ITTech Pulse Exclusive Interview with Erez Tadmor Global field CTO at Tufin

ITTech Pulse speaks with Erez Tadmor of Tufin about securing AI-powered infrastructure through continuous posture management, policy governance, and unified network control.

Erez, you have spent years working on network security and infrastructure protection. What experiences in your career shaped your perspective on how organizations should manage security across increasingly complex environments?

“I came from fraud detection and prevention, so I was already used to environments where decisions must happen fast and at scale. What surprised me about network security was that even the basic questions are hard. Who has access to what? Why does that access exist? Is it still needed? Does it still match policy? In a hybrid environment, those are not trivial questions.

As networks spread across data centers, cloud, SASE, and remote access, the problem stops being just configuration. It becomes context. A rule by itself does not tell you much. You need to know why it is there, what it supports, and what happens if the environment around it changes.

That is why Agentic AI is both exciting and risky. It can help teams move much faster, understand policy faster, and cut a lot of manual work. But if the environment already has stale access, fragmented visibility, or policy drift, AI can amplify that too. So, for me, the future is not just AI for speed. It is AI with context, guardrails, and trust. That is very much the direction Tufin is taking with continuous security posture and a unified control plane for agentic network security.”

Read More: ITTech Pulse Exclusive Interview with Michael Campell, Chief Product Officer, Hyland

Enterprise networks today span data centers, multiple clouds, and distributed workforces. How has this shift changed the expectations placed on network security teams compared to traditional perimeter-based security models?

“The perimeter model was simpler. There were fewer control points, the traffic patterns were more predictable, and the job was more clearly defined. That is not the world teams are operating in now.

Today, security teams are dealing with firewalls, cloud controls, SASE, microsegmentation, and increasingly AI-driven change happening across the environment. So, the job is no longer just protecting the edge. It is understanding and governing connectivity everywhere.

What we hear from customers is that the pace of change is the real issue. A weekly review cycle may have worked in the past. In a machine-speed environment, it does not. By the time you review the change, the network may already be different. That is why continuous posture matters so much. The question is no longer whether the network was compliant last week. It is whether it is secure right now and what needs attention first.”

Tufin recently introduced new capabilities designed for the AI era of security operations. In practical terms, how can AI assist security teams in simplifying rule management, policy analysis, and operational decision-making?

“What matters here is the larger shift in how network security gets done. The vision is not just to help teams find answers faster. It is to give them a way to maintain continuous control as the environment changes at machine speed.

That is why Tufin is building toward a model where AI can continuously understand the environment, identify real exposure, recommend the safest next step, and help drive action through proven playbooks, with humans still in control. In that model, natural-language interaction is important, but it is only the starting point. The broader strategy is a unified control plane for agentic network security – one that continuously assesses exposure, governs change reliably, and helps eliminate risk across complex, multi-vendor environments.

That is also why the engineer’s role evolves. Less time spent digging through rules and tickets or pushing repetitive changes by hand. More time spent setting guardrails, approving higher-impact actions, validating outcomes, and making sure automation stays aligned with policy intent. In other words, the shift is from manual operation to governed, continuous control.”

Many organizations struggle with slow change management and firewall rule reviews. How can automation and AI-driven insights help security teams accelerate access requests while still maintaining strong governance and compliance?

“What customers tell us is that the delay usually starts before the change itself. Someone asks for access, and then security has to decode what is really needed, assess the risk, and figure out whether it fits policy. That is where the slowdown happens.

AI helps by making that first step much cleaner. It can help interpret intent early, surface the relevant policy context, and narrow the safest path forward. Then automation can take over the repetitive part and move the request through the right approvals and guardrails.

So this is not about loosening governance. It is about making governance faster and more consistent. Customers do not want to choose between speed and control. They want both. That lines up closely with Tufin’s approach of helping teams remediate safely, prove posture continuously, and use proven playbooks so change does not come at the expense of governance.”

Read More: ITTech Pulse Exclusive Interview with Michael Jacobs, Head of Social Innovation at IBM

Security leaders often need to translate complex technical insights into business-level understanding. How do modern security platforms help CISOs, and executives gain clearer visibility into risks and policy changes?

“Most executives do not need more detail. They need a clearer picture.

They want to know where risk is building, what changed, whether controls are still holding, and whether the organization is getting more exposed or less exposed over time. That is where a modern platform can help. Instead of flooding leadership with technical data, it should show what actually matters: which critical systems are reachable, where segmentation is drifting, where exceptions are building up, and which risks are real based on exposure.

A CISO usually does not care that a specific rule changed. They care whether a critical system is now reachable in a way it should not be, whether that creates business risk, and whether someone is on it. That is why the idea of continuous proof is so important. Security leaders want to know, at any given moment, whether the network is secure right now and what should be fixed first.”

As AI applications and automation expand across enterprise infrastructure, what new security considerations should organizations address to ensure their network environments remain resilient and well governed?

“First, trust. Customers are open to AI, but they are not asking for blind autonomy. They want AI that operates within clear guardrails, has enough context to understand the environment, and keeps humans involved where the stakes are high. That is very consistent with Tufin’s model of vendor-agnostic AI, proven playbooks, and humans in the loop.

Second, speed. AI is accelerating how infrastructure is built, changed, and operated. That means security controls cannot rely on delayed validation and periodic checks. They have to become much more continuous. The deck is very explicit on that point: legacy workflows do not scale to the pace and complexity of AI-driven, agent-operated networks.

Third, the attacker side of the equation. This is not just about defenders moving faster. Adversaries benefit from speed and scale too. So, the real test is whether your security model still holds when change is happening continuously on both sides.”

For IT and security professionals working to modernize network operations, what practical steps would you recommend to help teams reduce complexity while strengthening security policy management across hybrid infrastructure?

“First, get the model right. Before you automate anything, you need a reliable picture of the environment – not just what devices exist, but how things connect, what is reachable, and where the real exposure is. Otherwise, you end up automating noise or fixing the wrong problem.

That is why the Dynamic Network Connectivity Graph matters. The point is to have one continuously updated model of the hybrid network so teams can work from actual context, not fragments. Tufin’s view is that without that model, you miss exposures, create segmentation gaps, and spend time on non-critical issues.

Second, start where the friction is highest. For most teams, that means access requests, policy analysis, exception handling, and exposure investigation. Those are good AI entry points because they remove manual drag without taking humans out of the loop.

Third, modernize with control in mind. The goal is not automation for its own sake. The goal is an operating model where you can assess exposure continuously, govern change reliably, and keep posture aligned as the environment moves faster. That is the broader shift Tufin is pushing toward with unified control, continuous validation, and vendor-agnostic agentic AI across multi-vendor environments.”

Thank you, Mr.Erez, for taking the time to share your insights with us.

Write to us [⁠wasim.a@demandmediaagency.com] to learn more about our exclusive editorial packages and programmes.