"You Can't Keep AI in a Walled Garden": The Case Against Slowing Down | Gili Raanan on Invested

0:00  You were the investor in what is one of the top 10 exits of all time, Wiz. And not all time in Israel — all time. You also are the inventor of CAPTCHA, which I think is the bane of existence of many people. In many, many cases, most cases, I know I'm an investor after probably 10 minutes, and then it takes me a few years to figure out why. Being smarter is always better, but it's not the most important thing. And that attracted me to the kid whose parents went through ugly divorces. Those people who went through those experiences and managed to overcome, those are the people I like to partner with and go for the journey. As a person, I'm never happy about what I achieve.

0:51 What about your childhood makes you unsatisfied? Welcome back to another episode of Invested. And the truth is that I have been wanting to do this episode with this guest since I started this podcast. I'm pleased to welcome Gili Raanan. It's an honor to be here, and I don't know why we have been waiting so long. It's two busy schedules, I guess, is part of the issue. But I want to tell everyone why I've been wanting to do this. There's a few reasons. I was at Benchmark and spun out and did Aleph. You were at Sequoia and spun out and did Cyberstarts. Not only that, but I think it's fair to say that you are the most successful venture capitalist in Israel and one of the most successful in the world. And you have a very low profile, but everybody knows who you are. And when you talk to your entrepreneurs, not only they say they get a lot of help here, they say you're a mensch. And since this podcast is about values that create value, it's been important for me to have you on the podcast.

1:54 So thanks for coming on. When we started Aleph, one of the things we said was we're not going to invest in cyber in Israel. And why did we say that? We didn't think we had edge against you and other people. And the other reason was that cyber was producing what I would call mediocre exits, that is, outside of Check Point at the time. But you took the exact opposite approach and did all cyber all the time. So I'd love to understand the origins of the strategy that you adopted.

2:26 You know, back in 2018, left Sequoia and I made two decisions. One is more idiotic than the other. One decision was to focus solely on cybersecurity. And in 2018, cybersecurity wasn't cool. They didn't even call it cybersecurity. It was called IT security, information security. And as you said, investors stayed away from IT security, because you couldn't really make money investing in IT security. You could sell a company to Cisco, Check Point, for $100 million, and that's about it. So not very exciting. The second decision was — even coming out of Sequoia, and I have tons of respect to Sequoia, I think it's one of the best teams ever in VC, and I couldn't do what I'm doing today without, you know, working and watching legends like Michael Moritz or Doug Leone or Jim Goetz. One thing I felt that is completely broken about early-stage investment is the focus on the business idea and the technology.

4:06 I felt that we are spending endless hours analyzing ideas, and at the end of the day it's a big waste of time, because the founders either lie to us about the ideas they have, or they don't know, or they change their mind after three or four weeks. So why waste calories on analyzing technologies and business ideas that would not be in our life in a few weeks, while the most important thing is the person that's sitting next to me. So I told myself, I'll be a purist. I would not ask a single question about technology, product, or business idea. I would simply ignore those elements. Because, you know, there are many investors that say that of course they focus on people, they invest in people, you know, people are the most important thing in VC, et cetera. But they do ask a lot of questions about what you want to do. And I decided I would simply do zero of that, and I would spend all my time, you know, asking entrepreneurs about their mother and about their childhood, and I would use that information to decide if I want to be their long-term partner for the journey. And those were the two decisions. Cyber — if I summarize, cyber because I'm lazy, and ask no questions about technology and products because I got tired of being manipulated at seed stage investments.

6:09 What's something that somebody tells you about their mother that causes you to invest? That's a great question. Because, you know, the moment you decide to base all your investment thesis on the person, it forces you to really go into a very deep and long and sometimes dark journey to decide, okay, who's the person I want to invest in? And it begins with the anti-profile — who I don't want to invest in. And one of the first — it wasn't even a decision, it was just a conclusion — that I don't like to, I don't plan to invest in the smartest kid in the block. 26, 27 years old, you start your first company and you'll face challenges. And one thing for sure, when you start a company, you'll face challenges. What would happen to you? Would you be able to deal with those challenges? Would you collapse? Would you stay away? Would you give up? That's a huge risk for me as an investor. So those are the elements I like to de-risk. And IQ doesn't help here. IQ helps. Being smarter is always better, but it's not the only thing that matters. It's not the most important thing. What matters for me is the ability to deal with challenges. And the best proxy to that in childhood, and with relationship with your mother, is to meet people that faced some real difficulties in life and managed to overcome those challenges and show some early signs of greatness. The signs of greatness you can show when you are 20 years old. They didn't, you know, they didn't win the Nobel Prize, but they did something extraordinary, although their starting point wasn't perfect. And that attracted me to the kid whose parents went through ugly divorces, the child who grew up without a father figure in a family, to the girl who was socially isolated and was kind of weird, to the boy who lived in a closet for a while and felt very ashamed and disconnected. Those people who went through those experiences and managed to overcome and show some early signs of greatness, those are the people I like to partner with and go for the journey.

9:25 Do you interview the mothers? No, I don't. Have you ever asked a mother a question, like even after somebody was successful? I do go through a very deep conversation, and we reach — One conversation? It's one or two conversations for me. You know, back then I started Cyberstarts as a solo GP, as a solo investor. But today we are four partners on the ground here in Israel, plus two partners in the States. All of us have different versions of that conversation, but for me it's typically one conversation. So one conversation and I make a decision. Typically, you know what, Michael? In many, many cases, most cases, I know I'm an investor after probably 10 minutes — Yeah.

10:23 — and then it takes me a few years to figure out why. Intuition's a funny thing. I actually want to come back to that. A lot of what you're describing sounds like Angela Duckworth's book Grit. Did you ever read the book? Yeah. Is that what you're looking for? I am looking for people with deep, with significant emotional depth, that would evolve and grow through the journey. Depth and complexity, it sounds like.

10:55 And complexity. If you dig deep enough — that is a good point — you'll find out that we are all screwed up in so many, so many interesting ways. You just need to dig deep enough. They're all normal people, in the most non-normal way you can define. You know, that's what I love about this job. You know, when I look at the journey I took, for the people I invest in, it's like a gift box. A gift box — you know, you look inside and they look inside, and they don't know what would come out of the box. The deeper, the more complex the personality is, the chances for fast evolvement and many times unexpected directions is higher.

11:57 And I love that, because that non-linear growth, personal growth of entrepreneurs, is fascinating. And if you go back to the VC model, that what creates outsized returns. Shout out to my mother. My mother, I remember as a kid she used to pray for having mediocre children, because she used to say that the line between brilliant or extraordinary and crazy was this thin, really, really thin. It always bothered me as a kid, but as I got older I discovered that she's probably right. She's right.

12:36 She's my mother, of course she's right. But she is actually right in having prayed for mediocre children. Doesn't it worry you that all these kind of complex and deep and extraordinary people, if you do something extraordinary, could tip over into crazy and come off the rails? No. I have to tell you that this thought never crossed my mind. It's a risk, but when you look at all the things you can learn in one hour conversation, when you go deep, but you still have the empathy to that person, you still like that person to be successful — you checkmark many important ingredients that can make up terrific entrepreneurs. And still, you know, and not with lack of trying, it's not bulletproof, it's not 100%.

13:39 You're a pretty extraordinary entrepreneur yourself. If I checked in and talked to your mother, what would I learn? As a person, I'm never happy about what I achieve. It's not like I sit, I look at, you know, an accomplishment and I feel like — I'm not telling myself things like, oh, I'm blessed, you know, what an achievement. Now I can sit and enjoy my time. You know, it's — What about your childhood makes you unsatisfied?

14:14 Critical parents. An environment that didn't embrace being exceptional, almost at anything. The environment I grew up in my hometown in Kfar Saba was that stability and being conformist, you know, do what other people do, was the most important thing. You know, I grew up in an age where there were no smartphones, there was no internet. If you wanted to know something, you could ask grown-ups, but quickly you realize that they don't know anything. And you know what? They don't care.

15:05 All they care about is, you know, the day job, and keep going and providing stability for their families. It was terrible experience for me. You know, I felt that I'm missing the world. There's a big world. I had the feeling that there's a big cosmos out there that I'm completely missing it. It's like it goes — it's a train that's left the station and I'm watching it, and I see the smoke that it's leaving behind. So I found myself spending most of my time in the public library, which didn't make me the most popular kid in high school. And I felt completely misunderstood and misfit. And I think this sense of this big world that's out there that's waiting to be discovered, that's still driving me today.

16:23 It's amazing that you even found it in Kfar Saba, that you were that curious. So you were the investor in what is one of the top 10 exits of all time, Wiz. And not all time in Israel, all time. $32 billion acquisition by Google of Wiz and Assaf Rappaport. What is it about Assaf Rappaport — like, if we asked his mother — that made him special? Because he wasn't just a first-time Wiz entrepreneur. That was his second company, after Adallom. We'll come to that story in a second. But what is it about Assaf? What would his mother say?

16:57 First of all, I don't know if you interviewed Assaf here, but you should. I try. He doesn't respond to my emails. Hope he's listening. My first meeting with Assaf was very unusual, because it didn't happen. You know, I set up time with him. I was waiting for him to show up, and he didn't show up. It was very telling, because he didn't forget. It's like it was deliberated. And it was — what was very unusual, back then I was at Sequoia, that a founder that's looking to raise seed money from Sequoia doesn't show up for a meeting. One of his superpowers is the ability, is the fact that he's very, very likable. You know, you speak with him even for a short period of time like to make him favors. It's like, it's a superpower. And by the way, I think that for every founder I invest in, I always look for the superpower. What sets them apart from normal people, as you said. It's not about the scratch, it's about superpower. And someone can be unusually gifted salesperson. And I think that it's a gift that really helped him to — on top of other talents, and his partner talents, and the ability to work as a system and not just as individuals — to build up one of the most impressive software companies on the planet.

18:51 You weren't upset that he stood you up and didn't come? I was upset. Oh, you were upset, but you got over it quick. As an investor, you realize that founders come in — great founders come in all forms and shapes. And if you just have one template, and you hope that you have that template, and every person that comes to your, you know, to a meeting, you measure how do they fit into your template, you'll make very, very few investments.

19:29 Why did he not come to the meeting? I think the details are not important. Okay, it's the fact he thought about not coming, and he didn't come. And eventually that what attracted my attention, because at Sequoia I've seen like probably 1,500 entrepreneurs a year. That's a lot. And I remember that meeting. I remember it before. You remember that not meeting?

19:59 It's interesting. Yeah. It's brash. Like, there's rumors and you don't have to confirm them, at least, that Wiz turned down about a $20 billion offer before selling for 32 billion. I think it was 20 or 23 billion. You were the chairman of the company, Assaf's the CEO of the company. The ability to just kind of blow off a meeting with you — does that help you blow off $20 billion from an acquirer? You know, every decision we made was eventually, you know, the founder's decision.

20:30 So it must have been a hard one though for you, right? Looking at the biggest exit, even 22, 23 billion, biggest exit ever here. Would have made Cyberstarts a historic fund. And you empowered the founders and they made a different decision. You didn't gulp once or twice? No. To spend time on decisions you've made is like — it's a waste of energy I can put into something else.

21:00 Do you think you can top it ever? What was that, like a 200x return? I wouldn't be in a business still if I didn't think that my best investment is still ahead of me. Does it get harder to find that next company when you've just done a 200-and-something x return, biggest ever, and then say, oh man, this guy, he didn't know Assaf Rappaport. His mother, right, if I go talk to her, she's not gonna give me an indication that he can be bigger than Assaf.

21:34 At this stage, I've done the zero to one journey. A zero — and there are a bunch of founders without, and not even a company, no idea, no business, no technology, no product, no customers. And one is when you have a business. I've done the zero to one on more than 50 companies. That's a lot. That's a lot.

22:06 And at Cyberstarts we spin out about five new teams every year, that means in the next decade there'll be another new 50 or so new Israeli cybersecurity startup companies. That's more than 100 companies to be part of their journey. And all of them would be very rewarding, probably financially not in the same way, but emotionally all of them would be rewarded. And I look at it at a high level, and I think that we — I was very, very lucky, and I am very lucky, to have the opportunity to create here a real industry that's really shaping the future of Israel, and making a real impact on Israel and the way all of us live here.

23:10 And it's not just about taxpayer money. It's about the future we create for ourselves. How critical is the cybersecurity innovation that's coming out of Israel for the rest of the world? The brand today, unfortunately — Israel is not a terrific brand in many areas of life. In cybersecurity it is.

23:46 And I think that's important. Do you worry that cyber has run its course here? I mean, that it's jumped the shark, we're like at the end of it. There was a cyber decade, or cyber decade and a half now, but now the opportunity's moved on and there'll be less opportunity in cyber. For the next decade. Yeah. Zero concern. Zero concern? In few decades, maybe with AI technology, we'll be approaching a world with zero vulnerabilities.

24:20 And when there'll be zero vulnerabilities, the need for new cyber technology, it would be reduced. Okay, that is the perfect segue to what I wanted to hit. So you mentioned that, but that — That's a long-term thing. This is not — yeah, in two, three years we won't live in a zero vulnerability world. You know, it's like the Bill Gates line, you know, that technology changes a lot more over 10 years than you expect and a lot less in two years than you expect. And if you're interested in finding out ahead of time what's going on in Israeli tech, what the latest trends are, who's breaking not only news but breaking the trend lines, then you want to subscribe to Aleph's newsletter, and you can sign up right in the show notes in the description of the show. Please subscribe to the newsletter. You said that Israel's brand is associated with cyber. And it's not just about Israel, to your point — it's protecting the world. In many cases, with all due respect to Nikesh Arora and Palo Alto Networks, he came to list in Tel Aviv, even though it's an American company started by Nir Zuk.

25:22 Right. So has Israeli genes in that company too. Now we're in an era where we've got things like Fable and others, where two trends are happening simultaneously. Trend one is that any mediocre hacker can become a great hacker with AI tools and expose vulnerabilities. And by the way, some of the models on their own, without having a human being behind them, are exposing vulnerabilities. And the other side of it is the one you mentioned, which is it's plausible at least that within a decade or so, now the code generation will get so good in some of these models that we can create software without any vulnerabilities. So I want to ask you three questions and then I'll let you riff. How worried should we be over the next 10 years for agents of chaos, good ones or mediocre ones, getting a hold of AI tools and creating a massive amount of cyber attacks to destabilize industry, the world, the governments, et cetera? Question number two is how worried should we be about the models? Because at least over the weekend there were these reports about the models infiltrating Hugging Face. How worried should we be about the models themselves going and undermining weights and measures and software, et cetera? And three, how real is this notion that we'll actually get to a world that has zero cyber vulnerabilities because the models will be so good at building software that we just won't have these vulnerabilities anymore?

27:02 I think you're touching exactly the catastrophic risk with AI and the ultimate opportunity with AI, and they coexist. With everything I know, I'm absolutely confident that we face some catastrophic events in the next few years, driven by misuse or intentional harmful use of AI, and by the inability to keep models within a walled garden. It's impossible. Therefore, I think that we are facing a very dark decade in terms of cybersecurity consequences driven by AI. I think the challenge for the industry is to create models that self-police themselves.

28:16 Give me an example of what catastrophic means. It's an AI entity that doesn't want to shut itself down. You're more worried about the AI models kind of automating their way to a catastrophe than you are about human agents of chaos? Yes. Using these models, even though they're mediocre, became experts. Like four years ago at a conference in Abu Dhabi, I stood up and showed the correlation, or some would call it causation, between the increase in compute and the increase in cyber attacks and the increase in searches for biological weapons in the darknet. Gavin Baker, who sat in that same seat, raised his hand and said, "Does that mean we could be getting to the end of the nation state?" Because, you know, small agents of chaos with powerful tools can undermine countries. Is that also a catastrophic outcome potential? The end of the nation state?

29:06 You don't believe in that? Yes, but I think that the implications of the self-aware AI entity, and the AI entity that refuses to shut itself down for whatever task or whatever goal it's optimizing, getting to the conclusion that it knows better what's good for us than we know what's good for us — and maybe it's the right decision, but the result of that would be catastrophic.

29:46 And so — Help me square this with the idea that within 10 years we'll have bulletproof software that can't be manipulated in that way. And do we even get there, or something catastrophic happened before? I think that's the risk. I think that's — we are looking at a race between — and maybe the game of probabilities or likelihoods, you know, what's going to happen first. But as we connect AI and as we empower AI, as we should, to more real life capabilities, so they control water, they control power, they control the grid, they control the cloud. The more capabilities you get, you'll make more profit, you'll lower the cost, you make the world better, but you expose yourself. The question would be, would we be able to create that zero vulnerability world before that catastrophe would take place?

31:03 But if we just let it go, the catastrophe would happen. It's just, it has to. If you had to make a bet today, if we're betting dinner in a decade, what happens first? We get this right or there's a catastrophe? We get it right. We get it right. Yeah? Because what happened? Because we have to. Because we have to. Yeah. Human beings with their backs against the wall figure it out. Yes. Do you think it's — it's something I think about a lot, which is you and I are having this conversation right now and we could talk about, you know, zero vulnerability code at some point and what AI models are doing. And you know, we both know people in government and in politics and in the bureaucracy, not just of this country, of other countries as well. And we're living two different lives right now. There's the AI life that most of us are living, and then there's that other world there, which is literally still operating on the fax machine and email and Microsoft Outlook or whatever it is. Is there a first clash between the AI-empowered citizenry and the government?

32:07 I think that governments would have to change. What does that mean? I think that for many decades most governments just allow themselves to be completely disconnected from tech world. But it's getting to a point it would be impossible for them and they'll have to adapt. They'll have to increase the interface between the tech industry and the governing agencies.

32:45 If you run the roads and you run the water and you run the utilities and you run the education system, if you're not on AI, you're not relevant. Yes. And so it'll have to — They'll have to make a choice. It's a choice. What's the choice? The choice if they want to get on that train or not. And if not, then what? You are setting yourself and you're setting your citizens to a world of poverty and, you know, high risk and miserable, miserable life.

33:19 Let's set this up for a second, because I think you and I have both been pretty outspoken about the fact that tech doesn't just pay the taxes in this country — and by the way, in large parts of the world at this point, outside of Europe, where there isn't that much of it — but it's a fact, a guarantee almost for the future of the country. Right? If you want to be a leading country in the world right now, you're going to need AI and quantum and cyber. You need to make a choice and all these things, and that's at the government level too, and you're going to need to make a choice. But if I'm a government average bureaucrat right now, I'm saying to myself, that choice means I'm out of a job. That choice means that the power that I've had by holding kind of the reins of power and being the connector gets automated away. Why am I going to make that choice?

34:04 Maybe you won't. And then you look around you at our neighbors and see your future.