Episode 13. Digital Twins, IoT & Business Intelligence: The Future of Security

Welcome to Executive Checkpoint, the live podcast for security professionals. Each week, we explore industry trends, challenges, and insights with leading experts. Welcome to Executive Checkpoint, where security professionals gather insights to navigate the dynamic and ever-evolving world of physical and cybersecurity. I am your host, Tino Urbina, and today we have the privilege of speaking with John Pauly, CSO and founder of Protec Solutions. With his 22 years of experience in physical and electronic security, John is an industry leader in smart cities, IoT-driven security solutions, and business intelligence. Holding multiple certifications, John brings a wealth of knowledge on how cutting-edge technologies are shaping the security landscape. In today's episode, we're going to cover topics like digital twins, IoT, business intelligence, and John is going to help us explore how these technologies are revolutionizing security operations, enhancing situational awareness, and driving more data-driven decision-making. So, John, it's a pleasure having you. Glad that we finally made it after some disconnect getting together. Apologize for that. That's on me.

No worries. So thank you for having me. This has been— it's a It's a pleasure, my pleasure to be on the show. This is gonna be great.

Excellent. And you know, John, a lot of people know you and your background, but it would be great if you can share a little bit about with the new audience. Tell us a little bit where you started and how you initiated your career with security.

Yeah, I've— I— so my, my career started as a police officer in Charlotte, North Carolina. I was doing well there, working off duty for a large global nonprofit who said, hey, we want to hire you. My response was, no, I'm doing good, thanks. Their response was, really? We'll give you permanent weekends off and $10,000 pay raise. Go ahead, twist my arm. So I got— that was my intro into the world of security, though. I literally got handed an access control system and a camera system that was brand new. And they said, okay, you know computers, go figure this out. It broke the first day, you know, the rest is history, right? So I've spent a— from there, I've spent a lot of my career in the integration world and culminating, if you will, doing citywide surveillance and smart cities for Hitachi. And then about 5 years ago, I I took my consulting firm full-time. So I've hit that 5-year mark, which is great. And so I tell folks I'm a security technology consultant. What that means is I get to geek out over security tech and tell people about it. I focus on roadmap and design, and it's keeping a pulse to where our industry is going and what the emerging techs, emerging trends are.

I love it. Well, let me ask you, you mentioned law enforcement. So how do you feel that experience shaped your approach to security solutions? I'm sure there, there's a correlation between obviously the two of them. But is there a particular, particular view that you gained by being in security prior to being in integration and consultancy?

You know, I think so. I, you know, where I come at it is, It's twofold, right? From a consultancy standpoint, a lot of the end users, they have a law enforcement background. So it's difficult to have a conversation with folks until you've walked a mile in their shoes. I've walked more than that mile. So you can have that conversation pretty easily, for one. For two, it's a matter of, okay, we're putting in systems that are, you know, lack of a better word, they're, you know, their insurance programs, if nothing else, for a lot of corporations. We hope we never have to use them, but we're going to put money towards them. That's great.

Right.

But if something happens, what then, right? Somebody has to respond from a law enforcement standpoint potentially and have to go do a case. What does that mean? And so I look at it from a little bit different standpoint of not only does the system have to work within the confines of the company, but it also has to be able to, to work with whatever evidentiary nature you've got to have out there. And so it's a little different conversation, but at some point, it's valid on all the tech that I've worked with.

Do you feel that there was a pivotal moment early on in your career that influenced your passion for technology?

I've always been the Someone who enjoyed computers and enjoyed working with stuff. It just, yeah, working, being handed a brand new system and said, go figure this out. It was analog cameras, it was access control, but I had no idea. And so digging into it to do that. And then it was from the integration standpoint, just putting hands on new technologies that were out and going, hey, this solves a problem. Right. And so something I will say frequently is the best technology in the world for the wrong use case is the wrong technology. There's a lot of shiny widgets out there.

I hear you say that, and I think it's so true. Do you know what? I correlate that a little bit with golf. Someone told me— yeah, it's true. Someone told me it's like perfection makes perfect. Not— you can practice, but you don't practice the right thing, you'll never be a great golfer.

Yeah, I love playing golf. I have 2 shots, tree missiles and ground squirrels. One hits the tree and one runs to the tree on the ground, then it goes up it. You know, and for everybody that's looking at me for a golf tournament, yes, I just completely shot myself in the foot on that one. But, you know, it's— here's the thing. It's, you can have the best technology in the world, the shiny widget, the whatever, but it does— if it doesn't work together, It's the wrong thing. And it has to work not only in your ecosystem, but it has to work within with all the other stakeholders, which gets to be more and more problematic. Here's where one of the things I found with smart cities and Fortune 500s, right? When you pull back the first layer of what they are, they end up with looking very, very similar at the bones, right? The structure is very similar. Stakeholders have the same issues. What I found with some of the smart cities is everybody has gone out and they bought their technology, their quote-unquote shiny widget. What it turns into is you bring it into one single room, if you will, and all the stakeholders are holding their shiny widget. And it's almost like 7th grade band on day one. And everybody tries to put those things together at the same time. It does not sound like a band. It sounds like a really horrendous noise. And so you have to put those together and as an orchestra, you know, conductor to the orchestra, and take 7th grade band with all those shiny widgets that are out there that are great things. And you now have to make the Philharmonic Orchestra where the clarinet plays when it needs to and percussion plays when it needs to and the trumpet plays when it needs to. But it doesn't play all the time. And that's where smart cities, I think, are— there's a little bit of struggle because they've all bought what they've bought, and so now we got to use it.

Could you break down a little bit the concept of smart cities? We all hear these concepts, and I feel sometimes it's like AI is a very general prescription or description of many different components. Could you break it down for us? Maybe someone that doesn't understand, how does that apply in their experience in security?

Yeah, and I'll actually give you a definition that I created because there's like 500 definitions out there. I figured why not give my own? I'm going to read it because I didn't memorize it. A smart city is an ecosystem of interconnected technologies and unified planning across city stakeholders, and public-private partnerships championed at the highest level. Championed at the highest level is key to increase the livability of the city. We want to make our cities more livable. That's the key. Let me, let me state this. The original smart city was broadband for everybody. That's all smart city meant was broadband for everybody.

Yeah.

There is a difference too between smart cities and sustainable cities. Sustainable cities are not necessarily smart, and smart cities are not necessarily sustainable cities. So one is focused on climate and weather sensors and things like that, and one is focused on technologies and sensors that make things easier and traffic calming and all this other stuff. And then you get some really cool things like, what's happening overseas where they're doing 15-minute cities, good and bad buzzword, but being able to go do everything in your city using micromobility, public transit, not having to have a car anywhere in the city within 15 minutes, right?

Right.

That's the— so that's kind of culminating both smart city and sustainable city. But smart city really is, it's about technology. It's about, again, communication networking. It has to be championed at the highest level to be successful. It's all about creating a more livable city using sensors.

Gotcha. Managing, being able to see it all. How do you feel is the main point of evolution? You explain how originally it was the perception of a smart city today with so much technology. What are the main components of a smart city? You mentioned sensors, but obviously you have to have speed and you have to have cameras. How does that all work?

The interesting thing about smart cities is that a lot in the US, we don't have a lot of smart cities. We have smart corridors, we have smart living labs, we have some things like that, but we don't have any city that is a fully smart city. But you have certain things that are corridors, certain things that are working in certain areas and won't work in other areas as well. Yes, technology sensors is part of smart cities. It still has to be communication. These things have to communicate somehow. So are we using LoRaWAN? Are we using point-to-point wireless networks? Are we using fiber networks? All the above? Yes, and then some. And so it is— and then what is the use case, right? Go back to our technology and use case. Am I trying to do something for Public safety, I'm putting cameras everywhere. Am I trying to make sure that my traffic, you know, my DOT boxes are secure? So it's a security function, but I also want to make sure that my that my fire truck can come down the street and all the lights turn green, right? Hey, let's go back to. I'll pull from a minute in my history. The Italian job, right? And they had, they said, we're just going to turn all the lights green so you can go where you need to. That's, if I could do that for a fire truck who's trying to get to a, to a, to an intersection, 8 intersections down and 4 intersections over, and they go down 8 intersections and make that left-hand turn and it's all timed. I just took their response time from 12 minutes down to 5 minutes. Right now I'm getting things done.

Very nice. So who are other groups interested? I mean, you have smart cities, obviously. Is that federal or is it private? Who are the players in smart cities?

Yes, and all the above. No, smart cities are typically the city, the public entity of the city. However, most smart city applications today are being funded by the private organizations. Right. Most smart cities, the first thing they want is they want to get new lighting. So then that goes to the electrical contractor, who is— is that the electrical provider or is that somebody else? Partly because if they get new lighting, right, they get LED lights, they get better color, CRI, but at the same point, they can also start leasing out those new poles. And they'll lease out the top of it for For communication technologies. So a lot of the RFPs I've seen come out have been focused around lighting, but it's— that's just step one, right? And a lot of things that if you've got it, once you've got the lighting, or you want to take a bigger chance, right? Something I'll say frequently as well is, you know, I don't condone the eating of elephants, but how do you eat an elephant? One bite at a time. You get partners. And so a lot of cities are focused on public-private partnerships. How do we do this together as a community, not just as the city funding this out of a limited budgetary bucket, but let's work with matching grants. Let's work with— there's federal grants out there. There's all these things here that can be done, but you've got to do that together with partners. You're not going to build a city by itself to be smart unless you have an unlimited bucket of money.

Speaking of money, I'm sure that there's some multiple benefits with gathering the data and understanding better where the money goes or return of investment, operational efficiency. It seems to me that that might be one of the biggest benefits. Do you have a good example that will qualify a project for that purpose, that that was important for them?

I don't, being a small-time, a small company, I haven't done a lot with the smart cities that I've wanted to, but I will tell you that from a corporation standpoint, right, when you look at those Fortune 500s and smart cities, again, having similar applications, the data behind what you're doing is critical. I will, so I'll give you a piece of, a data piece. A hospital, a friend of mine at a hospital recently put in weapons detection technology. And the reason that they, the byproduct, something they did not think about upfront, they bought it to stop weapons coming in the hospital. The data that they got off of that system, the fact that it did or did not actually pick up guns, it clarified how many people came through their building at any given time. It gave them an empirical number. They now had data that said, we know how many people walk through the doors of our building at any given time. What that equated to was it went to their— to the lunchrooms, it went to the HVAC. It all of a sudden, that data now gets shared across all those different platforms. And again, this is going to lead that business intelligence conversation. That data now defines how much food has to get ordered. Instead of, hey, we're going to have— we can assume that we're going to have 50,000 people. Now we can show that in the month of March, well, we only had 35,000 people, but in the month of May, we had 95,000 people, or whatever that number might be. That data now comes— brings more business intelligence off of a security system. That business intelligence is where I focus on. Because it's taking a system that in the past has been, again, very little ROI. We've been the insurance policy— gates, guards, and guns. Please, dear God, don't have to use the security system. But we have sensors that can tell you all kinds of data. Now we can share that data with other folks in the organization and say, hey, I can tell you how many people are coming in your building at any given time.

Mm-hmm.

I can, you know, I can address that with, you know, we can correlate that with visitor management or all these other things. I can now work your, your business to be more sustainable. I can help your, your, you know, your facilities department not run your HVAC as much, which comes into a correlation. We can turn off lights in certain areas, which drops your, your pricing. And so all of a sudden, the price of the security system just got paid for 3 times over by what we just saved.

combining all these technologies. You know, do you think there's some gaps in security technology adoption that, you know, businesses can be better aware, you know, to bring, to bring to their attention, let's say?

Yes, there— I think you're absolutely right that there are gaps in the security, in understanding what security technology can do. We're used to, again, gates, guards, and guns. We're used to a camera, A sensor looking at a room and telling us what's in the room, but not using that image, the data off of that, to define what we can do with our building elsewhere. And so, yes, I think there's absolutely gaps that we're not looking at. Some of that's just because who is the stakeholder that's buying it?

Yeah.

And it's a conversation that needs to happen. I mean, we still have a lot of security directors. We're deploying IP sensors, right? Whether it's an IP camera or it's other sensors, all of our access control is now networked. Maybe it's in the cloud. And the first thing I go into is say, hey, is, you know, how much of a friend do you have with the CTO or the CIO? Well, we don't ever talk. You need to make friends with them right now because everything we're going to do is going to be on their network. And let's make sure that they have a seat at our table as we talk about this because they're going to define what we do. And so, it allows us to have that open conversation. And all of a sudden, most of what I've been involved with has been the CIO or the IT department or whoever has been on board with, hey, we just need to make sure that it meets our InfoSec requirements. But you're— go ahead and do it. And we'll back you up. And oh, by the way, can we get the data off of that?

Right. Well, and then you have HR, right, that might be benefiting from that information. Legal, looking at shielding the organization from having to deal with any lawsuits because of failure and of security or technology. So, you know, I can see where is the role of cybersecurity in all these solutions?

Everywhere. And I don't mean that, I don't mean that in a, in a, in a bad way. It's the fact that you have a network, network device that lands on a production network, you have to secure that from an integrator standpoint. You have to be able to— if you plug that wire into a production network, you better have made sure that that camera is hardened to manufacturer standards or better, right? It is the due diligence of everybody in the community, everybody in the install. It has to be cybersecured. There's a— now, things happen, right? There are companies that don't have a good cybersecurity posture. From a security install side, we still have to secure our stuff, right? In the past, I've seen systems that weren't secured, and IT's response was they walked over, they unplugged the network cable and said, we secured our stuff. This thing is now running on its own. Don't touch it. Don't put it on network. It is standalone and it will always be standalone. Well, that doesn't work if it's a cloud-based system, right? Or cloud-hosted system.

Mm-hmm.

We need to do our due diligence to secure from the camera to the server to whatever that piece is. It's got to have that cybersecurity to it.

Right. And I think, you know, I've heard some companies buy insurance to be protected for liability, but that's not the ultimate solution, right? It's finding the right combination of manufacturers that bring certification to their product, so they can be all matched in a good situation, right?

So it's all the above. It honestly, at this point, it's— and a lot of the cyber insurance policies, there's a— you must do A plus B plus C. And so companies will go out and they'll get a policy that does A plus B plus C. But then they get a policy that does A plus C plus B. And then they get a policy that does B plus A plus C, right? And they have 3 or 4 different policies just to make sure that if they get the wrong order, they still are covered. But then they also need to require everybody who's touching their network holds that cybersecurity. And you can show, hey, we cybersecured our stuff to the The level of the of the manufacturer. The manufacturers need to have that cybersecurity hardening guide to it, and those that don't, quite honestly, to the to the to the integrator, maybe that's not a good partner, a product that you want to put in there if they don't have the ability to cybersecurity their stuff. Are you willing to take that risk? Because if if somebody gets in because they hacked one of your cameras. Trust me, they will pass that savings right along to the, to the integrator and the manufacturer, if so be.

Yeah, well, you know, I think, aside from cyber, which is huge, and the architecture of all things moving forward, AI has an impact on everything security, and it's not going away. So what's the impact of AI in your business or with your clients? your projects? What are the conversations you're having about it?

So twofold with that. And by the way, I've been through a cyber incident before. Having, having done that, and it was before I was consulting, it was with another company. So thank goodness it wasn't any of my stuff. I don't wish that on anybody. I'll say that first off. Second off, AI. Everybody has AI, Right? The problem is not all AIs are created the same. Think of it— I'll say it like this. Up until 2004, from the 1940s and '50s to 2004, we had created things like television and radio. And they moved at an adoption pace that was great. And in 2004, Apple releases a smartphone. We've innovated up until, let's say, 2022. In those 15 years, we innovated faster in 15 years than we did the 50 before that. 2022, November 2022, OpenAI releases ChatGPT. We've innovated more in the last 18 months than we have— 18 months, 2 years— than we have in the last 15 before that. AI is not the same across the board. The problem is, is it Boolean algebra? Is it Agentic AI? Is it a self— there's none of them that's self-learning. I've seen some better AIs that are used for automation. I've seen things for analytics that's just, we called it AI because analytics was old, right?

Right.

And everything in between. Here's where AI has an issue. To be looked at, and it's the regulations. So in Illinois, we had BIPA, right? The Biometric Information Protection Act, created in 2008, was ratified or changed last year to White Castle was a beneficiary that they had been. They had been charged $13.7 billion for using fingerprints. Now it's down to $9 million. Texas has a law. Washington State has a law. California has a law. The EU just did it.

Now it has an impact, right?

Yeah. Well, the EU just did a— just passed a law a year ago that if your AI is ranked as high risk, high risk could be something like facial recognition. Instead of it now in Illinois, it's a $1,000 incident, right? Per biometric. It's a $400 million fine. Um, and it's now $450— $400 million fine to the manufacturer, the integrator, the consultant, the end user, and the distributor. All 5 get fined $400 million. It's €400 million or $454 million. So $454 million fine if you spec a product and it's not handled correctly. It's not you can't put it in, it has to be handled correctly, and it falls in that GDPR piece. That's where AI— when you're doing AI, there's a lot of things out there that are AI and that— and or say they are and they're not. But anything you're doing, you need to look at what the local privacy laws are around that and how to handle it. There's ways to do all of it and do it safely. In Illinois, there's 4 things you have to do. to do biometrics and to do any identifier safely. A lot of people just choose not to do it. You got to know what you're doing in the area you're at.

What do you think leaders need to understand better to integrate intelligence-driven practices and security measures? What will be your biggest suggestion to that security director to look at this as an overall picture and said, okay, here are the best practice steps you should take to implement something like this.

Do homework, do deep dives, do, you know, yes, selfishly contact a consultant who geeks out over security tech, but—

Get your expert right online.

Get an expert on what you're trying to do. Let's define the use case and let's find the best technology for that use case. It may not be the shiniest new object out there. It might be the old workhorse that just does what you need it to do. I would also look at, if we're looking at technology, great, but don't put it in a box either. Let's put it, have that technology, look at that technology in ways that it will help benefit and use business intelligence for the organization. Can I do this and it works with HR? Can I do this and it works with the facilities, IT? I know we talked originally digital twin. I think that's where things are heading, where I have a single user interface of a 3-dimensional version of my building and I have every IP-connected device on there that almost like— and it's video game, right? We've gone to the gamification. that everybody can jump into that twin and be able to use the different— within reason. I don't need folks looking at security cameras, but can they get the data off of that to be utilized for something else? Those are things I think are going to happen. I think the biggest thing is, A, find the technology that's right for what you're trying to do for your use case, but also bring in the other stakeholders in the organization. So that you can have that, you can have that conversation with them. How can my tech that I'm putting in here now also benefit you? And there's a casino out west. I wish it was mine that I had put in. It wasn't. Their security department was sitting in a room with HR and marketing who were talking about— HR said their people weren't showing up on time, and marketing said, We're not getting big-ticket items being used. Security walks in and says, we heard you. We think we have a solution. They put up some heat mapping analytics. Really all they did to start with. What they found out was that the marketing's big-ticket slot machines were in the way of all the traffic flow. And they said, hey, move this stuff over here and let's see what happens. Well, marketing moved the casinos or moved the slot machines, which actually got them more money in the, in the big ticket items. And it got all— it moved the roadblock out of the way. And all of a sudden, HR's people started showing up early and on time to where they were supposed to be. And so today, marketing and HR split a budgetary dollar and they buy all the new cameras. Security still gets their budget. But they receive all brand new cameras from HR marketing because they saw the value in the security camera. And security still says, hey, we only have this little bitty budget. But all of our cameras come somewhere else. And that's where you're seeing some folks— your security departments need to be willing to say, hey, maybe we can charge internally to our other departments and say, yes, we can do this, but it's, you know, It's soft dollars changing across, across organization, because you don't have to go outside and go find a third party to do it.

Sharing, sharing all the benefits here. Recently, I heard a story about, not directly related to security, but you have a group, Best Buy, that was the company that gave their website to a consultancy group to analyze why people were getting to the shopping cart and then not actually making the purchase. And they determined that adding a button that says, Buy Now as a Guest, versus having someone create an account, made $300 million at the end of the year. Just one little change. And I feel security, sometimes we can be a solution or a partner to other departments, right? Like you explained with the child.

Absolutely.

And the budgets get bigger, right? It's not— you're sharing the benefits of technology that can play a role for security as well for everything else. So kudos for that explanation. That's very right on the money. So, but John, this has been an insightful conversation. It's clear, like, the technology is rapidly transforming and security is evolving with, you know, digital twins and IoT and business intelligence. So providing valuable guidance to some of your customers, I'm sure it's important. For people that would love to engage with you and learn a little more about your company, Where can we find you?

So, uh, protecsolutionspartners.com is my website. You can also find me on LinkedIn. Um, I'm fairly active there, especially in the security industry. So posting, uh, I write for a couple publications. So, uh, find me on LinkedIn, find me there, um, on the website as well. Uh, happy to have that conversation.

Um, are you gonna be in ISC West?

I will be at ISC West.

Uh, looking forward to seeing you.

Some really cool stuff coming in and, uh, chat some more.

This has been a great conversation.

Absolutely. I'm going to give a soft plug. It's official, not official, but we are sponsoring a wine and security event at ISC West. It's going to be an elevated event. There's going to be tickets through our sponsors. Look for more coming out on LinkedIn, but it's a passion project around wine and security. Looking forward to, to that event at ISC West.

Send it to us. We're happy to promote it for you as well. So, but thank you again, John. To our listeners, stay informed, stay secure, and we'll see you at the next Check Point.