Episode 32 Security, Converged: Why AI Needs People, Process, and Purpose Kasia Hanson

Welcome to Executive Checkpoint, the live podcast for security professionals. Each week, we explore industry trends, challenges, and insights with leading experts. This is your insider access to the minds driving change in our industry.

Welcome to Executive Checkpoint, where security professionals gather to learn about physical and cybersecurity, the newest trends. I'm your host, Tino Urbina, and today I have the unique pleasure to have Kasia Hanson, Vice President of Strategic Partnerships at Alcatraz, with over 2 decades of experience leading security innovation in companies like Intel, now Alcatraz, Kasia brings a unique lens to the convergence of physical security, AI, and ethical technology strategies. She's a recognized industry influencer, a champion of responsible AI, and passionate about diversity in leadership. Today, she'll share her journey with us and her view of the future of the industry. So Kasia, welcome to the show. It's been a minute. We've been wanting to get together and do this, so. So glad we're here, especially because this is right before the holidays. In fact, this is gonna air Friday after Christmas. So that they add the little decorations for Christmas.

Yeah, we're the present for everybody the day after Christmas present, you know, when you need a break from hanging with family, you can come and join us.

See, that's exactly my point. And you know, people are gonna have time. So we'll make sure that they catch on and there's a better better than ever to have this conversation. But, you know, Kasey, you obviously are a fairly public figure. You're a leader in the industry, but maybe there are some new folks that have not heard your background and some that know you for a while, maybe don't know your full background. So if we can start from the beginning, where was it that you started your career in security?

I started at Intel Corporation about 24 years ago. And I never thought it would be out of place for 24 years. I mean, I still talk to like younger generation folks and they're like, wow, you stayed at a place for 24 years. How can you do that? But I really— I grew as a leader. I grew as a friend, everything. I mean, I had my kids there. So learned so much about technology, learned so much about legal, IP legal, finance, silicon development, data center, client, storage, and then I jumped into security the last 8 years of my career. It was an amazing space. I knew I had found the spot for me, which I could be passionate about, really be behind a mission of protecting people, places, and assets. And then we quickly converged security teams to be physical and cyber and developing ecosystems that can deliver solutions. So it was really fun. And then I took an early retirement from Intel, had a great opportunity to do that, and started a consulting company called K-Factor Global, which is really focused on modernizing security and helping organizations leverage AI. And then I joined Alcatraz about 10 weeks ago to drive strategic partnerships and really, really excited to be part of that team and the mission that we're on to really drive your face as your credential and, you know, really as part of the human experience, being able to use your face. And we know we can rely on the face. So—

Absolutely.

Very exciting.

So technology service, it's obviously, it's been in your background professionally and you're right, I think to the newer folks, 24 years in one company is like, how do you do that? But now it's like every 2 years, everybody's kind of moving around. Yeah. What, at what point did you start to identify AI as one of the driven technologies in security that you wanted to align with and push, which seems to be your focus now? Correct?

Yeah, yeah. So about 8 years ago, probably, well, probably 8, 9 years ago. during my time at Intel, we launched an inferencing product, a software product. And when we did that, we realized security, given the nature of computer vision in security, that that was a spot for us to go drive. I mean, cameras are at the edge, right? There's almost 30 billion devices in the Internet of Things and cameras are one of them. And there's about a billion of them on the planet. And so we explored how do we make it easier to process the data at the edge through the cameras and with edge devices and things like that. And that's really when we started to talk about AI, educate the industry about how computer vision was, you know, what was machine learning, computer vision, AI, where were we going with it? You know, and it's a bit of a journey, right? I mean, the security industry tends to be pretty risk-averse.

Right, right.

For many good reasons, but I think technology is moving so fast now. So, it was really an education effort in my mind of how do we help the security industry get comfortable with AI, and, you know, it was a little bit of baby steps in that education, but also showcasing what AI could really do for security. And I think we're starting to see that now in some of the use cases. It was, it was good, but it was a long, it was a long journey, and now we're talking about it everywhere, you know?

Yeah. And, you know, for a while I remember talking to other professionals in the security industry, and it was, it was like, it's going to pass. It's technology that might not stick around. And I'm like, mm-mm, no. And the truth is, the more people think about it, the more it's going to move the needle and the less they're going to catch up.

So.

Yeah. What are the biggest challenges when you're talking to other practitioners or maybe C-level executives when it comes to technology?

I think I had a conversation recently with some C-level leaders in a workshop. And one of the things I'm finding right now is most don't have a strategy around AI, right? There isn't a comfort level yet with it. Now, if you look at like the C-suite, of a large organization or small, you know, most are starting to explore like, hey, we're going to look into AI, we're going to start to, you know, explore what it can do for us. There's usually some level of interest from board members about what is the company doing with AI, how is the company going to leverage it. From a practitioner perspective, I think most practitioners are starting to look at it and get a better understanding. I think there's still a lot of education to do and understanding of that from a technology perspective and how that will help. I mean, I think most practitioners I talk to agree, like, you don't want to deploy it just to deploy it. You want to solve a problem, and you want to solve a business problem. And I think AI can do that in one of two ways. You know, you're either looking to increase or create operational efficiencies, or you're looking to differentiate.

Right.

And in most cases, security people are looking for that operational efficiency. How can I use technology to help me more in one area? And then I can kind of rotate resources to another area, right? And/or how do I use that technology and use my OpEx budget versus my CapEx budget? I mean, there's a lot of conversations in that space as well. I think, you know, over time, you know, having a strategy, Getting to— getting a better understanding of it, getting a comfort level. I think we all have to do that. It doesn't matter what role you're in, whether you're in a big company or a small company. I think we all have to understand it to some degree because it isn't going away. I know there's some talk of, you know, if you look in the news, you know, I get articles fed to me every day, you know, Google articles about AI cyber risk, you know, and a lot of them are starting to say, Is there gonna be an AI bubble? And sure, there quite possibly is. I don't doubt it. I think now we're going into that, we're moving into that kind of, you know, trough of disillusionment from the Gartner hype curve, right?

Mm-hmm.

I think we're moving into that where some people have really jumped in, they've tried it, they either got an ROI or they didn't. And now you're starting to see companies sort of take a step back and that trough of disillusionment is happening. And it's a great time to explore and revisit your strategies, right? And so this C-suite audience that I spoke to recently, I asked the audience how many have a strategy around AI and only 2 people raised their hand. So it's definitely moving quickly and I think we all can help each other in this space.

Yeah. So, you know, interesting enough, I, I had similar conversation with a group and the one thing they learned specifically because they implemented, uh, the technology early on and 2 things. And of course, um, um, they did not reimagine the, the process. They just added AI and that proved not to be, uh, you know, a good way to go about it.

Yeah.

So that was the first one. The second one, yeah, was a group that intentionally took the time to do everything They understood the technology can do, they just did not have a good strategy on collecting and cleaning and addressing data properly so it can be utilized by AI.

Yeah.

And so they're the happier of the two because in one side felt like a total waste of time just to brand, we're doing AI, bam.

Yeah.

And now you have someone that put some thought, some resources, they're going like, you know, we got close to it, We just need to get a little better. To me, that's— and like you said, a lot of executives and practitioners see it as just kind of along the way, you got to take action. So what are the misconceptions you feel that most people have when it comes to technology, technology specifically with security?

Of course. I think in security right now, most of the deployments that you see are not really AI-driven. Some might be AI-powered to some degree. You know, there might be some AI processing on the backside, but most of it's computer vision, right, which is where, you know, AI is drawing from. It's computer vision related in security. I think from a future standpoint with AI, you know, the threat capabilities, the threat intelligence, visual language models, I think, will be a very big deal. I think we're a little bit off from that, but they will come. And visual language models will really land right in security where you'll be able to—

Yeah.

tell a camera, I wanna see this, this, this, and this, and the camera will do that, right? And so learning more about what that will do, the capabilities that you can use in terms of looking at logs and information and looking for anomalies will go faster, right? The amount of data and information, perfect examples like training security personnel.

Right? Sure.

Being able to provide them access to, you know, standard operating procedures and information quickly via their mobile device, maybe via a, you know, using agentic AI. There's 2 sides. It's like, how do we get more operationally savvy with it and do projects that are gonna deliver quick returns, save us on resources and time? And I'm not talking about, I know a lot of people are hearing about layoffs in the industry and, you know, like it's gonna affect jobs and it will. And that's why they say like, learn about it, get to know it. Those that will continue to work will be using AI. They will have to know about it. And so it's just arm yourself with information. And I think that's where the security industry is at right now. So much education. You know, if you look, if I pick up Security Journal Americas, there's always something AI related in there. Somebody's talking about AI.

Yeah.

I don't think the industry has fully moved. Physical security industry has, fully moved to AI yet. I think we're a ways off from that in terms of the comfort level of it. But if you just think about it, it's a perfect area for AI because of the use of computer vision and just making us more operationally efficient and being able to use our resources in the areas that we need it. And, you know, whether it's advanced analytics and visual language models or it's, you know, information, right, and data sharing across your security teams, The other area is identity and access, right? Identity and access, I think, will be a big— it is already a big thing, let's just put it that. But I think in 2026, it gets even more important because of the risks of AI. I mean, there's a lot of great, exciting things with AI, and then there's a lot of risks, right?

Mm-hmm.

It creates a lot of vulnerabilities, and I think that's where people historically I mentioned earlier, I often say AI, trust is a threat vector.

Yeah.

AI is creating this vulnerability and it has become— it's very vulnerable technology. The bad guys are using AI and if we think about physical security, we protect buildings, we protect networks, we protect people by trusting things. We trust credentials, we trust identities, we trust video and audio, we trust devices. And now all of that's changing, right? And so I think that trust has been put into question with AI. And so security practitioners will have to think about not only how can I use AI, but then what is AI doing to create more risks and threats in my environment, right?

Yeah.

So whether it's deepfakes or synthetic identities or manipulated audio, video, you know, I think all of that comes to play and there's kind of two sides of the coin, you know, Good and bad, right, that you have to be aware of. So, and that, and that, you know, I mentioned identity and access, you know, modernizing those 2 things. I mean, we, we all have our identity, and, um, access will become more important because oftentimes physical threats become a cyber threat, you know, and, and/or vice versa. And so, um, I think now more than ever, we need to start looking at the linkage between identity and access.

Absolutely. And, you know, there's To me, the keyword there is trust, right? I think that the concept of trust in the industry has moved as the technology evolves. And it used to be like, here's a card, this is your credential. It was permission, not identity, right?

Yeah.

And now even that, you need the advancement of the same technology to be credible and trustworthy. In your experience, you're working with global teams, massive ecosystems. What are the things that you've learned in influencing versus authority, you know, just trying to move the needle in security, specifically, you know, with AI and what you're doing today?

Yeah, I mean, I think one of the bigger things that I've been talking about for many years, and others have as well, there's a lot of other folks in security that feel the same way, is the idea of having converged security strategies, especially now with AI. I mean, there's both cybersecurity leaders are dealing with AI. One, they're using it to do threat hunting and anomalies, and they're using it to power some of their systems, and that is helping them, right? Then on the flip side, you have the bad guys, using AI. And so, I think the converged strategies make a ton of sense, ensuring both organizations understand the strategy overall, what each of them are doing, and how they can help support each other. I think some larger organizations do this, right? I've talked to leaders that say, oh yeah, I talk to my CISO all the time. Our teams are aligned. We meet regularly. I think I think we do see that, so I'm not saying it doesn't exist, but I'm saying if it's not strong, your 2026 goals should be to make that strong, to really converge. Because I think, you know, converging the organizations, that can help to, you know, stop trust-based attacks, right?

Yeah.

And in both areas, whether it's cyber or physical, you are— you have some level of trust. Whether it's an identity or it's a credential, right, on the physical side, like you have this idea of trust. So by treating physical and cyber as a unified strategy, you know, you're really gonna help yourself. So I've spoken a lot about that. I'm really keen on it going into '26 as a core strategy in security. And the core of that is really gonna be identity and access.

Mm-hmm.

Just because you mentioned the cards, cards can get lost, they get stolen. You know, you have this idea of, you know, people walking into buildings. I met with a CISO back in October. I was doing a tabletop and we had never met before until we started talking and I told him, you know, where I work and what we focus on. And he said, do you know that I have had to train more people on tailgating Than phishing. Like, that's how big it— like, that's on a CISO's mind, is tailgating, which we normally would consider that to be a physical security thing, right?

Right.

That's a CISO. So, you know, I think we're having to sort of think differently, um, for security as a whole.

Yeah. And, you know what, I feel like at one point in time we were misaligned. I think most of the groups, we were pretty much silos, right? You have your physical, your IT, And slowly but surely is mounting and it's becoming more collaborative. But I remember having a conversation with another— this is a technology consultancy group. And at the time, my focus was on physical security. This particular client was investing a lot of money on their technology and firewalls and all things IT. And they were asking for guarantees that that investment was going to protect them 100%, which that's the reason they called me. They're like, well, yeah, but you still need the physical controls, right? If someone can touch it, it can be hacked.

Mm-hmm.

And so, yeah, you know, that just click in their head is like, okay, we have had the solution.

Yeah.

So adjust the budgets and now it's, you know, a cool solution. Yeah.

And I, I think though, People think that, oh, the risks are out there because AI is not everywhere yet, but it really, it's starting, right? And yeah, there may be this trough of disillusionment, but it's going to keep going. It really is. And it's already permeated into our personal lives. And how often do you use ChatGPT? Like, I love it. I love— I don't give it a lot of personal information, but I like using it to inspire me. And I did a video last week on that. But I think there are real risks today that we have to think about. So we have to move faster as a security industry than we have before. We have to respond and to set up those layers of defense. I mean, I just wanna mention the Anthropic AI attack that happened. You know, folks, you know, pull it up, you can read about it. But the thing that I found very interesting was attackers used Anthropic's AI, the agentic AI coding tool. Okay, I wanna make sure I get this right. It made the systems think, act, and move on their own, and it spread really, really fast in about 30 organizations, and it escalated privileges, moved across systems with no human involvement. So think about an attack like that and what it can do to wreak havoc on an organization, whether it's physical or cyber, right? And so I think we have to think a little bit differently, and most of our systems and our organizations aren't built like that.

Yeah.

And so that's why, you know, now too, when you're deploying any AI tools, you know, having strong governance around them, looking at, you know, why are we deploying it? What business problem are we solving? You know, is it purpose-driven? Is it solving a business use case? You know, does it have human oversight? You know, looking at things like that, you know, data governance, how are you protecting the data, information privacy, et cetera. Is there transparency? So all of those things that you're looking at with AI, you know, as we start to change, I mean, it's just our systems haven't been built like to respond to the attacks that exist today. And now, you know, now we have to shift our thinking and how we operate.

So yeah, and you know what, I think a big challenge is leadership, the perception of leadership, and how you implement things in your own organization or as a practitioner, right, in your own practice. What was the belief you felt strongly 5 years ago that you've since then reconsidered, that maybe you see reflected in other leaders? Is there, is there a belief that 5 years ago you were like, now it's a completely different mindset?

Um, just in terms of tech or in leadership?

Like, let's call it leadership. Let's use leadership because I think, you know what, um, the few times when you and I talked about, you have this very conscious approach to conversations as a leader, and I love that. So let's, let's dive in a little bit on that.

Yeah, I think, um, for me, like, if I look back 5 years ago, I mean, I was, you know, deep insecurity. Um, I started really evangelizing, you know, bringing together our physical and cyber teams to really make sure we were under one house. I said, hey, we're out talking about being under one roof, we should do that. I still believe that, but I also think we're on this journey together and we have to help each other along the way. And 5 years ago, I thought, okay, we're going to shift in 5 years in a big way in security, and that shift hasn't happened yet. And then from a leadership perspective, that's a really good question. I'm trying to think. I really have evolved myself as a leader. I think I'm listening a lot more. I definitely am interested in other opinions a lot more. I'm also just spending a lot of time outside of my— what I learned. Somebody asked me about a, like, a lesson that I learned along the way. And one of the lessons for me was I oftentimes will talk to people and they don't really know what's going on in other parts of their company. And for me, it was like, learn what you're doing and then learn everything else around it, right? So you can be as strong as you can in your organization and to help your organization. And so that has rang true for me over the years. And it was something that I didn't quite resonate with until now. I was doing it, but I'm now much more clear on why to do that and how it helps you as one, an employee, as a leader. but to understand all the happenings around the different parts of the company and what people are doing. And then too, to volunteer for other projects that are outside of your scope, because that makes you grow as a leader. The more you understand about your organization and the organizations that surround you, you can grow as a leader. And so I think for me, I've evolved in a big way. I kind of take a little bit of a I review myself every year.

Good.

And I look at, you know, how have I evolved in the last year? What are some things I've learned? What are some things I want to improve on? You know, what do— what books do I want to read in the coming year? You know, like a lot of friends in security industry are writing books. I always buy their books because I love, you know, I love reading them and I So yeah, so it's just been, you know, my thought process has changed in terms of how leadership can evolve and how you grow and then becoming, you know, really your— and I think this word might be overused a bit, but your authentic self.

It's true.

It really is true. You know, doing things that I love, I find if I'm doing something that I love and I'm passionate about, people will see it, you know what I mean? They see that you, you love what you're doing, and, and, um, and I do. And so that's what I've learned too over the years, is like, do what you love and everything else will— everything else just kind of does fall into place. And, um, and help others around you.

So, right. And you know, you know this better than anyone, if you help others, it's almost like reciprocity rules, right? It definitely makes a difference in that sense. You know, we have quite a few folks that are starting their career or somewhat new in this path. And so when you think about bringing someone or mentoring someone, what are the 4 things that you will advise them to focus on in their careers and move along into a leadership position?

Possibly, I did an article recently, so this is fresh on the brain. You know, one is, again, volunteering. I had an executive at Intel say to me, you need to have a night job. And this was early in my career, and I didn't quite know what to do. You know, I was like, I have my job, I show up, I go home, whatever. So one was kind of do a night job, right? And that's that theory of you're doing your job, but you're volunteering for projects maybe outside of your job. You're taking on some extra workload to learn about the company. And that has helped me ever since he told me that, had helped me to learn even more because then I could get in front of customers and I was very clear about our company strategy, where we were going, what we were manufacturing. Like, I had much more information to be credible and to grow. And then those leaders saw me. Right? And so would then tap me for other projects. I think the other one I learned in a big way is, I mean, this is probably for the women out there that are growing in their careers, is oftentimes we're told that we need to look like everybody else and be like everybody else. And in my case, it was, I had a leader who had a group of men that he was mentoring and helping to grow as leaders, and all of them were doing doing great in their roles, but I was trying to be like them. I was trying to be exactly like them, who I thought that leader wanted me to be. And what was happening was the opposite was happening. I was struggling. I was stressed. I was, I was trying to be something I wasn't.

Yeah.

And, and I had a coach at the company tell me that, Cassia, you, you need to be you. And these are your strengths that I've witnessed, and you need to lean in on those because those other people may not have them and your, your leader may not know it yet, but he needs those strengths.

Right.

And that was mind-blowing for me. And, and I think, you know, the other one is just network. Network inside your company, but network outside your company. That is, you know, I've seen all too many people who just networked inside their company and they don't really have a strong network. Um, and I always learned that when I was, when I was young and in high school. Uh, my, my parents always said to me, just be friends with everyone. Like, it doesn't matter. Like, it doesn't matter who they are or whatever, just be friends with everyone. And I try to take that approach in my network is, um, you know, hopefully we can help each other today, maybe in the future, whatever it may be. But I created a network, and I'm thankful for it inside my company and outside. And so once I left that company, I was able to really tap into my network. So those are probably the 3 biggies, like in my— and then I think the 4th is just have a strategy. I think the worst question anyone can get when they're interviewing for a job is, where do you see yourself in 5 years? Because I think that has like gone out the window.

Yeah.

But you can have a strategy for your path. You can say, I'd love to be doing this, this, this. I want to be CEO. I want to be, you know, whatever the role you want, um, and what's going to make you happy. You know, you can have a strategy and just have that on your board that says, I want to work to get to this, and now I need to know what are the things that I need to do to get to CEO. Let's say I'm just using that as an example, um, but it's sort of like develop your own, um, career strategy.

Absolutely. I think Man, that's one of the best, very well thought advice. I'm glad that you just wrote about it. So look for, look for the information. I, I want to thank you, Kasia. This has been fantastic. I know, like we said, this is going to be in the middle of the holidays and, you know, there's a lot of great things that happened this year, a lot of challenges that we dealt with. And I think my take is always makes you grow. Challenges are preparation for greatness.

Mm-hmm.

I think we have our share this year. Not to say the next year we're not going to have any, but hopefully we address them with the best character possible. Yeah. And so, um, Kassia, what are you working on, uh, for dinner? Well, actually, that will be New Year's because you just— at this time, since we're recording, you'll have— what's your plan for New Year's?

Uh, New Year's, um, you know, I don't know yet. Um, we're still talking about it. We're, we're kind of, um, Last minute? Yeah, we kind of wait till last minute and just see how things go. And we went out last year. We may end up going this year. We may end up going to visit some friends. I don't know.

I don't know. This year I'm cooking, so I—

Oh, nice!

Yeah, so it's become a tradition on New Year's. If I can, I'll do— what is this? Beef Wellington.

Nice, nice. I love that.

Time-consuming. Get everybody drinking early, helping me.

Yeah, yeah. I think some years at this point in my life, it's like some years being in bed at 10 is great. Um, you know, uh, being, you know, staying up till midnight, like set your alarm for midnight and then yay, you know, um, or just go along with New York's, you know, or Australia's, you know, um, do those. So I think, I think the nice thing about life is like we can do whatever we want, right?

That's right. True indeed.

As long as we're all safe and sound and we head into the new year, you know, safe and sound.

Absolutely. Well, enjoy the holidays with your family. Where can we find you guys? What's the best place to engage with you professionally? And maybe someone looking for mentoring?

I think LinkedIn is fine. And I respond to DMs on LinkedIn. So I get quite a few and I do respond to all, unless somebody's selling me a product that I— has nothing to do with my business, but, or it's like a fake thing, which I can spot. So, no, LinkedIn is fine. I will connect there. And then if you wanna talk or get together, just DM me and I'll respond and then we can set up some time. So happy to do that.

Awesome.

But I think for us in 2026, really thankful for you and meeting you in 2025. So I look forward to more in 2026. We had the opportunity to meet at GSX last year. So thankful for that. And I think just, you know, the community itself is phenomenal. I mean, I think there's just such an amazing group of security leaders that we're a part of and just wanna have a great holiday season and then an amazing 2026.

Yeah, hit it hard. Let's go.

Yeah, definitely.

Well, Kasia, thank you for sharing your wisdom, your leadership, your knowledge, deep knowledge in the industry. And, uh, for you at home, again, have pleasant, uh, holidays. We wish you nothing but the best on the upcoming 2026. I have a couple really incredible guests coming up next year. Till next time, stay informed, stay secure, and we'll see you in the next Checkpoint.