Episode 9: Bridging Physical and Cybersecurity: The Future of Security

Welcome to Executive Checkpoint, where we explore the pivotal issues shaping the world of security. I'm your host, Tino Urbina. Happy New Year. This is the first episode of 2025, and we're kicking this episode with a truly impactful discussion about the future of security. Today, we're tackling one of the most critical trends for the industry ahead, the convergence of physical and cybersecurity. And to help us with this topic, we have none other than Michael Gibbs, a globally acclaimed security strategist and founder of Global Insight in Professional Security. Michael was named the number 1 global security thought leader in 2022 and has dedicated his career to pushing the boundaries of what's possible in security. From his pioneering work with ASIS International to, to his insights on technology, technology like AI, IoT, and blockchain. Michael is here to shape us in, uh, the new vision for the future and guide us into 2025 with actionable strategies for success. Get ready for an insightful conversation as we explore how to integrate the physical and cyber domains in the transformative, uh, landscape of the future of security. Michael, welcome to the show. So glad you're here.

Thank you, Peter. Happy New Year. It's a pleasure being here, and that was quite an introduction, a kind introduction, and, and you, you set me up for, um, for a lot. But, uh, hopefully I can, uh, I can come through for you.

Oh, absolutely. We, you know, you have a great background, and, uh, I think most of the people watching, uh, they're familiar with your career. And but since there might be a few viewers that might not be as familiar with your career, would you Kindly share a little bit of your background, where you come from, how you started, and where are you today in security?

Sure. Thank you. And I'll try to move pretty quickly through this. I'm from New York originally, and I went to school. I went to Tufts University. I was a history and Spanish double major. And then I went to law school. I went to Harvard Law School and graduated. And I went into, uh, to law, and my first inkling of doing security— actually, I did security for concerts when I was at Tufts. So I was a security officer, but it was more to get into concerts for free than to actually do the security. I went to law school, as I said, after that and started getting interested in, in risk, and I kind of drifted over to criminal law.

Mm-hmm.

And once I got out of law school, I took a job working for the New Jersey Supreme Court, and I was a death penalty clerk at the time. New Jersey had a mandatory death penalty, or mandatory appeal for all death penalty sentences. And there were a lot of cases coming through, and I spent most of my time for the New Jersey Supreme Court working on those cases. I went into the private sector. I did some criminal cases, including more death penalty cases, but I drifted over to intellectual property. So I got into copyright issues and trademark, and I also got into workplace policy issues, workplace violence, discrimination, alcohol and drug use in the workplace. Practiced law for a few years and said, you know, I want to be the client. I don't really want to be the lawyer here, and I got into journalism. So I started writing about all these experiences and covering security topics and community topics. At this point, I was living in Washington, D.C. After that, I— it's hard to make a living as a freelance writer. I found a job working as an editor for Security Management Magazine, the ASIS publication, and that's really where my security career took off, writing about issues, learning about issues, talking to the experts and the masters, people who showed me how access control worked and how, how data was put on magnetic media and how, you know, every aspect, video surveillance. And so unlike people who kind of started hands-on, I started in intellectual capacity, learning about and writing about and writing about trends. Eventually got to know a lot of people in the industry, a lot of subject matter, and I was tapped to start the CSO Roundtable at ASIS, which is a group within ASIS, a separate membership group for senior executives. So Fortune 500 companies, major agencies, nonprofit organizations. And what differed from other elite groups in security at that time is that we welcomed and encouraged deputies to join so we could build the next generation of security professionals. So I almost effectively worked as a consultant in that job, doing surveys, providing advice and insight to members, and providing content. After that, we— when a new CEO took over at ASIS, I was tapped to be the Chief Global Knowledge and Learning Officer, where I was responsible for the magazine, all learning standards and guidelines, certification, and heading up the secure internal security at ASIS. So I had a lot of responsibility at that point. I headed up the ESRM effort to ingrain ESRM into every aspect of ASIS. I, um, uh, overhauled the magazine. Um, I was back in charge of the CSO Center again. Um, so, um, I had various roles, and as well as a— as an active practicing security professional. I left ASIS in 2019, started my own company, Global Insights and Professional Security, and as of Monday, I'm going to be a managing director at Kroll at the Enterprise Security Risk Management Division. Really excited about that. But in the last 5 years, I've been a security consultant, writer, researcher, slash attorney. So that's a quick spin through what I've done. Hopefully, that conveys the idea without getting bogged down in too much detail.

Well, what it says to me is that you have accumulated a lot of knowledge in the industry and You know, I think that law perspective as a, as an attorney is very key on getting, uh, very good insight when you have conversations with, with folks as an interviewer, right? When you're meeting these folks and getting— learning those gaps, seeing those gaps. Uh, reflecting on 2025, what are the trends? What are the technologies that you, you, you you see had huge impact last year for the security industry?

Well, you can't credibly talk about the security industry going forward without— as much as I cringe on having to talk about AI, it really is a game changer. It's not all AI is created equal. And obviously, there's different kinds of AI. There's AI tools for predicting, preventing cybersecurity threats. Um, there's AI that can go, or, and machine learning that can go through and pull data from, uh, from reports that look, or from audio or, or video, um, pull out things that you're looking for. And there's generative AI that can help write reports, um, uh, and, and articles. And, and, you know, so most attention I think right now is on generative AI because a lot of people dread to write the, you know, reports and, and, and memos and other documents. And generative AI, I'm of two minds about it. It's good. I mean, it's amazing. I have to say it's amazing because it can do in 10 seconds what you can labor for hours over, right? However, I'm— and maybe I'm sounding like a Luddite here, but I fear it'll make us a little bit lazy, and the information— and most people know this— is not always correct. The writing is good, but it's kind of trite, uh, bland.

Right.

And you have to check it. You have to look at it. It's a good way to start out. The more prompts you give, the better off you are, but you've got to double-check it. Sometimes it makes things up. Known as hallucinations. I, for fun, every once in a while, I check on ChatGPT, the latest versions, and I, I say, tell me about Michael Gibbs, um, as a security professional. And then they'll spit out something that's usually pretty good, but then it'll always get something wrong. It says Michael Gibbs is the author of 5 books on blah, blah, blah. I'm not an author of any book. I've contributed chapters. I've done a lot of reports, a lot of articles, but not any whole book by myself. So, and it continues to make that error. And I run that because it's easy for me to tell immediately. I know myself pretty much better than anyone else does, right? So I know immediately.

Encouragement, you know, it's like, hey, you should write a book.

Yeah, well, actually I am.

So there you go.

See, I am. Uh, I've written a lot of it actually during the Christmas, New Year break. It's on leadership, but I haven't asked AI to, um, to work on that yet. I may put in some concepts in AI, but AI is great for framing a topic and, and getting ideas. And, oh, I forgot about that, you know, tell me about issues in executive protection, and then it'll give you a list of things like, oh yeah, I haven't— I didn't think about that consideration. But if you want something novel or particularly insightful, I say rely on yourself. Use generative AI as a cue, not as a crutch. That's a big one, AI. You know, I'm also close to weapons detection. That has vastly improved in the last couple of years. Weapons detection in, you know, days gone by were metal detectors, and, um, you know, that would beep, and, and when you— when it detected anything metal, knife or a gun. Now with new systems, there's so much more technology layered in, including AI, um, visible, uh, cameras. They can identify like a shape in a pocket or some item that looks to be a weapon. There's technology that will tell you when somebody is walking up to a portal and they see it and they turn around, and that may be a sign that they have a weapon and they're trying to avoid it. There's technology that ensures that secondary screenings are performed correctly that will actually that AI will show how the screening should occur and what parts of the, um, the body or bag should be checked, things like that. Um, it's integrated into other systems like access control, video surveillance, um, alarms. So that's, that's another technology I'm, I'm high on. Um, there There's also all sorts of robotics out there. You can't avoid that. Drones, I'm also, um, very high on, um, for their capability in both private security and public law enforcement, notwithstanding the hysteria over all those drones over New Jersey.

You want to talk about that for a minute?

Sure. I actually, um, was part of a witness to the— not to the drones, but New Jersey law enforcement hosted a symposium on those drones and among law enforcement personnel at Rutgers University, and they discussed the issue and exchanging information between federal, state, and local partners on, on drone sightings or unidentified— whatever they call it now. It's not UFO anymore, but I forget the phrase. And really, the issue is how transparent are we, how communicative are we in describing or explaining what these are. Now, nobody there knew, or no one said they knew what those were, but there were quite a few people who could— who swore that they saw drone swarms And some drones the size of cars or SUVs coming in off the water, where, you know, you're not going to feasibly have a station, a drone, um, you know, off the coast unless you have something, you know, you know, something set up there. So a lot of people wondering what that was. There was talk that, you know, maybe it's possible spying from, you know, nation-state, but that's very, very unlikely for many reasons. There's also talk that it was military looking for radiation, um, that there might have been, you know, components of a dirty bomb or, or nuclear materials that they were looking for. Nobody really knows, at least among the people I believe that you know, at the state and local level. I figure someone at the federal level must know what it is. Um, but the way it's been explained away by the FBI and DHS is that the vast number of sightings are— I'm not— they're either recreational drones or law enforcement drones, so they're legitimate, or they were fixed-wing aircraft. Or there were stars or other items in space. Now, a couple people I've talked to who have seen them said, yeah, I've been in law enforcement and identified a lot of people for a lot of things and people over years and years. I know what a drone looks like, and I know a drone the size of an SUV. And, and the way objects would move in the air— no plane would move like this, no commercial or law enforcement drone would move like this. So I, I'm— I agree, they're probably right that most of these sightings are not— or either legitimate drones or not nefarious drones, because most people don't look up and look for those things, right? They saw these lights in the sky, so they say, I see a drone. But there are a certain number of— at least 100 of the 5,000 tips that the FBI got are unexplained. that they're not— they haven't, they haven't said, okay, those, you know, they either, either not regular drones or they have no explanation for it. So it's a really interesting issue, but it's died down now because we have a whole new set of issues.

The hyper-awareness of the situation, I think, increased the number of sightings and of course panic a little bit. I mean, it's understandable. And unfortunately, like you said, the, the The security industry is on a high alert for several reasons. You know, the attack on executives, including the insurance CEO. And just a few days ago on New Year's Day in New Orleans, the attack on a truck that unfortunately there were fatalities. And you want to touch base on that a little bit on The situation, I know it's a fluid situation, some of the information is still not confirmed, but we believe we have a perpetrator, possible motive and associations.

So yeah, that just underscores the continuing threat to soft targets, you know, whether it's bars, a downtown area, Houses of worship, stadiums. Really, any determined adversary can attack, and there's not much you can do. I mean, there are things you can do, obviously. With the bollards being replaced in New Orleans, that wasn't a great time to do it. Perhaps there was pre-surveillance by the attacker and knew that was going to happen. You know, the police cars that were blocking the street. They weren't wide enough, or they didn't you know they they should have imagined someone would drive on the sidewalk. There, you know, you can put public public works vehicles across streets. You can put garbage trucks, other perhaps maybe disused fire engines or other surplus material. Obviously, don't want to take real fire engines or or working fire engines out of service. So in that case, yes, they could have done things, but to make it difficult. But all you need to make— do is make one mistake, leave one, you know, road unblocked, or somebody moves their car or whatever, or just somebody forgets or gets there late. You know, you— we have to be right all the time. It's a cliché, we have to be right all the time. The bad guy only has to be right once. So— My point about being the determined adversary, you can get to it, that what we need to do is, is harden the target and really discourage the person, and hopefully they'll abandon their plan or they'll get nervous. And in the worst scenario, we divert them, displace them somewhere else, and hopefully that other place also has appropriate measures. But it's a tough situation, but it also underscores that You know, for the past few years we've been looking at political, um, political terrorism. You know, left extreme right-wing terrorism, white supremacists, extreme left-wing terrorism. Islamic terrorism, it appears, is alive and well. Um, as you mentioned, there was some evidence. We're starting to to get some clarity. The person who drove the um. pickup truck into the crowd in New Orleans, had an ISIS flag. And that person didn't— was an American citizen. And there's all sorts of, um, comments about the person coming over the border, but I believe he was a U.S. citizen but had been radicalized. He wasn't— he wasn't, um, in the Army for years, but he had been radicalized and he had been off. And I had read— I've read that His ex-wife's current husband said that he had been spiraling. So there has to be some sort of, or should be some sort of intervention or response to someone who could be, who could become a threat actor, who's, you know, has the capability, has the, the mindset to you know, to disrupt, to cause terror, to, to infiltrate. And but there's so many people out there struggling with some sort of mental illness that what are we going to do, watch every single person whose wife or husband or uncle or son says that they're having emotional problems? You know, that's, that's a tall order. It's, it's more than a security issue. It's a mental health— it's a, it's a, um, you know, national healthcare and mental health issue. And as I'm rolling into the national, you know, the healthcare issue now, we're— that kind of dovetails into, um, Luigi Mangione, right? And the— as the purported killer of the UnitedHealthcare CEO, there's that whole active threat. And that's actually more concerning to me. Not that You know, vehicle ramming aren't, and there have been a lot of them, and they're easy to do. They don't cost anything. Really can do it anywhere. But they've had a long history with this Luigi Mangione case. This is a person who doesn't fall into any of this. Person wasn't radicalized. Is not a white supremacist as far as we know. Not you know, not a left-wing ideologue extremist, not an Islamic, or not any religious terrorist as far as we know.

Right.

He was radicalized in that he has, um, a gripe against the healthcare industry. He has a bitterness, you know. So this is a grievance-related, um, attack. And what's more concerning about the attack than maybe the attack itself is that the outpouring of support for him, that people are saying, yeah, he was right. You know, people are— the healthcare system is a rip-off. They don't take care of people. Insurance companies are just trying to make as much money as they can. They don't care about people. And something like 40% of people between the ages of 18 and 29, um, have a favorable impression of him. Which is amazing. So we got a whole new class of threat actors out there who are now anybody with a grievance. And we've seen a copycat. I think we've seen a copycat recently, and we see wanted signs in New York saying, okay, Brian Thompson, I believe his name, he was the first one, but now here, here are the next couple to go. That's, that's terrifying that we're targeting people like that. So I know I'm going, I'm sort of going stream of consciousness here, but—

No, this is great.

Yeah.

So, and you know what, to me it, it kind of sort of circles back to how, how do we, you know, all of these situations have been sort of opportunistic, hard to identify, and in a way, uh, not necessarily a surprise, but surprising for a lot of security professionals, starting with Executive Attack, following by this situation, uh, attack in the truck in New Orleans. You, you see that in Europe, in Germany, they just have that similar attacks over the last few years, and it's not that it's expected, but they have some, uh, time and experience to identify those type of situations. And unfortunately, in the US, I don't recall, um, having one that is linked directly to a terrorist group. Maybe I'm wrong, but—

There was one in 2017 in New York that might have been, um, where the bus went on a, um, Bike path on the west side along the Hudson River, but I don't remember who the perpetrator was in that. It's scary when there's enough of these things.

Yeah, uh, white supremacist group ramming their car in protesters.

But yes, there was that for sure.

But you know what, like you said, this is one of those things where we're seeing a lot more, um, we've seen a lot more from the political standpoint of view, right and left. and point of views, right, nationally. But we sort of kind of walk away from that more global perspective of attacker. And it's something to definitely be aware. I think in a way, going back to AI, that might be the right tool to multiply the efforts of law enforcement and intelligence officers to, you know, clean a lot of the information and come up with a more more sophisticated to outline or highlight the potential threats. You know, what's your take on that?

Yeah, those are good comments. I think there might be a place for AI in social media monitoring because you get a lot of people who are radicalized online, lone wolves or people who are disgruntled or have their own axe to grind, who you know, kind of sink into the depths, and then they find like-minded people on the internet, and they get into these little communities, and they're kind of encouraged to. And you look back at some of the terrorists— and I want to call them terrorists— who, you know, who went into, um, you know, into the mosque in, in New Zealand and tried, um, Brandon Tarrant or something like that, um, Uh, the, the gentleman— or not a gentleman, the person who shot up the camp in, um, in Scandinavia somewhere. I can't remember if it was Norway. And these people have been lionized, right? They become like, um, religious figures, um, you know, as, as on the front lines of like sort of a holy war to win back, you know, traditional values or whatever. And You see, they're actually online. There are— you see these people sanctified. There's a picture, there's a meme going around of, um, Luigi Mangione kind of looking like a saint. And they do the same thing with these other mass murderers. And they see— people see that and it's normalized and it's, it's, it's, um, glorified. And I think there's a role AI for monitoring this kind of stuff. And, and you see people are putting out— they, a lot of times they, they write their feelings, they write manifestos, or they post something like, this is it, you know, I'm going in and I can't take these Jews anymore, these Muslims, or these Christians, or these liberals, or these, you know, Trump fanatics. You know, there's something out there.

Extreme of extreme.

Yes. So I think— and they're really good people. Um, it's kind of scraping the internet looking for this kind of stuff. But I really, you know, AI could, you know, really help. Um, now you're going to catch a lot more, um, you know, um, innocuous things than, than actual threats. But then there has to be a system to sift through to, you know, to identify, you know, distinguish or the, uh, legitimate threats from just, you know, something that's, that's chimerical or doesn't exist.

Right. Well, I'm shifting a little bit. And, you know, again, these are, these are conversations happening in the industry for a lot of our colleagues. So, but shifting a little bit, you know, coming to people getting in the industry, I mean, there, there's awareness of security is needed. And maybe someone is starting their career, and they're looking Uh, up to, um, ways to engage with the industry. Uh, what, what's your recommendation? What skills do you feel are going to be important for a newcomer in 2025?

Well, it's almost axiomatic in, as in the profession, you know, once you get above, say, like a guard or like an entry-level position, that wherever you work, it's almost as important for you to know what your business does, how they make money, how how they operate as it is to practice security, because security is so attuned to the business requirements, the strategy, and the culture of any institution that it really behooves any security professional to know how— to know the culture, to know, um, uh, all the processes to know, um, to know the margins, to know exactly how they make money, what loses money. And really, you should be a jack of all trades and know how every part of the business works. Then you become invaluable, and really they can plug you in anywhere. Um, and that's how you get to become a strategic advisor. If not to the CEO, then to the C-suite. If not to the C-suite in big companies, at least to someone who reports to the C-suite. So I would know how the business works. I'd study up on your industry and study up on your specific company. Now, beyond that, I think it's good for everyone to have some cyber skills and physical security skills. So I think over time, though it's very, very slow, we're seeing convergence of physical and cyber. It's Some of the skill sets are different, but at core they're the same. They're protecting people, property, and information, and it's just different modalities of doing it. There's a lot of overlap. The reason we're not seeing more integration is because IT started— or cybersecurity started sort of as a function of IT because it was very technical. It wasn't a management-level role. It wasn't, you know, senior-level position. But, uh, technology and information became so important in the digital age that information became more oftentimes more important than physical products. And the IT departments spawned their information security departments, and they were technical people who all of a sudden started to get managerial roles and business roles and became, you know, were elevated because it became so important with people losing information or privacy concerns and with compliance and with attacks and ransomware and privacy issues. Like, the liability is so high for having information stolen that all of a sudden that role became a board-level issue. And so you had that had grown independently. And then you had sort of the physical security people on the side who, oh, that's too technical for me, right? So there was a division. Now, some places converged, and in some places, you know, the physical security always had oversight over cyber, but it's pretty rare. And so now you have a division, and now people are seeing the commonalities, but cyber was able to develop independently from sort of an operational and tactical function to a strategic function. And now we're trying to kind of tie the two back together for efficiency, for better security oversight, for cost-effectiveness, and, you know, other, other benefits.

Yeah, I mean, to your point, I think that a lot of Curiosity for someone coming into the industry. I— that's a great point, to have a view, understand that, a clear understanding of what the business is and those and where, where they monetize. But, uh, it's been important also is to be curious and, you know, find associations, right?

Yes.

To get an experience. You know, I think the shortest distance between knowledge and actionable, uh, abilities is who you know and gaining that experience from there, that little shortcut there.

100%. If I could summarize, join an association that you want to, you know, if you're, if you want to do, um, you know, healthcare security, join International Association of Healthcare Safety and Security. If you want to be in campus safety, IACLEA. If you don't know and you want to be a security professional practitioner, maybe ASIS. Um, if you want to get on the sort of the technical side of it, the equipment side, maybe you want to be SIA or ESA, right? Those are just some of the groups. If you're specific to a country, if you're in, in the UK, maybe you want to join the, um, the Security Institute there. Different groups. If you're more on the risk side, maybe you want to do RIMS or ISRM.

All—

and find, maybe more important than that, find some mentors, some people who can guide you already in it, because these are people who have made a career and a life of helping other people. They're in it because they have big hearts and they want to, you know, not many people are making that much money. No one's getting— there are very few millionaires except people who are, you know, own the companies. These are people who are dedicated to lives of service, lives of service. And want to help. You'll find that people are spectacularly generous when it comes to asking them for their time because they want to see to the succession. They want to see good people come into the industry and be caretakers and that people are educated and sympathetic. We want to bring more people in the industry so seek people out.

We, we need, we need more people in the industry than are equipped, curious, and eager to learn, right?

Exactly.

And that, and that, with that thought, what would be something that looking back when you started your career specifically in security, you would've told yourself now with this years of experience and knowledge? I think we might've covered it with your advice of seeking a mentor. Mm-hmm. But any final Words of wisdom for the audience?

Yeah, you know, I think I was around during the birth of cybersecurity. I mean, not back in like the '70s or '80s, but my career was getting going in the '90s. And that was really when cybersecurity was starting to become a corporate function. I was working at ASIS at the time. And I wish I had been more persuasive for ASIS to get into that area because everything was changing. It became physical security, almost became, um, you know, uh, subjugated to cyber. Cyber is traditionally— or not traditionally, but today it's more often a strategic issue than physical is, even though physical security lives are are at stake. I think I would have probably learned more about cyber to the extent I could and gotten a certification in it at the time. I mean, I, I did what I could, but I should have immersed myself more in the cyber aspect because it's taken over.

Right. Well, Mike, this has been an incredible conversation. I think that there's a lot of soundbites that will play out over the next couple of weeks. I do appreciate it. Thanks for getting us started with 2025. And, uh, uh, if people want to contact you for advice, mentorship, or otherwise business-related issues, how can they get in touch with you?

Yeah, absolutely. LinkedIn is the best way. I always check my LinkedIn, and, um, I've had quite a few people just reach out to me on LinkedIn who I still haven't met who I help advise. So I've never met them, but from all over the world. But they're good people, and I hope I've helped them, you know, advance their careers in security. And I certainly see by what they're doing on LinkedIn, they seem to be making a difference. So yeah, please do.

Well, again, thank you so much. And for the audience, thank you so much. We appreciate everything you've done for us in 2025— or 2024. eager to see what's coming up in 2025. Like and comment, and, uh, see you in the next one. Thanks.

Thank you, Tino. Pleasure.

Bye-bye. Thank you.