The cloud promised speed, scale, and efficiency.
What it didn’t promise — but absolutely delivered — is complexity. And inside that complexity hide the blind spots that attackers love more than anything else.
Most companies think they’re secure.
They have a CSPM. They have a CNAPP. They follow compliance.
Their dashboards are green.
And yet, they still get hacked.
In this episode of Scaling Cyber, we sat down with Kennedy Torkura and Nils Karn from Mitigant, a Berlin-based startup built around a simple, uncomfortable truth:
Security tools often overestimate how safe you really are.
Mitigant exists to validate whether they’re actually working.
🎧 Listen to the full conversation on Scaling Cyber: YouTube | Spotify | Apple Podcasts
From Academia to Builders: How Mitigant Was Born
Mitigant wasn’t born in a boardroom.
It started inside the Hasso Plattner Institute, one of Germany’s most respected engineering and tech research centers.
Kennedy and his co-founders spent years researching security chaos engineering, cloud risk modeling, and adversarial testing. Nils approached the space through a different lens: understanding how sensitive data, especially in education systems, required real-proof security, not assumptions.
When they compared their findings with what real companies were doing, the gap was striking:
What companies should be doing in the cloud versus what they actually do was nowhere close.
That gap became their mission.
Why the Cloud Is Full of Blind Spots
Cloud security today is dominated by CSPMs and CNAPPs. Powerful tools, but limited by their perspective. They analyze configurations. They enforce policies. They show you a static picture.
What they don’t do is test whether their findings hold up in reality.
As Kennedy put it:
“Defenders remain biased by their own systems. Attackers aren’t.
Their job is to find the gaps — the things you never thought about.”
Mitigant flips the model:
Instead of asking “Are we compliant?”
They ask: “If an attacker tried today, would they succeed?”
This shift in mindset — from defensive to adversarial — is what they call Cloud Attack Emulation, a category they had to create because nothing in the market truly fit what they were doing.
Continuous Cloud Attack Emulation: More Than BAS, More Than CNAPP
Mitigant performs continuous, automated attack scenarios inside your cloud or Kubernetes environment. Safely and in controlled conditions.
It’s not BAS.
It’s not CSPM.
It’s not red teaming.
It’s the glue between them, validating all of them.
Think of it as the missing half of your cloud security program:
* CSPM tells you what looks wrong.
* Mitigant tells you if attackers can actually exploit it.
* CNAPP shows potential attack paths.
* Mitigant tests if those paths are real and whether detection works.
* Your SOC thinks alerts are configured correctly.
* Mitigant proves whether the alert actually fires.
The term the founders love is “assumed breach mentality.”
Nils described it well:
“German companies especially think: ‘We have processes, we have guardrails, nothing can go wrong.’
And then you run our tests… and four or five attacks still make it through.”
Why European Enterprises Take So Long to Try New Security Tech
This episode also highlights a huge difference between the US and Europe.
In the US:
Companies buy the vision, try it fast, measure, and move on.
In Europe:
Companies want proof: upfront, extensive, and from multiple stakeholders.
Mitigant learned this early.
They didn’t want to run POCs at first, but it became unavoidable.
A German company buying a new security tool usually means:
* 3–6 month POC
* 12 months buying process
* Multiple internal stakeholders
* A long chain of technical validation
As Nils put it bluntly:
“German companies invest billions into cybersecurity —
but almost zero into cybersecurity startups.”
Yet Mitigant found its momentum anyway.
Scaling From Berlin: Japan, the Gulf, and What Comes Next
One of the most surprising decisions in Mitigant’s growth has been their choice of expansion markets.
Instead of jumping straight to the US, they went to:
* Japan, partnering with Future Spirits
* The Gulf region, especially around emerging AI security initiatives
Why Japan?
Quality. Detail. Service-oriented thinking.
It mirrors German engineering culture.
Why the Gulf?
A race to build the world’s fastest AI-driven digital economies — with massive investments in cloud, new datacenters, and AI safety.
Mitigant’s continuous validation fits perfectly into both worlds.
AI Attack Emulation: The Next Frontier
Perhaps the most exciting part: Mitigant is now applying its methodology to AI systems.
As companies deploy LLMs, fine-tune models, or adopt managed AI services like Amazon Bedrock, new vulnerabilities emerge:
* Data poisoning
* Prompt manipulation
* Unauthorized model access
* Data exfiltration through AI workflows
Most AI security tools claim full visibility.
But as Kennedy explains, the gap between marketing claims and technical reality is… big.
Mitigant is injecting adversarial tests directly into AI pipelines — bringing “assumed breach” into the world of machine learning.
What Success Looks Like for Mitigant
The next year is all about:
* Growing their enterprise customer base
* Solidifying their category
* Deepening AI security capabilities
* Strengthening partnerships (MSPs, global integrators, cloud-native consultancies)
* And getting Series A ready
Their biggest technical ambition?
Building an offensive security IDE: a platform where companies can craft their own cloud or AI attack scenarios with ease.
Democratized red teaming, continuous validation, real-world resilience.
Key Takeaways for Cyber Founders & Leaders
1. Tools don’t guarantee security — validation does.
Dashboards lie. Adversaries don’t.
2. Blind spots grow in complexity.
Cloud, Kubernetes, microservices, and AI multiply attack surfaces.
3. Europe’s GTM path is longer — but not impossible.
Mitigant is proving cyber companies can scale from the DACH region.
4. Assumed breach is not a slogan — it’s a mindset shift.
Real security leaders think like attackers, not auditors.
5. AI security will be the next great frontier.
And the winners will be those who treat AI like a dynamic system, not a static asset.
About the Episode
This interview is part of Season 1 of Scaling Cyber — the show spotlighting cybersecurity founders and innovators outside the US and Israel, where global growth stories often go untold.
Host: Ignacio Sbampato — cybersecurity executive and founder of BridgerWise
Guests: Kennedy Torkura & Nils Karn — Co-Founders of Mitigant
This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit scalingcyber.substack.com
