About Spotlight Security
Spotlight is the AI security orchestration layer for the ~2,000 devices in a typical factory. Like Plaid connects to any bank, our lightweight agents connect to any machine (IT, IoT and OT) to find and fix security risks at the edge, with human approval. Spotlight emerged from a $2.1M grant benchmarking LLMs on cybersecurity, with findings used by OpenAI and Anthropic. We live in operational environments, won the Women in AI Pitch Competition, and are a Black Hat SecTor startup finalist.
Q: Tell us about your background.
We’re Katie Kuzin (CEO) and Alex Leader (COO), co-founders of Spotlight Security. We met through the research project that became Spotlight: Alex’s $2.1M Coefficient Giving grant measured how well AI performs real security work, and Katie designed the LLM benchmarking scaffolding to test it.
Katie founded S&P AI Benchmarks at Kensho (S&P Global), LLM evaluations used by Anthropic, Google Gemini and Accenture, and managed a $20M budget to build a finance-focused LLM. She grew Kensho Scribe to $4M+ ARR with 15x customer growth, leading 17 engineers and ML researchers. Before that she was the first hire at All Vision, running product on NASA SBIR and DoD JAIC contracts, and a product manager at Capital One. At Spotlight she leads sales, fundraising and product.
Alex was principal investigator on the Coefficient Giving grant with NYU, and its findings have been used by OpenAI, Anthropic, the UK AI Security Institute and government AI agencies. He has advised the NSA, NIST and the White House Office of the National Cyber Director, including on the 2023 National Cyber Workforce and Education Strategy. He leads engineering and architecture.
Alex leads the build with engineers Jarrod Powers and Chinmay Shringi, who write our agents in Rust and Go and bring backgrounds in offensive security and classified-network operations. Matt Farley, our growth lead, has an Emmy-winning background in advertising. Our advisors include the founder of WebLife (acquired by Proofpoint) and the former CTO of Vercara (acquired by DigiCert), in addition to veterans of US military cyber operations.
Q: Tell us about your business/idea.
Spotlight is the AI security orchestration layer for the thousands of devices inside a typical factory, utility, or water system.
A plant floor runs on HMIs, PLCs, cameras, building controllers, and Linux boxes running production lines. Most of them can’t run a traditional endpoint security tool, and most OT security products watch network traffic from the outside. These tools pay attention to the platform and network, can identify issues, but they often can’t reach the device to execute a fix.
Our core technology is a lightweight agent, often under 1 MB, that installs directly on these machines across Windows, macOS, Linux (x86 and ARM), FreeBSD, and QNX. Like Plaid connects to any bank, our agents connect to any machine. Point Spotlight at one device and it finds the rest of the network, installs from the inside with no VPN or appliance, checks what’s exposed, explains it in plain English, and pushes the fix, but only after a human approves it.
The result is one inventory across IT, IoT, and OT, including devices nobody had on a list, and a path from “we found a problem” to “it’s fixed” in minutes rather than a professional-services engagement measured in weeks. Where other tools stop at the alert, Spotlight goes all the way to the fix on the device level – across thousands of device types.
Q: What was the original inspiration for your company/product?
Spotlight started as a research question: how good are AI models at defending real networks?
To answer it, we built realistic, containerized attack scenarios and scored frontier models against them. We partnered with former cyber operators to build on-device agents that let the models observe and act inside those environments. Our findings have been used by OpenAI and Anthropic.
This summer, attackers got into water systems in 12 states through PLCs, the “boring” devices with no screen and no API that nobody was actively protecting. The hardest part of securing against AI based attacks in our benchmarking work wasn’t LLM capabilities, it was the ability to execute a change in an incredibly diverse hardware ecosystem. The agents we built for the benchmark could reach devices that commercial security tools simply can’t, from industrial controllers to cameras to building systems. Meanwhile, the organizations running those devices, like mid-sized manufacturers, co-ops, and water districts, often have one IT generalist and no OT security team at all.
We realized the agents were the product. Give those teams a reliable, safe-by-design way to see and fix every device, add AI that turns logs into plain-English decisions, and you close the gap between detection and remediation. From 1000 miles away we can delete rogue running processes, change firewall rules, update firmware and handle CVEs – all through encrypted and highly secured channels.
Q: What’s your vision for the future… “What will the market you are pursuing look like in 5-10 years?”
The attack surface will continue to move to the edge. Every factory, hospital, and utility is adding connected machines faster than it adds security staff, and most of those machines will never run a traditional endpoint agent.
AI will continue to multiply and speed up attacks. It is already cheap for a single person with AI tools to probe a target. When attacks move in minutes, a security model that stops at the alert and waits days for a fix stops being viable.
Defense becomes increasingly agentic, while also being governed. Security teams will rely more on AI agents to act on their behalf. Those agents need a trusted way to actually touch devices, and humans will need approvals, audit trails, and proof of what changed. Insurers and regulators are already asking for evidence of remediation, not just monitoring.
In 5-10 years, we expect IT, IoT, and OT security to converge into a single view of the estate. The winners will be the platforms that can act safely on every device, not just watch the network around them. Those platform can start using Spotlight today and get ahead of the pack.
Q: How does your business address pressing cyber and data challenges for the commercial sector?
The commercial organizations most exposed are often the least served: manufacturers, food processors, utilities and co-ops, water systems, and the managed service providers (MSPs) who support them. Incumbent OT platforms are built and priced for the Fortune 500 and can take months of professional services to deploy.
Spotlight addresses three challenges for them:
- The first is visibility. We start with a deep network scan to find all hardware devices. In one environment, Spotlight found a sprinkler control system on the wrong network segment: an unindexed, open entry point nobody knew about. Our agents report what’s really on each machine, including open ports, running processes, accounts, patch state, and firewall rules.
- The second is expertise. AI turns raw logs and configurations into plain-English findings and recommended fixes, so an IT generalist can act like a specialist.
- The third is speed to fix. Approval-gated remediation happens on the device itself, with an audit trail, closing the window between detection and response. It’s safe to run on a plant floor by design, including older and resource-limited machines.
Because Spotlight is priced per device with no mandatory deployment engagement, and MSPs can run it across all their clients from one multi-tenant portal, it reaches the organizations that have been priced out of serious security.
Q: What attracted you to the DataTribe Foundry? Why did you choose to participate in the DataTribe Challenge?
The foundry model of getting hands-on with founders at the earliest stages, helping round out teams, and opening doors to customers and government is exactly what will accelerate our growth. DataTribe has a strong track record in industrial and critical infrastructure security and we’re looking forward to joining the network.
We first met the DataTribe team in 2025, and a lot has changed since then. The technology has matured from research into a commercial platform, and it’s now live in production environments on 100+ devices across two manufacturers, and we just won Black Hat SecTor’s Startup Competition. The Challenge felt like the right moment to launch our commercial product and to connect with the security leaders, operators, and investors in the DataTribe community.
Q: What’s your long-term vision for your business?
Spotlight’s goal is to make every machine in the physical world reachable by you.
Today, that means helping a single IT administrator find and fix risks across thousands of devices. Over time, the same access layer supports continuous compliance evidence that can lower insurance premiums, and fleet management for organizations running machines by the thousands, all through a governed channel AI security agents can safely act through.
The systems we protect run power, water and manufacturing. If we get this right, a rural water district or a regional manufacturer will have the same caliber of protection as a Fortune 100 company.
