Roei Ganzarski is the President and Chief Executive Officer of Alitheon, the Bellevue, Washington company behind FeaturePrint, and he isn’t a founder of it. He calls himself a mercenary CEO, which is the fourth time he’s been brought into a group of mathematicians and physicists who built something remarkable and then wanted a different set of skills in the building. His degree is in economics and finance. He says the pleasure of the job is usually being the least smart person in the room, and his rule for the team is that they don’t have to explain it to their mother, they have to explain it to him. What Alitheon does is biometrics for things. The argument starts with people. We used to identify a human with a badge or a passport, then governments worked out that a proxy can be lost, transferred, faked or manipulated, so they moved to fingerprints and irises instead. A twin can carry his brother’s real driver’s license into a real building, and the document is real and the person is real, and the link between them is the lie. Physical products are still stuck at the proxy stage. A barcode, or a hologram that reads as authentic mostly because it’s shiny and the picture changes when you tilt it. The mechanism is worth hearing him explain. No machine can make the same thing twice, so design engineers publish a tolerance band, and everything inside that band passes quality control and looks identical and works identically. Alitheon’s math reads the differences that are still there inside that band, and turns them into what they call a FeaturePrint. The fingerprint exists because the thing was manufactured, which means it can’t be peeled off, swapped, or re-issued with the paperwork. He puts the odds of 2 products carrying the same manufacturing signature at one in six and a half trillion. It runs on off-the-shelf industrial cameras, there’s no training phase, and he says there’s no machine learning anywhere in it. His words are discrete mathematics. Then host Jon McLachlan, co-founder of YSecurity and Cyberbase.ai, puts his security hat on and asks about hardware tampering in transit, and Roei makes the argument this episode is titled after. Zero trust says verify everything connecting to your network. The cyber runs on hardware. And the hardware is trusted because a sticker says who made it and where. He’s presented this to rooms of cybersecurity people who told him hardware isn’t their problem. The 4 markets he sells into are all versions of one idea he calls high consequence items, which covers expensive goods like the gold bullion that goes into national banks, anything that goes in or on a body, and then transportation and defense parts where the consequence of getting it wrong is somebody getting hurt. The example that stays with you is the aircraft engine supplier caught in the United Kingdom selling real used parts with fake paperwork saying they were new. Fatigued parts that were supposed to be destroyed at end of life went into commercial aircraft, and nobody found it for 5 years, and it wasn’t an accident that found it. Also in this one. Why a syringe that knows its own manufacturing date closes a loophole that the box can’t. Why counterfeit and gray market are 2 different problems, and why a customer’s own distributors are sometimes the people being caught. Why several customers won’t publicize that they use this at all. Why Alitheon doesn’t need to keep the images, or much data at all. The coin collector at the trade show whose question started the whole company. The day he had to tell roughly 40% of a team they were done, and why he did it himself instead of sending their managers. And the Friday all-hands he runs at every company he’s joined, which starts with Arabic coffee he makes himself and the question of who made a really cool mistake this week. His ask for the audience is a bigger one than usual. He wants critical thinking back. In his framing the goal is to stop seeing a box at all, and specifically to stop handing the questioning to a large language model because it’s easier than doing it yourself. Episode 103 of The Security Podcast of Silicon Valley. Brought to you by YSecurity, the security team that works next to yours. Your first 8 hours with 40+ security engineers are free at ysecurity.io/startups.
