Kevin Mahaffey

Kevin Mahaffey is a cybersecurity entrepreneur and vulnerability researcher who co-founded Lookout, a mobile security company, and served as its Chief Technology Officer for over a decade. He is best known publicly for high-profile hardware security research, including a widely covered demonstration of remote vulnerabilities in the Tesla Model S.

Lookout

According to TechCrunch's company history of Lookout, the company was established in San Francisco around 2009 as a consumer-focused smartphone security and data-backup business. Mahaffey is consistently identified in contemporaneous press coverage as "co-founder and CTO of mobile security leader Lookout," alongside John Hering, who is identified as the company's CEO and co-founder. Under this leadership, Lookout raised a $40 million round led by Andreessen Horowitz in 2011 (reaching roughly 12 million users at the time), and a $55 million round led by Deutsche Telekom in 2013 as it launched an enterprise-focused security suite and a partnership with Samsung. By 2023, Lookout sold its consumer cybersecurity business to F-Secure for approximately $223 million, refocusing entirely on enterprise security under CEO Jim Dolce.

Tesla Model S Research

In August 2015, Mahaffey and Marc Rogers — then principal security researcher at Cloudflare — presented findings at Black Hat on a chain of six vulnerabilities affecting the Tesla Model S. Their most notable exploit allowed a remotely triggered shutdown of the vehicle: below 5 mph, the brakes would engage, and above 5 mph the car would shift into neutral. The pair worked with Tesla ahead of the public disclosure, and Tesla shipped an over-the-air software patch the same day the research was announced, in contrast to the physical recall process other automakers used for comparable vulnerabilities that year.

Later Activity and an Unverified Claim

Mahaffey has also written published commentary on cybersecurity policy and remained active as an angel investor; a 2021 TechCrunch article on incident-response startup BreachQuest identifies him, by then, simply as "Lookout founder Kevin Mahaffey," investing alongside Slow Ventures and Tinder co-founders Sean Rad and Justin Mateen. Some secondary sources have claimed Mahaffey later founded the cloud security company Lacework. That claim could not be verified: contemporaneous reporting on Lacework's major funding rounds names Dan Hubbard as CEO, industry coverage of the company's 2024 acquisition talks and eventual June 2024 acquisition by Fortinet does not name Mahaffey as a founder, and no article surfaced in this research links him to Lacework in any capacity. This claim should be treated as disputed/unverified unless confirmed by a primary source such as Lacework's own founding announcement.

Timeline

• 2005Presented on passive RFID security at Black Hat, an early public security research credit predating Lookout.
• 2009Lookout is established in San Francisco as a smartphone security and data-backup company; Mahaffey serves as co-founder and CTO alongside CEO/co-founder John Hering.
• 2011-09-21Lookout raises a $40 million round led by Andreessen Horowitz, reaching roughly 12 million users.
• 2013-11-19Lookout launches an enterprise security suite and a partnership with Samsung, backed by a $55 million round led by Deutsche Telekom.
• 2015-08-06Mahaffey and Marc Rogers disclose six Tesla Model S vulnerabilities at Black Hat; Tesla issues a same-day over-the-air fix.
• 2015-09-12Mahaffey publishes a TechCrunch guest column on addressing automotive cybersecurity threats.
• 2015-12-01Mahaffey publishes a TechCrunch guest column arguing legacy IT security systems will be replaced amid the shift to cloud and mobile.
• 2021-08-25Identified as "Lookout founder Kevin Mahaffey" while angel-investing in incident-response startup BreachQuest's $4.4 million seed round.
• 2023-04-26Lookout sells its consumer cybersecurity business to F-Secure for about $223 million, becoming an enterprise-only company under CEO Jim Dolce.