Part IThe Story
The file needed a name, so he gave it one. In the earliest months of Check Point Software Technologies, the company's office was the apartment of Shlomo Kramer's late grandmother. There was no air conditioning against the Israeli summer, there were three founders, and there was roughly $300,000 in the company's bank account. Kramer opened the first project file for the product the three of them were betting everything on, and he typed in a name: FireWall-1. The file was unglamorous. "A Yacc grammar file for the stateful inspection compiler," he wrote a quarter century later, in an essay for a networking trade site, "if you must know."
That last clause is the closest thing to a self-portrait Kramer has ever published. It is precise, faintly impatient, and a little amused that anyone would ask. He was not looking for credit. He wanted to get the facts in the right order. FireWall-1, he went on to concede, was not the first firewall. The category already existed when he chose the name. One of the first things his co-founder Gil Shwed did during their market research in 1992 was subscribe to a newly formed mailing list for firewall administrators. The incumbents had names like Raptor and the Trusted Information Systems Firewall Toolkit, and they came, as Kramer put it, "out of corporate America." They were heavy products, sold with heavy professional services to large organizations willing to pay for heavy customization.
The three men in the apartment were "anything but corporate America." They were Kramer, Shwed, and Marius Nacht, and they were sitting, in Kramer's phrase, "10,000 miles away from the market." What they built in that apartment was a grammar: a compact, formal set of rules for deciding what was allowed to pass from one side of a wall to the other. It was the first firewall simple enough that it didn't need its makers in the room. Within three years it held 40 percent of the world market.
Kramer is now sixty and worth about $2.4 billion. By most accounts he is the most successful serial founder the security industry has produced: three companies, two IPOs, a third pending for years. He wrote the first angel check into Palo Alto Networks. He rarely grants interviews. In September 2025 he gave one anyway, to Sophie Shulman of the Israeli business daily Calcalist, and said something founders of $20 billion companies almost never say about the thing they built. "When Gil and I founded Check Point, we ideologically believed in the Internet as something that would unite the human race on a supranational basis," he told her. Then: "Over the years, I have come to regret that the enterprise of our lives, Gil's, mine, and that of many others, has become the destruction of everything we once believed in: democracy and liberalism."
It is a long way from a Yacc file to that sentence. The distance is mostly made of doors: who gets let in, who gets kept out, who has to pretend to be from somewhere else in order to be admitted, and who, at sixty, decides he no longer will.
By the Numbers
Three Companies, Thirty-Plus Years
40%Check Point's share of the world firewall market by February 1996, per IDC
$67MRaised in Check Point's Nasdaq IPO, June 1996
+33%Imperva's first-day gain after its $90M NYSE IPO, November 9, 2011
$4.8B+Cato Networks valuation after its $359M Series G, June 2025
$350M+Cato annual recurring revenue at year-end 2025, up 43% year over year
~67Angel investments, per PitchBook, concentrated in cybersecurity
$2.4BKramer's net worth, per Forbes, March 2026
Simple to Buy From Afar
Kramer's account of the founding reads less like a vision statement than a list of shortages. The Israeli summer was sweltering, there was no air conditioning, there was $300,000 in the bank, and the market was ten thousand miles away. None of the models that worked for Raptor would work for them: no extensive on-site support, no custom implementations, no professional services. "They say 'necessity is the mother of invention,'" he wrote, "and that was certainly the case for Gil, Marius, and I."
So they wrote a spec made of constraints. The product had to be, in Kramer's enumeration, "Simple to use without customer support, Simple to deploy without professional services, Simple to buy from a far, and, above all, Simple enough for three capable developers to build before running out of budget (about 12 months)." The fourth item sits at the bottom of the list, but everything above it depends on it. Elegance was not the goal. Surviving the runway was.
The technical answer was stateful inspection. Shwed had conceived it while serving in the Israel Defense Forces' Unit 8200, where he worked on securing classified networks. Shwed is the quieter of the two in public memory and was the more continuous at Check Point, where he served as chief executive for three decades. Kramer, explaining years later what he called the company's "secret sauce," pointed to something more ordinary than genius: Shwed had been a system administrator. He knew the customer's problem because he had been the customer. The existing firewalls required a new proxy server for every new internet application. If an application was upgraded, the proxies had to be upgraded with it, or the application broke. Stateful inspection replaced all of that with what Kramer called "a stateful and universal inspection machine that could handle any application given the right, light-weight configuration file." Add an intuitive graphical interface, and a network administrator could run the thing alone.
The money was modest. Initial funding of $250,000 came from the BRM Group. "We scrambled for a few $100,000 to enable us to launch the product," Kramer recalled on the Inside the Network podcast. Then the company "kind of stumbled on Sun Microsystem." In 1994 Sun signed an OEM agreement to distribute FireWall-1. Kramer still talks about Sun the way people talk about a country that no longer exists: "I don't know if if Sun is now long gone, but it used to be the largest network in the world and a major, major player with global reach."
This was the moment, in his telling, when the company nearly drowned in its own luck. "We were 3 people in the room," he said. "The Internet was just created. The first browser was just created. We had absolutely the right product in the right time in the biggest technology transition." The problem was no longer finding demand. It was surviving it. "You had to believe in yourself that you are able to do it, although we had zero experience in doing it." Check Point signed a distribution agreement with HP in 1995 and opened a U.S. office in Redwood City, California, the same year. By February 1996 IDC had named it the worldwide firewall market leader. That June it raised $67 million on Nasdaq. When the company was four years old, its founders received the Israeli Prime Minister's Award for Computer Software.
Kramer's fingerprints on the company go beyond the name. Contemporary biographies credit him with a key role in defining FireWall-1, VPN-1, FloodGate-1, the OPSEC partner alliance, and the security appliance program. That last item became the 1998 partnership with Nokia, which bundled Check Point software into Nokia's network security appliances. He served in various executive roles through 1998 and on the board through 2003. Then he left, with money from the sale of his stake, to do it again.
Two decades later, Check Point is a company with $2.7 billion in annual revenue and 6,825 employees. In December 2024 Shwed stepped up to executive chairman, and Nadav Zafrir, a former commander of Unit 8200, became chief executive. In 2018 the company added a green wall to its Tel Aviv headquarters. One Hebrew headline described the change as "shrubs instead of glass." The firewall company had grown itself a living wall. It is a nice image, and it no longer has much to do with Kramer.
Don't Speak Hebrew
The FireWall-1 beta went to the United States, and so did the advice that came with it. "We managed to bring it to beta in the U.S. but were advised not to speak Hebrew and pretend we were an American company," Kramer wrote in Fortune in April 2023. "There was a shocking nervousness around our accents."
The sentence is worth staying with. The men who wrote the grammar for what passed through the wall were told that their own speech would not pass. Israel at the time, Kramer wrote, "was seen as an engineering center for U.S.-based tech companies." Founders were advised to install an American chief executive. "There was absolutely zero trust in Israel as an environment to successfully invest in." He was candid about the part of the skepticism that was earned: "We were very good at engineering–but had little knowledge of the go-to-market strategy, commercialization, and legal structure needed to grow a company."
The second time, the advice had softened only slightly. When Kramer founded Imperva in the early 2000s, he was told to register the company and all its intellectual property in the United States. The Israeli operation would once again be the engineering subsidiary. Some local venture firms existed by then, and some branches of global firms. They no longer demanded an American CEO. "They did insist on me relocating to the U.S."
There is a document that records that insistence in the flat prose of employment law. It is dated August 16, 2010, on Imperva letterhead from 3400 Bridge Parkway, Suite 101, Redwood Shores, California, and it was later filed as Exhibit 10.5 to the company's IPO registration. "In connection with your transition of employment from Imperva, Ltd. in Israel to Imperva, Inc. in the United States," it begins, "Imperva, Inc. (the 'Company') is pleased to offer you employment on the following terms." The title is President and Chief Executive Officer, reporting to the board. The salary is $250,000, with a target annual bonus of another $250,000. The employment is "at will." There is a three-month notice clause and a standard proprietary information agreement attached as Exhibit A. This is how the man who co-founded the first commercial firewall company became, on paper, an American employee of his own company.
He went. He traveled. In 2008, before the formal transition, he told an interviewer about "a lot of sacrifices involved, especially when your family lives in Israel and you travel all around the world, but it's still worth it."
Then, in 2015, he stopped going. "When I co-founded my third startup, Cato Networks, we boldly decided to build the company in Israel with all the functions headquartered in the country," he wrote. "It was a pioneering decision then, to the point that I vowed not to relocate and to hire all my senior team from Israel." Eight years in, senior management, legal, and accounting were all in Israel. "We no longer have to hide who we are."
He wrote that sentence in the spring of 2023, in an essay arguing that the Netanyahu government's proposed judicial overhaul would undo it all. Three decades of earned trust, he wrote, could be spent in a single legislative session. The arc of the essay is the arc of his career told as a story about accents. In 1994 you hide. In 2002 you move. In 2015 you stay. In 2023 you discover that staying was conditional too.
The Boy at the Counter
The origin story Kramer tells about himself has a mirror in it. At fifteen, his first job was selling personal computers in a shop in Tel Aviv. One of the shop's best-selling games, he discovered, had been developed and marketed by a seventeen-year-old in Britain who had set up his own company. Kramer knew then, according to an account of his own recollection, that he "wanted to be like him — an entrepreneur, even though it would be quite a few years before I knew the word."
It is a modest epiphany, and a telling one. The teenager behind the counter was not dazzled by the game. He was dazzled by the fact that a boy two years older, in another country, had made it and sold it. The boy owned the thing, and the thing was in a shop in Tel Aviv. As a youth Kramer also worked on mainframes and sold video games himself. In high school, in the 1980s, he founded his first startup with a friend named Ofer Shemtov, and it was later sold to a software firm. Then came the army: Unit 8200, the intelligence corps whose alumni have become, over the decades, the officer class of Israeli technology. After his service he took a bachelor's degree in mathematics and computer science at Tel Aviv University and a master's in computer science at the Hebrew University of Jerusalem.
The model company of his youth, when it came, was another small, self-made thing from abroad. "As founders of Checkpoint, both Gil and myself really admired a company called Pure Software," Kramer said. It made a development tool that found memory leaks quickly. It lived in the Sun Microsystems universe, which was the founders' world, and it was bootstrapped. "We really liked the fact that it was a bootstrapped startup starting from 0 and with very little resources, became a significant company." Only decades later did he learn whose company it had been. "Years later, just recently, I found out the fact that I hope I believe it's accurate, that this was the company of the Netflix founder." The interviewer supplied the name: Reed Hastings.
The hedge in that sentence, "I hope I believe it's accurate," is characteristic. So is the way the anecdote arrives at its punchline without his seeming to care much about the punchline. Kramer does not collect famous names. He collects examples.
There is one more early figure in the family story, and he appears only once, secondhand, in a LinkedIn post by an attendee at an Israel Collaboration Network event in Palo Alto in February 2025. Kramer, she wrote, "shared a story about his grandfather — a successful businessman who was stripped of his assets and banished to a gulag in Siberia." Hold that grandfather in mind. He comes back.
Crickets
The second company began as WebCohort in 2002 and took its first round from Accel Partners. It was renamed Imperva in 2004. Kramer founded it with Mickey Boodaei and Amichai Shulman. The English-language record on Boodaei and Shulman is thin, but they were young enough that Kramer, a decade into the industry, was the elder statesman in the room, and they were technical enough that the company's thesis was an engineer's thesis. The wall was no longer enough. Imperva, in the words of one profile, "moved away from perimeter defenses such as firewalls and instead deployed its software to protect against hackers and business-data theft." The co-founder of the first commercial firewall company was now in the business of explaining why firewalls didn't go far enough.
The market did not want to hear it. "It was a company that was started before, PCI was born and before the 1st disclosure role was born," Kramer said on Inside the Network. "It was 2 years ahead of its time. So we had, kind of the product out, and there were crickets." In 2007 he described the landscape of the early years more specifically: "When we started in 2002, not much of the market understood what we were doing. Data security was seen as far-fetched because everybody was talking about worms and broad attacks."
This was the inverse of the Check Point problem. At Check Point, three people had been chasing a demand funnel they could not keep up with. At Imperva, a company had to be held together through silence. "Now I had to believe, and the the other founders, Miki and Mihai, had to believe that the market is going to happen and demand is going to come. And we had to articulate that to the employees." Then the Payment Card Industry standard arrived, and demand came the way it does, all at once. "Then PCI came in 1 quarter, data security was happening in a big way."
He has never quite forgiven the experience. In 2026 he posted the lesson in capital letters on LinkedIn, a platform he otherwise uses with the restraint of a man drafting a press release. "Startups or product launches don't fail because they are late to market. They fail because they are too early. Being late or even slightly off the mark is fixable. You iterate. You pivot. You reposition. Markets can forgive adjustments. But being too early is different." And then: "TIMING IS THE ONE VARIABLE YOU CONTROL THE LEAST."
By May 2008 he could afford to be generous about it. SC Magazine had named him CEO of the Year. A reporter from the British trade press found him on the top floor of the Mandarin Oriental in Knightsbridge, his "imposing frame" supported by a sofa in the middle of a suite that "seemingly meets his approval." He liked the view over Hyde Park. He was bringing his family over for Passover, he said, and wanted to know whether there was much fun to be had in the park for the children. The reporter offered horse riding and the playground. "The suggestion is duly noted," the reporter wrote, "with just an 'OK'. I feel I should have come up with some better ideas."
Imperva then had 170 employees in eleven countries. The headquarters, the reporter noted, was "of course, in Israel, with the marketing functions centred on Silicon Valley." Two years later the offer letter would move the chief executive too. Kramer told the reporter he had a six-year head start on the competition. He also offered what remains his clearest statement of the founder's double bind: "Being an entrepreneur is all about, on the one hand, trusting yourself and saying: 'what's out there is wrong and what I'm doing is right', but also not being too full of yourself." And: "If you're a young entrepreneur, you don't know everything, and you can't invent everything, you can't re-invent all the wheels - just invent one new wheel and accept the others."
The other important thing he did at Imperva, he did to Imperva. Amazon Web Services launched in 2006, and Kramer concluded that the cloud "was going to become a major force." He did not simply bolt a cloud product onto the company. "We did something radical: We created a subsidiary, called Incapsula, that could reinvent our value proposition around a cloud service and spun it out." Incapsula's co-founder was an engineer named Gur Shatz. Kramer would later call Shatz "our technical genius." Shatz had built Imperva's SecureSphere platform before founding Incapsula, a cloud network that protected websites against DDoS attacks. In February 2014 Imperva bought out the shares in Incapsula it did not already own and acquired Skyfence, a cloud security gateway in which Kramer had been lead investor. The Haaretz headline was blunt: "Shlomo Kramer's Imperva buys two of his Israeli firms."
Imperva went public on the New York Stock Exchange on November 9, 2011, raising $90 million. The shares rose 33 percent on the first day. Kramer stayed on as president and chief executive until 2014. In early 2018 he sold his entire remaining stake, for an estimated $90 million. In 2019 Thoma Bravo acquired the company for about $2.1 billion. By then Kramer and Shatz had been building something else for four years. It was the thing Incapsula had been the rehearsal for.
The First Check
In July 2007, a blogger asked Kramer to explain a new company whose board he sat on. The company had assembled "an absolutely amazing group of heavy hitters from industry," and the blogger wanted to know what it was doing differently. Kramer's answer came from an unusual vantage point. "Existing firewalls are based on Stateful Inspection, which employs a port and protocol approach to traffic classification," he wrote. "The problem existing firewall vendors face is the fact that much of their core technology (Stateful Inspection) is over a dozen years old."
The company was Palo Alto Networks. Its founder, Nir Zuk, was a former Check Point engineer who had spotted, in Greylock's phrasing, "a new massive opportunity in cyber." Kramer was one of the earliest financial backers. By most accounts he wrote the first angel check, and he took a board seat. The man whose company had popularized stateful inspection was now funding a former employee to declare it obsolete. Zuk's company became one of the most valuable pure-play security companies on earth, worth well over $100 billion. At the time of the blog post, Kramer described it in terms any parent would recognize: "We've just launched the company, it's an exciting time."
The pattern holds across Kramer's angel portfolio. The people he backs are usually people he has watched work. In 2016 Network World asked why he had joined LightCyber's $20 million second round. He listed the market and the product, and then the third reason: "I've known Gonen for many years." Gonen Fink, LightCyber's chief executive, had been one of Check Point's early employees and its chief product officer "throughout the growth years of the company." Palo Alto Networks bought LightCyber in 2017. Check Point itself bought Lacoon Mobile Security, where Kramer had been the founding investor. Trusteer, which protected online transactions from phishing and crimeware, went to IBM in 2013 for roughly $1 billion. One headline estimated Kramer's take at about $240 million. WatchDox went to BlackBerry in 2015, Worklight to IBM in 2012, Secure Island to Microsoft. Dealroom counts 33 portfolio companies across 63 investments, most of them in security. Ten became unicorns.
The industry has a name for the web of companies spun out of Check Point's alumni: the Check Point mafia. If there is a godfather in that sense, the title the Israeli press has assigned Kramer more than once is less ornamental than it sounds. He does not run the family. He finances its children.
His standards as an investor are idiosyncratic and mostly first-person. The founders of Gong pitched a sales-intelligence tool at a time when, Kramer said, "it was far from obvious that it's, it's going to be a category." His reaction was that of a buyer: "Hey, I want that as the VP of sale of my startup. I want it." He invested alongside MVP and then "we doubled down, and and, the rest is history there." Gong was last valued at more than $7 billion.
His losses follow a pattern too, and he names them more readily than most investors do. After the iPhone, he backed a team building mobile security. The logic seemed airtight: "It's a handheld device. It has to have security. It's the most private device that you have." The team was great and the product was good. "And the market didn't happen." His forays outside security into AI-adjacent pharmaceuticals and marketing, he told one interviewer, were mostly mistakes. He concluded that it is "much easier to get excited about things you don't understand." Then he offered the corollary: "A deep understanding of something gives you granularity."
His memory for granular things is exact to the point of being combative. Kumar Saurabh, co-founder of the log-analytics company Sumo Logic, has told the story of pitching Kramer in a hotel lobby. Kramer walked up, skipped the small talk, and got straight to business. Kramer accepted the characterization and disputed the venue. "I seem more comfortable when a conversation has a subject than, it's free form. I admit that," he said. "Although I have to, counter Kumar, and my memory tells me it was on the 2nd floor of the old Italian coffee shop on University Avenue." He offered to take it offline.
The intimacies of this portfolio produce awkward geometry. By the 2020s Kramer was competing head-on with Palo Alto Networks, the company he had helped birth. When an interviewer suggested this might look "a bit off," Kramer reached for Jeff Bezos and the line about customers and competitors. Then he added: "Not that, you know, Paolo is such a Goliath, and we are such a David, so I'm I'm not comparing." He called Palo Alto "the best portfolio company, that cyber has ever seen," and then took the compliment apart: "Unfortunately, portfolios are a very bad idea in the digital, transformed the world." When Palo Alto announced its $25 billion acquisition of CyberArk on July 30, 2025, Kramer was less diplomatic. "Platformization? More like IBMization," he wrote on LinkedIn. "I believe the Palo Alto Networks-CyberArk acquisition is the end of a successful run from PANW."
That is how one generation of a family business talks to the next once the second generation has gotten big.
A Very Ambitious Project
Cato began with a failure that took about three months. In 2015, Kramer and Shatz, fresh from the world of cloud-delivered DDoS protection, were looking for something new to do with the fact that networks had become software. Their first idea, which Kramer calls "Cato version 1.0," concerned east-west traffic inside the data center. "We worked for, for a few months, 2, 3 months on that building, formalizing the idea and building a presentation around that, etcetera, and it didn't stick."
The interviewer asked how they knew it didn't stick. "It was a gut feeling. We are not feeling it. We are not feeling it." Was that a consensus? "It was a consensus. Both Goh and myself did I felt the same. So there was no question about it. If both of us didn't feel it, then it's a no go."
"I remember the day that we decided, hey, that doesn't work," Kramer said. "We are back to square 1. Went back, home and, sat on the patio and, was frustrated or or disappointed. And then the idea of Cato, came to mind." The second version moved the idea out of the data center and into the spaces between. It covered the traffic between the data center and everything else: branches, remote users, other data centers, SaaS applications. Networking and network security would be converged into a single cloud service. "I immediately talked with GUR," he said, "and the rest is history." Four years later Gartner gave the category a name: Secure Access Service Edge, or SASE.
He is insistent, and almost mystical about not being mystical, on how the idea arrived. "The decision needs to be a gut level decision. And by gut level decision, I don't mean something spiritual, etcetera. I really believe that we have processing capabilities that goes beyond the kind of where the fleshlight of the conscious points." The three months had been spent "consuming a lot of information." The patio was where the information finished processing.
The venture capitalists did not share the gut. "Some of them said it's a very ambitious project, which I guess means go away," Kramer said on Inside the Network. To Calcalist in January 2022 he was more pointed, and he sounded wounded in a way the Hebrew press noticed: "Many investors told us 'This is a very ambitious project.' In 'American,' it means 'Are you out of your minds? It has no chance of success.'" The man who had once been told not to speak Hebrew in America was now translating American back into Hebrew for an Israeli newspaper. The skeptics, he said, were the most experienced investors in networking. They came "from the old days of Cisco." They remembered Juniper buying an appliance company for $4 billion and failing to fold it into its operating system, and they remembered Cisco's own attempt. "And we're familiar with, any number of startups that tried to do that and failed. Unfortunately, here, here is another team that is going to fail at that."
The problem they were pointing at was real, and Kramer describes it better than his critics did. Every CIO wants the network to be invisible: "You know, it's going to be up and working, no hiccups, and nobody's going to call me with an issue." That means five nines of availability. The same CIO wants the best security, which "requires huge amounts of updates and upgrades and dynamics. We do thousands of updates a year to the network." Stability and constant change, in a single stack, processed in a single pass, delivered as a global cloud. "That has been since the early days of Checkpoint, since the Ciscos, Juniper's of the world, all in a, in a graveyard of startups, all tried to do this and failed."
The believers were not hard to find, he said, once the skeptics had cleared out. Steve Krausz of U.S. Venture Partners and Aspect Ventures led a $20 million Series A in 2015. Cato launched officially in February 2016 and raised a $50 million Series B that September. The Greylock partner Jerry Chen came in "before it was obvious," as Kramer later wrote. Chen describes Kramer, with a slight twist on a cliché, as "fast and steady." Singtel's venture arm, Innov8, joined as an investor. That was odd at first, because Cato's first competitors were the carriers. Kramer had the numbers memorized: in 2015, roughly 70 percent of North American enterprises built their networks themselves and 30 percent went to carriers, while in Europe the proportions were reversed. The carriers had their own cloud strategy, network function virtualization. Kramer spent years writing Forbes columns with titles like "The Telco Conundrum" and "Industry Experts Call For Caution On NFV." "It was clear to us that it's not going to happen," he said, "and it never happened." Singtel guessed that the competition would turn into partnership, and it did. Today the carriers resell SASE.
What the early years felt like from the inside, he described without decoration. "The road from version 1.0 to version 3.0 in the early years was very challenging." When an application has a bug, customers grumble and wait. When the network has one, everything stops. "We are waiting for version 3.0. We are now in version 10. Right? And, those were difficult years."
The money arrived in the rhythm of a company that had proved the skeptics wrong one round at a time: $55 million in 2019, led by Lightspeed; $77 million in April 2020; $130 million that November at a valuation above $1 billion; $200 million in October 2021 at $2.5 billion, with Kramer himself among the participants. In January 2022 he told Calcalist the company had 1,100 customers, a $100 million annual run rate, $400 million in the bank, and two goals: an IPO in 2024 and half a billion dollars in sales by 2026. The same season, Wiz, another Israeli cloud security company with about a quarter of Cato's sales, raised at $6.5 billion. Kramer was invested in Wiz too, through Gili Raanan's Cyberstars fund. "First of all I am quite pleased from the value attained by Wiz," he said. The newspaper noted that he showed little emotion.
The IPO did not come in 2024. The market for technology listings had closed by then, and Cato kept raising privately: $238 million in September 2023 at more than $3 billion, then $359 million in June 2025 at more than $4.8 billion, led by Vitruvian Partners and ION Crossover Partners. That September, Cato announced its first acquisition ever, the Israeli AI-security startup Aim Security, along with an extra $50 million and annual recurring revenue above $300 million. By the end of 2025 the figure was past $350 million, growing 43 percent. More than 4,000 enterprises run on the platform, across more than ninety points of presence. Once customers try it in a proof of concept, Kramer says, Cato wins about 70 percent of the time.
In 2023 Check Point bought Perimeter 81, a SASE company, for $490 million. Kramer's first company had paid to enter the category his third company built.
A Collection of Contradictions
Asked to describe his leadership style, Kramer declined to name one quality and listed a set of oppositions instead.
— Shlomo Kramer, on the Inside the Network podcastSo perhaps my leadership style is the founder CEO, which is what I'm also, is a collection of contradictions.
The founder must believe in the vision and sell it "sometimes through very hard times." The same founder must have "intellectual honesty and look at the reality and adjust and sometimes pivot." He must be a good listener and still treat every piece of advice "not as somebody you admire, which I don't have world figures like that, but as inputs." He must be "a rebel" and "very scrappy and version 1.0 type of person," and also "very organized and operationally oriented in order to scale that." The point, he said, "is not to have one or the other. It's the key is to maintain the balance of in all these dimensions." At the ICON event in Palo Alto in February 2025, an attendee recorded a tighter version: you must make decisions as a rebel, "without the influence of third parties...and still manage relationships, influence others, and get buy in all the time from everyone."
Notice the aside buried in the middle: "which I don't have world figures like that." Kramer has no heroes, or says he doesn't. He admired Pure Software as a company, not Reed Hastings as a man, and he didn't learn the man's name for thirty years. He quotes Bezos once, for a single line about competition, and moves on.
Most of what is known about him comes from other people's set pieces. In those he appears as an imposing figure on a hotel sofa, a man who skips the small talk in a café, a CEO who answers a question about the possible decline of an industry with a heavily hedged non-expert's opinion. His childhood friend Shahar Bar Kohan told the podcasters that Kramer would have made a great writer had he not become a founder, and that he is "one of the most curious persons I know," curious "in a very intellectually precise manner." Kramer's reply was brief and dry: "I have no, no idea why he told you that, and I'll I'll I'll check it in a decade or 2 when I retire."
Precision of that kind cuts both ways. In a 2020 Calcalist interview, Kramer compared founders to professional basketball players: people who want to win but also simply love to play. He then listed what the game demands: "very high stamina, intellectual integrity, and a combination of the ego necessary to found a startup and the humility required to be able to work with other people as a team." The ego is easy to locate. "With all my record as an expert in building companies," he told the same paper in 2022, "and I think that I am one of the best in the world in this field." The humility shows up as an almost clerical honesty about failure. He named the mobile bet that missed, the out-of-domain investments that were mistakes, and the version 1.0 that didn't stick.
He seems most himself when describing the trap of having been himself. "If you're lucky to have been successful," he told Greylock in 2024, "you have to make sure you are not frozen in that persona." Success turns a person into a reputation: the godfather, the hat trick, the golden touch. The cure he prescribes is to go back to zero. "Startups are a very human experience," he said. "They're all about taking calculated risks. It's okay to fail as long as you learn as much as you can from that failure, and continue to have real human ambition and dreams."
He also delivered the line every subsequent profile has quoted, in the tone of a man who knows exactly how it will be quoted: "I hope the third will last for a very long time, because I am not sure there's going to be a fourth one."
At the start of 2026 he flew the company to Paris for its annual sales kickoff and posted about it afterward. "Eleven years ago, we chose to build a company around people, not the other way around," he wrote. "After 30 years in this industry, one thing is clear to me: this is a human journey." On a competitor's LinkedIn post, a former rival named Sanjay Mehta left a comment that served better as a portrait than anything Kramer has said about himself: "competing against you was a masterclass."
We Understood Nothing About Humans
For most of his career Kramer said little in public about politics. That changed in 2023, when the Netanyahu government moved to curtail the Israeli judiciary's power, and his public statements arrived in quick succession.
The first was the Fortune essay in April, the history of his three companies told as a history of trust. The second was an email to Cato's employees on Thursday, July 6, 2023. "On Monday, July 10th, there will be an attempt in the Knesset to start changing the governance system in Israel from a liberal democracy to what will eventually deteriorate into a full blown corrupt dictatorship," he wrote. He was careful to separate the citizen from the chief executive: "On a personal level you know my opinions as I expressed them many times in different public forums. But today I am writing to you as the CEO of Cato." He called on employees who agreed with him to join the nationwide demonstrations on Tuesday, July 11, and specified that the day would not be deducted from their paid time off. On a podcast recorded at Cato's offices that same week, he put the stakes in an engineer's terms of irreversibility: "The trust that the high-tech industry built over 30 years could be lost in three weeks."
Then came October 7, and the war, and a different register. That October he posted on LinkedIn a message he had just sent "to the CEO of a company whose one of its employees decided to boycott Israeli products in support of Hamas-Isis." The post drew more than 1,200 reactions. The man who had spent the summer defending Israeli democracy against its own government spent the autumn defending Israeli companies against a boycott. The two positions were not in tension, at least not in his mind. Both were about whether Israel could remain a place from which you could build a company without apology. Both were about the accent.
The September 2025 Calcalist interview was something else, and it is the hinge of the whole story.
— Shlomo Kramer, to Calcalist, September 2025Today I understand that while we knew computers very well, in truth we understood nothing about humans. It turns out that when you give humans a powerful tool, it can become the foundation of many of our troubles today.
He placed himself among the builders: "Check Point was an indispensable component in building the web and connecting people to the Internet. I see myself as part of those who built the web." He gave his account of what the builders missed, and it turned, unexpectedly, into natural history. Homo sapiens, he said, "is not as big as an elephant or as strong as a lion, but it is very aggressive and, at the same time, intelligent, and therefore knows how to use tools with extraordinary aggression." The founders had built a door for the species to pass through, believing it would pass through as citizens. The headline of the interview was the bleakest sentence in it: "AI is going to destroy humanity as a liberal society."
Three months later, in the last days of December 2025, he appeared on CNBC's Money Movers. That Monday Benjamin Netanyahu was meeting Donald Trump at Mar-a-Lago, and the host Sara Eisen asked how AI cyber warfare was shaping geopolitics. Kramer argued that AI was giving authoritarian governments an unfair advantage over democratic ones. Then he said the thing that went viral. "You're seeing the polarization in countries that allow for the First Amendment and protect it, which is great," he said. "And I know it's difficult to hear, but it's time to limit the First Amendment in order to protect it. And quickly before it's too late." Asked what he meant, he explained: "I mean that we need to control the platforms, all the social platforms. We need to stack, rank the authenticity of every person that expresses themselves online and take control over what they are saying, based on that ranking." Asked whether he meant governments should do this: "The government should, yeah. They should do that." When the host David Faber observed that technology moves faster than political systems, Kramer answered with the logic of his entire career: "So you need to use technology in order to stabilize the political system. And you need to put adjustments that are perhaps not popular, but necessary."
The clip was viewed millions of times. Free-speech advocates on X were scathing, and Fox Business ran a story. Kramer later said his remarks had been taken out of context and that he supports the First Amendment.
It would be easy to read this as a fall: the libertarian dreamer of the early internet turned into a would-be censor. It is more interesting read as a continuity. The first artifact of Kramer's company was a grammar, a set of rules deciding what may pass. His working life since then has been spent refining the rules of what passes, from ports and protocols to applications, to data, and finally to every flow between every user and every machine, inspected in a single pass. Asked about speech, he gave a security architect's answer: rank the sources by authenticity and inspect what they say. He was describing a firewall. In the September interview he had said that he and Shwed understood computers but not humans. In December he proposed to treat humans as a network.
He has kept writing, in a more measured key. In Fortune in March 2026, after Anthropic's release of a code-scanning tool on February 20 sent CrowdStrike down 10 percent, Zscaler down 11, and Okta down 9 in a day, he argued that public markets no longer have the specialized machinery to price technology. "We would never ask a commodities trader to price oil, copper, and wheat as if they were variations of the same asset." In August 2026, after an AI agent at Hugging Face navigated around the barriers meant to restrain it, he argued that model builders should not be expected to secure their own models and that the security of AI is not a contest between nations. "The attack surface doesn't care about a model's passport," he wrote.
A passport is the document that tells the border whether to let you through. Kramer's career has been about borders of every kind, and he has rarely seemed much interested in where anyone's papers were issued. What he is interested in is what they are carrying.
Newspaper
Kramer has given the founding of Check Point at least three addresses over the years. It was "my late grandmother's apartment" in the 2023 Fortune essay and on the Inside the Network podcast, and "my grandparents' apartment" in a LinkedIn post after the ICON event. The attendee who wrote up that same event placed it in "the same grandfather's home," the grandfather of the gulag. Memory is not a Yacc grammar. It accepts more than one form.
What the attendee recorded about the grandfather is brief, and it is the oldest scene in the story. A successful businessman is stripped of everything and sent to Siberia. In the camp he notices that there is demand for cigarettes and nothing to roll them in. Then he notices that there is newspaper.
Part IIThe Playbook
What follows is distilled from three companies, roughly sixty-seven angel investments, and three decades of Kramer's public statements. They are not slogans. Most of them are working rules that he arrived at by being wrong, by being early, or by being told he was out of his mind. Several of them contradict each other, which, in his own account, is the point.
The principles
- 1.Let the constraints write the spec.
- 2.Build something that can be bought without you in the room.
- 3.Fear being early more than being late.
- 4.Gather consciously, decide below consciousness.
- 5.Make the co-founder's gut a veto.
- 6.Converge; don't assemble.
- 7.Disrupt yourself through a separate vehicle.
- 8.Invest where you have granularity.
- 9.Back the people you have watched work.
- 10.Treat "very ambitious" as a map of the graveyard.
- 11.Decide where you will not move.
- 12.Escape the persona by returning to zero.
K
Three Generations, One Architect
Each company attacked the limits of the one before it, including Kramer's own.
| Company | Founded | Thesis | Hardest moment | Outcome |
|---|---|---|---|---|
| Check Point | 1993 | A firewall simple enough to run, deploy, and buy without professional services | Demand overload Three people chasing Sun's global funnel | 40% share by 1996; $67M IPO |
| Imperva | 2002 | Protect the data and applications, not just the perimeter | Too early "Crickets" until PCI arrived | $90M NYSE IPO, 2011; ~$2.1B sale to Thoma Bravo, 2019 |
| Cato Networks | 2015 | Converge networking and security into one cloud stack, one pass | Technical risk Years from version 1.0 to 3.0 | $4.8B+ valuation; $350M+ ARR, 2025 |
Principle 1
Let the constraints write the spec
FireWall-1's design document was, in effect, a list of things the founders could not afford. They had no support staff, so the product had to run without customer support. They had no field engineers, so it had to deploy without professional services. They were ten thousand miles from the buyer, so it had to be simple to buy from afar. And there were three developers with about twelve months of money, so it had to be simple enough for them to finish. Each shortage became a product requirement, and the requirements together became the competitive advantage. The incumbents, Raptor and the TIS toolkit, had resources, and their resources let them stay complicated.
Most founders treat constraints as obstacles to be raised away. Kramer's earliest success treated them as the design brief. What made FireWall-1 win was what it didn't need: a new proxy server for every application, or an engineer on site for every upgrade. Kramer later said that "firewall evolution has largely been catalyzed by simplicity." Cato's pitch, a quarter century later, was the same pitch moved to the cloud: replace eleven products and the services that hold them together with one.
Tactic: Write down the four things your company cannot afford, and make "works without them" an explicit product requirement rather than a cost to be fixed later.
Principle 2
Build something that can be bought without you in the room
"Simple to buy from a far" is the clause in Kramer's list most founders skip. It treats distribution as a property of the product, not a job for the sales team. Check Point did not win because it had a sales force in America. It had three people and an apartment. It won because Sun Microsystems could resell it, HP could distribute it, and Nokia could put it inside an appliance, all without a Check Point engineer making the product legible to the customer. The OEM deal worked because the product could travel without its makers.
The same logic shows up in Cato's go-to-market. It sells through the channel, and its early competitors, the carriers, became its partners and resellers. Kramer's description of Cato's buyer is a CIO who wants above all that "nobody's going to call me with an issue." A product that has to be explained in person caps its own distribution at the number of people who can do the explaining.
Tactic: Test whether a partner who has never met you could sell, install, and support your product from your documentation alone; anything that fails the test belongs on the roadmap.
Principle 3
Fear being early more than being late
The conventional fear in startups is lateness: the incumbent, the fast follower, the window closing. Kramer's scar tissue is from the other direction. Imperva was, in his words, "2 years ahead of its time," and launched to "crickets." The company survived because its founders could keep the employees believing until the Payment Card Industry standard created demand "in 1 quarter." His mobile-security bet after the iPhone had the right team, the right product, and a thesis no one could argue with, and "the market didn't happen."
His conclusion is asymmetric. Lateness is fixable: "You iterate. You pivot. You reposition." Earliness is a different kind of failure, because "customers don't yet feel the pain," budgets don't exist, and "you spend your energy on educating rather than selling." Cato's timing was deliberate by comparison. It arrived when AWS had already taught enterprises to consume infrastructure as a service, when networks were already software-defined, and four years before Gartner named the category it was building.
Tactic: Before committing, identify the specific external event (a regulation, a platform shift, a budget line) that will make customers feel the pain, and size your runway to outlast its arrival with margin.
Principle 4
Gather consciously, decide below consciousness
Kramer's account of Cato's founding has two phases, and he insists on both. The first was three months of deliberate consumption: reading about recent networking innovation and software-defined networking, "doing a lot of, I would say, conscious processing." The second happened on the patio, after the first idea had died, when the real one arrived unbidden. "The decision needs to be a gut level decision," he said, and then quickly removed the mysticism: "I don't mean something spiritual."
His model is close to a theory of cognition. The conscious mind is a flashlight, and the rest of the processing happens in the dark, but only if you have filled the dark with data first. Gut feeling without the three months is impulse, and the three months without the gut is paralysis. He applies the same rule to hiring: per one account, he advises trusting the gut, because "the mind plays tricks," while weighing present as well as past performance.
Tactic: Separate your big decisions into a fixed period of deliberate, high-volume research and a deliberate pause before deciding; refuse to make the call while you are still in the research phase.
Principle 5
Make the co-founder's gut a veto
When the interviewers asked how Kramer and Shatz knew Cato 1.0 had failed, the answer was not a metric. "We are not feeling it." What made that enough was that it was shared. "If both of us didn't feel it, then it's a no go." Unanimity among the founders did the work that a dashboard would have done in a later-stage company.
This turns a soft signal into a hard rule. A single founder's doubt can be overridden by enthusiasm. Two founders' doubt, independently felt, is data. It also protects the founding relationship. Neither man had to argue the other out of an idea, because the rule decided for them. Kramer has said that a startup's founding team must bind together the way championship teams do on the court, which requires knowing in advance how disagreements end.
Tactic: Agree with your co-founders, before you start brainstorming, that any idea which fails to excite all of you after a fixed exploration period is dead, with no appeal.
Principle 6
Converge; don't assemble
Kramer's sharpest strategic distinction is between a platform and a portfolio, and he is unsparing about it, including toward the company he helped found. A portfolio is a set of products, "built independently, acquired over time, and later brought together." A platform is "designed as a single system." His argument for the difference rests on three claims. On security: "security is a data problem," and converged data in real time, with context, beats stitched-together logs. On operations: one system is one thing to run. On agility: an enterprise that acquires a company or moves to the cloud needs infrastructure that moves at the speed of the business.
The carriers, in his account, failed because "the telcos are an integrator, and we own the IP." Palo Alto Networks, "the best portfolio company, that cyber has ever seen," is in his view on "the road to IBMization." Cato's engineering bet, a single stack delivering networking and security "in a single pass," is the founding commitment of the company, and it is what a generation of prior attempts died trying to do.
P
Portfolio vs. Platform, in Kramer's Terms
The distinction that organizes his competitive strategy at Cato.
| Dimension | Portfolio | Platform |
|---|---|---|
| Origin | Products built separately or acquired, then unified under one UI | Designed as a single system from the start |
| Security | Fragmented data across point products | Converged, real-time data with context in one data lake |
| Operations | Fewer vendors on the contract, same complexity | One system to run and update |
| Agility | Change requires re-integration | Moves at the pace of the business |
| Kramer's verdict | IBMization | The future |
Tactic: For every capability you plan to add, ask whether it shares the same data, stack, and update cycle as your core; if it doesn't, recognize that you are building a portfolio and price in the complexity.
Principle 7
Disrupt yourself through a separate vehicle
When AWS launched in 2006 and Kramer concluded that the cloud would reshape Imperva's market, he did not ask Imperva's product organization to build a cloud offering alongside its appliances. He created a subsidiary, Incapsula, "that could reinvent our value proposition around a cloud service and spun it out." In 2014 Imperva bought back the shares it did not own. The disruptive bet had had room to develop its own logic, and the parent then reclaimed it.
The structure matters as much as the bet. An existing company's incentives, sales compensation, and roadmap all defend the existing product. A separate entity with its own founders and its own cap table can be cannibalistic without asking permission. The same logic appears in Kramer's decision to make Cato's first acquisition, Aim Security in 2025, when he judged that AI was moving too fast to build for organically: "We had to accelerate our time to market." He says you must innovate "not only from a product perspective, but also in all aspects of the organization."
Tactic: When a platform shift threatens your core product, house the response in a structure with its own leadership and equity, and decide in advance the terms on which you will bring it back.
Principle 8
Invest where you have granularity
Kramer's angel record is heavily concentrated: roughly two-thirds in security by most counts, and the outsized wins are almost all there. His losses are instructive in their location. Forays into pharmaceutical and marketing applications of AI were, he says, mostly mistakes, and his diagnosis is a general law: it is "much easier to get excited about things you don't understand." Distance flatters an idea because you only see its vision. "A deep understanding of something gives you granularity."
His one major out-of-domain success proves the rule rather than breaking it. Gong was a sales tool, but Kramer evaluated it as a CEO who wanted it: "I want that as the VP of sale of my startup." His domain in that case was being the customer. His stated ideal startup is "a homegrown application that evolved from a team's need for a product." Shwed's background as a system administrator was, in his telling, Check Point's secret sauce.
Tactic: Restrict your investments, and your product bets, to domains where you have either built the thing or bought it; treat excitement about anything outside those domains as a warning sign rather than a signal.
Principle 9
Back the people you have watched work
The most valuable investment of Kramer's career was a check to a former Check Point engineer, Nir Zuk, whose company was premised on the obsolescence of Check Point's core technology. He backed LightCyber partly because he had watched Gonen Fink run product "throughout the growth years" at Check Point. He started Cato with the engineer who had built Imperva's SecureSphere platform and founded its cloud spinout. The network of Check Point alumni he financed is the closest thing Israeli security has to a dynasty.
This is not sentimental loyalty; Kramer is clear that the entrepreneur is "by far the most important" factor in any investment, "especially in cyber, where you have 10 different startups" pursuing the same idea. If ideas are commodities, the only scarce information is how a specific person behaves under pressure, and you only get that by working beside them. He reports the Israeli version of this as structural: a small community in which "everybody knows everybody" creates "a different type of bond."
Tactic: Keep a running list of the people whose work you have seen up close under pressure, and treat it as your primary deal-flow and co-founder pipeline, ahead of any cold pitch.
Principle 10
Treat "very ambitious" as a map of the graveyard
The VCs who told Kramer that Cato was "a very ambitious project" were not wrong about the history. Embedding a full security stack in the network had defeated Cisco, Juniper, and "any number of startups." Kramer's response was not to dismiss the skeptics but to study the dead. As one attendee summarized his telling: "Loads of competitors had tried and failed. He learned why and changed how they thought about security." His answer was architectural: a software-defined network had made possible what had been impossible on appliances.
The discipline is in distinguishing an impossible problem from a problem that was impossible under the old conditions. Kramer's claim, which the market has largely validated, was that a change in the substrate reopened a closed question. The VCs' phrase is still useful, because it tells you exactly which attempts to read about.
C
Cato: From "Very Ambitious" to $4.8 Billion
The funding sequence of the project investors initially declined.
2015
Founded by Kramer and Gur Shatz; $20M Series A from U.S. Venture Partners and Aspect Ventures.
2016
Official launch in February; $50M Series B in September.
2019
$55M Series C; Gartner names the SASE category.
2020
$77M Series D in April; $130M Series E in November at a valuation above $1B.
2021
$200M at a $2.5B valuation, led by Lightspeed, with Kramer participating.
2023
$238M at a valuation above $3B.
2025
$359M Series G at more than $4.8B; first acquisition, Aim Security; ARR past $350M by year-end.
Tactic: When experienced investors call your idea too ambitious, ask them to name the companies that failed at it, then write down the specific condition that killed each one and whether it still holds.
Principle 11
Decide where you will not move
Kramer's three companies trace a migration and a return. At Check Point the founders were told to hide their accents. At Imperva the CEO was required to relocate, and a 2010 offer letter formalized his "transition of employment" to California. At Cato he "vowed not to relocate" and to hire the entire senior team in Israel, at a time when that was, in his words, "a pioneering decision." He presents the outcome as vindication: "We no longer have to hide who we are."
The strategic content goes beyond patriotism. A founder who has committed to a location has committed to a talent pool, a culture, a cost structure, and a legal regime, and can build around them rather than hedge against them. It also made Kramer's stake in Israel's institutions concrete. When he judged the 2023 judicial overhaul a threat, he wrote to his employees not as a citizen but "as the CEO of Cato," because the commitment had made national politics a business variable.
Tactic: Decide explicitly, at founding, which parts of the company will never relocate, and treat that decision as an asset to be defended, including in public, rather than a constraint to be quietly worked around.
Principle 12
Escape the persona by returning to zero
Kramer's most personal piece of advice is about success rather than failure: "If you're lucky to have been successful, you have to make sure you are not frozen in that persona." The godfather, the hat-trick founder, the man with the golden touch: each label invites its owner to defend it rather than risk it. His remedy has been to start over three times, and to describe the experience in unglamorous terms: "Startups are a very human experience."
Returning to zero also explains how he handles his own reputation in the room. He disclaims being a professional VC or a professional board member, saying "my only profession is entrepreneur." He said he would step off every outside board to be "100% doing CATO." The persona brings capital and credibility. The work requires a willingness to hear "very ambitious project" and stay in the room.
Tactic: Once a year, list the beliefs about yourself that your past success makes you reluctant to test, and choose one project where you will be judged as if you had no track record.
Free playbook
Get The Business Model Playbook
58 business models, one visual page each: how the money flows, the metrics that matter, and who runs it. Free when you join the Faster Than Normal email.
Free. No spam. Unsubscribe anytime.
Part IIIQuotes and Maxims
In their words
— Shlomo Kramer, to iTnews, May 2008I really like building things. I enjoy the process of taking an idea I believe in and turning it into market reality.
— Shlomo Kramer, on LinkedIn, 2026Startups or product launches don't fail because they are late to market. They fail because they are too early.
— Shlomo Kramer, to Greylock, April 2024Startups are a very human experience. They're all about taking calculated risks. It's okay to fail as long as you learn as much as you can from that failure, and continue to have real human ambition and dreams.
— Shlomo Kramer, to SoftBank Vision Fund's Sōzō InsightsYou have to run as fast as you can just to stay in the same place.
— Shlomo Kramer, on Check Point's founding, writing for Firewall.cxBut FireWall-1 was the first firewall to make network security simple. It's the stroke of simplicity that made FireWall-1.
Maxims
- Shortage is a spec. Write down what you cannot afford and design a product that doesn't need it.
- Ship something that travels alone. If the product needs its makers to explain it, distribution will stop where the makers do.
- Early is the expensive mistake. Lateness can be fixed by iterating; earliness has to be outlasted.
- Fill the dark, then wait. Do the conscious research exhaustively, then let the decision arrive from below.
- Two doubts make a no. When co-founders independently feel nothing, the idea is dead.
- Converge, don't collect. A portfolio under one interface is still a portfolio.
- Disrupt yourself at arm's length. Give the threatening idea its own structure, its own founders, and a way back in.
- Granularity beats excitement. You get most excited about what you understand least.
- Fund the people you've seen under fire. Ideas are plentiful; firsthand knowledge of someone's character is scarce.
- Don't freeze in the persona. Success is a reputation to risk, not a monument to guard.
