SaiFlow

**Product and the concrete problem it solves.** SaiFlow addresses a fast-widening and under-defended attack surface: the millions of internet-connected, grid-edge energy assets — EV chargers, rooftop and utility solar inverters, wind turbines, battery energy storage systems (BESS), smart meters, substations, and microgrid controllers — that together form the "distributed energy resources" (DER) layer now being bolted onto power grids. These devices were designed for uptime and interoperability, not adversarial resilience, and they speak energy-specific protocols (OCPP, OCPI, IEEE 2030.5, OpenADR, DNP3, IEC 61850) that conventional IT and even generic OT security tools do not natively understand. As DER penetration rises, an attacker who can manipulate a large enough aggregation of these devices can cause more than a data breach: they can disrupt charging networks, steal energy, trip protection systems, or — in aggregate — destabilize grid frequency and voltage. SaiFlow's platform is purpose-built to see, understand, and defend this layer, positioning itself under the tagline "Securing Energy, Enabling Life" as runtime cybersecurity for the energy transition rather than a repackaged enterprise-security product.

**Core technology and how it actually works.** SaiFlow's differentiator is the fusion of *energy telemetry* with *network telemetry* into a single detection and response engine. The platform delivers three linked capabilities: (1) **contextual AI threat detection** that correlates power-side data (load, charging sessions, generation, protocol commands) with network behavior to flag anomalies that are invisible to a purely IT- or packet-oriented tool; (2) **energy IoT asset visibility**, an observability layer that discovers and inventories every distributed asset, its firmware and vulnerabilities, and its protocol conversations to build behavioral baselines; and (3) **automated zero-trust response**, which enforces energy-context-aware policies through integrated network security controls. Because the correlation engine is trained on the semantics of energy protocols and grid operations, it can distinguish a legitimate demand-response event or charging surge from a coordinated manipulation. SaiFlow has also published original vulnerability research — most notably a class of attacks in the widely deployed OCPP 1.6J standard, where the protocol's mishandling of multiple concurrent charge-point connections combined with weak authentication lets an attacker hijack a charger's identifier and launch a denial-of-service against electric-vehicle supply equipment — demonstrating genuine domain depth rather than generic anomaly scoring.

**Market, customers, and go-to-market.** SaiFlow sells into a structurally expanding market driven by electrification, EV-charging build-out, and grid decentralization. Its buyers are the operators of distributed energy infrastructure: charge-point operators (CPOs) and e-mobility service providers (eMSPs), utilities and distribution operators, solar/storage developers, microgrid and BESS operators, and the energy-management platforms that aggregate them. The go-to-market is heavily partner-leveraged: SaiFlow announced a technology partnership with **Check Point Software** integrating its energy-context risk assessment with Check Point's Quantum IoT Protect, and a parallel partnership with **Palo Alto Networks**, in each case delivering an end-to-end solution tuned to energy protocols such as OCPP, OCPI, and IEEE 2030.5. Riding established security channels lets a small company reach large infrastructure operators far faster than a direct-only motion, and aligns SaiFlow with the two vendors most likely to be already present in a utility or enterprise network.

**Traction, funding, and third-party validation.** SaiFlow is early-stage but has accumulated credible external validation. Public databases report roughly $4.75M raised, with a November 2024 round associated with Essentia Venture Capital and Next Gear Ventures; the company has also been selected into notable programs including the AWS & CrowdStrike Cybersecurity Accelerator and a Next Gear cyber accelerator cohort, and is listed among Israel's energy-tech ecosystem players by Startup Nation Central. The Check Point and Palo Alto partnerships are the strongest third-party signals — both imply technical vetting by tier-one security vendors — and SaiFlow's coordinated-disclosure vulnerability research earned independent coverage in outlets such as SecurityWeek, which reinforces the team's technical credibility with the broader security community. The countervailing point is that disclosed capital is modest, revenue and named paying customers are not documented in open sources, and the platform is competing for budget in a crowded OT/IoT-security field.

**Founders and team background.** SaiFlow was founded in 2022 by **Ron Tiberg-Shachar** (CEO), **Or Shwartz**, and **Dor Shmaryahu**, with the small-team profile (public figures cite roughly 11–50 employees) typical of an early cyber startup. The founding thesis — that securing the energy edge requires people who understand both cybersecurity and power-system operations — is reflected in the product's protocol-native design and its published OCPP research. The principal gaps in the public record are the depth of the go-to-market and energy-OT engineering bench, the founders' full prior track records, and the precise current headcount, all of which warrant direct verification in diligence.

**Competitive dynamics.** SaiFlow competes along a spectrum from broad OT/ICS security incumbents to niche energy-security specialists. (1) Horizontal OT/IoT-security platforms such as **Claroty**, **Nozomi Networks**, and **Dragos** cover industrial environments broadly and have far greater scale, but are not purpose-built around DER and EV-charging protocols. (2) Energy-and-OT specialists like Israel's own **Astoria Cyber** (renewable-plant cyber bundled with energy-management and trading/optimization) overlap on renewable-plant security but pursue a different, more integrated operations posture. (3) Adjacent grid- and asset-monitoring players (e.g., IoT energy-monitoring vendors) touch the same assets without the security depth. SaiFlow's edge is fourfold: (i) energy-plus-network telemetry fusion rather than network-only detection; (ii) native fluency in EV and DER protocols; (iii) original, disclosed vulnerability research that builds trust and product signal; and (iv) distribution through Check Point and Palo Alto. The risk is that a well-funded horizontal incumbent extends into DER and EV coverage before SaiFlow reaches escape velocity.

**Defense, security, and resilience dual-use relevance.** The dual-use case is real but should be framed honestly as critical-infrastructure resilience and homeland security rather than kinetic defense. Power grids and their fast-growing DER/EV edge are prime targets in modern conflict and gray-zone operations: attacks on Ukraine's grid and repeated warnings about pre-positioning in Western utility networks make grid cyber-defense a national-security priority, and large aggregations of hijackable grid-edge devices are precisely the kind of distributed weapon an adversary could weaponize to destabilize a grid. SaiFlow's protocol-aware detection and automated response directly harden this surface, with clear applicability to energy resilience for utilities, military installations and base microgrids, and allied critical-infrastructure operators. The calibrated view: the commercial thesis (protecting CPOs, utilities, and DER operators) is the fielded reality, while the defense/homeland-security relevance is a credible adjacency — energy security is a recognized strategic domain — rather than a documented set of military contracts.

**Growth stage, trajectory, and key diligence risks.** SaiFlow is an early-stage company with a differentiated product, a domain-credible team, and strong channel partners, but modest disclosed funding and thin public evidence of scaled revenue. Its trajectory depends on converting the Check Point and Palo Alto partnerships and accelerator relationships into repeatable, referenceable deployments before better-capitalized OT-security incumbents close the DER/EV gap. Key diligence risks: (1) **capitalization** — ~$4.75M disclosed is light for a category that rewards scale and long enterprise sales cycles; (2) **competitive encroachment** — Claroty/Nozomi/Dragos and energy-OT specialists could extend coverage; (3) **commercial proof** — named paying customers, ARR, and retention are not documented publicly; (4) **channel dependence** — heavy reliance on partner ecosystems concentrates go-to-market risk; (5) **standards/regulatory timing** — demand is partly gated by evolving EV-charging and DER security mandates; and (6) **team-scale opacity** — current headcount, bench depth, and founder track records need direct confirmation. The bull case is a protocol-native leader for the electrified grid edge with tier-one distribution; the bear case is a strong niche product that is out-scaled before the DER-security market fully materializes.