Most security tools are built to notice things. Very few are built to finish them. A scanner flags a misconfigured account and adds it to a queue. A monitoring platform catches unusual login behavior and opens a ticket. Somewhere down the line, a person still has to go and actually fix it, and there have never been enough people to keep pace with everything the tools find.
Twine Security was built to close that gap. Benny Porat, the company’s Co-Founder and CEO, puts it directly. “But the software never did the work. It told a human what the work was, and then that human, already stretched thin, had to go do it.”
Twine’s answer is a category it calls AI digital employees, systems built to finish a job rather than simply flag one. Handed something like an identity exposure, an AI digital employee sees the fix through from start to end, functioning less like a piece of software and more like a colleague picking up a task.
Benny is careful to frame what this does not do. He says, “This doesn’t remove human expertise, it elevates it. People still set strategy, make judgment calls, and own the decisions that carry real risk; the AI handles the heavy lifting underneath them. The future security team is a blend: humans working alongside AI digital employees, each doing what they do best.”
Closing the Execution Gap
That kind of execution was not possible a few years ago. What changed, Benny says, is that AI models finally became capable of following a task through several steps without falling apart partway through, even as the talent shortage never eased and the workload kept growing.
Three converging trends shaped the company’s long-term thesis: a structural talent shortage no amount of hiring will solve, complexity that compounds every year as identities and systems multiply, and AI’s shift from advising to genuinely executing. As Benny frames it, “Put those together and the conclusion is unavoidable: the industry’s real bottleneck isn’t knowing what to do, it’s having the hands to do it.”
Identity as the New Perimeter
Twine Security’s first deployment ground was identity and access management, or IAM, and Benny’s reasoning is direct: “In a cloud-first, distributed world, the perimeter isn’t a firewall anymore, it’s who can access what.” In his account, “An overwhelming majority of breaches trace back to identity and access.”
The work itself piles up fast: reviewing who still has access they no longer need, shutting off accounts that should already be gone, trimming permissions nobody uses anymore, and keeping pace as people join, switch roles, and leave. Most security teams can already see where the problems sit. Staffing to clear all of it is the harder part, and that gap made identity the clearest place to test whether an AI digital employee could actually finish work rather than just point at it.
Trust Built into the Architecture
Handing an AI system the ability to take action inside a customer’s environment raises an obvious question: how do you trust it? Benny sets the bar high. “If an AI takes an action on your environment, you have to know what it did, why it did it, and be able to stand behind that decision to an auditor or a board.” Twine Security built its architecture around that requirement from the start rather than adding it later.
Three elements do the work. Every AI digital employee lays out a reviewable record of its reasoning and what it relied on to act. A person signs off before anything consequential happens, keeping someone accountable for the call. And each digital employee is boxed in by scoped, least-privilege access, so its reach never extends past a defined boundary. Benny sums up the aim this way: “The goal is a coworker you can supervise like any other – one that earns confidence by being legible and accountable.”
Benny does not dismiss the risk that comes with the same technology. Generative AI, he acknowledges, genuinely expands the attack surface, spinning up new non-human accounts, opening angles like prompt injection, and creating fresh paths for data to slip out. His answer starts by holding Twine to the same standard it asks of customers.
Every Twine Security AI digital employee is treated as its own governed identity, kept on minimal access, watched continuously, and logged from end to end. As he puts it: “We refuse to become the new risk we’re meant to reduce.” Used with discipline, he argues, the same execution capability that creates new exposure can also review access continuously and retire it before it accumulates.
Where Autonomy Begins
Twine Security treats the split between human judgment and machine autonomy less as a fixed line than a relationship that develops over time. Benny explains: “I don’t think of it as a fixed line so much as a graduated relationship, much like the one between a manager and a capable team member. Trust is earned.” An AI digital employee, in his description, starts closely watched and earns more room to operate as it proves itself over time.
Where that balance settles, in his framing, tracks the stakes involved. Low-risk, reversible, repetitive work can run with a light hand, while anything consequential or irreversible still waits on a person’s sign-off, regardless of how much trust the system has already earned.
Rewriting the Scoreboard
Capacity, in Benny’s telling, has always tracked headcount, and hiring alone was never going to close a shortage this size. Buying another tool rarely helps either, in his account: it tends to surface more problems without doing anything to clear them, which is how backlogs and budgets both keep climbing while teams fall further behind.
As Benny describes it, “AI breaks that link between capacity and headcount.” Once a machine can carry a task all the way to done, finishing the work gets a lot cheaper, and where organizations spend starts to move away from tools that only generate findings and toward whatever actually resolves them.
That shift changes how Benny wants the work measured. In his words: “The old scoreboard measured activity: alerts triaged, tickets closed, mean time to respond. Those numbers reward being busy, but they don’t tell you whether your risk actually went down.”
Benny puts what comes next in a single sentence by saying, “The work gets done continuously and business value becomes something you can state plainly: risk retired per dollar.” Twine, as he positions it, sits at exactly that pivot, expanding what it covers while giving human experts room to spend their time on judgment calls rather than triage. As he sums it up: “That’s what makes AI execution for cybersecurity an economic story, not just a technical one.”
Earning a Place Inside the Enterprise
No enterprise hands an outside system the keys lightly, and Benny treats that hesitation as reasonable rather than an obstacle to argue past. Letting an AI system act on production infrastructure is, in his words, a big step, and Twine has built its systems to win that confidence gradually rather than demand it upfront, showing its work openly, staying inside tightly scoped permissions, and routing anything consequential through a human first.
Integration matters just as much as trust, since enterprise environments rarely look alike. As Benny describes the challenge: “They’re layers of existing tools, processes, and exceptions built up over years. Technology that demands a rip-and-replace doesn’t get adopted.” Twine designed its AI digital employees to slot into whatever tools and workflows a company already runs, rather than requiring it to rebuild around the product.
Some of that credibility, in Benny’s telling, traces back to the team itself. He says: “Because our team came up through elite cyber units and years of building for these same enterprises at Claroty, we’ve been in our customers shoes and this is a great starting point that helps them trust us.”
To win new customers, Twine Security applies the same formula it builds into its product: full transparency into what an AI digital employee does, paired with autonomy that starts on lower-risk work and expands as confidence grows.
The Moment it Became Real
Ask Benny for the moment that changed everything, and he points to a single deployment. Twine’s first AI digital employee, named Alex, ran a complete workflow from start to finish inside a live customer environment. Before that, the claim that AI could truly execute was still just something the company was asking people to trust.
As Benny remembers it: “Seeing the work being completed autonomously, safely and transparently changed the conversation entirely.” What had been an unproven claim turned into evidence.
The Next Five Years
Benny does not expect the next five years to be about who claims to use AI, since nearly every security vendor will make that claim. His read: “The distinction won’t be who has AI, nearly everyone will claim that. It’ll be who actually lets it execute properly.” Looking further out, he adds: “Five years out, I think organizations that embrace autonomous execution will retire risk continuously, keep their backlogs low, and free their best people to focus on the judgment-heavy work only humans can do. Their teams will be more effective, compliant and secure.”
Asked how he wants Twine Security to be remembered beyond its products and milestones, Benny keeps the answer simple: “The company that made AI execution for cybersecurity real and closed the execution gap.”
Also Read :- CIO Times Magazine For More Information
