In the summer of 2000, middle-schooler Amy Chang persuaded her parents to drive her from California’s East Bay to the Vans Warped Tour in San Francisco. Awaiting her at Piers 30 and 32 was a sprawling punk-rock festival, with Green Day, NOFX, The Donnas and dozens of other bands playing across multiple stages.
It was a world far removed from the one Chang knew at home. The daughter of Chinese immigrants who worked multiple jobs, she grew up understanding that their sacrifices had created opportunities for her, and that she was expected to make the most of them. Distractions were not part of the plan.
“The way my parents raised me shaped who I am,” Chang said from her sunny home office in Oakland, California, where one of her three dogs, an Australian shepherd named Potato, made a handful of on-camera cameos. “It gave me the internal motivation to succeed. It was also hard. I felt an obligation to make sure that they didn’t suffer for nothing, that they were proud of their daughter.”
But Chang was also growing up in the Bay Area at the dawn of the mainstream internet, where classmates and online message boards opened doors to new music, ideas and counterculture. Her tastes soon ranged from punk standard-bearers like the Ramones and riot grrrl bands like Bikini Kill to independent Bay Area hip-hop like E-40. Online, she wandered through GeoCities, Angelfire and LiveJournal, then Napster and LimeWire, where downloading a new song sometimes meant getting, as Chang puts it, “Trojans as well as the MP3s.”
Yet she resists describing these influences as rebellion against her upbringing. Instead, Chang talks about the creative tension of growing up in a highly individualistic society while being raised by parents whose own experiences had instilled a different sense of opportunity and obligation. For her, it was never a binary choice between the dutiful student and the middle-school kid at Warped Tour. Her answer was, and still is, D: All of the above.
Today, as Head of Cisco’s AI Threat Intelligence and Security Research team, that disposition has become essential. Chang is charged with questions that have few settled answers: How will bad actors manipulate artificial intelligence? How can AI agents be secured? And how can organizations realize AI’s benefits without surrendering human oversight?
The work requires understanding how complex systems are supposed to function and then considering all the ways they might be made to behave differently.
Following the Questions
Chang did not set out to work in cybersecurity. She was interested in broad questions about technology, government and power, particularly when the rules struggled to keep pace.
She studied international relations at Brown University and later earned a Master in Public Policy from Harvard Kennedy School, where her thesis examined obstacles in U.S.-China cybersecurity relations. As a Fulbright Research Scholar in China, her fluency in Mandarin allowed her to better examine those questions at their source.
That curiosity would take her into national security policy in Washington, DC, eight years as an intelligence officer in the U.S. Navy Reserve, and eventually the private-sector world of cybersecurity.
“Technology and public policy are both mission-oriented, and that through-line always resonated with me,” she said.
Chang found that cybersecurity sat at an intersection she had been moving toward for years, where technical questions collide with human behavior, institutional interests and geopolitics. By the time artificial intelligence emerged as the next major cybersecurity frontier, she had spent much of her career preparing for questions no single discipline could answer.
The Weight of Authority
Chang is equally interested in testing her own limits.
While living in the Washington, D.C., area, she found herself drawn into its intense fitness culture. Chang took up weightlifting and soon discovered she had an aptitude for it.
“I just found that I was good at lifting heavy,” she said. “And I was like, how far can I take this?”
Pretty far. Chang now ranks sixth in her U.S. weight class in powerlifting and believes she could reach No. 1 if she didn’t have such a demanding career. Powerlifting also offers something her professional life rarely does: absolute clarity. Under a barbell, the weight moves or it does not.
Powerlifting also placed Chang in another arena traditionally associated with men.
As an “elder millennial,” Chang has watched representation improve. But she has also been in many rooms where her points of view weren’t welcome.
“As much as we’ve been on this arc towards better representation of women,” she said, “there are still those male-dominated panels and such where you don’t necessarily feel supported to voice your opinion.”
I decided I wanted to be one of those people in one of those seats, but to do it differently.
At Cisco, that means making sure that fresh ideas and even disagreement are part of the job.
“I want people from a wide variety of backgrounds and perspectives to feel it is OK to say what they’re thinking,” Chang said, “what their opinions are, what their principles are, and to tell them without intimidation.”
Lifting, she said, remains “a counterbalance” to the complexity of her daily work. “But lifting heavy metal is a great release. And while it might feel like a small act in some ways, it’s very empowering. For everyone.”
Attack Surface
The threats Chang studies can begin with something simple, like a user trying to convince an AI model to do something it was never supposed to do.
Jailbreaks and prompt-injection attacks attempt to circumvent a model’s safeguards, making it produce prohibited content or manipulating a model connected to other systems into accessing proprietary information. Chang’s team tests how susceptible models are to such attacks, including the most advanced ones.
“And the truth is: no model is completely secure,” she said.
A second risk area lies in how organizations deploy AI. They download models, add data and run versions in their own environments. But do they know exactly what they are running, what has been added to it, where it came from or what licensing restrictions biases or risks came with it? When something goes wrong, understanding a model’s provenance can become a security problem of its own.
The third area is AI agents. Because agents can take actions rather than simply generate responses, Chang’s team is working on ways to monitor agent traffic for patterns that could signal harmful, unintended or unauthorized behavior.
Her team’s research feeds into products including Cisco AI Defense and Cisco Cloud Control Defense Claw. “We help translate our research into what we ship out from Cisco,” Chang said, “as the best defenses.”
Humans in the Loop
For all the new risks AI introduces, Chang keeps returning to something decidedly old-fashioned: human judgment.
“The human can’t just become a rubber stamp,” she said. “You still have to have your critical thinking cap on; you still have to have ownership.”
That concern extends beyond Cisco products. Chang led the development and implementation of Cisco’s Integrated AI Security and Safety Framework, work that reaches into standards, governance and public policy.
“We have an obligation,” she said, “to use all that knowledge to educate our customers and other leaders about this technology and how it can be compromised. And to help influence the development of standards, what governments and organizations need to do to ensure that this technology is trusted and safe.”
That obligation is particularly important, Chang believes, for people and organizations without the resources of a company like Cisco. The point isn’t simply to understand what AI can do, but what “the bad people are doing with it,” she said, and to help protect those who may be less equipped to protect themselves.
Into the Deep
When Chang wants to keep expanding her perspective, she goes outdoors. She hikes near her Bay Area home and farther afield in the Alps, Canadian Rockies and Patagonia. But some of her most profound experiences have come in the ocean.
In French Polynesia, Chang has free-dived among humpback whales, including an encounter with a mother and calf accompanied by three males.
“I recommend to everyone that they try diving in open water,” she said. “It’s just so far from KPIs and getting to the next deadline. It connects you with a whole other universe.”
“It’s humbling to be one tiny person in a vast ocean,” Chang said, “and then be next to this magnificent creature the size of an airplane. It expands your worldview, but it also makes you want to protect those things that are impacted by what humans do.”
