Marco Muto on KnowBe4’s Digital Workforce Security Strategy | KB4-CON 2026

Hey everyone, welcome back to our coverage for KB4CON here in Orlando. Continuing what's been a great day of interviews, my next guest is Marco Muto, and Marco is the SVP of Strategy for KnowBe4. Hey Marco, welcome to Techstrong TV.

It's great to have you on here. Thanks so much, Alan. I really appreciate the opportunity.

Absolutely. So, Marco, let's talk about you to start. You're SVP of Strategy, as I said.

How long have you been in that role? And give us an idea of leading up to that role, kind of where you've been, what you've done. Absolutely.

I have one of those weird resume journeys. Been in the business with KnowBe4 for about a year and two or three months or so. My journey's been interesting.

I spent about 15 years, first half of my journey, in startups, helping them scale, getting them to exit. 2013, I started my own business in the security space. Oh, very cool.

So I started a security monitoring business. We were one of the first cloud-based SIM tools that were out there. Mm-hmm.

And we had a successful exit to SolarWinds in 2018. Oh, very cool. And I sat around, and we built out a biz dev function over there, a corp dev function, and a strategy function.

Got to spin out a business unit, got to IPO, and have all of that fun. And then I came over to KnowBe4 back in early 2025. Love it.

That's a great story, man. We'll talk offline more about it. But you came to KnowBe4 at a very interesting time, right?

I mean, KnowBe4, a well-known quantity in the security training, security awareness space. But the world's changed, and KnowBe4's changed with it. And as a result, I spoke about it with Brian Palmer, the CEO, earlier.

There's a whole different strategy, not different, but an expanded strategy, an expanded vision of what the mission is. I got to imagine, as SVP of strategy, you've got a lot to do with that. I have a fun job, Alan.

Yeah. I really do. KnowBe4 is one of the most well-known brands in the security space.

We have such tremendous user affinity, down to the individual layer. We were originally this SAT company, or security awareness training- Mm-hmm ... that then turned into what was called human risk management, right?

So it's about making sure that you and I, sort of the dopiest part of the equation, making sure that we're always covered. The world has changed pretty rapidly, as you know. " We came up with this concept of digital workforce security, because as the modern workforce has changed, it's no longer just about the human.

It's all of these digital identities, alongside of the agents running these autonomous workflows and things like that. Brian talked about it on stage. We've got over 400 agents in our business operating right now.

Yeah. What systems are they touching? What are they performing?

Who are they operating on behalf of? So it's a really interesting time to be in the business right now. The pace of change is immense, but it's incredible how much this community and the ecosystem's come together to focus on this concept of digital workforce security.

Absolutely. I can't agree more with you. I guess my question for you, though, is, is this tangential?

Is it out here, right? How do you leverage all of the great assets of KnowBe4 as you enter this next era of agentic, or digital workforce, as you call it? It's adjacent.

Right? So if you look at our platform, what once was, again, just the security awareness training platform, is now just the KnowBe4 platform. We have attack simulation and training as one pillar.

We have collaboration security as another pillar. And we have this third pillar now, which is agent risk or agent management, and that includes all of that agentic management capability as part of that digital workforce. So, it's adjacent in that it's touching all the things that we have in the lineup before that.

What it looks like tomorrow, Alan, as you and I both know how fast this is moving, who knows? You're right. Who does?

I asked Brian a similar question. If he was sitting here at KB4CON 2027 and you look back, would you be surprised, right? Who knows?

Who knows? Who knows is the answer. But clearly, look, the train's left the station, and either you ride that train, or you get run over by that train, or you could stay at the station, right?

Which is no fun either. It's one thing to set a vision. It's another thing to execute, as you, I'm sure, are well aware.

So how does KnowBe4 execute on this vision now? Yeah. So I was just talking to partners earlier in a partner AMA, and I mentioned then this concept with myself where I said, "Am I reaching an age where I'm struggling to keep up?

The pace of change is so rapid. Or is it me," right? And what I realized is, it's really just the pace of change.

We have this concept internally within the business. We set out this corporate strategy that says who we are as a business and who we are to our customers, and what are the things that we're focusing on. And then we have imperatives around that corporate strategy.

This way, we can align 2,000 people around the same goal. This is where we're headed. This is how we're going to do it.

And then each function and department can get behind that. That concept of being able to then execute on that is making sure that everybody, one, understands what that vision is, understanding what the strategy is, and how we need to get there. There's two schools of thought here, Alan, as you know.

You just said it, right? Those who are going to come along for the ride, and those who are going to be left at the station. Yep.

And the pace at which people are being left at the station today is exponential to what it was even yesterday, right? But I think it's minuscule to what it's going to be tomorrow. I agree.

Just look at what's happened since November with all of the Claude capabilities that have come out. I've changed my work every day just around that in the past six months. Yeah.

So who knows what it's going to be, like you said. We're sitting here, 2027Couldn't tell you. I know.

I think November was a watershed, especially for software development. I think March was the watershed for security. Absolutely.

With Mythos and everything that's come out since then. I think fundamentally, we've changed what AppSec is. AppSec used to be about finding vulnerabilities.

Yeah. We now have to focus on fixing them, protecting them, shielding them, whatever you want to call it. So it's just a whole thing.

But there's another fundamental. You mentioned 400 agents. Brian gave me the numbers.

Is it 2,400 people? Yeah. So 400 agents to 2,400 people, that's one sixth.

He says he's not surprised if you'll see 1,000 agents by the end of this year. For KnowBe4 alone. I wouldn't be surprised.

We're still piloting all the capabilities internally, so it's really a select list of folks who are using it. So we can see, to your point around the AppSec concerns and the capabilities that are out there, I wouldn't be surprised if we even saw more than 1,000 as soon as we start to unleash this thing. But the one thing I will say, Alan, is what's critical at this juncture, especially in cybersecurity, I think you said it, you've been in this space for decades.

What's critical now more than ever is the ecosystem of partners who are working together to make sure that we've got the common goal in place. Because I don't believe anymore that each company is going to have their own platform. All of our platforms together are going to become the infrastructure of the future.

Right. com. And I think that's exactly what you're seeing there, is this is so much bigger than any one, and I don't care how big the company is.

From the biggest tech companies down, no one company is going to own this whole thing. It's just that big. That big.

But it's going to take a village. It's going to take an ecosystem. " But you definitely need that ecosystem.

Absolutely. I think the other kind of realization you got to come to is that when we talk about workforce, and workforce is something that was really important to KnowBe4, right? That was your bread and butter.

When we talk about workforce, it's no longer just humans, right? It's humans alongside of agents. That's the modern workforce.

It is. I look at the work that I do, we look at competition and what they're doing, and the amount of work that I can just send my agent to go do that used to take a team of people to operate, that agent is now part of my workforce. Yeah.

The scary part about it is, it's going and doing stuff without me knowing about it. Yeah, it's going to give me that output, but where is it touching? What is it doing?

That's why we need things like, we've got an agent risk manager. Yeah. You just hit the nail on the head here, though, is it's all fine and dandy until the agent does something that is a security risk.

That's right. And then it's no joke. And I think it wouldn't be the first time we dove into the pool before we asked if there was water in it.

Absolutely. And that's the scary part of this, right? I think we're all enamored with the gee whiz wow of what agentics and AI does.

Taking the time to say, "Wait a second, maybe we need to put some guardrails up here. " As I said before, that train left the station. It left.

It did. But I will tell you this, Alan. This is where I think KnowBe4 specifically in this space is uniquely positioned.

We've been training humans for 15 years. We've got 15 years of proprietary data around how humans interact when they have a certain set of circumstances, and training and simulations occur. We're applying that same data to the capability to train these agents to make sure that they're operating within the bounds.

Of course, there's going to be outlier situations, and there's a lot of unknowns. No doubt. But we've got a good foundation of bedrock to work with.

Yeah. We spoke about velocity, speed of change and everything. How does KnowBe4 keep up with that velocity to make sure the information we're providing people is kind of up...

I used to say up to the minute. It's up to the second now. Up to the second.

Yeah. It sure is. Look, we've got a fantastic executive team who's leading this business.

We've got great support with Vista Equity, of course. We listen to our customers and our partner ecosystems. We've got a phenomenal channel of partners who are out there.

" We're making sure that every piece of new information that comes our way, specifically around agentic capability, we're taking it very seriously. We're testing it, and we're applying it, seeing how it can benefit us and our customers. I love it.

As the strategy guy, what's next? What's next as the strategy? Yeah.

That's always the question, right? I think for us, we really want to make sure that we can see how agent risk management can really be the next thing for our customers to ensure that this digital workforce is secure for our customers. We're going to keep track on how agentic technologies are constantly evolving and moving, because as you know, what was cool today might not be the best model tomorrow.

And that next model that comes out tomorrow might be the next and greatest thing. We're going to keep track on that, and we're going to make sure we're protecting our customers. You got to have ear to the ground here.

Ear to the ground. And the other thing, having done this like you a while, sometimes you can't just run with the sheep, right? You got to zig when others are zagging because you believe in what path that you're taking.

" And that's certainly a valiant effort. We still believe in that philosophy as well. But at the end of the day, that's just one small- It's not the strategy for today's world.

It's not. I agree with you. In your role as SVP there of strategy, we mentioned the ecosystem, right?

And there's always room for a great ecosystem, but also key acquisitions to graft technology that you think is vital. I know you guys did one, was it about a year ago now? About two years ago.

Yeah. About two years ago, we did an acquisition of an email security company- Yes ... called Egress based out of the UK, which we've now put into our collaboration security pillar.

So that's inbound and outbound email security, ICES, right? So it's that step beyond SEG. We're one of two partners with Microsoft that essentially- Yes ...

" What's coming next? We're looking at tech and talent, specifically around agentic capabilities. There's so many adjacencies out there that we can look at that touch the user and the digital identity.

So the world's kind of our oyster when it comes to that. I've got a big playground I can play in. Not going to put you on the spot, but might we see some actual acquisitions?

I think you'll see some things coming this year, for sure. Very cool. Yeah.

Marco, it looks like we're here during break time. It amazes me that people walk right by and they're not in it. I know.

But thank God our mics are good. We're hearing you. But you know what?

I think we've covered the agenda, man. You've got a great opportunity here. It'll be interesting to see how this plays out.

Thanks, Alan. We appreciate your time so much. I appreciate you, man.

Thanks so much. Thank you. Hey, Marco Muto, SVP of strategy from KnowBe4 here.

We're going to continue. I think we'll let this place clear out just a second or two before we bring on our next guest. But you're watching Techstrong TV.