Cybersecurity in IT has moved beyond perimeter defense and compliance checklists. In the latest episode of FutureTalks by IT Insights, Justyna Szymańska-Laskowska speaks with Kathrina Meisl, Managing Director at secunet International GmbH and Global Head of Customer & Strategic Projects at secunet Security Networks AG, about the forces reshaping cybersecurity and what they mean for both business leaders and technical teams. Kathrina works at the intersection of security, digital infrastructure and large-scale public-sector innovation, including homeland security and automated border control.
The conversation is especially relevant now because AI is amplifying both the speed and sophistication of attacks while organisations still struggle to operationalise cyber resilience. Kathrina argues that the real challenge is not whether digitalisation should happen, but how to build secure systems that can scale without becoming a burden. That tension runs through the entire episode.
Key takeaways
- AI is an accelerant, not a replacement for cybersecurity strategy. It can improve detection and efficiency, but it does not solve weak governance or poor architecture.
- Security and convenience must be designed together. A process that is secure but unusable will fail in practice; a usable but weak process creates unacceptable risk.
- Regulation should enable scalable trust. Especially in digital identity and border control, frameworks are necessary - but they should not be written faster than the technology matures.
- Paper-based workflows are still a hidden security problem. Traceability, access control and auditability are far stronger in digital systems than in manual handoffs.
- Career growth is built through small decisions. Broad experience, mentorship and numeracy all compound into stronger leadership over time.
AI in cybersecurity: Scaling factor, not a new security model
AI in cybersecurity: Scaling factor, not a new security model
Kathrina’s first and most important point is that AI is not fundamentally creating cybersecurity as a new category; it is scaling everything that was already there. Threat actors already existed. What has changed is the speed, volume and sophistication of those threats. As she puts it, “AI is not a force coming in that’s new or reshaping the whole industry. It’s just that the whole industry is now scaling up due to AI.”
That distinction matters for executives: if AI is treated as a standalone security strategy, organisations risk confusing tooling with resilience. AI can accelerate detection, automate repetitive tasks, reduce human error and improve process efficiency. But it is not, in her view, a business model customers can simply buy and resell as value in itself. Its value emerges when it reinforces a broader security and operations strategy.
For technical leaders, the implication is clear: AI should be evaluated inside the architecture, not above it. The question is not “Should we use AI?” but “Where does AI reduce cycle time, improve signal quality, or strengthen controls without introducing new blind spots?” In security operations, for example, AI can help triage alerts or identify anomalies faster. But if identity governance, access control and incident response are weak, AI only speeds up an already fragile system.
Kathrina also ties AI to the larger force of digitalisation. Secure digital infrastructures are no longer optional in business, government, or public services. As more processes move online, the dependency on reliable infrastructure deepens. In that context, cybersecurity becomes less about a specialized IT function and more about operational continuity.
Secure digital Infrastructure depends on regulation, not despite it
Secure digital Infrastructure depends on regulation, not despite it
One of the strongest themes in the episode is the connection between innovation and regulation. Kathrina uses automated border control as a concrete example because it reveals the full complexity of secure digitisation. A passenger sees a smooth, fast process at an e-gate. Behind that experience lies a web of dependencies: software, hardware, legacy integrations, identity verification, document verification and legal requirements that all have to work within seconds.
It’s very convenient for the passengers… but it has to also be secure.
That convenience-security tradeoff is not abstract – in heavily regulated sectors such as insurance, finance, and public administration, digital transformation fails when security is treated as an afterthought or when regulation is written without understanding how systems actually operate. Meisl does not argue against regulation – she argues for usable regulation: frameworks that enable interoperability, cross-border consistency and scalable trust.
Her position is pragmatic rather than ideological. In some areas, especially around AI, she suggests Europe may be regulating ahead of the technology’s actual deployment. “Maybe we over-regulate there, before the AI is even part of processes,” she says. The bigger point is not anti-regulation sentiment. It is that regulation should not lock in assumptions before real-world adoption patterns are visible.
Are you ready for future threats?
Is your cloud infrastructure safe? Run an audit with our cybersecurity experts and find out.
Security and convenience must be designed together
If a digital process is secure but unusable, users will route around it. If it is usable but weak, the organisation inherits unacceptable risk. Kathrina’s message is that security should behave like an enabler inside the workflow, not an obstacle placed on top of it.
The human factor: Why paper still creates security risk
Kathrina’s explanation of the human factor is one of the episode’s most practical insights: the best way to understand cyber risk, she suggests, is to look at mundane workflows where paper still dominates. Classified documents, public administration and inter-agency communication remain vulnerable because every handoff creates uncertainty: who touched the document, where it was stored, who transported it, whether it was altered and how long it took to reach the next person.
By contrast, digital workflows create traceability. “You can really see maybe who worked on the paper, who will work, who’s allowed to access it,” she notes. That visibility is not just operationally convenient; it is a security control. Access rights, logs and audit trails reduce ambiguity and make accountability enforceable.
Importantly, Kathrina does not romanticise digitisation – she acknowledges that the transition is uneven: in some parts of government and industry, digital systems are advanced; in others, Germany in particular still relies heavily on paper. That unevenness matters because hybrid environments often produce the worst risk profiles. Information starts in one system, moves through another and then lands in a third with partial oversight.
For technical leaders, the lesson is to map workflows end-to-end: cybersecurity is not only about firewalls, endpoint protection, or cloud posture. It is also about where data enters, where it is duplicated, who can touch it and how traceability is preserved across systems. For executives, the implication is that security investments often pay back not just in reduced incidents, but in process efficiency, accountability and better governance.
A more mature security program does not simply digitise paper – it replaces uncertainty with control. That is why Kathrina frames security not as a burden but as a necessary add-on to trusted operations.
Career growth, mentorship, and women in IT security
The conversation also turns to Kathrina’s career path and here the episode becomes very relevant for emerging leaders. She did not transition through one dramatic turning point – instead, her career evolved through a sequence of decisions: starting in controlling at Siemens, moving into strategy and M&A and eventually shifting into international customer work on complex IT projects. Her view is that career development is rarely one defining moment – it is a series of moves made by people willing to take on discomfort and learn new domains.
That is a useful counterpoint to the idea that people must choose one perfectly linear path. Kahtrina’s own trajectory suggests depth can come from breadth, especially when earlier roles teach fundamentals that remain useful later. Her controlling background still helps her today when reviewing contracts, numbers, and project performance. As she puts it, “When you understand numbers, you understand the business.”
Her mentoring philosophy is equally practical – she does not believe in a single ideal mentor. Instead, she has intentionally worked with several mentors over time, each stronger in different areas. Now she returns that model by mentoring others. “Being a mentor means listening more than telling,” she says. That line matters today more than ever because it captures the highest-value form of mentoring in technical and leadership contexts: diagnosing the person, not reciting generic advice.
On women in IT and cybersecurity, Kathrina is direct: the sector remains male-dominated, especially in senior leadership and in customer-facing roles. She does not overstate the issue, but she does not soften it either. The answer, in her view, is not to ask for special treatment – it is to build credibility through preparation, consistency, and professional presence. Negotiation is central here – whether with customers, peers, or leadership – and the ability to prepare well is what earns respect.
This section of the episode will resonate with women navigating technical leadership roles, but it is also useful for organisations. Diverse teams are not created by intention alone; they require visible role models, mentoring systems, and environments where expertise is recognised over stereotype.
Conclusion
This episode makes a clear case that cybersecurity in IT is no longer a narrow technical discipline – it is an operating model challenge shaped by AI, regulation, infrastructure dependency and human behaviour. Kathrina’s perspective is valuable precisely because it is grounded in real systems where security cannot be theoretical. Automated border control, sensitive documentation and cross-border digital services all require the same thing: processes that are both trustworthy and usable.
For business leaders, the message is to stop treating cybersecurity as a cost centre detached from digital strategy. For technical leaders, the task is to design systems that preserve traceability, reduce human error and scale securely. As organisations push deeper into automation and AI-enabled operations, the winners will be those that treat security not as friction, but as the condition that makes digital transformation sustainable.
