Show Notes
Some travel operators ask you to shout your passport number across a crowded desk and think nothing of it. While intentions are good (checking who you are), this episode is about why that is a serious security failure and what it would take to fix it. Yagub Rahimov is the CEO and founder of Polygraf AI, a company building behavioral security and contextual privacy tools for enterprise environments. In this conversation, he and Alex work through the specific vulnerabilities created when AI agents gain user level access, why human behavior rather than model failure is responsible for the vast majority of data breaches, and what a genuinely privacy respecting travel product would actually look like. What You'll Learn: Agent security: AI agents are a new category of user in the digital security pyramid, with the same system access as humans but no training in deception or social engineering. Deep fake risk: Voice cloning is already sophisticated enough to impersonate individuals convincingly to family members and colleagues, without any technical breach of the underlying systems. Mosaic intelligence: Even anonymized data fed repeatedly to an AI can be re-identified over time through behavioral pattern mapping, a concept Rahimov terms "mosaic intelligence." Behavioral control: Addressing human behavior in real time, before a violation occurs, is more effective than after-the-fact audit or punitive controls, demonstrated by a 72% drop in DLP violations for one enterprise client. Data in AI tools: Organizations that deploy internal LLMs without governing what employees input are creating serious exposure, as one $25M chatbot deployment illustrated on its first day. Travel industry failures: Asking passengers to recite passport numbers and dates of birth aloud in crowded gate areas, or type personal data into in-flight entertainment screens, represents a real and unaddressed privacy risk. Tokenization as a fix: Stripping personal data before it reaches an LLM and reuniting it with processed output via tokenization can deliver the same analytical value with substantially less exposure. QA at scale: AI makes universal quality assurance of customer interactions cheap enough that random sampling is no longer the only option, with one call center client processing 500,000 calls daily at 5 to 10 cents per call.
Time-Stamped Highlights: (00:00) Introduction: The airport data disclosure problem (00:00:42) What actually happened with Meta's Instagram AI chatbot (00:06:17) AI agents as a new user type: the security pyramid explained (00:08:57) Deep fakes in practice: voice cloning, elderly parents, and the CEO (00:14:36) North Korean infiltration via data science job interviews (00:20:54) How Polygraf detects synthetic speech in real-time video calls (00:28:42) The meeting note taker with 23 vulnerabilities (00:36:24) How Mr. Paranoid travels: loyalty status, one airline, mid-tier hotels (00:42:58) The oil and gas CEO kidnapping and the email summarizer attack vector (00:49:00) What travel companies get wrong about passenger data collection (00:30:10) Mosaic intelligence and why anonymizing data is not enough (01:07:07) The $25M HR chatbot and the 72% DLP violation reduction (01:14:12) Building the next OTA: tokenization, QA at scale, and simplicity (01:21:01) Red teaming, visibility, and why behavioral control is the next frontier
Guest bio: Yagub Rahimov is CEO and founder of Polygraf AI, a company specializing in behavioral security, contextual privacy, and AI risk management for enterprise clients. He works across defense, financial services, and enterprise technology sectors, and is an active contributor to conversations on AI behavioral control at venues including the Gartner Security Summit. LinkedIn: https://www.linkedin.com/in/yrahimov/ | Company: https://polygraf.ai/
About the Podcast: The Travel Tech Podcast features long-form conversations with leaders across travel and technology. The show explores how software, data, operations
More from Travel Tech Podcast
An AI asked to protect every passenger connection gave a flawless answer: cancel the flights. Kevin Hightower is Chief Innovation Officer at Cirium, where he leads Propulsion Labs, the company’s innovation group. He and host Alex Brooker, former colleagues at Cirium, discuss Kevin’s path from oceanic air traffic control at Lockheed Martin to Google’s drone delivery program, how AI is changing product development and decision making in aviation, Cirium’s aviation knowledge graph, and the data interoperability problems holding the industry back. What You’ll Learn Automating the routine: Lockheed’s oceanic ATC system let controllers comfortably manage 30 aircraft instead of a busy 7 to 15 by automating conformance checks and altitude probes. The three hour rule: No decision, from buying a car to buying a company, should need more than three hours of actual thought, with data gathering kept separate from thinking. Disposable prototypes: When AI cuts build time from months to days, the discipline shifts to throwing work away instead of defending ideas because of the effort already spent. AI as an accelerant for learning: Early career engineers who use AI to compress years of learning will outpace those who use it only to do an old job faster. Decisions, not dashboards: Most aviation decisions run roughly eight steps, and AI can now carry four or five of them before a human makes the call. The aviation knowledge graph: Aviation data starts with an aircraft and links orders, lessors, schedules, and tail swaps, so connecting it unlocks analysis no single dataset can. Efficiency before safety: AI will speed up flow management and sequencing well before it touches the safety critical systems that keep aircraft separated. The interoperability gap: Multi year, multi million dollar data lake programs rarely deliver usable value, and the real problem is combining data across boundaries while keeping control of it. Time-Stamped Highlights (0:00) Cold open: the AI that cancelled the flights (2:04) A Cessna ride to Embry-Riddle (4:48) "Do you want to kill people or save people?" Choosing air traffic control (6:26) Replacing paper strips over the Pacific (9:17) From Lockheed CTO to a quarter million drone deliveries (13:10) Why there's no one right way to be a product manager (16:22) The three hour decision rule (22:03) Formal testing in five minutes, not a few months (24:42) Fail fast, then fly everyone to Hawaii (32:39) Powering every decision connected to aviation (34:40) Behind the dip: analyzing every turn instead of one (47:17) Why nobody can predict the Charlotte arrival sequence (48:36) Could AI make travel worse for passengers? (54:09) Data interoperability and the $10 million data lake
AI made writing code nearly free, which only matters if code was ever most of the job. In this compilation episode, host Alex Brooker pulls together clips from seven past guests across travel software, airspace infrastructure, airline operations, corporate travel, content, and airline ancillaries who each arrived at the same idea independently. Alex Ragin of Zoftify puts a number on it: code is about 20% of a software product, and the other 80% is domain knowledge, process, and judgment. The episode follows that 80% through edge cases, daily operational disruption, fare construction expertise, and the question of what a product team's job becomes when execution costs almost nothing. What You'll Learn The 20/80 split: Code is roughly 20% of a complex travel system, and the remaining 80% is knowledge of how the business actually works. Vibe coding limits: A simple invoicing app can be vibe coded, but a CRM, ERP, or GDS cannot, because the hard part is specifying behavior rather than writing it. Edge case cost: One modest custom fields feature at Zoftify took about five days of internal and client discussion before it was ready to build. Failure at the seams: Complex systems break at their interfaces and edge cases, not on the happy paths that teams test and load test. No standard day: In airline operations, disruption from weather, aircraft swaps, or system faults is the normal state rather than the exception. Expertise outside the code: International fare specialists routinely beat GDS pricing engines by thousands of dollars by knowing where to break a fare. Where value moves: As development costs approach zero, advantage shifts to network effects, knowledge of customer pain, and position in the customer journey. The new job: When execution is cheap, deciding what to build and why becomes the core work for every team, not just well funded ones.
Two euros can decide who wins a metasearch sale. Inside most airlines, moving them is still revenue management's call, and it is rarely fast.
Everyone is racing to build the AI agent that books your trip, and nobody is building the thing that makes it safe to use one.
A guy who used to hand carry passports to airport cargo terminals just built the database he couldn't afford in 2018 for a fraction of the cost, and every application still passes through a human before it goes anywhere. Rob Lee is CEO and co-founder of Swift Passport and Visa Services, a company he started in 2008 helping private aviation clients navigate passport and visa logistics. In this conversation, Rob traces the industry from same day passport courier runs through the shift to eVisas and ETAs, and explains why his team uses AI heavily to build internal tooling while keeping customer data out of public AI tools and a human check on every application.