{"id":323848,"date":"2026-03-05T22:10:08","date_gmt":"2026-03-05T22:10:08","guid":{"rendered":"https:\/\/www.newsbeep.com\/il\/323848\/"},"modified":"2026-03-05T22:10:08","modified_gmt":"2026-03-05T22:10:08","slug":"how-israels-cyber-chief-fights-back-in-the-ai-cyber-era","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/il\/323848\/","title":{"rendered":"How Israel\u2019s cyber chief fights back in the AI cyber era"},"content":{"rendered":"

One of Yossi Karadi\u2019s predecessors as the chief of the Israel National Cyber Directorate (INCD),<\/a> Yigal Unna, warned in 2020 that \u201ccyber winter is coming.\u201d<\/p>\n

According to the standards of 2020, cyber winter has arrived and run roughshod over the civilized world, including Israel, leading to broader global economic losses of $10.5 trillion in 2025 alone, with direct losses to hacked companies in the hundreds of billions. In recent years, two quadrillion bytes of Israeli data have been hacked.<\/p>\n

Karadi emerged from IDF intelligence into this cyber artificial intelligence dystopia in March 2025 to take over the INCD\u2019s reins. Shortly before Operation Roaring Lion,<\/a> he sat down for an exclusive interview with The Jerusalem Post.<\/p>\n

After one year trying to roll back aspects of the wave of constant hacking \u2013 now boosted to new levels by generative artificial intelligence \u2013 and to improve future cyber defense strategies<\/a> and tactics, Karadi has arrived at some clear findings about the state of play.<\/p>\n

A general spike in AI threats<\/p>\n

First, Karadi said that the traditional advantage of the cyber attacker over the cyber defender has only been augmented by AI.<\/p>\n

\"DEFENDINGDEFENDING ISRAEL\u2019S digital frontier: Israel National Cyber Directorate chief Yossi Karadi warns that artificial intelligence is rapidly transforming cyber warfare and expanding the scale and sophistication of attacks against governments, companies, and critical infrastructure. (credit: Israel National Cyber Directorate)<\/p>\n

An AI-boosted hacker has multiple advantages, even when a cyber defender fully leverages AI to enhance their defenses.<\/p>\n

It has always been true that a cyber defender needed to succeed 100% of the time, whereas a hacker needed to succeed only once to cause harm, but this imbalance is worse now that black hat hackers can go on the offensive so many more times.<\/p>\n

Put differently, white hat hackers must actively cover a much larger digital surface than before AI.<\/p>\n

Besides being able to attack more victims in absolute numbers, AI attackers are operating at a much higher quality than before, given that they can find new vulnerabilities much faster. This gives defenders less time to \u201cpatch\u201d those vulnerabilities once they are announced to the public.<\/p>\n

In the same vein, AI attackers are often more versatile in changing their tactics than their defenders, who are sometimes large corporations or government agencies and require more time to relay new issues and rules across a large platform. This is akin to trying to change the trajectory of a large sea vessel. It takes time.<\/p>\n

In addition, AI attacks can more easily incorporate deepfake techniques, including cloning a person\u2019s voice to convince a target to let them into their system or to provide sensitive information.<\/p>\n

At a recent conference, various cyber officials revealed that with just two minutes of audio, hackers can now clone a voice \u2013 even for words not recorded.<\/p>\n

Karadi noted that cyber defenders\u2019 capabilities have also increased through the use of bot agents to automate defensive responses. Further, he said that AI is allowing cyber defenders to study and adapt to cyber attackers\u2019 methods more quickly.<\/p>\n

This is crucial, as Karadi warned that in the new age of cyber warfare, there is a constant need to learn and adapt.<\/p>\n

AI shifts fundamental defense strategy<\/p>\n

Another paradigm shift in the AI hacking era may be a basic strategy.<\/p>\n

In recent years, cybersecurity experts have told companies and government agencies to prioritize their \u201ccrown jewels\u201d (their most important financial and technological assets) and defend them much more aggressively than the rest of their digital assets.<\/p>\n

Now, even these crown jewels are likely to be compromised or damaged at some point, necessitating new strategies.<\/p>\n

One fresh approach has been to enhance the ability to counterattack hackers, something many Western countries previously refrained from doing to avoid unpredictable and catastrophic escalations.<\/p>\n

However, given the constantly aggressive cyberattacks from China, Russia, Iran,<\/a> North Korea, and others, many Western countries are shifting toward a philosophy that only disproportionate counterattacks may rein in attacks from rogue states and actors.<\/p>\n

Yet another change is that, in the past, even top Russian cyber attackers left clues that could expose their attacks and their identities due to errors they made in Hebrew.<\/p>\n

But in the age of AI, Karadi said, the tools for writing in foreign languages are so sophisticated that many of the errors that used to tip off cyber defenders have disappeared.<\/p>\n

This makes it harder than ever to catch hackers before or after their attacks.<\/p>\n

Recommendations to address such issues involve investing much more heavily in continuous cyber intelligence collection to track potential attackers\u2019 movements long before they zone in on their actual moment of attack.<\/p>\n

The INCD issued 2,480 attack alerts in 2025 alone, of which 2,304 were proactive notifications to organizations based on specific indicators of targeted attacks, even though the organizations themselves were not necessarily aware of the attacks.<\/p>\n

The geopolitics dimension<\/p>\n

Israel has been reviewing the massive US cyberattack on Venezuela.<\/p>\n

Before US President Donald Trump initiated the operation targeting former Venezuelan leader Nicol\u00e1s Maduro, Trump announced that he had ordered one of the largest offensive cyber operations in history, shutting off electricity all over Caracas, Venezuela.<\/p>\n

Questioned about that cyber operation, Karadi responded, \u201cWe are learning about it. We didn\u2019t partner with the US on that. They are a great partner [in general]. Whatever information we receive from them, we will learn.\u201d<\/p>\n

Impact on Israel given US stronger on offense, weaker on defense<\/p>\n

The media has extensively reported that the Trump administration cut over one-third of the US Department of Homeland Security\u2019s Cybersecurity and Infrastructure Security Agency (CISA).<\/p>\n

Collectively, these and other cuts have left the US\u2019s digital infrastructure, and especially its defense against cyber influence campaigns, much weaker than the high level it had reached in recent years.<\/p>\n

Simultaneously, Washington\u2019s cyberattack on Venezuela, and on Iran in June 2025, along with other offensive cyber moves, have shown that America\u2019s offensive cyber operations are as strong as ever, if not stronger.<\/p>\n

Pressed about whether these fluctuations in American cyber offensive and defensive capabilities were in any way destabilizing the cyber cooperation between the countries, Karadi rejected that premise.<\/p>\n

\u201cWe are trying to develop both the best cyber offense and defense. We are running forward with our other partners. The cooperation with the US is still excellent. We are still helping each other. I have sat with them, and the results were excellent.\u201d<\/p>\n

US splits with EU on cyber, trade, impacting broader Israeli cooperation efforts<\/p>\n

Recently, Trump\u2019s trade wars with the EU have led Europeans to explore greater independence from US technological tools to avoid a situation in which Trump could use US technological dependence as yet another pressure point in policy.<\/p>\n

Karadi was asked whether US-EU infighting on trade or cyber is impacting broader Israeli efforts to form a larger cyber defense dome with Western allies.<\/p>\n

He responded, \u201cWe work very well with everyone. We recently signed an agreement to send a permanent cyber liaison to Germany.\u201d<\/p>\n

That announcement was originally made on December 9 by Friederike Dahns, the national director for cyber and information security at the German Federal Interior Ministry.<\/p>\n

However, at the time, the Post correctly reported that no appointment had yet been made.<\/p>\n

Estimates are that it will take another three to six months until the process of interviewing and selecting candidates culminates and the final candidate is selected.<\/p>\n

The Abraham Accords<\/p>\n

The Abraham Accords have been somewhat frozen or sidelined in some ways due to criticism by Sunni countries of Israel\u2019s handling of the Israel-Hamas War.<\/p>\n

Saudi Arabia, which seemed like a guaranteed new addition to the accords in September 2023, is now farther away from joining than at any time in years. The UAE and Bahrain have remained in the Abraham Accords, but have publicly slammed Israel repeatedly.<\/p>\n

Asked about the impact this has had on the highly successful cyber cooperation since 2020, Karadi said that all cyber interactions remain very professional and focused on operational issues, not politics.<\/p>\n

He added that all relevant countries, which likely include those outside the formal Abraham Accords, are still working with Israel on cyber issues. When it comes to cyber, Karadi said, \u201cIt\u2019s not dependent on headlines. Every country wants to work with Israel due to its high level of expertise.\u201d<\/p>\n

New cyber law<\/p>\n

Regarding his new cyber law, which he proposed on January 25, Karadi is ready to push hard for its passage.<\/p>\n

Prior INCD chiefs have also been trying to get through some kind of cyber law for years, to no avail.<\/p>\n

So, which countries have similar laws defining cyber authorities, and which have failed, as of yet, to pass such laws?<\/p>\n

Most European countries, democratic ones, and even some nondemocratic states with advanced approaches to cyber issues, such as Saudi Arabia, have cyber laws to create some order on the issue.<\/p>\n

\u201cDo we want to be on the bad list?\u201d Karadi wondered, noting that the list of countries without such laws tends to be nondemocratic developing countries, far less free and far less advanced than Israel.<\/p>\n

Getting more specific, he said the law is needed so that the INCD can \u201cunderstand what companies have [in terms of vulnerabilities and defenses] in advance in order to better manage their defense in real time. The law defines our powers,\u201d on this and other critical issues.<\/p>\n

According to the cyber law proposal, if there is \u201cpotential grave damage\u201d to the country, \u201ccritical\u201d private sector and government agencies are obligated to report a cyberattack immediately and in real time.<\/p>\n

Cyber laws in other democracies have set reporting periods of 24-72 hours. However, the volume of cyberattacks has increased, and since the Israel-Hamas War began, the Jewish state became the third-most-cyber-targeted country on the planet.<\/p>\n

This led the INCD to recommend a more immediate reporting requirement.<\/p>\n

Several years ago, there were 31 categories of the economy viewed as \u201ccritical,\u201d totaling possibly a couple of hundred companies. These parts of the economy are a major focus, and the cyber law imposes minimal defense and reporting requirements for cyber incidents.<\/p>\n

As of 2026, the number of organizations that would fall within these reporting requirements could be as many as between 400 and 600, the Post has learned.<\/p>\n

For example, Karadi said that if a cyber attack brings down a hospital in Israel, it impacts the whole country. A recent cyber survey in Politico found that a majority of the West would view a cyberattack on a hospital as an act of war.<\/p>\n

In 2025, there were attempted disruptions of operations at Shamir Medical Center in Tzrifin during Yom Kippur. There was a supply chain attack targeting a software service provider managing sensitive nursing data, and a destructive wiper attack that resulted in the deletion of client servers at a cloud service provider.<\/p>\n

Responding to such attacks, the new law would define when the INCD might send its physical rapid response teams, create a new set of INCD representatives permanently present in government agencies, and provide for remote access to hacked organizations.<\/p>\n

Naftali Bennett, Tzachi Braverman, Ayelet Shaked all hacked<\/p>\n

In recent months, Iran-linked hackers have compromised the digital devices or accounts of former prime minister Naftali Bennett, Prime Minister Benjamin Netanyahu\u2019s chief aide Tzachi Braverman, former justice minister Ayelet Shaked, and others.<\/p>\n

In some ways, these repeated hacking successes by the Iranians, one after another, seemed to indicate an open lack of defensive capabilities for some of the country\u2019s individuals who most need defending due to their access to the most sensitive classified information.<\/p>\n

Karadi said that such senior government officials are not within his jurisdiction but rather within the jurisdiction of the Shin Bet (Israel Security Agency) cyber defense department.<\/p>\n

The Shin Bet said that as soon as the penetrations were identified, they worked with various senior officials to mitigate and cut off the penetrations.<\/p>\n

Further, it said that it provides detailed briefings to all such senior officials on how to avoid being hacked.<\/p>\n

Despite those elements, the agency said that if an individual, no matter how senior, disregards the advice it provides, is cleverly hoodwinked by the Iranians into clicking a compromising link, or otherwise provides some of their personal access data, there is little the agency can do to block such a penetration.<\/p>\n

The opposition to Islamist Iran\u2019s undoing brings together Russian losers, European cynics, and American foolsKaradi\u2019s predecessor, Gaby Portnoy, was viewed as very successful in his role, especially given that he had to handle it during the two-year Middle East war of 2023-2025, during which cyber threats to Israel tripled.<\/p>\n

However, the Post has learned that Karadi has had a structural advantage over Portnoy: closeness to Netanyahu.<\/p>\n

Portnoy rarely ever met with or spoke directly to the prime minister. By historical coincidence, he was appointed by then-prime minister Bennett in February 2022.<\/p>\n

When Netanyahu returned to power in December 2022, he carried out cordial, professional, and effective relations with Portnoy and allowed him to stay on (unlike the IDF and Shin Bet chiefs appointed by Bennett, both of whom he eventually forced out), but clearly kept him at a distance, likely because he was not his pick.<\/p>\n

In contrast, Karadi, whom the prime minister appointed himself, holds semi-regular meetings with Netanyahu.<\/p>\n

If an issue is important to Karadi or Netanyahu, then there is no issue with them meeting or speaking. If the cyber chief believes he needs the prime minister\u2019s backing to get something important done, he receives it, and relatively quickly.<\/p>\n

Karadi also speaks even more frequently with Netanyahu\u2019s Military Secretary, Maj.-Gen. Roman Gofman.<\/p>\n

New AI chief, positive or negative?<\/p>\n

On October 12, 2025, Netanyahu appointed Brig.-Gen. (res.) Erez Askal as the first chief of the National Artificial Intelligence Directorate (NAID).<\/p>\n

Since then, former INCD chiefs have been split on whether having yet another government technology-digital entity would be a disadvantage, leading to unnecessary duplication of efforts and infighting, or a positive, multiplying distinct energies and capabilities invested in digital-technological issues.<\/p>\n

Karadi himself came down unequivocally on the positive end.<\/p>\n

He said that he and Askal have been \u201cworking super close together with regular meetings, whether multiple meetings in a week or once in a month \u2013 whatever is needed.\u201d<\/p>\n

\u201cI trust him completely \u2013 he is doing great work. And if they [the NAID] are able to develop a new data center,\u201d to increase Israel\u2019s energy capacity and overall resources for AI and digital causes for Israel, that would be a big success.\u201d<\/p>\n

Also, he said that to date, the roles of the INCD and NAID have been clear, with the INCD still being the only operational digital agency confronting hacking issues, and the NAID working more on building long-term national capacities for AI.<\/p>\n

One year into his role as INCD chief, Karadi has had no moment of quiet, and the world he is trying to defend is evolving at light speed.<\/p>\n

But with backing from Netanyahu, strong international partners (even when not all of them get along), a new ally in the NAID, and hopes of finally passing a long-overdue cyber law, Karadi feels he is in a strong position to continue as Israel\u2019s chief cyber defender.<\/p>\n","protected":false},"excerpt":{"rendered":"One of Yossi Karadi\u2019s predecessors as the chief of the Israel National Cyber Directorate (INCD), Yigal Unna, warned…\n","protected":false},"author":2,"featured_media":323849,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20],"tags":[345,343,344,4287,126841,160517,93773,93774,85,46,126842,157282,157283,125],"class_list":["post-323848","post","type-post","status-publish","format-standard","has-post-thumbnail","category-artificial-intelligence","tag-ai","tag-artificial-intelligence","tag-artificialintelligence","tag-cybersecurity","tag-cybersecurity-israel","tag-data-privacy-in-ai","tag-hack","tag-hacker","tag-il","tag-israel","tag-israeli-cybersecurity","tag-operation-epic-fury","tag-operation-roaring-lion","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/posts\/323848","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/comments?post=323848"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/posts\/323848\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/media\/323849"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/media?parent=323848"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/categories?post=323848"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/tags?post=323848"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}