Andrea Licciardi

The post separates three goals often blurred together: bringing AI into OT, making OT more secure, and ensuring the AI itself is designed and used securely.

• Licciardi points to studying ISA/IEC 62443 as grounding for that work, not a way to collect badges.
• The argument is not anti-AI; it is about sequence and competence.
• AI can analyse data, detect anomalies and support complex decisions, but should not arrive before people understand what it is touching.

Licciardi uses a commissioning analogy: no refinery goes live without commissioning.

• The post applies the same principle to AI systems and the skills of the people who design them.
• They write, “I know I don't know enough,” and frame continued learning as a defence against easy answers and the feeling of already knowing it all.

Read original

When security becomes an obstacle, people find another route through shadow IT, personal accounts, unauthorised tools and unmanaged exceptions.

• The result, they argue, is less visibility, not stronger security.
• The alternative is a conditional yes: with compensating controls, for a limited scope and time, or where the business consciously accepts the residual risk; sometimes it is no, with a clear explanation.

The post lists the workarounds that follow a blunt refusal: shadow IT, personal accounts, unauthorised tools and unmanaged exceptions. Licciardi says the security team's job is to protect the business, not security controls, and that maturity means finding a secure way to say yes.

Read original

The post describes the work in specific terms: responders piece together information that does not always match, judge the severity, decide what to do and explain whether the problem is solved — sometimes while still working that out. Experience, tooling and automation matter, they argue, but people remain behind the tools and need to know what they are doing.

Licciardi quotes Mickey Bresman on experience, expertise and track record, agrees, and adds that people matter: those who have faced real situations, made mistakes, learned from them and stay clear-headed under pressure. They name Simon Hodgkinson as a friend and familiar face in the story, and say they prefer this kind of storytelling to cyber coverage built only around spectacular attacks and shiny technology.

Read original

From working with women in detection, incident response, threat intelligence and national CSIRT roles, they observe analytical depth, precision under pressure and a different way of framing problems.

• The reasoning is blunt: adversaries are creative; monocultures are predictable.
• They also defend national SOC and CSIRT work against questions about whether it is public money well spent, arguing that its output is measured by what never reaches the news.

Licciardi gives examples of invisible success: an intrusion contained at hour two instead of week six, a campaign stopped before it becomes a headline, and services that stayed up while someone was actively trying to bring them down.

• They credit Esmeralda Kazia's comment that representation has value only alongside merit, preparation and responsibility, and pass on the advice to girls in tech: look for opportunities, but build them — and build them with continuity.
• Recognition is deserved 365 days a year, Licciardi says, including at 3 a.m. when the country is asleep and the shift is not.

Read original

It is a strong first read, showing both their technical grounding and the argument style used elsewhere.

Licciardi contrasts the rush to build "the AI that will revolutionize the OT world" with a quieter choice: keep studying first.

• They announce another step in an ISA/IEC 62443 journey and make clear that this is not about collecting badges.
• The argument separates three goals that often get blurred: bringing AI into OT, making OT more secure, and securing the AI itself.
• AI can analyse data, detect anomalies and support complex decisions, but the people designing it still need to understand plants, industrial processes, operational risk and safety.
• Licciardi writes "I know I don't know enough" and frames continued learning as a defence against easy answers.
• They close with an industrial analogy: no system goes live without commissioning, and the same applies to AI systems and the skills of the people who design them.

For brands planning a campaign

A direct fit for an OT security vendor's secure-AI adoption theme.

• The three-goal framing (secure the plant, make AI useful, secure the AI) gives a co-authored article a structure that avoids both AI hype and blanket caution.
• The commissioning metaphor offers industrial audiences an accessible bridge.

It is short, plainly argued and full of concrete examples, making it the easiest piece to test against a campaign brief.

The post starts with familiar security denials — no local admin, no Wireshark, no tool someone needs by tomorrow — then reverses the argument.

• A "no" given without understanding the business context becomes a risk: people who see security as an obstacle route around it through shadow IT, personal accounts, unauthorised tools and unmanaged exceptions.
• Licciardi puts the consequence bluntly: you have not increased security, you have lost visibility.
• They offer a set of conditional yeses — yes with compensating controls, yes for a limited scope and time, yes if the business consciously accepts residual risk — and the courage to say no with a clear reason when needed.
• Security creates value by enabling the business while reducing risk to an acceptable level, not by blocking it.

For brands planning a campaign

A strong foundation for thought leadership aimed at CISOs and OT operators: the position is distinctive without being contrarian for effect. Vendors selling governance, risk-acceptance workflows or exception management can use the conditional-yes pattern to educate customers.

It explains why the human side of response matters to them, useful context for their more technical posts.

Responding to a documentary about cyber incidents, Licciardi says they liked it because it tries to show the people rather than the hooded hacker, another miracle product or technology as the answer to everything.

• They describe the work specifically: when something serious goes wrong, responders piece together information that does not always match, judge the severity, decide what to do and explain it to someone who understandably wants to know whether the problem is solved — sometimes before responders have worked out what happened themselves.
• Licciardi quotes Mickey Bresman on experience, expertise and track record, agrees, and adds that people matter: those who have been through real situations, made mistakes, learned from them and stayed clear-headed under pressure.
• Simon Hodgkinson is named as both a friend and a familiar face in the story.
• The post accepts that documentaries add drama but prefers this kind of storytelling to cyber stories made only of spectacular attacks and shiny technology.

For brands planning a campaign

Useful for incident-response and cyber-resilience messaging built on trust in people rather than product claims. The detail about having to "explain it before you fully understand it" gives a vendor campaign a concrete scenario and supports endorsements from named practitioners rather than generic brand copy.

It shows how they handle a topic where sentiment is easy and specificity is hard, making it the best example of their argumentative writing voice.

Writing a few days after International Women in Cyber Day, Licciardi congratulates Albania's National Cyber Security Authority and moves beyond the calendar date.

• Their core claim is that diversity of thinking is, quite literally, a control: adversaries are creative, monocultures are predictable.
• The post names the functions where women work — detection, incident response, threat intelligence, national CSIRT — and says their contribution deserves recognition throughout the year, including at 3 a.m. when the country is asleep and the shift is not.
• On whether a national SOC/CSIRT is public money well spent, they argue that its output is measured by what never reaches the news: the intrusion contained at hour two instead of week six, the campaign stopped before it becomes a headline, the services that stayed up while someone tried to bring them down.
• That output is invisible by design; in Licciardi's view, people who have spent time in an operations room are the most careful before judging it.
• The post credits Esmeralda Kazia's comment that representation has value when it walks alongside merit, preparation and responsibility, then passes on advice to girls in tech: look for opportunities, but build them, and build them with continuity, because authority in this profession accumulates shift after shift rather than from one brilliant result.

For brands planning a campaign

A credible workforce-and-talent angle for a cybersecurity vendor, grounded in operational reality rather than awareness-day slogans.

• The "invisible output" argument offers a distinctive way to discuss national cyber investment or managed detection services, while the merit framing avoids empty representation language.
• Handle the topic carefully: the post's authority comes from specificity, so a campaign should not generalise it.

The post frames three goals as increasingly inseparable: making OT more secure, developing AI that is genuinely useful in industrial settings, and ensuring AI is designed and used securely.

• The argument is that people who design AI for plants need real understanding of industrial processes, operational risk and safety, not only data skills.
• They point to ongoing ISA/IEC 62443 study for that grounding and use a commissioning analogy: just as no refinery goes live without commissioning, neither does a model or the expertise of the people who build it.
• The tone is openly self-critical about the limits of one's own knowledge, keeping the piece from reading as a product claim.

A first-person learning narrative built around a specific certification path, with an industrial-engineering analogy carrying the main argument instead of statistics or vendor references.

For brands planning a campaign

This is the closest match to a co-authored article on secure AI adoption in OT.

• The three-goal framing gives a vendor a ready structure, and the commissioning analogy is a concrete, quotable device that avoids generic AI-in-industry language.
• A brand should expect the argument to lead with engineering discipline and operator understanding rather than AI capability.

Examples: Source 1

Their stated observation from working with women in detection, incident response, threat intelligence and national CSIRT roles is that they bring analytical depth, precision under pressure and a different way of framing problems.

• The reasoning is blunt: adversaries are creative; monocultures are predictable.
• The post also defends national SOC and CSIRT work against the recurring question of whether it is public money well spent, arguing that its value is measured by what never reaches the news: an intrusion contained at hour two, a campaign stopped before it becomes public, or services that stayed up during an attack.
• Licciardi credits a comment by Esmeralda Kazia that representation has value only alongside merit, preparation and responsibility, then tells girls in tech to build opportunities with continuity rather than wait for symbolism.

An occasion-based argument that moves from a calendar date to an operational claim, supported by a quoted peer comment and concrete examples of invisible prevention work.

For brands planning a campaign

Useful for workforce, national-resilience or public-sector cyber campaigns, but the angle matters.

• The post ties representation to operational merit and explicitly rejects symbolism, so a campaign built on visibility alone would sit awkwardly against this material.
• The invisible-output argument is also a strong, less-common talking point for a brand working with SOC or CSIRT audiences.

Examples: Source 1

The post describes what responders actually face: information that does not match, the need to judge how serious a situation is, decisions made before the picture is clear, and explaining to others whether the problem is solved while still working that out.

• They qualify Mickey Bresman's emphasis on experience, expertise and track record: people matter, including those who have made mistakes, learned from them and taken difficult decisions.
• Colleague Simon Hodgkinson is named as one of the familiar faces in the story.
• Licciardi accepts some documentary-style dramatisation and still prefers that kind of storytelling to attack-of-the-week coverage.

A reaction to a longer media work, combining a personal anecdote, a short list of what responders do under pressure, and direct engagement with named practitioners.

For brands planning a campaign

A natural fit for human-factor, resilience or incident-response readiness messaging, and evidence that Licciardi will engage with a vendor-produced film, report or documentary. Their willingness to credit and gently extend another practitioner's framing suggests a collaborative format, such as a recorded discussion or jointly authored piece, would work better than a straight endorsement.

Examples: Source 1

When security is seen as an obstacle, people route around it through shadow IT, personal accounts, unapproved tools and unmanaged exceptions, leaving the organisation with less visibility rather than more protection.

• The alternative is a set of conditional answers: yes with the right compensating controls, yes for a defined scope and limited period, yes where the business consciously accepts the residual risk, and, where warranted, no with a clear explanation.
• Security creates value by helping the business move with risk reduced to an acceptable level, not by protecting controls.

A contrast structure that opens with concrete everyday examples, reverses the expected position, and lands on a memorable reframing of the security team's purpose.

For brands planning a campaign

Strong positioning material for vendor messaging about governance, risk-based controls or business-aligned security. The conditional yes/no list is directly reusable in a campaign asset such as a decision framework or workshop prompt, and the closing reframing of the security team's job is quotable without a product hook.

Examples: Source 1

The format is consistent: a LinkedIn post of a few hundred words that opens with a personal or contrarian hook, develops one argument, often uses a short bulleted list, and closes with a reframing line.

• Observations are anchored in named people and named documents rather than statistics.
• The posts are undated, so ask for dated examples before assessing development over time or whether these subjects reflect a longer editorial pattern.

A close reading of every available post in full, examining opening device, argument shape, evidence type and closing move.

The posts here are few relative to a typical creator page and contain no publication dates. Treat the topic list as a reading of these posts, not as a complete map of what Licciardi writes about; older or non-LinkedIn material would need to be collected before making any claim about changes over time. No sponsored or commercial formats appear in these posts, so nothing here says how Licciardi works with brands.

Examples: Source 1 · Source 2 · Source 3 · Source 4

The post names Mickey Bresman and calls Simon Hodgkinson a friend and a familiar face in the story. It does not say Licciardi was paid or engaged by Semperis; the post is commentary on the company's documentary.

View example

The post indicates study of a published standard, not a commercial tie to the standards body. Ask for details if training, sponsorship, or a client arrangement would affect your decision.

View example

The post expresses support for the authority. Ask about any employment, contract, or paid work if that would affect your decision.

View example

They write short, first-person LinkedIn posts that develop one argument and close with a reframing line. Policastro's posts on MDR warranty coverage and the latest Cyber Threat Download use the same resilience framing as Licciardi's argument that security should help the business move with risk reduced to an acceptable level.

Policastro writes from inside a managed-detection provider, tying their posts to a commercial service and its partnership announcements.

• They address executives weighing preparation and recovery.
• Licciardi's posts contain no product or sponsorship pitch and focus more on operational and industrial issues, including OT environments, ISA/IEC 62443 study and the human judgement behind incident response.

Read original · Original 2

Karanjalkar's pieces on the OCA Indicators of Behaviour project and behaviour analytics versus behavioural threat intelligence share Licciardi's habit of naming the standard or framework at the heart of the discussion.

Karanjalkar works on detection and threat intelligence: indicators of behaviour, STIX 2.1, MITRE ATT&CK, and where today's behaviour analytics products stop short. Licciardi focuses on industrial and operational environments and the human and governance layer, with less attention to detection tooling and more to operator understanding, business context and accountability.

Read original · Original 2

Rodenhauser asks whether everyone on a leadership team would know their responsibility if unauthorized access were discovered today—a question close to Licciardi's argument that incident response means people making decisions before the picture is clear.

Rodenhauser anchors arguments in public documents such as DOJ settlements and SEC filings, drawing lessons for executives and boards in the language of operational excellence. Licciardi draws on industrial practice and personal practitioner experience, writing from the operational room rather than advising leadership from outside it.

Read original · Original 2

The two posts frame cybersecurity as a leadership and financial problem.

• One describes an MDR offering bundled with up to $250,000 in warranty coverage for eligible recovery expenses after a covered breach; the other argues that attack speed and AI-driven exploitation make cyber resilience a board-level question of whether the organisation is prepared, not merely secure.
• For a vendor selling resilience, incident response or risk transfer, that argument could anchor the campaign, and the financial-recovery angle is unusual enough to carry a co-authored article on its own.
• Policastro also writes from inside a vendor partnership, having worked closely with named colleagues to bring the offering to market.
• That suits a vendor-authored piece where the sponsor wants to discuss its commercial model openly.

You give up the operational-technology grounding and specific secure-AI-in-OT structure.

• These posts focus on enterprise detection and response, warranty protection and executive preparedness; they say nothing about industrial control environments, ISA/IEC 62443, plant processes, safety or securing AI on an operational network.
• A co-authored article based on them would speak to boards and CFOs about resilience and recovery.
• To address AI in OT, it would need Licciardi’s three-goal framing.
• The posts are also closely tied to a named vendor’s product and partnership, so an article would need to avoid reading like a product announcement.

Examples: Source 1 · Source 2

One post walks through the Open Cybersecurity Alliance Indicators of Behaviour project, describing how behavioural observations such as privilege escalation, lateral movement and exfiltration can be represented in a vendor-neutral, machine-readable form using STIX 2.1.

• The other draws a sharp line between behaviour analytics, which flags that something unusual happened, and behavioural threat intelligence, which explains what the behaviour means, which stage of an attack it belongs to and what the attacker is likely to do next.
• A detection or analytics vendor can build credible thought leadership around that distinction.
• The posts show a writer who can sustain a technical argument without padding.

You give up the industrial setting entirely.

• These posts cover no OT networks, plant processes, operational risk or safety, so the secure-AI-adoption angle for AI in OT would have to come from elsewhere.
• Their AI references concern AI-assisted detection and autonomous attacks, not securing AI that runs in a plant.
• The style is also more standards-and-taxonomy than narrative.
• Licciardi’s commissioning analogy and conditional-yes framing give general business readers a way in; these posts assume readers already know IOCs, XDR and SOC workflows, narrowing the campaign’s reach to practitioner audiences.

Examples: Source 1 · Source 2

Both posts draw an operating lesson from a public case.

• One uses a cybersecurity settlement over Department of Defense contract requirements to argue that the distance between what a business promises and what its teams do widens as it grows, and that leadership needs clear ownership, current documentation and an escalation path when a gap appears.
• The other uses a disclosed network intrusion at a dental group to ask whether everyone involved would know exactly what they are responsible for if unauthorised access were discovered today.
• For a vendor selling governance, assurance or incident-response readiness, that question-first structure works directly in a co-authored piece, speaking to the people who sign off on the programme rather than those who run the tools.

You give up technical and industrial depth.

• These posts draw on published enforcement and disclosure cases rather than hands-on platform or control-system experience, and offer no information on OT environments, industrial processes or AI deployment in plants.
• This voice is strongest on accountability, decision rights and preparedness, and weakest on the engineering question of secure AI adoption in operational technology.
• It also shifts the audience upward, from the OT practitioners Licciardi writes for to the leadership layer that approves the budget.

Examples: Source 1 · Source 2