96% Human Error: Why AI Security Starts with the Human, Not the Model

From the Travel Tech Podcast newsletter for episode 21, 96% Human Error: Why AI Security Starts with the Human, Not the Model.

There's a moment in this week's episode that I keep thinking about. Yagub Rahimov, a founder who spends his days mapping enterprise AI vulnerabilities, described standing in a crowded airport terminal being asked by a gate agent to read out his passport number, his date of birth, and his email address at full volume. He stopped the agent. He refused. The people around him did not. That gap between what a security practitioner sees in that moment and what most travelers accept without thinking is exactly why I wanted his perspective on the show. Across aviation, travel tech, and AI, I suspect a lot of you will recognize both sides of that scene.

He started his career at the intersection of cybersecurity and behavioral analysis, and has since built Polygraf AI into a company working with defense contractors, large enterprises, and call centers handling half a million interactions a day. He pioneered a patent-pending behavioral control layer that operates like Grammarly for data compliance, showing users what they are about to expose before it leaves their device. One enterprise deployment reduced data leak prevention violations by 72% within a month. Listen on Apple Podcasts, also streaming on Spotify and YouTube.

The conversation kept returning to one specific fault line: the travel industry believes it has a technology problem, when what it actually has is a behavior problem, and those require entirely different solutions.

The gap between a security policy and a departures board

That tension has a structural cause. Travel is a high-trust, high-velocity environment where identity verification requirements were built for an era of paper documents and analog fraud. The processes that result (reading passport numbers aloud, typing dates of birth into seatback screens to unlock entertainment) were designed for accuracy, not for adversarial conditions. They assume the threat model stops at the terminal door. It does not. The person next to you at the gate now has the three data points most commonly used in account recovery attacks, and they did not have to do anything to get them.

AI is compressing the window between data collection and exploitation. Rahimov described a concept from defense intelligence called mosaic intelligence: even when identifying information has been stripped from a dataset, repeated interactions with a frontier model allow it to reconstruct the identity behind the data from behavioral patterns alone. The implication for any travel operator feeding customer interaction data into a third-party LLM without a tokenization layer in between is significant. His own team demonstrated this with a $25M internal enterprise chatbot that, on its first day of deployment, allowed employees to extract colleague salary data, bonus structures, and year-end promotion lists. The model had not been breached. The model had worked exactly as designed.

This week's guest is Yagub Rahimov, CEO and founder of Polygraf AI. We cover the anatomy of AI agent vulnerabilities, why behavioral control rather than model security is where the real leverage is, what a genuinely privacy-respecting travel product would look like from first principles, the economics of AI-powered universal QA for customer operations, and how red teaming needs to change when the architecture it is testing is changing faster than the testers can keep up.

Key Takeaways

• Agents are users, not software: AI agents inherit user-level access to calendars, communications, and data systems, which means social engineering attacks scale to them the same way they scale to humans.
• 95% of breaches are behavioral: IBM's cybersecurity index and recent impact data attributes 95% of cyber breaches to human error, which means most AI security investment is being directed at the 5%.
• Tokenization decouples utility from exposure: Stripping personal data before it reaches an LLM and re-matching it after processing delivers equivalent analytical output while keeping raw identifiers out of third-party model training pipelines.
• Visibility drives compliance faster than policy: Real-time behavioral flagging, the kind Polygraf's tool provides, reduced DLP violations by 72% in one enterprise deployment, a faster result than any post-hoc audit or training program had produced.
• Random QA is a 20th-century practice: At 5 to 10 cents per call with LLM-assisted processing, universal quality assurance of every customer interaction is now economically viable, and the travel sector has not caught up to what that makes possible.

🔧 Two to Build from this week's episode

Yagub's core point: travel's weak spot isn't the AI model, it's the human standing at the gate. Two places that turns into something you could actually ship:

1. Audit where you ask for data, not where you store it. Most privacy work points at the database. Yagub's argument is that the leak happens earlier, in the gate agent who asks for your date of birth out loud, the seatback screen that wants a passport number, the call centre script nobody's reviewed in years. Run an LLM over those customer facing scripts and flows and score each one against a single question: what could a stranger standing nearby learn? It tends to surface more than a pen test does. → Analyze passenger data for privacy risks

2. Stop making people say their secrets out loud. A passenger reads out their date of birth across a crowded gate for one reason: it's the cheapest way to prove who they are. Biometric or Second factor verification does the same job silently: you confirm identity without anyone nearby overhearing it. The catch: biometrics don't remove the risk, they move it onto you. A leaked QR code or password can be reset. A leaked biometric can't. → Biometric passenger verification

Alex Brooker, Host of the Travel Tech Podcast, Founder of Airside Labs