theCUBE + NYSE Wired: Zero Trust Cyber Series | Karim Toubba, Lastpass

Clips
More from theCUBE + NYSE Wired: Zero Trust Cyber Series

Karim Toubba

CEO

Kenna Security

play_circle_outline Rapid, broad AI adoption driving new security risks across organizations

play_circle_outline Browser-Embedded Vaults: Turning Password Managers into AI Visibility Platforms to Combat Shadow AI and Unmanaged Accounts

play_circle_outline Agentic/autonomous agents as future enterprise workload and security challenge

play_circle_outline Core priorities: visibility, policy, control, governance for AI use

play_circle_outline Advice for CISOs: start with authentication, access controls, and clear AI policies

Info
Transcript

Karim Toubba, Lastpass

Karim Toubba

CEO Kenna Security

In this interview from theCUBE + NYSE Wired: Cyber Security Leaders 2026, Karim Toubba, chief executive officer of LastPass, joins theCUBE + NYSE Wired's Gemma Allen to discuss how rapid AI adoption is reshaping enterprise security priorities. Toubba explains how LastPass has evolved from a password vault embedded in the browser into a platform that answers three fundamental questions about AI use: who's using it, what applications and modes they're accessing, and what they're actually doing with it. He details the rise of Shadow AI as the modern successor to... Read more

explore Keep Exploring

How is the rapid, widespread adoption of AI changing the security industry, and what risks and attack models does it introduce? add

What exactly does the company deliver for enterprise customers, and how are those offerings evolving? add

How should security/products adapt to the rise of agentic (AI) workloads—specifically, who is the agent, what work is it doing, what is it accessing, and what is it doing with AI? add

What are the primary categories of issues organizations need to address when adopting AI—particularly regarding visibility, policy, control, governance, and related security risks—and what basic steps should they take? add

What fundamental steps should an organization take to govern and secure AI usage — including managing authentication and access, inventorying AI applications (Shadow AI), and preparing policies and controls for emerging agentic systems? add

bolt Powered by CUBE AI

Karim Toubba, Lastpass

search

>> John Furrier: Palo Alto Studio connection, Silicon Valley and Wall Street. I'm John Furrier here with Dave Vellante, my co-host.

Gemma Allen

>> Welcome back to theCUBE Studio here at the New York Stock Exchange. I'm Gemma Allen with NYSE Wired and this is Cyber Security Leaders where we talk to folks who are protecting the security of the future. Joining me now is Karim Toubba, CEO of LastPass. Welcome, Karim.

Karim Toubba

>> Thank you, Gemma. Nice to be here.

Gemma Allen

>> So Karim, you've been in this industry quite a while, right? This is certainly not your first rodeo in the world of cybersecurity and identity protection. Talk me through your thoughts on this moment you're in right now and give me the breakdown on LastPass.

Karim Toubba

>> Yeah, sure. Yeah. I mean, it's certainly an interesting moment. I think, as you said, I've been in the security industry for the better part of three decades at this point, and the current moment is clearly the most interesting I've experienced so far. And that's largely been driven by all of the work that's been going on in the broader AI space and specifically given the rapid pace of adoption that we see broadly across all organizations. I think it's kind of what's defining the moment. Because the reality is, every organization across every vertical, almost across every single segment from small to medium-sized businesses, obviously all the way to large enterprise is seizing the moment to adopt AI as quickly as possible in many cases to really maximize the productivity gains and gain an edge wherever they can against competitors in the market. And so the pace of adoption, I think the industry understands we've never really seen anything get adopted this broadly and this quickly across so many areas of the market. And so with that comes a number of risks, because it's really kind of fascinating to watch the infrastructure of artificial intelligence, not just at the data center and the compute level, but even the models on top of that and the applications on top of that and the skillset to deploy AI is being developed in near real time. That's the pace of innovation that's driving it. And oftentimes, ironically, it's actually being driven by AI. And so you have a security industry that was kind of sitting to the side and then about 18 months ago really started to understand this. And we all very, very quickly began to start to evaluate, number one, what are going to be the risks and the attack models into artificial intelligence? How do we surface them and protect against them? But also, how do we understand AI utilization? Because as we've known for decades in cyber, it's hard to protect what you can't see.

Gemma Allen

>> And as it relates to LastPass, what is this specific product to tech stack here? What is it exactly that you deliver for enterprise, and how is that evolving?

Karim Toubba

>> Yeah, yeah. It's evolving rapidly like everything else is nowadays to keep pace with what's going on. So LastPass historically was in the password management space for enterprises, small to medium-sized businesses and even consumers. And what we had built was a vault embedded in the browser deployed in the form of an extension where we would store credentials. More often than not, those credentials were really kind of the keys to the kingdom for most businesses. We then extended beyond that probably about two years ago, started building a number of technologies. And what we realized early on was that we're deployed in the browser, so we see a lot of the web flow traffic so we can see everything. And so, one of the first things we did last year, about a year ago, we launched a new set of capabilities that would give you full visibility into all applications that users are using through the browser. Now, we initially started with all SaaS applications, but then quickly evolved that into AI applications. That was the first place where we started to see huge AI adoption and growth. So think of this as the modern day version of Shadow IT, now obviously routinely known as Shadow AI, where people would sign up for accounts through the LLM models and then would open up a browser and then that extended to the desktop. And so what we build was a series of capabilities to begin to really drive and answer three really basic fundamental questions. Who's using AI and what accounts are they using? Are they actually using a corporate account like karim@lastpass.com or a personal account like a Gmail account? That matters a lot, because when you log in to something like Anthropic or Claude with a corporate account, typically, you have corporate agreements where the models don't use any data that's uploaded to train the model from a governance and privacy perspective. Versus when I log in with a personal account, that benefit is not available to me. So we answer who's logging in. Number two, we answer what AI is actually being used and what modes. Are they doing it through the browser or are they doing it as an extension? Or in the future, are they doing it through the desktop like Cowork in a fit client on the desktop? And then number three, what are they doing with AI? Are they simply prompting? Are they actually cut and pasting data? Are they uploading data? Are they getting large datasets that are returned based on a particular prompt? And so understanding all those nuances is extremely important to understand for where the users are today. A lot of the future, obviously, is about agentic. So today, the workloads that we protect are effectively user-based is the best way to say it, but obviously, the industry is moving extremely fast. So the employee of the future are not just humans, but they're also agents. So it's really beginning to adopt and scale the model to understand whether it's a reactive agent, a proactive agent or a semi-autonomous agent. How do you answer those three fundamental question? Who's the agent and what work is it doing? What is it accessing and what is it actually doing with artificial intelligence?

Gemma Allen

>> It's interesting you mentioned at the beginning that you guys have both a consumer customer base and an enterprise customer base, right? And in some respects in the world of cyber, those two product and feature trajectories have somewhat grown up a little bit separately, right? But Shadow AI brings that problem together in somewhat of a unique way. So do you anticipate that whatever features and solutions solve for the cybersecurity challenge of 2030 will solve for both? Or do you see a world whereby these two problems and these two kind of risk factors will continue to be seen as separate tracks?

Karim Toubba

>> Yeah. I mean, look, I think I would say about 10 to 12 years ago, I think there was a great term that was referred to about the consumerization of IT and security, which is this idea that users inside of the enterprise started to see interfaces that were more common with what they experienced on standard platforms as a consumer. And so I think that has taken hold through to today with AI. In many ways, when I sign up for something like Claude as a consumer or as a business user, even though I get only a subset of the features, the primary chat interface is identical. And I think most companies understand that they want that commonality of feel and experience across the board. But to directly answer your question in terms of whether or not we'll build something for the future that has a similar set of capabilities, the answer to that is obviously no. There's a much richer subset of capabilities that are required within the business environment that are typically not adopted by users, largely because organizations are oftentimes under an entirely different attack vector than consumers. But also, I would say there's a large set of requirements around compliance and policy and regulatory requirements and security structures that have to be built into organizational grade products that typically don't always see the light of day in consumer land.

Gemma Allen

>> So at this moment we're in right now, when you are assessing this landscape and building solutions, what sorts of threats and exposures are you building to protect against? What are you seeing? You mentioned Shadow AI. We know that's a large challenge, right? Folks are increasingly using these LLMs at home, et cetera, but what other sorts of risks are you seeing that are perhaps less well-known?

Karim Toubba

>> Yeah. Well, I would categorize the type of challenges we see most organizations face. By the way, what's really fascinating about what's going on in the industry as a whole is I've never been in a situation where what we're going through is what our customers are going through. If you look at LastPass, we started rapid pace adoption of artificial intelligence across different aspects of our organization, call it just about a year ago, I'll say, in a serious manner where we made meaningful investments. And in many ways, what we're going through actually parallels and mirrors what our customers are going through. So it's kind of fascinating and, in some ways, ironic to see the parallels between those two paths. So I'll give you my point of view, but also in terms of what we're seeing, but also the reflection of what I hear about from customers as well. And I would say the categories can be put into two general areas or general buckets. The first is really around visibility, policy, control, and governance. These aren't attacks per se like an attacker is doing something specifically to exploit the usage of AI. This is really around understanding, especially in an environment where rapid pace adoption is so significant and so fast, trying to understand how do I get a hold of the real estate that I'm dealing with uniformly in a way that makes sense for me as an organization so then I can begin to define what acceptable policy is. And then on top of that, start to understand what attacks are coming in through the channels that I am allowing so that I can detect and protect against them. And so a lot of that right now, we see many organizations, I would say, struggling with just the basics. How am I using AI? How are my employees using AI? Are they using it through the browser? Are they using it through an extension? Are they using it through a desktop? Are they using skills? Are they beginning to incorporate agentic workflows? What do those agentic workflows look like? And then the corollary to that is, how do I put structure in place once I understand the utilization that is then correspondingly tied to policy so that organizations can deploy the associated policy of what's permitted and what's not? Think of this as the basic authentication and authorization world into AI. So that's one area you want to protect against first. The second area is really around a whole host of attacks. So there are things that we are starting to see, even though it's early like data corruption, basically corrupt data that attackers insert that feeds the model, prompt injection, which is malicious instructions embedded in the actual prompts themselves. And of course, things like jailbreaking where they bypass the safety guardrails that organizations put in place. We're at the very beginning of the journey and we're just starting to see some of those attacks manifest themselves both against the LLMs but also against the organization directly.

Gemma Allen

>> It's interesting, because you set out an important scene there, saying that there is a maturity level here that needs to be met. Some folks are still trying to figure out the pre-AI landscape of security and now there's these huge pressures. We get great, I guess you could call it was an excellent marketing narrative from Anthropic with Mythos for sure, because suddenly everybody is terrified. And we all think that this dystopian future is happening much sooner rather than later. But the reality is, there's still a lot to be done to get to this zero trust place. And if you were a CISO and any large enterprise, Karim, or you're talking to one, what are the fundamental steps do you believe that need to happen immediately versus the world of quantum encryption and all these other crazy theoretical themes that we hear about that just seem like so non-plausible at this moment?

Karim Toubba

>> Yeah. I mean, look, you're right about maturity. I think what we see and what we typically advise is start with the fundamental basics, which has been kind of tried, true, and tested for many years in cyber, even though we're at a position or at a point in time where the pace is just torrid right now. And what does that mean? It means that, first and foremost, you have to understand authentication and access structures into AI. So who is using AI is kind of first and foremost, and what accounts are they logging into? As we said earlier, number two, that boils all the way to the top in terms of the fundamental structure that you want to put in place is what AI applications are they using. More often than not, we will see so much once you start to understand and get your hands around Shadow AI, you start to see so many applications, much like you did in Shadow IT, although you see it at a much faster clip now. What you have to work with and more importantly, what you should and should not allow access to. And then thirdly, put a policy in place that very clearly stipulates what users should be doing and can be doing with AI, especially as you map your journey to agentic. The sooner you put in that structure, the quicker you can adopt capabilities to really start to manage things like agent harnesses. Because in many organizations, there are early pilots. And in a few cases, they're starting to deploy it and we're starting to see agentic really start to take hold in certain companies, because again, everybody sees the promise and no one wants to be left behind.

Gemma Allen

>> Another space that's had a big fast rise too is this autonomous agent space, OpenClaw, NemoClaw. Those developments are happening quite rapidly. There is also a level of inertia around what would that actually look like at enterprise level, but also how are security companies and cyber companies like yours actually using AI in their own R&D process? How is it kind of poacher-turned-gamekeeper approach or risk? How likely is that risk? I'd love to understand how do you guys use it in a sensical way?

Karim Toubba

>> Yeah, it's a great question. It's back to the point I made earlier about the irony. In many ways, we are our own customer. We see the rapid pace of adoption we've implemented internally. Now, we've gone out of our way to deploy a number of controls and we were very, very aggressive in being incredibly clear about what our utilization policy looks like. And we felt like in some organizations I see that define that later because AI is already let in the door. We were very tight about letting AI in initially until we developed a policy. So in some ways, we were a little bit late, I would say probably about a quarter or two, but we felt we needed to get the security posture right for AI internally. 9 to 12 months later now, we are pretty broad-based adopters of AI in multiple ways. It's interesting you mentioned R&D. So we've been R&D users of AI within R&D for a couple of quarters now. That's always the poster child, if you will, of initial artificial intelligence development, especially for organizations, because they use it as a mechanism to actually deploy more rapid capabilities from a development perspective. But interestingly, we've deployed it across multiple functional areas, including customer support to create better customer experiences. We used it within our product organization to converge the product development lifecycle and be more precise about UX testing, and be more precise about feature requirements and do so at a faster pace. We have deployed it within our sales organizations to help our reps actually be more ready contextually for conversations with customers so that they can put themselves in the shoes of the customers and understand some of the challenges that they may have. And, of course, we've used it in marketing to do better analytics and, of course, better targeting. And so the promise is not just within R&D, it's kind of broad-based and it's kind of fascinating to watch what type of return that will yield.

Gemma Allen

>> So Karim, last question to you. What is ahead for you and the team at LastPass? But with a specific caveat, we know that the space of cybersecurity has been somewhat fragmented for quite a while. There is a belief by some, whether true or not, that there will be some sort of convergence. How do you think about this from the perspective of staying competitive five years from now? When you talk to your team, what is it that you say to motivate, I guess, and inspire where this kind of roadmap is going in an industry that's changing so rapidly?

Karim Toubba

>> Yeah. Well, it's actually a great question. I think one of the things that has become very, very clear is speed has become a much more important attribute to an organization than I've ever seen in my career. I mean, that is clearly obvious and that's not just because you're attempting to keep up with the competitive landscape or the adversary. Because remember, those of us who grew up in the security space always had this almost symbiotic but speed relationship with adversaries. We would always try to stay one step ahead of them. They would leapfrog against us and we would sort of come back. And so we've kind of been used to operating at that pace. So the AI adoption within security companies requires more speed, but just as importantly, keeping up with the pace of innovation and the commensurate potential attack in the LLM models and then the utilization of AI is even more so. So I think speed is kind of the new currency, if you will, is probably the best way to say it. And that means you have to be comfortable with getting some things right, making some bets early and then calling a win a win and calling a fail a fail and then pivoting, but you're going to have to make some bets. And it's certainly one of the areas that we feel very, very passionately about. But as it relates to the future, I don't really have a challenge keeping my team motivated, because I think we all collectively see many of us have worked for a couple of decades at least. This is kind of one of the most interesting times you've ever been in. I mean, if you're a technologist at heart and you love innovation, it is impossible not to be incredibly excited and optimistic about the future and what the potential holds. And for us specifically, we started down this journey about 12, 15 months ago leveraging the footprint that we had across millions and millions of business users to really take the footprint that we have in the browser and enable it for AI visibility, control, and security. And now, we're building a bunch of capabilities to do the same thing for the future employee, which is in many ways agentic. And so we are incredibly excited. It's a torrid pace and certainly for the next couple of years, I don't think we see much of a relaxation of that pace at all.

Gemma Allen

>> Well, Karim, it's certainly a very exciting time and a very important time for companies like yours to ensure that whatever this future looks like and where this world takes us, it does in a protective fashion. So thank you so much for joining us on theCUBE.

Karim Toubba

>> Yeah. Good to see you. Thank you so much, Gemma.

Gemma Allen

>> I'm Gemma Allen coming to you from theCUBE Studio here at the NYSE. This is Cyber Security Leaders, one of our programs with NYSE Wired. Thanks for watching.