In this episode of Shift AI, Shay Sandler, CEO and co-founder of Vega, joins host Boaz Ashkenazy for a wide-ranging conversation on why the legacy SIEM is breaking down just as security teams need their data the most. Shay grew up in Israel studying math and physics in a famously competitive class of gifted kids, then spent six years in one of the country's most elite military intelligence units before joining Granulate, a cloud cost optimization company, as one of its first ten employees. Granulate was acquired by Intel for $650 million, and after a year inside Intel, Shay left with his former Granulate colleague Ellie to found Vega — a decision he says was pushed forward by a month of reserve duty after October 7th that reminded him how much he missed solving hard problems with his old team. The two dig into why traditional SIEMs, built for a pre-cloud world of centralized data, are collapsing under multi-cloud, multi-region, siloed telemetry — and why teams that once filtered data down to save on SIEM costs now need all of it to keep up with threat actors wielding frontier models. Shay walks through Vega's architecture: querying data in place in commodity storage like S3, federating across regions and clouds without duplication or egress costs, and a deterministic, auditable natural-language-to-KQL layer that lets AI agents run threat hunts a human could fully verify. This episode is for CISOs, security operations leaders, detection engineers, and startup founders building in cybersecurity who want to understand how AI-native architecture, not just AI features, is reshaping enterprise security. Chapters [00:00] Introduction: Shay Sandler's path to founding and leading Vega [02:07] Growing up gifted in math and physics, and finding cybersecurity [04:18] Six years in an elite Israeli intelligence unit, and the "everything is solvable" mindset [06:08] First paid job at 14: distributing meat before dawn in southern Israel [08:37] Granulate, the $650 million Intel acquisition, and missing the startup thrill [10:43] October 7th reserve duty and the spark to build Vega with co-founder Ellie [15:04] How legacy SIEM broke under multi-cloud, siloed security data [17:32] The post-Mythos era: frontier models as tools for threat actors [23:16] Vega's three primitives: commodity storage, federation, and an AI-native interface [27:50] Natural language to KQL as a transparent, auditable layer for AI agents [30:05] AI as a "scalable engineering capability" for lean security teams [36:40] Velocity as the new core metric, and the closing thought: creativity and engineering Connect with Shay Sandler LinkedIn: https://www.linkedin.com/in/shay-sandler-305508107/ Connect with Boaz Ashkenazy LinkedIn: https://www.linkedin.com/in/boazashkenazy/ Email: boaz@shiftai.fm
