# Bartosz Jurga

Bartosz Jurga writes about cybersecurity risks in software delivery pipelines, ransomware recovery, and protecting code and development data. The posts focus on practical resilience measures for security and executive leaders, including tighter pipeline permissions, immutable backups, and tested recovery plans.

- Profile: https://b2binfluencer.marketing/creators/bartosz-jurga/
- LinkedIn: https://www.linkedin.com/in/bartosz-jurga
- LinkedIn followers: 4,103
- Topics: supply-chain, software-supply-chain-security, cyber-resilience
- Based on 10 dated posts, latest 2026-09-24

## Summary

Bartosz Jurga is most useful for executive-level posts on CI/CD supply-chain risk and ransomware recovery.

- Best for: A cybersecurity vendor thought-leadership campaign on DevOps supply-chain resilience for enterprise C-suite readers.
- Not for: Hands-on developer content with copyable pipeline configurations, commands, screenshots, or lab exercises for platform engineers.
- Check first: Ask for sources for numerical claims and audience analytics before relying on figures or reach.

### Takeaways

- Prevention alone is not resilience; tested recovery plans matter for business continuity.
- A trusted delivery pipeline can be the attacker's route to credentials and production access.
- Paying a ransom is not the same as recovering; isolated immutable backups and tested recovery matter.

## Main ideas

- **Prevention alone is not resilience**: Bartosz Jurga treats shift-left security and perimeter controls as necessary but incomplete. A pipeline incident can spread through a compromised runner into repositories, cloud environments and production secrets, so resilience must include a recovery plan for when prevention is bypassed. The posts also warn that many breaches stem from ordinary misconfiguration rather than sophisticated attacks, making basic governance and tested recovery more important, not less.
- **A trusted delivery pipeline can be the attacker’s route**: An organisation’s own authenticated build and deployment process can become the entry point when an upstream dependency is poisoned. Perimeter defence does not help if CI/CD fetches and executes malicious code inside the environment. The post then translates the technical event into executive consequences: wider breach exposure through deployment secrets and cloud credentials, compliance and legal risk, and disruption to software shipping and customer trust.
- **Paying a ransom is not the same as recovering**: Bartosz Jurga frames ransom payment as a board-level risk decision: payment does not reliably restore data, can invite repeat attacks, and creates legal and regulatory exposure. The deeper cost is operational: downtime, lost developer productivity and brand damage. The post also challenges the assumption that cloud platforms cover customer data recovery under shared responsibility, arguing that intellectual property resilience remains the organisation’s responsibility.
- **Security arguments should end in a board decision**: Across the posts, Bartosz Jurga moves from technical incidents to the categories executives already manage: blast radius, compliance, business continuity, downtime and customer trust. The focus is not just awareness but ownership. The posts close with practical controls and a direct question that pushes security risk into board-level reporting and C-suite discussion.

## Work to read

- [CI/CD pipelines as a supply-chain attack vector](https://www.linkedin.com/posts/bartosz-jurga_gitprotectexpert-activity-7505206676199976960-4whU)
- [The keyv compromise and the executive agenda](https://www.linkedin.com/posts/bartosz-jurga_protect-your-repositories-from-open-source-activity-7507710891702996992-kcji)
- [Ransomware: to pay or not to pay](https://www.linkedin.com/posts/bartosz-jurga_does-it-make-sense-to-pay-a-ransom-a-c-suite-activity-7500085155919982592-s5KS)

## Brand relationships

- **GitProtect** (disclosed_partnership)

## Partnerships

Bartosz Jurga writes executive-level LinkedIn posts on CI/CD and software supply-chain risk, ransomware recovery, and DevOps resilience, directing readers to a longer brief. The posts use a closing question and a brand hashtag. For a buyer, the practical requirement is a live, substantive brief or landing page supporting the post’s claims, plus agreement on the technical framing and C-suite audience. Ask whether the arrangement is paid, sponsored, or an in-house content role, and for an official inquiry route; none is documented, so omit the partnership link.

## Alternatives

- Swati Gupta: If the vendor's campaign targets small and medium-sized business owners rather than enterprise C-suite readers, Swati Gupta is a better choice. One post addresses the cost of trust for small businesses, stating that 89% of small businesses currently have at least one compromised credential and that AI-powered attacks on small businesses rose about 340% in 2025. Another explains why paying ransomware is a bad bet for small businesses: ransomware groups now use a volume-based strategy targeting SMBs with automation, and many SMBs lack dedicated security teams and tested backups. For a brief on identity security or ransomware resilience for SMB owners, this creator's material is already framed for that audience and uses concrete figures.
- Sam Alba: If the vendor wants a creator with firsthand experience building and operating an AI-native DevOps platform, and content that shows deep technical understanding of CI/CD supply chain attacks, Sam Alba is a better choice. One post tells the story of the Aqua Security trivy-action compromise, where an attacker force-pushed malicious commits to 75 of 76 version tags. It explains how Mendral's proactive upgrade put a customer on the only safe version, preventing credential exfiltration. The post shows detailed knowledge of supply chain attacks and practical prevention. Another post traces the building of Mendral, from leaving Dagger to YC W26 to shipping a supply chain security agent into the GitHub PR workflow. For a vendor seeking a technical founder's perspective and concrete incident storytelling, this creator is a stronger option.
- Bradley Richards: If the vendor wants to broaden the campaign from DevOps supply chain to enterprise security and resilience topics such as vulnerability management, patch discipline, and identity-based ransomware attacks, Bradley Richards is a better choice. One post discusses organizations that believe MFA alone is enough and how ransomware groups exploit known Fortinet VPN vulnerabilities. It emphasizes that the fastest-recovering organizations have disciplined vulnerability-management processes and operational accountability. Another highlights the PAYLOAD ransomware group using compromised domain credentials and Active Directory Group Policy to disable security controls, stressing identity protection, privilege management, and recovery readiness. For a vendor targeting security leaders with a resilience message, this creator can speak to the operational and customer-success side of those decisions.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/