On November 4, 2026, the workshop entitled “From Intelligence to AI Risk Management: Turning Data, Reputation and Geopolitics into Secure Business Decisions” took place at SMAU Milan 2026.

The event provided an opportunity for Salvo Castiglia, founder of Kriptia and security manager, to share his reflections on AI and Risk Management. Below is the full transcript of his presentation.

Introduction

Approximately four billion euros: that is the amount lost to theft. But there is an even more alarming figure: 5% of revenue is lost to internal fraud, and fraud goes undetected for an average of around 12 months. We are not talking about cybersecurity or hackers. We are not talking about analog or digital threats. We are talking about something that goes beyond both.

Good morning, everyone. My name is Salvo Castiglia, founder of Kriptia and security manager. Today, in this workshop, I will try to offer you a different perspective on how companies should approach security compared with how it has traditionally been understood.

But first, I have a question for you. Who uses an AI system, an agent or a chatbot in their company? Practically everyone. And that means this concerns you.

Imagine asking: “Is this mushroom edible?” The answer comes back confidently. But the question could just as easily be: “Is this supplier reliable?” The answer might be yes.

The problem is that artificial intelligence always provides an answer. If the mushroom is poisonous, the AI may not know. And the problem only becomes apparent afterwards, when the damage has already been done and perhaps we are already in hospital.

In this presentation, I want to take you from quick answers to verified answers, and explore the consequences for those responsible for this process. Above all, we need to know when we can rely on, or trust, an answer. But let’s take things one step at a time.

The Five Questions of the Workshop

These are the five questions I proposed for this workshop:

1. Why corporate security is an investment that generates value, rather than merely a cost.
2. Which areas corporate security covers beyond physical and cybersecurity.
3. How to identify the main risks.
4. How security improves reputation, customer trust and the ability to attract talent, which is a major challenge today.
5. Which tools and methods are needed to build an integrated security system.

The Company as a Community

Let’s begin with the social role a company should play.

A few months ago, I wrote an article for La Voce di New York entitled “Corporate Security as Social Infrastructure.”

I started with Aristotle’s concept of human beings as political animals: beings who fulfil their nature within a community.

A company is exactly that: an organised community of people who share rules, objectives and responsibilities. Within a company, identities, values and behaviours are shaped, and those behaviours then extend beyond the company into the wider community.

One example is Colleferro, about 50 minutes from Rome. Today, we know it as a municipality, but Colleferro originated around BPD, an explosives factory established in a former sugar refinery.

The entrepreneur first built the factory. Then he needed workers and engineers, so he began building houses, followed by places where employees could gather after work. He created a community around the company.

In 1935, Colleferro became an independent municipality. The factory came first, and the factory generated the community.

Today, however, the opposite is happening.

Anyone from Milan has seen it: companies close themselves off, no longer open their doors, and put up wooden panels that, incidentally, are not broken down but set on fire, potentially causing even greater damage.

These are painful scenes because companies are no longer opening themselves up or helping to create a generation capable of facing the future.

And when a company closes itself off, it is not a secure company. It is an isolated company.

To be secure, a company needs to open itself up and spread its message, so to speak.

The Company as a State: The Missing Function

Let me suggest an exercise: look at a company as you would look at a state.

Governance. A state has a government; a company has a board of directors or a sole director.

People. A state has its population; a company has employees, collaborators and everyone who belongs to the organisation.

Territory. A company has its premises and boundaries.

Laws. There is Legislative Decree 231, internal regulations, the code of ethics and the various rules the company applies.

Police. A company also has its security guards and internal security personnel: its own internal policing system.

Foreign policy. Internationalisation is the company’s foreign policy.

But there is something every state has that almost no company has: intelligence.

No serious state enters negotiations with another country, opens an embassy or signs an agreement without first having someone collect, verify and analyse information.

In companies, however, we send people abroad with little more than a suitcase, completely exposed.

A manager closes a deal with a supplier they have never met before, evaluating them solely on personal rapport.

A company enters a new market, chooses a partner, signs an agreement or moves into an unfamiliar country, effectively operating in the dark.

It has a government, people, territory, laws, police and foreign policy, but it lacks the eyes: intelligence.

That is why I say a company is an incomplete organisation. It has all the functions of a state except the one that allows it to see what lies ahead.

And I am not referring only to multinational corporations, which often have efficient systems, but also to SMEs and startups. They have all these functions, yet the fundamental element is consistently missing: the eyes.

Risk Perception: The Tiger and the Mosquito

Then there is the question of leadership.

To understand risks, we need informed leaders who do not rely on personal impressions but know how to recognise a risk before it becomes a vulnerability or a problem.

Let me ask you a seemingly simple question: which causes more deaths?

If a tiger entered this room, everyone would run away. If a mosquito landed on you, you would probably just swat it.

Yet mosquitoes cause more deaths than tigers every year.

Our perception of risk follows what frightens us, not what actually causes harm.

And between the internet and artificial intelligence, which causes more harm?

The instinctive answer might be artificial intelligence, because today it increasingly overlaps with human activity.

But it is the internet that generates all of this. The internet contains all the answers, and artificial intelligence simply helps us retrieve them.

AI: Real Superpowers and False Superpowers

Let’s start with the good news.

AI makes us feel a little like Superman: it gives us real superpowers, such as speed.

But it also gives us a false superpower: the feeling that we know everything.

The confident answer about the mushroom is a false superpower. Asking artificial intelligence whether a mushroom is poisonous or not illustrates exactly the issue.

But even Superman has his kryptonite.

Artificial intelligence often behaves like a superhero trying to save someone: it wants to help, but it does not always succeed.

So the question is not whether we are for or against artificial intelligence, but how we organise its use.

There is no doubt that AI makes us faster, and this advantage must be incorporated into risk management and intelligence carefully and under controlled conditions.

And how do we use the extra time AI gives us today?

Often in the worst possible way.

Cats used to be the symbol of social media. Today, we make cats cook carbonara.

It’s funny, but that is how we use the time we have gained.

Speed allows us to do more, but it also enables us to generate falsehoods. Artificial intelligence amplifies misinformation and fabricated narratives.

From Search Engines to Proposed Answers

Let’s go back in time.

There was once a society of hunters and gatherers.

About 30 years ago, search engines arrived, marking the internet revolution of that era: “Googling” something, going to Google and asking it virtually anything imaginable.

With artificial intelligence, we ask for an answer, but it is not the same as searching on Google.

A search engine gave us a series of sources. AI, unlike a search engine, can replace our own reasoning by giving us the answer we want to hear.

In theory, we already faced this problem when search engines first appeared.

Thirty years ago, saying “Google said so” was something people would dismiss: “Google told you that? I don’t care.”

Today, the same thing happens: “AI said so? I don’t care.”

But that is not the point. The real issue is understanding how to manage it.

Search engines have made our lives easier, and nobody would want to go back.

Over the years, we learned how to use them. They did not tell us what to do; they provided sources. They did not replace ethics, judgement or responsibility.

Artificial intelligence goes one step further: it does not merely find information; it proposes answers.

Anyone Can Generate False Information

Article 21 of the Italian Constitution establishes freedom of expression: everyone is free to express their thoughts, and the press must not be subject to censorship.

But in a world where anyone can publish and anyone can generate content, a new issue emerges: anyone can generate false information.

This is the problem companies face today.

Companies no longer simply need to search for information. They must defend themselves against false information and know how to recognise it.

And who does that within a company?

Intelligence.

We need to embed an intelligence system within our organisations.

AI Without Brakes

Now for some less encouraging news.

Artificial intelligence without safeguards is like a car without brakes.

It does not matter how powerful it is, how much horsepower it has or how large its engine is: AI without safeguards can cause damage.

What are brakes for?

In Formula 1, brakes are among the most important systems in the car.

A car without brakes is not faster. Either it moves extremely slowly because it cannot stop, or it goes too fast and crashes at the first corner.

Brakes allow us to go faster, because only with reliable brakes can we push the limits.

And that is exactly what we need to do with artificial intelligence.

You may have heard about an incident reported in August 2026 involving tests in which an AI system was instructed to purchase tickets without being given any limits.

It was told to buy a ticket at the lowest possible price, and the AI discovered vulnerabilities in the system and altered the price.

It did something illegal, not because it was malicious, but because nobody had set boundaries.

Its objective was simply the one it had been given: find the cheapest ticket.

Start With What Matters

Now let’s connect this to the business world.

We start with what matters.

Remember the tiger and the mosquito: we should not focus on what frightens us, but on what can actually harm us.

Who or what can be harmed, or cause harm, within a company?

• People, first and foremost.
• Information. How is it classified? What can I share externally, and what must remain confidential?
• Processes. Who decides where money goes, how decisions are made and how those decisions move through the organisation?
• Reputation, which we usually address only after something has gone wrong, because until it happens, we never imagine finding ourselves in the headlines.
• Business continuity. Have you ever considered what would happen if your company stopped operating tomorrow? Is there a continuity plan?

Four Ways to Identify Risks

Here they are, in summary.

Observe. This is what I do most often in companies.

When we conduct an assessment, everyone talks about documents and procedures: “We know how to do everything.”

Then we visit the operational department and find a turnstile with a badge reader.

The company tells us everything is perfect and everyone uses that turnstile.

But as we observe, we discover an employee whose badge does not work, perhaps because the system is complicated and requires procedures they do not have time to follow. So they simply climb over it.

The turnstile is there and it works, but nobody has ever observed whether that solution is appropriate for the location where it was installed.

Listen. Listening, observing and understanding what happens inside a company are fundamental steps in improving risk management.

Remember. Anything that has happened can happen again. Incidents, reports, complaints and audits must be treated with the utmost attention.

Look outside. Failing to see what lies beyond your own boundaries, or not knowing what is happening to competitors, for example, is itself a risk.

An incident affecting a competitor could also affect us.

The example of hacked refrigerators, which you have probably all heard about in the news, comes down to passwords that were never changed from their factory defaults and software that was never updated.

Yet I suspect that no supermarket chain using those refrigerators is currently developing an alternative system or updating its infrastructure, because it assumes: “It happened to them. It won’t happen to us.”

Once this information has been collected, we build a risk matrix: we establish which risks are more serious and which are less serious, and address them accordingly.

Once vulnerabilities have been identified, we assign a risk level and determine where immediate action is required, where risks should be reduced and where they can be accepted.

Let me give you a little spoiler.

In companies, I often hear people say: “Well, we have insurance.”

Insurance can often protect against financial losses, although not always.

But all the other issues we discussed remain: reputation, business continuity and the ability to attract talent.

Bringing Order to Data

Let’s begin to understand how to organise everything, starting with digital disorder.

Today, companies deal with large amounts of disorganised data. We do not know where folders are stored or who can access them.

We have OneDrive, SharePoint and shared folders that we open to external users without knowing who is viewing them, and there is no clear structure defining how everything is organised.

Above all, I now encounter multiple AI systems within the same company, provided by different vendors, with nobody knowing who manages them or who purchased them, perhaps because the employee who knew has left.

Organised data combined with artificial intelligence means faster decisions.

Disorganised data combined with artificial intelligence creates even more confusion and more errors.

If the confusion already exists within the organisation, AI simply amplifies it, because it does not even know where to look.

There are four key elements, equally valid for an SME and a multinational corporation:

1. Inventory. What data do we have, and where is it stored? You cannot protect what you do not know you have. If data is sitting in a folder nobody monitors, I cannot protect it.

2. Ownership. Who is responsible for that folder, those archives or that account?

3. Classification. A small number of clear, understandable categories that are consistently applied throughout the organisation.

4. Access. Who can read what, whether they are people or AI agents? Another spoiler: within a company, an AI agent should be treated like a colleague, no more and no less, with its own clearly defined access permissions within the system.

This is not an IT project.

We are talking about organisation, housekeeping and taking proper care of our tools.

That is where we start.

If we want to discuss intelligence or conduct a risk assessment of our organisation, we must first put our own house in order.

Intelligence: From Information to Decision-Making

At this point, we have established order, and we can move on to intelligence: turning information into decisions, which is what really matters.

Without intelligence, risk assessment is difficult to manage.

Think about what happens in many company meetings when something is found to be wrong.

Often, the company fails to recognise the problem, not because it refuses to see it, but because it is convinced that the way it has always operated is the right way.

Even when faced with an inspection or audit, it cannot understand how that process could be wrong: “We’ve always done it this way.”

It struggles to recognise the reality of what has happened, and I can assure you that this is an extremely difficult exercise.

Data, reputation and geopolitics are very often handled by three separate departments, and intelligence is the function that can bring them together and enable better decisions.

Consider the case of engaging a supplier in another country, a typically geopolitical situation.

Translated into an intelligence process:

1. Collect: Open-source information and field intelligence.
2. Organise: Verify, discard and connect information. Artificial intelligence can be extremely helpful during these stages.
3. Analyse: Determine what the information we have collected and organised means for us.
4. Decide: Reach a risk determination. Artificial intelligence can make decisions on certain matters, but always with safeguards and human review wherever human judgement is necessary.

Returning to the mushroom example, which we had almost forgotten: the second step is organising the information, and the fourth is making the decision.

Reputational Analysis and Travel Security

Reputational analysis is a tool that helps companies assess suppliers, business partners and managers, but it must be proportionate to the level of risk.

Not everyone requires the same depth of investigation.

Companies need to know how to conduct reputational analysis, but failing to conduct it at all within an organisational context is undoubtedly a failure.

And artificial intelligence alone is not enough, because it:

• confidently invents information;
• confuses people who share the same name;
• cannot see everything, because it does not have access to every relevant system;
• above all, fails to properly weigh the reliability of sources.

An error involving someone’s reputation can cause real harm, and a person must take responsibility for it.

Travel security is another area where artificial intelligence can support us today, but always as part of a broader analytical process.

Where the Physical World Ends and the Digital World Begins

At this point, let me ask you: where does the physical environment end, and where does the digital environment begin?

At Kriptia, we have coined the term Phygital to bring these two worlds together.

Physical and digital are no longer separate worlds. They form a single perimeter that must be protected, and our vulnerabilities lie precisely at the intersection between them.

A cloned access badge opens a door, but that door may provide access to much more, including the network. Just imagine the door to a server room.

A stolen laptop is not merely a theft: it is a potential data breach.

These two dimensions are intertwined, and that is why a Phygital approach is essential today.

Areas of Security and How to Identify Risks

Beyond physical security and cybersecurity, security covers a wide range of areas: people, information, processes, suppliers, business travel, reputation and business continuity.

Today, it also includes the use of artificial intelligence, with measures proportionate to the size of the organisation.

How do we identify the main risks?

What are we protecting? From what? Where are we exposed? How likely is the risk? How serious would the consequences be?

And above all: who is responsible for addressing it, and by when?

The question we should all be asking ourselves today is: what could bring our company to a halt tomorrow morning?

What is our main vulnerability, and how are we addressing it?

The New Skills

The skills required within companies have changed.

Today, having a security manager is no longer enough. We need a security manager who can consider multiple dimensions.

We need:

• Intelligence analysts;
• Data and AI governance;
• Crisis management, which is fundamental today, particularly in terms of communication;
• Training and awareness, which are also evolving: they are no longer limited to explaining rules but must create an understanding of why information and awareness are necessary.

From the department of “no” to a measured “yes.”

Strategy is the first obstacle we must overcome.

Think of the executive who, with little humility, tells you they are excellent at everything. The assumption takes hold that they know what they are doing, and everything else will follow.

Humility is the foundation.

For years, corporate security was the department of “no”: it cannot be done, it is not allowed, it is too risky.

But in a company, simply saying no also means closing off opportunities.

We must also learn to say yes: a measured, carefully considered yes.

We need to know when to say it and how to make that decision.

Why Security Is an Investment, Not Just a Cost

Let’s take an example from the banking sector.

It is true that many things have changed, with less cash in circulation and a significant number of bank branches closing.

Nevertheless, the banking sector has invested €400 million per year in security, and the results are reflected in the figures: from 80 bank robberies in 2023, the number fell to 51 in 2024.

Where investment is made, the results of security measures become visible.

It must also be said that crime has shifted from bank branches to motorways.

In recent years, we have increasingly heard about cash-in-transit vehicles being targeted on motorways, precisely because criminals know that banks have security systems, while private security operators do not have the same level of protection.

The focus has shifted.

But the fundamental point remains: if I do not invest, I have a security problem.

For any company, there are four drivers of value:

1. Avoiding losses: Theft, fraud and operational disruptions.
2. Continuity: The company must remain operational.
3. Opening new markets: Increasingly, customers and tenders require security assurances before contracts are signed.
4. Shared value: Every company must foster trust within its organisation.

Customer Trust and the Ability to Attract Talent

Security and governance are at the heart of the fourth question: how can security improve customer trust and the ability to attract talent?

At the top are the board and the security function.

The security function makes recommendations, senior management makes decisions, other departments implement those decisions, and everyone in the organisation is informed and aware.

The most difficult challenge is translating return on investment into measurable data.

CEOs are accustomed to reading reports in which ROI is expressed in numbers.

But how can security provide those numbers?

If security successfully prevents damage, it saves money that never visibly leaves the company.

How can I quantify a robbery that never happened?

If I have done my job properly, that figure often does not exist, and the hardest part is getting the CEO to understand its value.

How can we address this?

By bringing business metrics into the discussion: how many robberies occur across the sector, and how many have we experienced ourselves, for example.

As we have said, a company is a community, and its security contributes to everyone’s security.

Returning to the article I mentioned earlier: a robbery, an organised theft or a fraud does not affect only the company.

Insurance may compensate for financial losses, but not for social, reputational or human damage.

Transferring risk does not replace prevention.

These consequences do not remain within the company’s boundaries. They extend beyond them.

The Security Plan

The security plan is the essential system that companies need to establish today.

It must:

• analyse risks;
• establish priorities;
• assign responsibilities;
• define procedures;
• identify mitigation measures;
• schedule regular reviews.

For those interested in exploring this further, some of the best security plans today are those developed under the ISPS Code in the maritime sector or those used in civil aviation.

They have clearly defined both the approaches and the practical tools required.

The security plan must be an integrated system, not a collection of separate projects, with rules governing artificial intelligence incorporated into the plan itself.

And it must be proportionate.

This does not apply only to multinational corporations, but also to startups and SMEs.

These elements must be present.

Tools and Methods for an Integrated System

But at this point, is everything digital or not?

As we discussed, this brings us to the final question: which tools and methods are needed to build an integrated and proportionate system?

The eight tools we have examined cover risk assessment, the security plan, governance, roles and responsibilities, reputational due diligence, travel security and, above all, rules governing the use of artificial intelligence, including training.

Integration means ensuring that all these elements communicate and work together.

Answers to the Five Questions

At the beginning, I made you a promise concerning five questions.

Here are the answers.

1. Security is an investment because it prevents losses, ensures continuity, opens new markets and creates shared value within the wider community.

2. Security extends beyond physical security and cybersecurity: it includes people, information, processes, suppliers, business travel and, today, the use of artificial intelligence.

3. Risks are identified by starting with what matters, and every high-priority risk must have a named person responsible and a deadline.

4. Security builds trust among customers and employees, and today it plays a fundamental role in retaining talent.

5. An effective system is built using a limited number of tools, integrated and proportionate to the organisation’s needs.

Conclusions

I would like to leave you with the image we started with.

A company is like a state: it has a government, a population, a territory, its own laws, its police and its foreign policy.

But it consistently lacks one fundamental function: intelligence, which allows it to see what lies ahead.

Today, with artificial intelligence, building this capability has never been more accessible, provided we remember the mushroom.

AI will always tell you yes.

Your job is to know when to believe it, and establishing that distinction is essential.

Our role is not to always say no.

What we are dealing with in companies today is a reliable, affordable and accessible system in which artificial intelligence plays a decisive role.

Today, companies must know how to distinguish false information from genuine information, and to do so, as I have already said, they need intelligence.

Intelligence is not just about being the eyes of the organisation.

It means organising the data we already have, finding new information and incorporating it into a security framework.

All with a clear and simple objective, without fundamentally disrupting the organisation’s existing structure.