived, first-person understanding of exactly the failure their product targets. That pedigree materially de-risks execution and go-to-market relative to a first-time team, and helps explain the blue-chip early reference logos.

**Competitive dynamics.** Exposure management is crowded and contested. (1) Onit competes against established **risk-based vulnerability management / CTEM** vendors such as **Tenable** (which acquired Ermetic), **Qualys**, and **Rapid7** — incumbents with large installed bases but heritage in scanning and scoring rather than autonomous remediation. (2) It competes with **exposure/attack-surface consolidators** like **XM Cyber** (Israeli, Schwarz-owned) and **Cymulate**, and with **Wiz**-style cloud-security platforms increasingly moving into prioritized remediation. (3) A wave of **agentic-AI security automation** startups (e.g., companies applying LLM agents to SOC and remediation workflows) is converging on the same "let agents do the toil" thesis, so Onit's agentic angle is differentiated today but unlikely to stay uniquely so. Onit's plausible edges are: (i) a genuinely different framing — *decisions* as the unit of work rather than tickets or alerts; (ii) automatic ownership resolution across fragmented CMDB/ticketing/comms systems, a painful and under-served step; (iii) an integration-first posture that eases displacement of nothing and augmentation of everything; and (iv) a founding team with credibility to win enterprise trust quickly. The countervailing risk is that incumbents with distribution can bolt on "agentic remediation" and compress Onit's window.

**Defense, security, and resilience dual-use relevance.** Onit's dual-use relevance should be stated with calibration: it is a commercial enterprise-cybersecurity company, not a defense contractor, but its mission sits squarely on the national-resilience axis. The catalytic event was a nation-state (Iranian) attack exploiting an unremediated known vulnerability — the exact attack pattern that repeatedly compromises critical infrastructure, government, and defense-industrial-base networks. Reducing mean time-to-remediation and automatically closing exploited-vulnerability windows is directly relevant to hardening the operators of energy, water, manufacturing, and defense-adjacent enterprises against exactly the adversaries Israel and its allies face. The founders' OT/ICS heritage (SCADAfence, acquired by Honeywell) reinforces the critical-infrastructure adjacency, and NAC/exposure heritage (Portnox) reinforces the enterprise-hardening angle. The honest calibration: this is resilience-enabling commercial cybersecurity with clear relevance to critical-infrastructure and government defense, not a fielded military capability or a disclosed defense contract; its dual-use weight scales with any future adoption by infrastructure operators, government, and defense-industrial customers rather than resting on a fielded system today.

**Growth stage, trajectory, and key diligence risks.** Onit reads as an **early-stage** company: founded 2025, out of stealth March 2026, one $11M seed round, a product in initial enterprise deployment, and no disclosed revenue or headcount. Its trajectory is unusually strong for its age because of the founders and early references, but the diligence risks are real. (1) **Execution/category risk** — exposure management and agentic security automation are crowded and fast-moving; incumbents with distribution can converge on the same thesis. (2) **Unverified performance and traction** — the "up to 87% MTTR reduction" and Fortune 1000 / named-logo statements are vendor-reported testimonials, not audited metrics or confirmed at-scale contracts. (3) **Autonomy trust and safety** — auto-executing remediation in production enterprise environments demands very high reliability; a bad automated change can cause outages, and enterprise buyers will gate autonomous action carefully. (4) **Financial opacity** — revenue, burn, ARR, headcount, and cap-table detail beyond the seed are undisclosed. (5) **Founder concentration** — the thesis leans heavily on three principals. Progression toward mid-stage would be evidenced by a priced Series A, disclosed paying-customer counts and retention, independently referenceable deployments, and evidence that autonomous remediation is trusted in production at scale.