IT Tech Pulse Exclusive Interview with Elad Schulman, CEO & Co-Founder at Lasso Security

Elad Schulman, Co-Founder and CEO of Lasso Security, shares insights on GenAI security, intent-based protection, and securing autonomous AI agents at scale.

Share key milestones from your 25+ years in cybersecurity, from software development at HP/SAP, co-founding Segasec (acquired by Mimecast), to launching Lasso Security amid the GenAI boom.      

I’ve spent 25 years on the vendor side of software and cybersecurity, and the common thread has always been solving problems where the existing tools weren’t enough. I started my career at Mercury, which was later acquired by HP, and then moved to OpTier, which was acquired by SAP. That’s where I met my co-founder, Lior Ziv, and we realized we worked well together under pressure.

In 2017, Gad Akoka and I co-founded Segasec, a digital threat protection and anti-phishing company. We built it from scratch and were successfully acquired by Mimecast in early 2020 for $50 million, which was meaningful given we’d only raised a few million.

After Mimecast, I spent time angel investing and mentoring early-stage startups. Then, in late 2022, watching enterprises rush to adopt LLMs without any purpose-built security layer, Ophir and I saw the same pattern we’d seen before: a massive adoption wave outpacing the security infrastructure. We founded Lasso Security in June 2023 to close that gap.

Read More: ITTech Pulse Exclusive Interview with Eric Schwake, CISSP, Director of Cybersecurity Strategy at Salt Security

What specialized expertise does Lasso bring to securing LLMs and agentic AI, differentiating from traditional cybersecurity in addressing data leakage, shadow AI, and prompt injection risks?

Traditional security tools were designed for a world of deterministic applications, firewalls, endpoint detection, DLP scanning for keywords and regex patterns. But LLMs and AI agents are non-deterministic. The same input can produce entirely different outputs depending on context, and the same content can be benign or malicious depending on intent. That’s the fundamental gap.

Lasso was built from the ground up for this reality. We don’t bolt AI security onto legacy infrastructure; we analyze the behavioral intent behind every AI interaction. For data leakage, that means understanding whether an employee is using an AI tool within their authorized scope or inadvertently exposing sensitive data. For shadow AI, it means giving security teams visibility into which tools are actually being used, by whom, and for what purpose. For prompt injection, it means going beyond pattern-matching to decode the semantic meaning behind requests, detecting hidden malicious commands that techniques like obfuscation and payload splitting are designed to conceal.

We do all of this at sub-50ms latency with 99.83% detection accuracy, so security never becomes a bottleneck for the business. That combination of intent-level analysis and real-time performance is what separates us from both legacy tools and other AI security entrants.

Building on ITTech Pulse’s article about Intent Deputy’s launch, how does it enable safe AI agent deployments for enterprises grappling with 2026’s exploding GenAI attack surface?

The shift from chatbots to autonomous AI agents changes the security equation entirely. Chatbots are stateless: text in, text out. Agents are stateful; they reason, plan, access sensitive data, call APIs, and execute multi-step workflows on a user’s behalf. That creates what we call the “Dangerous State”: agents operating with untrustworthy input, sensitive access, and stateful autonomy simultaneously.

Intent Deputy addresses this by shifting from content scanning to behavioral intent analysis. Instead of asking “what is the AI saying?” it asks “what is the AI doing, and why?” It creates behavioral baselines, essentially fingerprints, for both users and agents, enabling real-time anomaly detection. A marketing agent that suddenly starts generating code. That’s scope drift. A customer service agent making a sequence of seemingly benign requests that together constitute data exfiltration. Intent Deputy catches that because it tracks the full session history, not just individual prompts.

And it provides explainable compliance, human-readable evidence that an agent operated within its authorized scope. That’s increasingly critical as regulators begin scrutinizing how enterprises govern their AI systems.

We’ve reviewed Lasso’s stealth emergence, your SANS profile, and prior Segasec success – how do these inform Intent Deputy’s model-agnostic approach to human/non-human AI interactions?

Every company I’ve built has followed the same principle: the security layer should be independent of the vendor it’s protecting. At Segasec, we protected brands regardless of which email provider or web infrastructure they used. At Lasso, we took the same approach. Intent Deputy works across any LLM or AI agent framework, whether it’s OpenAI, Anthropic, Google, or custom models.

Being model-agnostic is essential because enterprises don’t standardize on one model. They’re running different LLMs for different use cases, deploying agents through multiple frameworks, and the landscape changes quarterly. If your security is tied to one model provider, you’ve built a point solution, not a platform.

The SANS engagement has been valuable for contributing to the industry’s understanding of AI security threats.

Read More: ITTech Pulse Exclusive Interview with Mark Wojtasiak is SVP of Product Research and Strategy at Vectra AI

What are your top predictions for 2026 in GenAI security, like AI-orchestrated attacks, regulatory mandates for LLM governance, or quantum-safe encryption, and Lasso’s leadership role?

First, AI agent compromises will become the new headline breaches. We’re already seeing the early signals. Tools like OpenClaw give employees significant autonomy, but misconfigurations or malicious activity can expose credentials, local files, and connected services. As agent adoption scales, so does the blast radius. Prohibition isn’t viable; the path forward is intelligent governance.

Second, regulators will move from AI ethics frameworks to enforceable AI security mandates. The compliance conversation is shifting from “do you have an AI policy?” to “can you prove your agents operated within scope?” Enterprises that can’t generate audit trails for AI behavior will face real consequences.

Third, the “intent gap” will emerge as the defining security challenge. As agents become more sophisticated, the gap between what content-scanning tools can detect and what intent-aware systems can catch will widen dramatically. Organizations relying on legacy approaches will find themselves increasingly exposed to threats that are invisible to their existing stack. That’s exactly where Lasso sits; we’re defining and closing that gap with Intent Security.

Can you highlight real-world ROI from Lasso/Intent Deputy, such as compliance wins, threat mitigation rates, or TCO reductions in regulated industries like finance or healthcare?​

The most tangible ROI our customers see is the ability to deploy AI at scale without having to choose between security and performance. Our platform delivers 99.83% threat-detection accuracy with sub-50ms latency, which is 570 times more cost-effective than comparable cloud-native guardrail approaches. That means security teams aren’t creating bottlenecks for the business.

In regulated industries, the compliance dimension is equally important. The ability to generate explainable audit trails showing that AI agents operated within authorized scope is becoming a hard requirement rather than a nice-to-have.

How does Lasso help enterprises balance GenAI innovation speed with security, avoiding ‘security as an afterthought’ while scaling tools like custom agents responsibly?

The biggest mistake enterprises make is treating AI security as a gate, something that says “no” and slows innovation. That approach fails because it incentivizes the use of shadow AI. Employees adopt tools because they make them more productive, and if security blocks access, they’ll find workarounds. We saw this with cloud adoption a decade ago, and we’re seeing the same dynamic now.

Lasso takes the opposite approach. We enable adoption by making it safe. Our platform gives security teams real-time visibility and control without degrading the end-user experience. When you’re blocking threats in under 50 milliseconds, the user doesn’t even notice the security layer exists.

The key architectural decision is where security sits. Legacy tools try to inspect at the perimeter; they scan prompts and outputs like a firewall. Intent Deputy sits between intent and infrastructure, continuously evaluating context throughout the interaction lifecycle. That means you can enforce policies dynamically rather than with blanket rules, allowing different teams and use cases to have appropriate levels of autonomy while maintaining guardrails.

How will Lasso evolve Intent Deputy with agentic AI advancements, edge deployments, or integrations to dominate the LLM security market like Wiz in cloud?

The Wiz comparison is one we take seriously, not because we’re trying to replicate their playbook, but because the market dynamics are similar. Cloud security went from a niche concern to a board-level priority in a few years. AI security is on the same trajectory, and the companies that define the category will lead it.

For Intent Deputy, the roadmap centers on three areas. First, deepening multi-agent analysis: as enterprises deploy chains of agents that interact with one another, the ability to track how intent transforms and potentially corrupts through complex workflows becomes critical. Second, expanding our integration surface to meet enterprises wherever they build and deploy agents. Third, continuing to advance our behavioral baseline intelligence so the system gets smarter with every interaction it monitors.

What I’m most excited about is that we’re defining a category, not just building a product. Intent Security, as a concept, will outlast any single feature release. The shift from content scanning to behavioral intent analysis is permanent, and we intend to lead it.

Thank you, Elad, for taking the time to share your insights with us.

Write to us [⁠wasim.a@demandmediaagency.com] to learn more about our exclusive editorial packages and programmes.