Episode 7 – Cloud, AI, and Security: The Next Frontier

Welcome to Executive Checkpoint, where we bring you stories and insights and predictions from leading voices across the security industry. I'm your host, Tino Urbina, and today we have an extraordinary guest whose career bridges the cutting edge of technology and real-world challenges. Dr. Daniel Richman is the CEO and Chief Scientist of Argus, a company specializing in leveraging artificial intelligence to enhance surveillance systems. With a PhD in electrical and computer engineering from Duke University, Dr. Richmond's career spans academia, research, and industry leadership, giving him a unique perspective on the evolution of security in our increasingly digital world. In this episode, we explore Dr. Richmond's professional journey, his experiences at the forefront of AI innovation, and his thoughts on the future of technology in the security landscape. Dr. Ridgeman, welcome to the show. Glad you're here.

Hi, Tino. Thank you for having me.

Excellent. Well, you know, as usual, we like to learn the full story on the folks that visit the show. So I would like to start from the beginning. What attracted you to security? Obviously, we talked about your background in academia, so, you know, private sector. So it seems like you have a very interesting initiation within the security industry. Tell us a little bit about that, if you don't mind.

Yes, certainly. So I, like you mentioned, did my PhD at Duke University in electrical and computer engineering, but specifically doing artificial intelligence for the US military, developing algorithms to find landmines. And we did a lot of computer vision stuff like that. And the chief information officer at Duke was aware of our lab and what we do. And one day she just, she told us kind of, or she told my professor kind of desperately, yeah, you know, we have 2,000 cameras on campus and we try to do the maintenance of it. We have all sorts of software, but there's so much manual work associated with it. Maybe you can help. And this was the first time I had ever considered a security camera. I didn't even realize there were 2,000 cameras on campus or that there was even one on campus, even though I'd been there for years. So.

Right.

But apparently there are, and apparently they need to be maintained, and apparently there was no solution for it. So we worked on it and they were happy. So I thought, well, if Duke, you know, is so desperate that they're willing to pay a lab who's not going to offer them support or additional development and stuff like that, maybe there's a market here. And that's, that's how the journey of Argus got started.

Very interesting. So it sounds like you find a— or a problem was dropped on your lap and you just run with it. Pretty much.

Yeah, yeah. Well, once we got the— once we started working on it and we saw the technical challenges with it and we saw that it's really hard to apply, uh, let's say older technologies to it, and we had to start using deep learning and things like that, we saw that maybe there's a good reason why there was no solution for this before. It was— it would have been really hard to do this accurately and at scale with earlier technology. So it's It seems like it could have just been a case of it couldn't be done, but now there's the technology, so now it could be done. So here we are.

Sounds like the pivotal moment there was that interaction with, with the school, but, uh, it's still more so in the, um, maintaining the cameras. Uh, you mentioned the military and you mentioned, um, using AI to discover landmines. Tell us a little bit about that. Sounds fascinating.

Oh, yes, certainly. So it's been a while since I've thought about this. So the— we worked with— we worked on the program that was closest to deployment. So it was a technology that was already pretty, pretty advanced in terms of its maturity. And we worked on a sensor that, that's mounted ahead of a truck that can see underground. And so if you imagine there's a radar each with a bunch of sensors. So it's an array of sensors, each one measuring a point in the ground. And what it does is it sends an electromagnetic wave down into the ground and reflections happen each time the material changes. So imagine you've got some dirt and then you've got the mine, that would be a reflection. And then it continues going down and sending us reflections. So we see things that look like this. balls, hyperbolas.

And was this an implementation of AI, or that was not?

The radar is entirely— it's just a radar, it's physics, right? They have to do some processing, um, that, that involves some AI, but that was like the vendor magic, so I don't know too much about it. But once we got a good picture, then once we got a picture, that's when the fun began. Because I told you, it looks like a ball, it doesn't always look like a ball, it Looks like all sorts of stuff. And so we had to develop algorithms that make the truck beep at the right time and not beep at the wrong time, because otherwise the truck will stop, will have to stop each time, because if it beeps, it means there's something there and the soldier doesn't want, you know, to get harmed. So they have to stop the truck and investigate. So the idea was to reduce false alarms as much as possible so that they can keep driving and go to where they need to go.

So the potential combination of technologies there, like a lot of things in our industry, is possibly an unmanned vehicle with, you know, AI and stand them with the, you know, technology already in place to minimize danger in a way, right?

Yeah, absolutely. I know, I imagine that's the long-term goal, that it wouldn't be a person that needs to drive that truck because, yeah, just casualties.

Right. Well, and so, uh, you know, minimizing people in harm is the job. That's security for us, right?

Yeah.

Um, let me ask you, your background in academia, I'm sure it has impacted your professional life in the private sector. Um, how does that professional, um, or corporate side is impacted by academia and when it comes to problem solving?

Well, The PhD process is a very special one. You get used to people asking you a lot of questions about anything you say. So you better be confident about the things you say, or say them but not very confidently. And that process really forces you to be careful, you know, and be careful about what you think you know and what evidence you're using in order to come to a certain conclusion or to make a certain assertion. And this is a general process, you know, a general thought process and thought pattern. But in the real world, things are a little bit difficult— different because, well, in academia, it's okay to say you don't know and you just, you say, all right, I'm going to take another 3 months and research this. In the real world, you need to make a decision and you need to move forward. So you have to find some way to deal with imperfect information. And that's, I would say, would be the biggest change and the biggest challenge.

You know, I heard someone tell me before, make a decision and then make it right. That seems to apply perfectly in what you're sharing. It's almost like there is no perfect answer sometimes. You just have to move forward and make the best of it or make it right in a way, right?

And that's true for very many things. development, for anything, because you want to get customer feedback at the end of the day, and you, 'cause that's ultimately who you're serving. So the sooner you can get something in front of someone to tell you, yes, this will help me, or no, this is not going to help me at all, is really the signal you're looking for. It doesn't, whatever's going on in your brain and internally in the company and data you've collected, it's not relevant until the rubber meets the road, which is the customer saying, I will pay for this or not. Right.

Ultimately paying for it, correct? Not just liking.

Yeah.

Well, and, you know, I'm sure now that you've, you know, been in security for this many years, what do you think are some of the most common challenges facing the security industry today?

I think it's difficult to to deploy a new technology because there's— because safety is involved. And so people want to be sure that the new technology is both going to be helpful but also not cause issues with the existing technologies and the existing infrastructure. So, you know, testing is something that's very important and making sure that any threats that might occur because there is something new introduced into the system is properly managed and that there's proper visibility into how the system is operating altogether.

Right. You know, I think sometimes, especially in speaking specifically about AI, I think that we need to reimagine how it's going to be implemented in an organization. It's not just bringing AI into the organization. And this is just based on conversations we have with different end users and other leaders in the industry. But how do you see AI contributing to addressing some of the challenges across the industry?

So there's 2 ways I think you can look at it. Either you say, imagine that AI could just do the job, you know, and then we'll introduce people into whatever gaps there are. Or you can say, well, we have people, let's see how we can help them with AI. And I think the first approach, while tempting, is very challenging to do because when you actually play with some of these technologies, you notice that they make a lot of mistakes. They make unpredictable mistakes. They don't really— they recognize patterns, which for a lot of things is great, but it's not enough because the pattern needs to be contextualized. So for example, if you have a person that's crossing a line and you say, all right, I'm going to learn that pattern. Well, a person can cross a line for a lot of reasons. They could be doing something bad. They could have made a mistake and just crossed into somewhere they shouldn't. They could be sick, you know, and if they fell over. So you can't just use a pattern recognizing engine to be your starting point and then say, oh no, it's cool, and then the people will figure it out. Whereas if you think, well, I have people and they're really good at certain tasks like contextualizing information or taking action to remediate any problems, any cybersecurity issues, any vulnerabilities that are active threats that are going on, but finding those threats is such a nightmare because it's so boring and time-consuming. And with the quantity of data that we're processing, it's just not really feasible for a person to be sitting and logging into every server, reading all the log files, looking at all the camera images. So really, I think at this point, thinking about how to augment people's workflows with AI is the most congruent at this time. Might change, might change soon, I don't know. But right now, I think that's the easier way to think about it.

Yeah, that's a great answer. You know, I feel that, you know, when you think in terms of security specifically, you have physical security, you have IT networks, cybersecurity, and then the human factor. And augmenting, to me, that's the right description of the new involvement of humans within the process of securing a a location or an architecture, right? What are the potentials for AI to be, to be used in, you know, let's call it the corporate world versus the private sector or education? What are the differences that you see that will contribute to AI implementation in either side?

I think the threat landscape they face is very different. And so I would start with that and say schools have— it seems like schools are, in the US anyway, being hit by a plague of active shooters problems. They have, you know, they have usually physical grounds that are indoors and outdoors. They have a lot more, they have some very specific threats. But on the cyber side, I would say that the school probably has fewer devices that they have to worry about and fewer assets that they need to worry about, including intellectual property. So the things that need to be secured are just different than at a company. However, the tools bear a lot of similarity because the problems always happen where there are gaps, where someone didn't have an easy way to track where there are connections that they should be looking at. So for example, If the school or the camp or the private sector is depending on certain hardware like their cameras and access control and speakers all for their security, and for whatever reason they don't have a good way to know, oh, this panel, this access control panel is no longer working, or this camera went offline, or this camera that's supposed to show me who's at the door is blurry, Then they— that's a gap. That's a gap that could be an issue due to cybersecurity. Someone could have hacked into it and made a change. It could just be a— it's definitely a physical vulnerability because now, you know, whatever operational assumption you made about physical security is no longer physically secure because you didn't put a guard at that door because you said, I have a camera. Camera's out though. Camera's not camera's not showing the view. So what is it doing? You don't have security at that door, and it's certainly a cyber physical vulnerability because it's something that well, it's something cyber, but it crosses over into a failure of security at the physical level. So now, if you do have a threat that's coming up, like an active shooter thing or someone trying to do unauthorized access. for whatever reason, trying to get into a room they shouldn't, trying to plug in a cable where they shouldn't, stuff like that.

Sorry.

You don't have the protection that you thought you had. And that's a gap that can be plugged. That's a gap that people can have some way to track so that when there is a problem, because there always is a camera that goes out, there always is an access control panel that stops working, people need to know so that they can resolve it. And although the threats could be different depending on the sector, the human in the loop should really be used for solving problems. And if you don't have software tools or monitoring tools or visibility tools, however you want to think about it, to give you the information that the human can act upon, then that's a gap. That's a very big gap.

It seems to me that this technology can be a really good complement for a digital twin. Have you guys worked in any projects that include digital twins in industry or elsewhere?

It's, it's something I'm familiar with. And when you have a— whenever you, um, build something like that, you need to take into account synchronizing your model for the physical world. And so if you've got discovery tools and you've got You know, you've got easy ways to keep that digital twin up to date. It gives a good sense for people for where things might be missing. However, it's something that needs to be maintained over time, and it's certainly helpful if you're trying to model adding new components into it, but you're kind of limited by the software. So if your model can't model a certain risk, then having a digital twin might be a bit of overkill. So it's something— it's a helpful tool. You just need to remember where, where it— where your model ends and where the real life, uh, begins.

Well, it sounds to me that we're talking about collaboration, right? And different, uh, levels of collaborations. How do you see the collaboration between researchers, technologists, and practitioners? Just to continue to drive AI into a more cohesive solution for end users and your clients in general?

Yeah, so the AI community, that's the one I know best, has really moved to publishing a lot of their papers in open access, which is great. And some of the bigger companies have been publishing a lot of their models with more permissive licenses so that people can play around with it. There's even datasets that could be used free of charge or without restrictive licenses. And so that makes it much more possible to take the latest and greatest from research land and apply it in the real world. Because if people are developing things but it's inaccessible or the code is impossible to to replicate, which are definitely very real possibilities, then, you know, we're all stuck. So it's been really great to see how the research world, who is working on interesting and important problems, makes it— has lowered the barrier to adopting some of these things as we go to present them to customers.

Right. You know what I found is that people, when they hear the term AI, to them signifies an all-encompassing solution. when in reality there's 6, 7 disciplines or subcategories within AI that contribute to a potential one single solution, right? And so I think that to your point, you know, uh, the academic community needs to present this in a way that people understand it and minimizes the friction of implementation. But, um, I'd like to bounce back a little bit on your, in your career, you know, you as a leader of an organization What are the challenges that you face in the day by day as the CEO of a growing organization? What are the things that you aspire your team to be? Tell us a little bit about your life as a leader.

Yes, certainly. It's definitely been a transition because in the early years it was me and my co-founders, Itzik and Joel, who were individual contributors and, you know, trying to grow a company. But now I think Some of the bigger things would be, I guess there are 2 different things. Hiring is a big one where—

Very important.

And each person you bring, each new person you bring kind of changes the character of the company, especially we're a relatively small company. So every person matters a lot and the, you know, how they think, how they work affects the organization. And hopefully through the interview process, it's someone who you find to impact your organization positively. The idea being that everybody has skills and everybody has, you know, a background that you can learn from and you can develop from. And then, but similarly, the organization itself has a DNA. And so how do you make sure that their, you know, their contributions mesh well into the fabric of what is your organization today so that you can move forward and improve tomorrow.

Right. And that's culture, right? Creating a culture specific to your organization. So speaking of culture, um, I think, and you're talking about bringing new people, um, of course in the industry you have 2 sides of the question, right? Qualified folks and walk them into a senior position And you have people that just started. Potentially some of the viewers might be people interested in the conversation that are really not, you know, yet in the security industry. They may be finishing a degree and they're interested because you have a background in academia that, hey, maybe there's a good space to transition to. What, what would be your advice to those folks looking from the outside in, uh, early in their careers, uh, and how to become part of it, or why become part of the security industry?

Yeah, uh, I think that one of the things that has emerged post-pandemic is that the security industry isn't one that's affected by other more traditional cycles, and that security is something that people are very actively thinking about now and interested in, especially as cybersecurity has really permeated our lives. Like, you see ads on the subway about, you know, buying, you know, multi-factor authentication software. So it's really become a very common thing to think about. And security is something that we all, you know, grow up thinking about, but maybe not so actively. And now that it's become a field that's adopting new technologies, it's a field that is that is becoming more open to, you know, modern trends of using AI, using cybersecurity standards, using general, you know, corporate standards that it's a very exciting field to be in because if you can bring an idea that, you know, you learn that's a modern idea, there is likely to be a way that it will get implemented in the security industry, Because if it's a best practice somewhere, it will at least be considered as something that people might want here.

Absolutely. Now, thinking about the future, obviously, as a founder of a company, it's always part of your job to be strategic about it. But generally now, the next 5 years, 10 years, what do you see being the advancement that will impact cybersecurity and physical security the most?

The most, uh, that's always a tough question. Let's see, I think that, um, one thing is, one thing that doesn't change much is, uh, or doesn't change a lot over the years is budget. So the question is, what can you fit into the budget? Because your needs will change, but the budget doesn't. And you have systems that need to be maintained that costs stuff. So I think doing more with what you have is going to be probably the biggest trend. And so that comes from using the equipment more efficiently, meaning not needing to replace a camera every year, let's say, because, you know, you maintained it poorly. Or it could be reusing the same camera for multiple purposes, not just security, but also— Let's say you want to have a better sense for where people are spending time in your space, or you want to monitor the doors for whether someone's keeping them open and that's why the air conditioning keeps running, or you want to have a sense of who's in the office and who's not. Just, there's a lot of different things that you can do with having a security camera somewhere or security hardware somewhere. Your network equipment can help you assess certain things as well. And so finding creative ways to use what you have and looking for solutions that will let you in the future use them creatively, I think, is what's going to be the trend. Because we know that AI is probably going to be in there somewhere. So you want to make sure that it's something that can be in some way used by AI, whether it's by letting the devices be controlled by the AI, if, you know, to a limited degree, of course, that that device can get some, uh, that you can get information out from that device so that better decisions could be made. I think that's kind of the, the direction of, of the field.

Excellent. And now, introspective, you know, introspectively, um, looking back at your earlier part of your career, um, you know, in the corporate or academia, what advice would you give yourself, uh, now knowing what you now know, to your younger self? What would that be?

Um, am I speaking to someone who wants to start their own company, or who am I giving this advice to?

You can give it to yourself, uh, if you could have, or to a new person, which is— that's the target, right? We're targeting that advice from someone starting knowing what you know now.

Yeah. What's working and what? I think there are a couple of things to pay attention to when you want to start a company. You need to have something, something that you want to sell, and you need to have a team, of course. It's really hard to do things alone. And you want to, you need to know who you're going to sell to. And I think if you have 2 of those 3, you can get started. If you have only one of those 3, it's gonna be really— it's gonna take just so much time before you get anywhere. Because, you know, having an idea is not that easy. And well, fortunately, I got lucky there because Duke gave me that idea. And then finding who to work with and who to sell to, is, uh, you know, that, that's like number of steps number 1 and number 2 of the business. So if you have— they say you, you want to exploit your unfair advantages, and that's really a place where you want to make sure you have an unfair advantage.

That's a great answer. Well, Dr. Brejman, I really enjoy our conversation. I think this is a good point to, to ask you to give us a little bit of background on the Argus, your company, and how to reach you guys in the case that someone would like to learn more about your solution?

Yeah, absolutely. So Argus is software to give you visibility into cyber-physical threats of your security system. So problems that cross over from cybersecurity gaps into physical problems. So for example, if a camera is not viewing the— giving you the view you expect, if a camera is not recording, if a camera stops working, if an access control panel stops working, whatever the case may be, you need to know about it because you are making operational assumptions about your devices working. And if they are vulnerable and something happens, well, all your operational assumptions go out the window. This has effects on liability, on compliance, all of which depend on your equipment working. And so if you want to learn more, you can contact us at info@ai-rgus.com. And yeah, we're always happy to chat and learn and partner with companies to see how we can help, you know, improve their security posture.

Well, like I said, thank you so much. Feel free to contact Dr. Richmond and his team. Uh, for my part, I want to thank the audience for joining us today. Uh, please comment, give us more questions, uh, either for me or for Dr. Richmond. And again, thank you for your time and see you in the next episode. Thank you.