Product-Market Fit in AI Security with Gidi Cohen

Gidi Cohen joins Collin Stewart on the Predictable Revenue Podcast to tell us more about his journey as a founder.

He’s the founder of Bonfy, an AI security company built around a market that was still taking shape. When he started the company, enterprise AI adoption was in its early stages, security risks were still emerging, and many buyers were still figuring out who should own the problem.

That made Bonfy’s path to product-market fit different from the usual startup playbook. Instead of validating a pain customers were already shouting about, Gidi and his co-founder had to test whether a future pain would become urgent, owned, and valuable enough to support a real market.

Their process offers a practical lesson for founders building in fast-moving categories: conviction only becomes useful when it is tested against the market.

Don’t Fall in Love With Your Idea

A strong insight is not the same thing as product-market fit.

Founders often get into trouble when they treat conviction as evidence. They see where the market is going, understand the technical shift, and can clearly imagine the product. That clarity feels like progress, but it can also become a trap.

The more exciting the idea, the easier it is to look only for confirmation.

Gidi took the opposite approach. Before building Bonfy, he and his co-founder spent months in discovery conversations with CISOs, investors, and security leaders. The goal was to pressure-test the assumptions behind the product.

A sales conversation asks, “Do you want this?” A strong discovery conversation asks, “What would make this wrong?”

Look for the Holes

Founders should be looking for the holes in their own thinking:

• Would this problem actually become urgent?
• Who would be accountable for solving it?
• Would companies pay for it, or simply absorb the risk?
• Were existing tools already close enough?
• Would the market mature fast enough to support a company?

That kind of customer discovery can feel uncomfortable because it is not designed to protect the idea. It is designed to make the idea earn its right to survive.

Customer discovery should focus on disproving your idea, not confirming it.

Validate Future Pain, Not Just Current Pain

In established markets, validation is usually anchored in current pain. Customers already know the problem, they may already be using a workaround, they may have tried competitors, and they can describe what is broken in detail.

Emerging markets are different.

When Gidi started exploring Bonfy, AI security was still in its early stages. The risk was visible, but many companies had not yet felt the full operational consequences in their day-to-day workflows.

That made validation more conceptual. Bonfy was not simply asking whether customers had the problem today. The bigger question was whether security leaders shared the same view of where AI adoption was headed.

In other words, would this become a critical problem in the next 12-24 months?

That is harder to validate because customers may agree with the thesis intellectually but be unwilling to buy. They may see the risk but lack budget, urgency, or clear ownership.

The founder’s job is to separate curiosity from urgency.

Future pain becomes more credible when multiple signs point in the same direction: the market trend is accelerating, leaders independently describe the same risk, existing tools appear insufficient, and someone within the organization is likely to be held accountable.

Emerging-market founders need enough conviction to build before demand is obvious, but enough customer validation to avoid building science fiction.

Find the Real Buyer Before You Build the Product

A problem without an owner does not create a market.

This is one of the most important lessons for founders working in new categories. A problem can be real, expensive, and strategically important, but if no one clearly owns it, the sales motion becomes messy fast.

Ownership Creates the Market

Emerging technologies often create organizational confusion. AI security could plausibly sit with security teams, IT, compliance, legal, or even with business units that adopt AI tools directly. Each group might care about part of the risk, but caring is not the same as owning.

One of Bonfy’s biggest discoveries was identifying who would ultimately own AI security initiatives.

Ownership shapes the entire go-to-market motion. If security teams were the primary buyers, the product, messaging, use cases, and sales process needed to match how security leaders think. If legal or business units owned it, the value proposition would shift.

Budget, Authority, and Accountability

Before building features, founders need to understand where budget, authority, and accountability live.

This is especially true in emerging markets, where the buyer may not yet have a mature job description for the problem. Founders need to watch how ownership is forming: who asks the hardest questions, who gets pulled into internal conversations, and who would be blamed if the risk turned into a real incident.

Those are buying signals.

Finding the problem matters. Finding the person responsible for solving it matters more.

Use Customer Conversations to Prioritize Use Cases

Founders cannot build everything, especially in a rapidly changing market.

Every Conversation Can’t Become the Roadmap

The danger in an emerging category is that every conversation can pull the roadmap in a new direction. One customer cares about governance, another about visibility, another about risk scoring or workflow automation. All of it can sound plausible while the category is still taking shape.

That does not mean all of it should be built.

Bonfy used a simple yet useful prioritization lens: which use cases do customers care about most, and which are technically achievable today?

The overlap became the roadmap.

That framework keeps product strategy grounded. Customer demand is not enough if the product cannot deliver reliably, and technical possibility is not enough if customers do not care. Product-market fit begins where those two realities meet.

This is where customer interviews become more than research. They become a forcing function for product discipline.

The point is not to collect every possible feature request. It is to understand which problems recur, which use cases create urgency, and which version of the product can deliver value now while still leaving room for the market to evolve.

In fast-moving markets, the roadmap should not be a pile of interesting ideas. It should be a record of what customers are pulling toward and what the product can credibly deliver.

Why Outbound Was Critical to Validation

Warm introductions are useful, but they can distort reality.

A founder’s network can create early conversations, especially when the market is still ambiguous. Those conversations are valuable, but they often come with context and goodwill already attached. People may take the meeting because they know the founder, trust the referrer, or want to be helpful.

Cold outbound tests something different.

Gidi personally ran thousands of outbound messages while Bonfy was still in stealth mode. The goal was not simply to sell. It was to learn whether the market cared enough to respond.

Outbound Tests Market Language

He tested different types of messaging: pain-focused, solution-focused, and personal founder-led outreach. Each version helped answer a different question.

Pain-focused messaging tested whether the problem resonated. Solution-focused messaging tested whether the proposed category made sense. Founder-led messaging tested whether the story and credibility were enough to earn a conversation.

That is what makes outbound useful for validation: it tests market language, not just demand.

If the right people ignore the message, the founder has to ask why. Is the pain not urgent? Is the buyer wrong? Is the language too early? Is the solution unclear? Is the category not understood yet?

Cold outreach creates fast feedback because the market has no obligation to be polite. Silence, replies, objections, and the words prospects use are all data.

For founders building before demand is obvious, outbound can be one of the fastest ways to test whether a thesis is becoming a market.

Product-Market Fit Feels Like Repeatability

Product-market fit is rarely a single moment. It usually starts as a pattern: similar conversations, recurring use cases, the same buyer persona, familiar objections, and repeatable reasons for buying.

That repeatability is what founders should be looking for.

For Bonfy, the turning point came when the company began to understand why customers bought, which use cases mattered most, where they beat competitors, and which ICPs responded best. The market stopped feeling like a collection of disconnected signals and started to show a pattern.

Activity Is Not Progress

Early validation can be noisy. A founder can mistake activity for progress because there are meetings, ideas, and interest. But product-market fit gets closer when the wins become explainable and repeatable.

The question becomes: can we predict who will care, why they will care, and what will move them forward?

When your thesis consistently matches customer buying behavior, you are getting close to product-market fit.

That does not mean the company is finished learning. It means the learning is becoming structured enough to build around.

Don’t Chase Every New Opportunity

Fast-moving markets create endless distractions. AI is a good example because the category keeps shifting: new tools appear, customer expectations change, risk perceptions evolve, and competitors reposition quickly. For a founder, every trend can feel like a strategic opportunity.

But chasing every opportunity is not a strategy. It is a reaction. The challenge is to stay flexible without becoming scattered.

Build Durable Capabilities

Bonfy avoided betting everything on one narrow AI security use case. Instead, the company built a platform that could support multiple evolving use cases as AI adoption changed. That gave the team room to adapt without having to rebuild the company in response to every new market signal.

In an emerging market, focus does not always mean choosing one tiny feature and ignoring everything else. It can mean building durable capabilities that let the company serve the market as it matures.

The wrong kind of focus locks the company into one assumption too early. The wrong kind of flexibility scatters the company across experiments with no center.

The better path is to anchor the product around a clear thesis, then build enough flexibility to evolve as the market reveals itself.

The Real Work Is Staying Close to the Market

Finding product-market fit in an emerging market looks different from finding it in an established one. Customers may not fully understand the problem yet, buying personas may still be unclear, and priorities may change as the category matures.

That uncertainty can make early markets exciting, but it also makes them dangerous. A founder can be right about the future and still wrong about timing, buyer, use case, or go-to-market motion.

Gidi’s approach with Bonfy was not just about believing in AI security. It was about repeatedly testing that belief against the market through customer conversations, outbound, use-case prioritization, and repeatable buying patterns.

The work is to validate the pain, find the owner, test the message, watch for repeatability, and build a product flexible enough to evolve with the market.

That is how conviction turns into something stronger: evidence.

NO TIME TO READ?