Small Business Cybersecurity: What You Don't See Can Hurt You with Last Pass CEO Karim Toubba
Small Business StoriesShow Notes
S6:E76 Security is ultimately a promise of trust. So what happens when that trust gets broken? Karim Toubba has had to answer that question in circumstances few CEOs would choose. He joined LastPass as their CEO only months before the company experienced a significant and highly publicized 2022 security breach. In this candid conversation, Karim acknowledges that LastPass initially communicated too slowly and explains the systemic changes, transparency, investment and cultural work required afterward. Queue up this episode of Small Business Stories for a conversation that goes well beyond passwords. Because the threat itself is changing. Karim says AI is producing a meaningful productivity advantage for small businesses, but it is simultaneously allowing malicious websites and other threats to be generated at much greater velocity. Employees are also adopting AI applications faster than many organizations can establish policies around what data those applications should be allowed to access. If people don't trust you, reassuring them that you're trustworthy isn't enough. If customers cannot see credible evidence supporting what you say, they'll increasingly turn to third-party communities and other sources to interpret your credibility for themselves. And if inaccurate or incomplete information about your organization remains unchallenged, the external interpretation of your company can begin separating from the reality inside it. That's where Karim's cybersecurity experience intersects powerfully with Dr. LL's work on misinterpretation risk. 👤 Guest Karim Toubba CEO, LastPass Cybersecurity executive with nearly three decades of industry experience ⚠️ Core Problems Credential theft remaining a major attack vector Password fatigue and poor security habits Trust erosion after a public organizational failure Employees adopting unsanctioned SaaS and AI applications Sensitive information being uploaded into AI systems AI accelerating the volume and sophistication of malicious sites Organizations confusing a security product with a secure culture 🥡 Practical Takeaways Make security easier to practice; complexity undermines adoption. Passkeys and biometrics can reduce dependence on traditional passwords. Treat every piece of information uploaded to an outside platform as something that could potentially become exposed. Understand both what AI tools employees are using and how they're using them. Cybersecurity requires technology, investment and culture not merely software. After trust is damaged, acknowledge what went wrong and provide evidence of what changed. Participate in third-party conversations about your company rather than assuming your owned communications control the narrative. Begin thinking beyond human identity: AI agents will also require identities, permissions and access controls. ⏱️ Timestamps 03:20 Passkeys, biometrics and the future beyond passwords 08:14 Rebuilding trust after the LastPass breach 13:00 What Karim says LastPass got wrong about communication 20:03 Dr. LL's Invisibility Decoder lens and hidden digital risks 21:45 AI adoption and the new small-business security problem 23:53 AI is dramatically accelerating malicious websites 27:36 Leading a company with a perpetual target on its back 36:01 How do customers distinguish security from reassurance? 🔖 Who This Episode Is For Entrepreneurs, SMB leaders and executives trying to balance AI adoption, cybersecurity, employee behavior and customer trust without becoming paralyzed by the complexity. At STEERus, we see a related Trust Blind Spot across industries: organizations frequently assess their credibility from what they know internally while customers, search systems and AI interpret them from the evidence available externally. Trust cannot simply be asserted. The signals supporting it have to be visible, consistent and credible. Subscribe and share Small Business Stories for thoughtful conversations with leader
More from Small Business Stories
S6:E88 After nearly 450 conversations on his Leaders With a Heart podcast, Payman Lorenzo has heard extraordinary stories of leadership, adversity, failure, resilience, and reinvention. But one of his most important lessons is surprisingly basic: Listen. Really listen. Queue up this episode of Small Business Stories for a deeply human conversation about leadership, boundaries, assumptions, patience, setbacks, and why making another person feel seen and heard may be one of the most consequential things a leader can do. If people don't trust that you're listening, they stop telling you what you need to hear. If we assign motives before understanding someone's circumstances, we may react to an intention that never existed. And if leadership is built around our interpretation rather than another person's actual experience, even good intentions can produce the wrong impact. Loralyn Mears, PhD, aka "Dr. LL," brings you thoughtful conversations with entrepreneurs and small business leaders navigating visibility, leadership, and growth. Thank you for being here. 👤 Guest Payman Lorenzo Host, Leaders With a Heart Leadership, podcasting, human connection, and entrepreneurship
S6:E87 Overall, small business sales are growing. So why do so many owners still feeling the squeeze? The answer is hiding underneath the headline. Matan Bar, CEO of Xero U.S., joins Dr. LL to unpack what Xero's U.S. Small Business Insights data reveals when you look beyond one encouraging number: sales may be improving, but businesses are also contending with rising costs, longer waits for payment, geographic differences, and a financial picture that varies dramatically depending on what kind of business you actually operate. This isn't simply a conversation about accounting. It's about interpretation. If people don't trust the numbers, they can't confidently make decisions from them. If a headline accurately reports one measure while obscuring several others, the conclusion can still be wrong. And if AI can slice, summarize, and visualize enormous amounts of data, the ability to understand what that information actually means becomes more important, not less. Loralyn Mears, PhD, aka "Dr. LL," brings you thoughtful conversations with entrepreneurs and small business leaders navigating visibility, leadership, and growth. Thank you for being here. 👤 Guest Matan Bar CEO, Xero U.S. Small business technology, payments, financial operations, and AI
S6:E86 The businesses people overlook may be the ones worth examining. Especially those ew - yucky - services! Entrepreneurship culture gives enormous attention to innovation, technology, and businesses that sound impressive. Mark Regan built something very different: a recurring-revenue company around a simple problem many people do not want to solve themselves. In this episode of Small Business Stories, Mark and Dr. LL unpack what it actually takes to turn an unglamorous idea into a durable service business from pricing and route density to customer retention, franchising, and the unexpected challenge of getting AI to understand what kind of business you actually are. If people don't understand what you do, they may underestimate its value. If AI doesn't understand what you do, you may never surface when someone is looking for it. Loralyn Mears, PhD, aka "Dr. LL," brings you thoughtful conversations with entrepreneurs and small business leaders navigating visibility, leadership, and growth. Thank you for being here. 👤 Guest Mark Regan Co-founder, Poop Away Service-business operations, recurring revenue, customer retention, and franchising ⚠️ Core Problems • Looking past viable businesses because they lack status or glamour • Mistaking revenue for profitability without understanding the operating math • Getting categorized incorrectly when a business crosses traditional industry boundaries 🥡 Practical Takeaways • Start with a problem people genuinely want solved. • Recurring revenue only works when the operating economics work. • Customer trust can become a competitive advantage even in a seemingly transactional service. • In the AI-search era, business categorization is becoming part of business strategy. ⏱️ Timestamps 03:15 — "Who would pay for that?" becomes a business 07:35 — The operating mistakes Mark wishes they had avoided 11:29 — Customer service as a retention strategy 21:16 — The operator mindset required for franchising 23:27 — Misinterpretation risk meets AI search 🔖 Who This Episode Is For Entrepreneurs searching for realistic business opportunities, service-business owners trying to build recurring revenue, and founders whose businesses do not fit comfortably inside one familiar category. At STEERus, we study what happens when the value is real, but the signals people and machines use to interpret that value are not clear enough. Subscribe to Small Business Stories for more real-world conversations about what it actually takes to build, operate, and sustain a business and share this episode with an entrepreneur who may be overlooking the opportunity right in front of them. ✅ Subscribe for weekly conversations on entrepreneurship 🔁 Share this episode with someone who needs to be heard Follow STEERus on social media: YouTube: https://www.youtube.com/@DrLLSmallBusiness Instagram: https://instagram.com/steerus LinkedIn: https://www.linkedin.com/company/steerus Twitter: https://x.com/steerus_io
S6:E85 People experience your leadership long before you make a formal leadership decision. It's in how you enter a room. How you react when you're stressed. Whether you acknowledge someone. The story you tell. The difficult interaction you choose not to pass along to the next person. Lisa Even calls it the ripple effect: everything we say and do creates one, whether we're consciously choosing it or not. In this episode, Lisa and Dr. LL explore intentional leadership, workplace culture, experimentation, small moments of human connection, and why impact doesn't have to be enormous to become meaningful. If people don't trust what version of you is going to walk into the room, they start preparing for you. If employees repeatedly experience something different from the leadership values an organization claims, those interactions become more credible than the words. And if we're unaware of the signals we're continually sending, other people are left to interpret them for themselves. Loralyn Mears, PhD, aka "Dr. LL," brings you thoughtful conversations with entrepreneurs and small business leaders navigating visibility, leadership, and growth. Thank you for being here.
S6:E84 It has never been easier to look like an expert. That may be precisely why genuine expertise matters more. AI can help produce polished content, sophisticated branding, books, social posts, and an increasingly convincing professional presence. But none of those things automatically demonstrate depth, judgment, experience, or the ability to create results. In this episode, Katrena Friel, founder of Becoming the Expert, joins Dr. LL to explore the increasingly important difference between being visible and being trusted. In my opinion, Katrena is AMAZING. She speaks her truth and knows her subject. If people don't trust the evidence behind your expertise, reach alone won't create authority. If your personal brand requires you to perform someone you're not, consistency eventually becomes exhausting. And if AI makes everyone sound increasingly polished, the messy, specific, deeply human evidence of real expertise may become even more important. Loralyn Mears, PhD, aka "Dr. LL," brings you thoughtful conversations with entrepreneurs and small business leaders navigating visibility, leadership, and growth. Thank you for being here. 👤 Guest Katrena Friel Founder, Becoming the Expert Expert positioning, personal branding, business ecosystems, and entrepreneurship