Ian Swanson grew up in a small town roughly two hours east of Los Angeles, where his father ran a construction business. At dinner, the family heard about the working day. The company had begun with a loan from his grandfather. Business arrived at the table as something a person did, with problems to discuss before the plates were cleared.
Swanson later described himself as an introvert. His early ambitions nevertheless involved considerable exposure to other people’s opinions. After college, he worked in telecommunications, read Business 2.0 and became interested in the founders behind Myspace. He pitched a business networking idea to a relative. The response included advice to get an MBA. He chose a stint at a startup instead.
There is a useful modesty in this beginning. No childhood prophecy is required. A parent supplied an example, a magazine supplied possibilities, and a rejected pitch supplied an awkward lunch. Before Swanson could sell anything to a large company, he had to discover whether he wanted to keep going after someone he knew said no.
Virtual coins, very real customers
Sometrics, founded in 2007, gave that ambition a business. It worked in virtual currency and payments for online games. American Express acquired it in 2011. Swanson went on to hold an executive role at the company, adding a large financial institution to a career that had already included Sprint.
Virtual currency sounds like an unlikely apprenticeship for enterprise AI. Yet both fields ask an unglamorous question beneath an attractive interface: what must work behind the scenes for a customer to use this repeatedly? A game can make imaginary money desirable. Collecting payments and keeping the machinery operating belong to the decidedly real economy.
A 2015 university guest-speaker biography records another side of this period. Swanson earned the 2013 American Express Chairman’s Award and mentored founders through Los Angeles startup programs, including Amplify.LA and Launchpad.LA. The founder had become someone other founders could consult. Experience was beginning to circulate back through the community that had helped him get started.
The transition also complicates the familiar picture of the entrepreneur who can tolerate only small companies. Swanson has repeatedly worked inside the organizations that bought his businesses. The pattern suggests an interest in what distribution, infrastructure and an established customer base can do for something a startup has built. Selling the company can change the scale of the assignment.
- 2011Sometrics → American Express
- 2018DataScience.com → Oracle
- 2025Protect AI → Palo Alto Networks
A model needs somewhere to work
In January 2014, Swanson founded DataScience.com. Its subject was the daily work surrounding data science: tools, projects, computing resources and the path from an experiment to a deployed model. The platform gathered those activities into a governed workspace. A useful algorithm still needed somewhere to live, and its creators needed a way to work together.
When Oracle announced an agreement to buy DataScience.com on May 16, 2018, customers included Rio Tinto and Sonos. The proposed combination paired the startup’s workspace with Oracle’s cloud infrastructure and applications. Swanson’s business had reached the point where the surrounding organization mattered as much as the individual tool.
That distinction helps explain his subsequent career. As Oracle’s vice president of machine learning, he worked on AI and ML product strategy. At Amazon Web Services, he later led worldwide AI and ML business activity. These roles placed him close to organizations trying to turn technical capability into ordinary operations, with all the procurement, staffing and implementation that entails.
An impressive demonstration occupies a few minutes. A system in production occupies somebody’s working life. The distance between the two includes permissions, dependencies, budgets, maintenance and responsibility when something behaves unexpectedly. Swanson’s career kept moving into that distance. With DataScience.com, the task was helping teams put models to work. His next company would examine what those teams were bringing through the door.
The unwanted passenger
Protect AI brought Swanson together with co-founders Badar Ahmed and Daryan Dehghanpisheh. Their experience building AI businesses gave them a view of adoption from the inside. The early commercial approach needed revision: a focus on adversarial machine learning did not produce the traction they wanted. The broader problem of exposed machine learning infrastructure proved more compelling.
The timing mattered. As ChatGPT drew attention to generative AI, corporate leaders began asking how quickly they could use it. Protect AI’s opportunity lay in the consequences of that enthusiasm. A model could arrive with dependencies, unfamiliar file formats and behavior that a conventional security process had never been designed to inspect.
By January 2024, Protect AI was offering Guardian to scan models before organizations used them. Think of the model download as a delivery at a loading bay. The interesting question is what came inside the package. A familiar destination or a promising description cannot, by itself, tell a security team whether the contents deserve access to its systems.
For Swanson, this meant protecting the whole development process. In his account of secure AI development, he advocated integrating security early, repeatedly scanning models and applications, and teaching teams about the particular risks. MLSecOps, short for Machine Learning Security Operations, gives that continuing work a name. The abbreviation is less charming than the problem it addresses is expensive.
The appeal of this approach is practical. An organization needs to connect what researchers build with what security staff can inspect and what operators eventually deploy. Each handoff can lose information. A security check that arrives only at the end has to reconstruct decisions already made, often by people who have moved on to the next experiment.
Buying the missing pieces
Protect AI expanded through acquisitions of huntr, Rebuff, Laiyer AI and SydeLabs. Those deals assembled complementary capabilities rather than leaving the company dependent on one narrow product. Swanson acknowledged that buying businesses at an early stage made some investors uneasy. It was a choice about how quickly a small organization could become useful to a large customer.
The financing gave the team room to pursue that breadth. In August 2024, Protect AI announced a $60 million Series B led by Evolution Equity Partners, taking total funding to $108.5 million. Participants included Samsung, Salesforce Ventures, 01 Advisors and StepStone Group, alongside existing backers. The money was intended for product development, research, sales, customer support and channels.
The company also supported huntr’s AI vulnerability research community, which had more than 15,000 members by that funding announcement. This added a continuing flow of discoveries to the product effort. Security software has to contend with an opponent who does not observe the vendor’s release calendar. A community of researchers helps keep the questions coming.
SydeLabs added automated red teaming for generative AI systems. Red teaming deliberately tests how a system can fail or be manipulated before an adversary supplies the demonstration. Alongside model scanning and an inventory of AI components, it broadened what Protect AI could examine. Swanson was building a business around several connected points of failure, each capable of spoiling an otherwise convincing deployment.
“You’ve got to have a far horizon.”
Ian Swanson, on the work of a CEO
An inventory question goes to Washington
On December 12, 2023, Swanson appeared before the House Homeland Security Committee’s Subcommittee on Cybersecurity and Infrastructure Protection. The hearing put him alongside executives from IBM Consulting, Hitachi Vantara and SentinelOne. AI security had become a matter for public infrastructure as well as enterprise purchasing.
His written testimony asked a disarmingly concrete question: could an organization supply a complete inventory of its machine learning models, their lifecycle stages, the data they processed and the people involved? It is the sort of question that can make a meeting quieter. An organization cannot make an informed decision about assets it has not counted.
Swanson proposed a machine learning bill of materials standard, investment in securing the open source AI ecosystem, and continued participation by startups in policy discussions. His emphasis gave the debate an operational footing. Alongside arguments about AI’s future sat the immediate work of identifying components, assigning responsibility and understanding what was already running.
The third sale, and the next assignment
Palo Alto Networks completed its acquisition of Protect AI on July 22, 2025. Swanson joined as VP, Product, Prisma AIRS. The integration brought Protect AI’s technology into a larger platform covering model scanning, security posture management, red teaming, runtime protection and agent security. It was the third acquisition of a company he had helped build.
At the close, he described the ambition in straightforward terms: “make AI secure, safe, and trustworthy for everyone.” The larger company offered a route to more customers and a broader security operation. His current official biography identifies him as vice president of AI Security Products, responsible for strategy and product innovation.
By November 2025, Swanson and colleague Hitendar Sethi were setting out a first-principles approach to securing AI. Their guide returned to confidentiality, integrity and availability, applying those familiar controls to training data, model code, traceability and service resilience. New technology still had to answer old questions about who could access something, whether it had been altered and whether it would remain available.
In January 2026, Swanson was discussing another organizational blind spot: research teams that thought security did not concern them because their work was experimental. His account involved a conversation in which security colleagues pointed out that imported AI artifacts, customer data and cloud infrastructure were already involved. A research label did little to remove the exposure.
His work also extended into a March 2026 IBM Institute for Business Value study on securing AI at scale, co-authored with Mark Hughes, Srinivas Tummalapenta and Gerald Parham. The setting had changed again, from a startup product to a cross-company research effort. The recurring concern remained how organizations manage the technology they are adopting.
Swanson’s story gives the acquisition tally some human scale. The child listening to construction problems at dinner became a founder dealing with the consequences of software success. First came payments for virtual goods, then workspaces for machine learning, then security for the systems being deployed. Each business found work waiting beyond the attractive front end. AI may produce its answers in seconds. Someone still has to take responsibility for what happens next.