Axonius Adapt25 | Kara Keene, TransUnion

Clips
News
More from Axonius Adapt25

Kara Keene

Manager, SOAR ASR

TransUnion

From shadow IT to singular truth: Axonius reshapes cybersecurity visibility

Fragmentation isn’t just a technical issue in cybersecurity — it’s an existential one. Shadow IT, software-as-a-service sprawl and disconnected tools leave teams squinting at their environments through fractured lenses, with no clear cybersecurity visibility into what’s safe or exposed.Axonius’ Dean Sysman talks with theCUBE during Axonius Adapt25.“That’s led to dozens of different tools that organizations need to use, and each one only sees a part of the picture, a part of the one piece of that puzzle of the organization,” said Dean Sysman (pictured), co-founder and chief executive offer of Axonius Inc

play_circle_outline Attack surface reduction challenges

play_circle_outline Collaboration and partnerships in security

play_circle_outline Maximizing Cybersecurity Success: Soft Skills, Trust, and Diversity Tips for Women in Leadership

Info
Transcript

Kara Keene, TransUnion

Kara Keene

Manager, SOAR ASR TransUnion

Exploring cybersecurity collaboration with Kara Keene at Axonius Adapt 2025 features a comprehensive discussion on the intricacies of cybersecurity and collaborative strategies within organizations. Kara Keene, senior manager of Attack Surface Reduction Engineering at TransUnion, shares valuable insights on bridging departmental divides and fostering a culture of cooperation. This conversation delves into the challenges and opportunities in the cybersecurity landscape.

Keene offers a nuanced perspective on the importance of agility and communication ... Read more

explore Keep Exploring

What considerations should be made when thinking about attack surface reduction in light of the expansion of services, vendors, and apps, as well as the use of personal devices in a company's network? add

What conference are you currently attending, and how has the tool Axonius helped improve collaboration between security and other departments in your organization? add

What impact do soft skills, such as diplomacy and customer service orientation, have on one's career, particularly for women in security or management roles? add

bolt Powered by CUBE AI

Kara Keene, TransUnion

search

Rebecca Knight

>> Hello, CUBE Nation, and welcome back to our coverage of Axonius Adapt '25 here in Dallas. I'm your host, Rebecca Knight, alongside my co-host and analyst, Jackie McGuire. One thing that is just so clear is that there's cybersecurity, that's this exceedingly-technical and complex thing, but it's also so much about humans and the humans that are charged with keeping organizations secure.

Jackie McGuire

>> If we trust statistics, humans are involved in about 100% of cybersecurity incidents, so I would agree.

Rebecca Knight

>> Exactly. With that, I would like to welcome our next guest to the show. She's Kara Keene, senior manager, ASR Engineering at TransUnion. Thanks so much for coming on, Kara.

Kara Keene

>> Thanks for having me.

Jackie McGuire

>> Super excited to talk to you. One of my favorite coworkers I've ever had, Ed Bailey, is a TransUnion alum and I know you know him. So, when I saw TransUnion, I was like, "This is going to be good because I know they have a phenomenal security team."

Kara Keene

>> Yeah, Ed Bailey is the man. He was the Cribl man, and now he is onto bigger and better things, but it's crazy that we both knew him.

Jackie McGuire

>> Yeah.

Rebecca Knight

>> Small world.

Jackie McGuire

>> Fantastic.

Rebecca Knight

>> So, I think a lot of people are familiar with TransUnion as a credit bureau, but why don't you tell our viewers a little bit about the organization and about what you do there?

Kara Keene

>> Yeah, so TransUnion, first thing that comes to mind when I describe it to people is it's your credit scores, but TransUnion is a global information and insights company. So, in order to be one of those, you have to collect a lot of data from everyone across the whole world, which is why I really like my job, my position there, because I know that there's a lot of important data to protect, and we do that on the attack surface reduction team. So, I support the vulnerability, threat-management, applications security teams specifically. Any engineering, and really, anything that they need at any time comes to our team. It's really collaborative and it's nice to work with them.

Jackie McGuire

>> Yeah. Attack surface reduction almost sounds like a oxymoron to me because it seems like the attack surface is expanding exponentially as we add services and vendors and apps and bring your own device. So, how do you think about that? So, when you think about the attack surface and you think about reduction, what types of things does that usually entail, or what are the low-hanging fruits that you think organizations should be looking at?

Kara Keene

>> What are the low-hanging fruits? I mean, yeah, you make a great point in that reduction seems like an oxymoron. I think they were careful naming it not attack surface elimination, because I just don't think that it will ever be at zero, and then we'd have to ask, well, what's next? But the low-hanging fruits for us are the public-facing assets or the crown jewels. But I think that the bigger problem is identifying, what are my public-facing assets? What are my crown jewels?

Jackie McGuire

>> Especially a company of your size, I would imagine you guys have a lot of crown jewels.

Kara Keene

>> Right, right. We have a lot of mergers and acquisitions, which each have their own hierarchies of assets and products that they want secure. So, it's important that we look at our headquarters' perspective, but also that we work with the M&As in order to facilitate prioritizing their things against our record.

Rebecca Knight

>> So, how do you work, Kara? I know that sounds like a really broad question, but we just hear so much about the fragmented nature of this industry, but also that there's all these silos within organizations. How do you approach working with other departments and getting the context that you need to have the visibility of the attack surface?

Kara Keene

>> Yeah, actually, we're at the Axonius Adapt conference, and I'm about to plug Axonius. But when I was looking at that tool, it seemed like the perfect segue to working with the other departments, because when I first joined security here, it seemed adversarial, maybe to put it nicely, with other teams, as security barks commands and expects everyone to jump. And I've just noticed that and realized there should be a centralized platform where we're all working out of the same data, and we all have our own abilities to modify or develop things as we want without running into conflict. So, what I try to do is pull people into this tool, because I don't care if you're tagging things, it's not a production tool that the tags matter for vulnerability scanning. This is just an aggregator. So, I'm able to facilitate those relationships by, "What do you need? Let's build it. What do you need? Let's build it." And by just exchanging different types of... Security's reaching out to... It's like, "How can we help you?" Other teams are much more amenable to helping us when we do need it. Instead of barking commands, it becomes a project together, which has been really nice.

Rebecca Knight

>> So more collaborative and a partnership, really?

Kara Keene

>> Yeah, yeah.

Jackie McGuire

>> So, it sounds like almost diplomacy, like security diplomacy using Axonius as the olive branch.

Kara Keene

>> Yeah, yeah. I love that, Axonius as the olive branch. It really is because a lot of the times I feel like in diplomacy is usually give and take, compromise, but before it was like, "I need this. I don't need to tell you why. We're security." And now, "How do we do this together? And how do we do each other favors and just move it forward?" I love that olive branch comment. Yeah.

Jackie McGuire

>> I think it's worth noting that there are three women sitting at this table, which at a cybersecurity conference, you would not normally find. I think it's not a secret that we only have about 20% representation in security, depending on what study you look at. So, one, I think it's great. I also just spoke to a high school class yesterday that was almost half women, which made me really happy. But I bring that up because in talking about diplomacy, I try to emphasize how important it is not just to diversify our security teams, men and women, but just from diversified backgrounds. And so, thinking about diplomacy, a lot of women tend to bring soft skills with them that the more neurodivergent, and I say that proudly as a neurodivergent person, security team members don't always naturally have people skills. So, do you feel like those soft skills and the ability to bring more of a customer service-oriented, diplomatic, let's get to yes attitude has helped you in your career?

Kara Keene

>> I think it's helped me immensely. I mean, I have had great mentors and I've had great experiences that, I think supported as well, but my ability to work with other managers and branch out to other departments and just have normal and peaceful conversations, it gets your name out there, but in a positive way. I think that as a woman in security, there's this very fine line that you have to walk, probably across any woman in management as well, but between coming off too harsh and being called certain expletives or being too shy and not being seen as a leader. But by just having natural conversations and talking about mutual goals, it's been really a significant impact in my career. And it's much more enjoyable to work as a us versus the problem situation works for relationships and for work. So, I really think that's helpful.

Rebecca Knight

>> So, you're making it sound so easy in terms of creating these partnerships in this collaborative relationship with other departments, other executives, but can you talk practically about the kinds of behaviors that you exhibit as a leader in terms of cultivating this trust with your colleagues and in terms of collaborating and getting to yes, and being innovative, and, "Let's figure this out together," rather than, as you said, cybersecurity, there is an adversarial element to it and how do you get beyond it? So, if you can just reflect a little bit on what you do that makes it work?

Kara Keene

>> The first thing that came to my mind just off the cuff is I listen. So, listening to understand is something I work on in my personal life, I am gabba mouth, so-

Jackie McGuire

>> I don't know what you're talking about, really.

Kara Keene

>> So, I need to work on that in general, but that's helped me across the path and work by... I think when people feel listened to, they're just immediately open to working together more. And then, letting them know that you understand the problem, acknowledging the issues, that's great affirmation, which gets further buy-in. Then actually... How do you say it? Walking the walk, I think. So, you listen, affirm and then do what you are going to do. It just gets a lot of trust in people and in a peaceful manner. There's no yelling needed when everyone feels like they're on the same team. That's how I try to treat everyone at work, no matter my personal feelings. Yeah.

Jackie McGuire

>> Okay. Yeah, I try to go into most situations with the assumption that very few people operate with malicious intent and that it's generally lack of context and common sources of truth that produce more conflict than anything. So, again, going back to those soft skills. It sounds like having the patience to-

Kara Keene

>> Patience.

Jackie McGuire

>> Yes, the patience, the understanding, the empathy of... I think having worked outside security as well and having been the data scientists saying, "Hey, I want this," and they say, "No, you can't have that." Being able to really see things from both sides and understand that starting with a commonplace you agree is a lot easier than where you start to disagree.

Kara Keene

>> Yeah, yeah. I would actually extend what you said is listen to them and having worked in... I've been in data science before, you know what's possible and what's not. But I think as a leader, what's important as well is the trust, that when someone says something's not possible, then to trust in that, take that up and devise a new strategy, instead of forcing people down a path that is doomed in the first place. I think that that really people's impressions of you as a leader will be better, but also it's better in the long run to just trust the experts. You're in management, but that doesn't mean your ideas are the best or you are the smartest in the room. I think that the smartest people in the room are the ones on the ground.

Jackie McGuire

>> Yeah, I think if you're the highest ranked person in the room and you're the smartest person in the room, you're probably really crappy at hiring.

Rebecca Knight

>> Yeah, you're not surrounding yourself by the people you need to be surrounded by.

Kara Keene

>> There may be an ego thing there. Yeah, exactly.

Jackie McGuire

>> Well, yeah, I mean the skills that it takes to be a CFO or not, the skills that it takes to be the VP of finance or to do accounting. And the same thing in CISO. We were just talking with another former CISO about how you almost are a politician. To your point, as a CISO, you have to be a diplomat. You're kind of stuck in the middle. So, you need to be kind of an executive and board whisperer. And so, I think it's really important to kind of understand that there's a lot of different skills. And that each role within security should be the smartest in the room at that thing.

Kara Keene

>> 100%. Yeah.

Jackie McGuire

>> Yeah. So, what other backgrounds do you feel like you've brought into security with you that have helped how you work with other people and how you see things? So, did you do sports? Were you involved in art? Did you do other things in school or college that you feel like... Because I'm working on the theory that one, almost everybody in security is musical in some way, plays an instrument, sings, something like that, or is some type of art. So, what I tend to find is that people who come into security or from somewhat creative backgrounds, usually. So, were there anything that you could look at from before your security career that helped you succeed?

Rebecca Knight

>> Help her make her confirmation bias come true?

Jackie McGuire

>> Yes, please.

Kara Keene

>> I have bad news.

Jackie McGuire

>> Oh, no.

Kara Keene

>> I'm about to be the counter-example. I mean, we should get my sister up here because she is of the family... She also works in security, actually, but she's a musical prodigy and singer. But I was always more, I was a sports person. I would do anything to burn myself out pretty much. I'll join all the clubs. I just really like-

Jackie McGuire

>> Including your job. You'll do it-

Kara Keene

>> Yeah, exactly. I'll do it as much as you need until I burn myself out. But really, I just love being in many different clubs and experiencing different people. So, I did the baking club or whatever, and not great at it ever. Didn't really do much for it, but it was fun. But also, I did a test-taking club. There's test-taking competitions, that's real. But really,. Just broadening my horizons. I think that that helped as I met through high school, through college, by joining the sailing club at my college. I've never done that before, but it's tons of different people you interact with and I'm able to bond with a lot of people because I have a little bit of experience in a little bit of everything.

Rebecca Knight

>> Mile-wide and inch-deep.

Kara Keene

>> Yeah.

Jackie McGuire

>> So, context switching, being able to switch context from one weird group to another, and then being able to build bridges with people in all kinds of different groups who you may not normally interact with.

Kara Keene

>> Yeah, I just really enjoy people. I was just saying earlier at the talk I was giving people process, technology... People comes first, for some reason, we think of them last. So, I think that I prefer to think of it in the order we say it. Yeah.

Rebecca Knight

>> So, Kara, this is the first ever Axonius Adapt, probably the first of many. This company's only eight years old. What are the kinds of conversations that you're having at lunch and over the water cooler that are most interesting to you that you're going to take back with you at TransUnion?

Kara Keene

>> Ooh, that's a really good question. A lot of really good conversations. I think that the response to my talk that I gave about the ownership problem was bigger than I thought. I thought that maybe just our company had a problem assigning ownership to assets because it is where you start. Like, "Oh, we know about all these issues, but now who do I go to? What's important?" And realizing that other companies have the same issue. I mean, first, it makes you feel a little bit better-

Rebecca Knight

>> You're not alone.

Kara Keene

>> Right. But it's making me think more about what other context is missing when we're reducing the attack surface? What am I missing? What factors are important? And I'm having some of those conversations here with what's important to them to identify a crown jewel? That's been really helpful so far.

Rebecca Knight

>> Yeah. Excellent. Excellent. Awesome.

Jackie McGuire

>> Great.

Rebecca Knight

>> And then finally, last question, because I know that as you were saying, there's not a lot of women in cybersecurity and we want more of them. So, what would be your advice for young women watching theCUBE today, hearing you saying, "I'd like her job someday"? What would you say? Is there a certain thing you should study? Is there a certain-

Kara Keene

>> I think that I have a few core mantras that I like to hold to, and one was what my dad told me is that however you feel about being a woman in security, that may be what gets you in the door, but they keep you because you're good. They promote you because you excel and you'll show everyone. But for young people starting, I would say that just live by the worst they could say is no. I've got through a lot of my opportunities by just asking. I'm comfortable asking for just about anything now, but it did take a little bit for me to be like, "Is this even appropriate to ask?" But the worst they can say is no. I was able to, during my internship, study abroad because I asked. The position I was in before this, I got it because I asked. And I think as a woman in security, if you want to be noticed, ask the questions that you want to ask and do what you need to do to get to that point. But I think the biggest thing is speaking up for yourself. And yeah, I would just say-

Rebecca Knight

>> It may be scary, but summon the courage.

Kara Keene

>> Right.

Rebecca Knight

>> Push through. Excellent. Great advice.

Kara Keene

>> That's what men do. Yeah.

Jackie McGuire

>> Yeah, I told the high school kids I talked to the same thing, and that a lot of people don't get what they want in life because they don't ask for it, and then they don't have a plan once they get it for how to execute. So, also, make sure if you ask for something, you know what to do when you get it, right?

Kara Keene

>> Right. Exactly right. Exactly right. Yeah, and even the nos are also valuable as well, because they're really good opportunities. What's a different path? And I think that they'll take you down a better road than you may have had before. But just don't be discouraged, because I think that... I studied cybersecurity in college and there's comments all the time, but you just tune them out, focus on your vision. It's a lot better when you come out on the other side.

Jackie McGuire

>> Yeah. I have to say too, I've found security to be... I've worked in retail, I've worked in finance, I've worked in music. Security is where I have felt the most respect from other men and had the least unpleasant experiences. And I try to tell women that frequently and that this is one of the industries that really can be a meritocracy. And where the level of respect that I've received, I did not like I had to work as hard for it as I have in other male-dominated industries.

Kara Keene

>> Yeah, I completely agree. If I ever had a question... I had one team where it was like if I wasn't asking questions, then they'd be like, "Hey, are you dead?" Which is kind of nice because it encourages you to ask when you have those questions. Speaking to the meritocracy point as well, women invented computer science. Women were the first computer programmers. And I think it would do us all well to remember that we are built for this and that collaborative nature of security can be a really great thing. And just diplomacy, all of the above are really important.

Rebecca Knight

>> Well, this was a really badass and inspiring conversation, so thank you so much, Kara. I really appreciate you coming on the show.

Kara Keene

>> Thanks for having me.

Jackie McGuire

>> You're one of my new heroes.

Rebecca Knight

>> Yeah, indeed.

Kara Keene

>> I'll take it.

Rebecca Knight

>> I'm Rebecca Knight for Jackie McGuire. That wraps up theCUBE's coverage of Axonius Adapt. We will catch you next time. You've been watching theCUBE, the leader in enterprise tech news and analysis.