Snehal Antani

Selling Pizza in New Hampshire

His first job was at a mall pizza counter. He told the Master Move podcast So my first job was, selling pizza at the mall when I was 15 years old in New Hampshire. The job pushed a shy teenager to talk to strangers. His father, an electrical engineer, was his model: I really just wanted to be him in every way. Watching where his father missed out on promotions, he made a list of the skills he saw in leaders he admired, from technical depth to public speaking, and chose later jobs by which of those skills they would teach him. His father also introduced him to hacking culture, and he has said he has been obsessed with this product, Craig, since I was 12 years old.

Mainframe Years at IBM in Poughkeepsie

He studied computer science at Purdue University and graduated in 2002, just after the dot-com crash, and later earned a master's degree in computer science from Rensselaer Polytechnic Institute. He turned down offers in Silicon Valley to join IBM in Poughkeepsie, New York, where the mainframe was built. My early career at IBM was probably the most formative of my career, he said. He worked on distributed systems and WebSphere and learned by listening: I literally used to sit in the hallway in front of the office of my team lead because, because I was afraid to ask him questions that were dumb. The ACTION Institute at the University of California, Santa Barbara, where he sits on the external advisory board, lists him as holding 18 patents.

Deciding What Not to Fix at GE Capital

He left IBM to become a CIO at GE Capital, his first large executive job. On a CyberWire-X special edition he described receiving lists of 100,000 vulnerabilities he did not have the staff to fix. So the hardest part of the job was deciding what not to fix. The second hardest part of the job was telling people to fix stuff I knew weren't even exploitable or relevant to the attacker. He said he had to ask IT staff to skip their children's basketball games for patches that did not matter, and that he had no way to know whether his security worked. I had no idea I was secure until the bad guy showed up. His wish became a line he still repeats: And for every patch Tuesday, I wanted a pentest Wednesday.

Splunk and Special Operations

As chief technology officer of Splunk he worked with the data company's largest customers and found the same doubt among their security chiefs. He also studied how Splunk's executives ran sales and finance, part of his habit of learning from the people next to him. He then left industry to serve as the first chief technology officer of Joint Special Operations Command, where he led data analytics, cloud and edge computing, and cybersecurity work. There a commander gave him the instruction that shaped Horizon3.ai: Don't tell me we're secure. Show me. And then show me again tomorrow, and then show me again next week. Because our environment's always changing, and the adversary always has a vote.

He was an early user of Project Maven, the Pentagon's AI program, and took a lesson from its leader, Colonel Drew Cukor, that the training data mattered more than any model. So when I started Horizon3 3 in, early 2020, I said, we're a data company, like every AI company is a data company first.

Building Horizon3.ai

NodeZero works from inside a network the way an intruder would, chaining together stolen credentials, misconfigurations and exposed services to show what an attacker could reach. He explains the difference from a vulnerability scanner in plain terms. Of a scanner, he said on CyberWire-X: It's basically looking at one thing on one machine in complete isolation. And that's just not how attackers behave. He treats each test as a sensor that collects data about real networks, which he says lets the company improve its hacking algorithms over time, the way Tesla collected driving video before improving self-driving.

He believes AI is making attackers faster at the hardest part of an intrusion. He compares an attack to chess, with set openings and endings and a dynamic middle game, and said tools built on language models are lowering the barrier of entry to mastering the middle game of pen testing. On how security companies win customers, he said You’re not going to win security deals one steak dinner at a time. The Master Move host described Horizon3.ai's growth from $1 million to $100 million in annual recurring revenue.