Jonathan Zanger, Chief Technology Officer at Check Point – Interview Series

Jonathan Zanger, Chief Technology Officer at Check Point, brings a rare combination of elite military intelligence experience, deep AI expertise, and operational leadership across both startups and global enterprises. Prior to his current role, he served as CTO at Trigo, where he led the development of next-generation AI and computer vision systems enabling frictionless retail and loss prevention at scale, while aligning product and R&D with real-world commercial deployment. Earlier, he held senior R&D leadership roles at Trigo and spent over a decade in Israel’s elite Unit 8200, ultimately heading a cyber R&D division responsible for national-scale intelligence and cybersecurity initiatives and earning top national recognition for his work.

Check Point Software Technologies (CHKP ) is a global leader in cybersecurity, providing AI-driven, cloud-delivered security solutions designed to protect enterprises and governments from increasingly sophisticated digital threats. The company serves over 100,000 organizations worldwide with a comprehensive platform that secures networks, cloud environments, endpoints, and users through a prevention-first approach that aims to stop attacks before they occur. Its integrated architecture leverages artificial intelligence and real-time threat intelligence to simplify security operations, reduce risk, and enable organizations to scale securely as they adopt AI, cloud computing, and distributed systems.

You have led large-scale cybersecurity and AI initiatives, built AI-driven systems at Trigo, and now oversee AI strategy at Check Point. What specific failure modes have you observed when AI systems transition from controlled environments into production, especially when they are given access to tools and enterprise data?

Two things change fundamentally in production. First, scale turns edge cases into everyday events. A 0.1 percent false positive rate sounds excellent in the lab, but when you are processing millions of interactions, that translates into thousands of incidents that need attention. Statistical outliers in testing become operational realities at scale.

Second, production means adversarial exposure. In a controlled environment, inputs are benign and predictable. In the real world, some users and threat actors will actively try to fool the system, leveraging every untrusted data channel available to manipulate behavior. The transition from demo to production is not a scaling problem. It is a shift from a cooperative environment to a contested one, and that demands fundamentally different design assumptions.

In agentic systems, where models can call APIs, execute code, and chain actions, what are the most critical attack surfaces that security teams are still not instrumenting properly?

The critical surface that most teams underestimate is the data itself. Agentic systems routinely access untrusted data sources — incoming emails, websites, Jira tickets, open-source code, external documentation. That data is ingested and analyzed by models as part of their reasoning process.

This creates two concrete risks. First, memory poisoning — where manipulated content subtly shapes the model’s future responses and decisions without any obvious prompt injection. Second, indirect prompt injection — where adversarial instructions are embedded in that external data and effectively jailbreak the model from within. The attacker never touches the prompt directly. They simply plant instructions where the agent will find them.

Prompt injection is often framed as a model problem, but in practice it becomes a system-level issue. How should enterprises redesign their architecture to isolate model inputs, tool execution, and sensitive data access?

Prompt injection is not a universal problem with a universal fix. Whether a given input is legitimate or adversarial depends entirely on context. Asking an agent to “change the admin’s password” is perfectly legitimate if it is a technical helpdesk agent. The same request to an online retailer’s chatbot is an attack.

This is why architecture matters more than any single detection technique. Systems need both deterministic and non-deterministic mechanisms working together. Deterministic controls manage access to tools and data based on the identity of the agent, the identity of the user, and the defined role of the system. Non-deterministic, model-based controls add the ability to understand language, context and intent. You need both layers — rigid policy enforcement and intelligent contextual reasoning — because neither alone is sufficient.

Many AI agents rely on retrieval-augmented generation and external data sources. What are the risks around data poisoning and context manipulation in these pipelines, and how can they be mitigated at runtime?

The risks differ depending on the direction of data flow. For internal data sources, the primary risk is sensitive data leakage — PII exposure, cross-customer data sharing, internal information being surfaced to unauthorized parties. For external data sources, the risks include model bias from unverified information, indirect prompt injection embedded in retrieved content, and reliance on untrusted or manipulated sources.

Mitigation has to happen at the transaction level, in real time. Every agentic interaction needs to be secured in both directions: ensuring sensitive data is not leaking from inside to outside, and ensuring poisoned or adversarial information is not being fed from outside into the system or the model. You cannot solve this at ingestion time alone because context is dynamic and the threat landscape changes continuously.

Your AI Defense Plane introduces a unified control layer across employee AI use, applications, and agentic systems. What were the biggest architectural challenges in building a system that can observe and enforce policy across such a fragmented AI stack?

We believe that in the near future, agentic workloads will span endpoints, applications, SaaS services and cloud workloads — all hyper-connected in what we call the “Internet of Agents”. The idea behind the AI Defense Plane is to discover, govern and protect this evolving enterprise agentic infrastructure within a single pane of glass.

The core architectural challenge is dynamically evaluating the risk profile and context of every agent while developing efficient real-time protection for every agentic transaction. That means maintaining high block rates against genuine threats while minimizing false positives — at production speed and scale, across multiple running environments. Building a system that can observe and enforce policy consistently across such a fragmented and rapidly evolving AI stack required us to rethink how we abstract and evaluate AI activity at a foundational level.

The platform emphasizes real-time decisioning at machine speed across languages and workflows. How do you balance latency constraints with the need for deep inspection and control of AI-driven actions in production environments?

We develop and train foundation models specifically for threat prevention, then use distillation techniques to make them extremely efficient. That allows us to run inference fast and with minimal compute — even on CPUs or commodity GPUs — while maintaining multi-language and multi-modal coverage, including image and audio analysis, with maximal accuracy.

This approach lets us inspect agentic transactions deeply without becoming a bottleneck. Security that introduces unacceptable latency will be bypassed. Security that is invisible to the workflow but enforces meaningful controls is what actually gets deployed and stays deployed.

AI agents increasingly operate with delegated permissions across multiple systems. How should organizations rethink identity and access management for non-human actors, especially when agents dynamically expand their scope through tool use?

The mistake most organizations make is treating AI agents either as extensions of human users or as traditional service accounts. Neither model fits. Think of them as digital employees — entities with defined roles, responsibilities and boundaries.

Agent identity should be defined by three dimensions: the specific workflow the agent is executing, the user who owns or created the agent, and the user currently interacting with it. All three factors shape what the agent should be allowed to do. Beyond that, organizations need to apply zero-trust principles to agents — never assume trust based on origin, continuously verify behavior and enforce least-privilege access at every step. Without this, agents will silently accumulate more authority than anyone intended.

Most enterprises now have shadow AI usage across copilots, plugins, and internal scripts. What telemetry should security teams be collecting to gain real visibility into how AI is interacting with sensitive data?

Visibility needs to operate at the agentic transaction level — not just prompts and responses, but tool calls, the data returned by those tools, and the actions taken as a result. Security teams need to see the full chain: what was asked, what data was accessed, what tools were invoked, what parameters were passed, and what happened next.

Without that transaction-level telemetry, you cannot answer basic questions about exposure, misuse or impact. Shadow AI is not dangerous because it exists. It is dangerous because it operates without this level of governance or insight.

Red teaming agentic systems is fundamentally different from testing static applications. How do you simulate adversarial behavior across multi-step workflows, and what types of exploits are most commonly uncovered?

We operate Gandalf (https://gandalf.lakera.ai), which is the largest AI red-teaming exercise in the world. It is a crowd-sourced platform where real users attempt to persuade AI agents to break their guardrails. That gives us a unique and continuously growing dataset of actual adversarial techniques — not theoretical attacks, but the strategies real people use to manipulate AI systems.

We leverage that dataset to drive our red-teaming capabilities. The attacks we see most often involve users gradually persuading agents to violate their constraints — through indirect prompt injection, creative reframing, context manipulation and incremental trust exploitation across multi-step interactions. These issues are invisible if you only test individual prompts. You have to test sequences and sustained adversarial campaigns.

As attackers begin using autonomous agents to probe systems continuously, do you expect defense to shift toward real-time adaptive controls driven by AI, and what does that architecture look like in practice?

Yes. Static defenses cannot keep pace with autonomous attackers operating continuously. Defense must become adaptive, runtime-driven and automated. This means real-time monitoring of AI behavior, continuous risk assessment and immediate enforcement when policies are violated. The speed and scale of AI-driven attacks will only be countered by equally fast, machine-speed defenses.

In practice, security becomes a feedback loop rather than a rule set. AI systems are observed, evaluated and constrained dynamically, at the same speed and scale at which they operate. That shift is essential if organizations want to deploy AI safely at enterprise scale.

Thank you for the great interview, readers who wish to learn more should visit Check Point Software Technologies.