Bartosz Jurga

A pipeline incident can spread through a compromised runner into repositories, cloud environments and production secrets, so resilience must include a recovery plan for when prevention is bypassed. The posts also warn that many breaches stem from ordinary misconfiguration rather than sophisticated attacks, making basic governance and tested recovery more important, not less.

In the CI/CD post, Bartosz Jurga points to overly permissive YAML files and compromised runner infrastructure as routes to elevated access.

• The post says 80% of successful breaches exploit everyday misconfigurations rather than zero-days, and that malicious AI tools are lowering the barrier to pipeline attacks.
• It presents immutable backup and disaster recovery as the final line of defence.

Read original

Perimeter defence does not help if CI/CD fetches and executes malicious code inside the environment. The post then translates the technical event into executive consequences: wider breach exposure through deployment secrets and cloud credentials, compliance and legal risk, and disruption to software shipping and customer trust.

The keyv package compromise and ChainDrop campaign provide a concrete case: more than 400 infected packages and more than 500 million weekly downloads, according to the post. The recommended response combines strict version pinning, least-privilege pipeline access, automated credential rotation and independent immutable backups that recover metadata, environments and workflows as well as repository code.

Read original

The deeper cost is operational: downtime, lost developer productivity and brand damage. The post also challenges the assumption that cloud platforms cover customer data recovery under shared responsibility, arguing that intellectual property resilience remains the organisation’s responsibility.

The ransomware post cites over 50% of enterprise victims refusing to pay and 80% of organisations that pay being targeted again. It recommends immutable backups, air-gapped or isolated storage, and tested automated recovery procedures so ransom demands need not be negotiated.

Read original

The focus is not just awareness but ownership. The posts close with practical controls and a direct question that pushes security risk into board-level reporting and C-suite discussion.

The supply-chain post asks how software supply-chain risk is evaluated and reported at board level.

• The ransomware post addresses a C-level network directly and asks how data resilience is handled within the DevOps supply chain.
• The CI/CD post opens by naming enterprise CISOs and IT leaders, framing pipeline risk as a business continuity issue.

The topics span pipeline misconfiguration, upstream dependency compromise and ransomware recovery, but the board-level frame stays constant. The posts are undated; ask for publication dates if chronology matters.

Read original · Original 2 · Original 3

The post addresses enterprise security and IT leaders directly.

• It argues that shift-left security fails when runner infrastructure or pipeline permissions are misconfigured.
• Bartosz Jurga makes the risk concrete: a compromised runner can reach repositories, cloud environments, and production secrets.
• They cite a striking operational detail—80% of successful breaches exploit everyday misconfigurations such as overly permissive YAML files rather than sophisticated zero-days—and argue that malicious AI tools are lowering the barrier to pipeline attacks.
• The post then shifts from prevention to recovery, presenting immutable backup and disaster recovery as the final defense when perimeter controls are bypassed.

For brands planning a campaign

This is useful material for executive thought leadership linking pipeline governance to business continuity. A vendor could build a piece around a simple argument: identity and permission controls reduce the risk of compromise, while tested recovery limits the damage when those controls fail.

Bartosz Jurga uses the compromise of the keyv package and the subsequent ChainDrop campaign—described as more than 400 infected packages with over 500 million weekly downloads—to make a direct point: a trusted delivery pipeline can become the entry point even when perimeter defenses are in place.

• The post breaks down the impact into blast radius, compliance and legal exposure under frameworks such as NIS2 and ISO 27001, and business continuity.
• Its recommendations are specific: strict version pinning, least-privilege pipeline access, automated credential rotation, and independent immutable backups that recover repository code plus metadata, environments, and workflows.
• It closes by asking how software supply-chain risk is evaluated and reported at board level.

For brands planning a campaign

The post offers a ready-made structure for a C-suite campaign: incident, executive consequence, concrete controls, board-level question. A partner brief could turn that final question into a practical discussion guide for security leaders and their boards.

Bartosz Jurga frames ransom payment as a board-level risk decision, not an IT question.

• The post cites three statistics—over 50% of enterprise victims now refuse to pay, 80% of organizations that pay are targeted again, and IP resilience is 100% the organization's responsibility.
• Ask for the sources behind these figures.
• It explains why payment is an unreliable recovery strategy: data may return corrupted, repeat attacks are common, and transfers can create legal and regulatory exposure.
• The post also argues that cloud providers guarantee platform uptime, not customer data recovery, and recommends immutable backups, air-gapped or isolated storage, and tested automated recovery procedures.

For brands planning a campaign

This gives a vendor a way to connect supply-chain security to ransomware readiness without treating them as separate topics. A campaign could challenge executives to test one assumption: if a trusted pipeline were compromised today, could the organization recover its code, metadata, environments, and workflows without paying?

The post identifies compromised runners, overly permissive CI/CD configuration files and elevated access to repositories, cloud environments and production secrets as ways a pipeline incident can spread.

• It says most breaches exploit everyday misconfigurations rather than sophisticated zero-days, while malicious AI tools are lowering the barrier to pipeline attacks.
• The argument ends with immutable backup and disaster recovery as the final line of defence when preventive controls are bypassed.

Risk factors move from technical misconfiguration to blast radius, threat evolution and business continuity.

For brands planning a campaign

A cybersecurity vendor can use this topic for executive thought leadership that names concrete pipeline failure modes and pairs prevention with recovery. It suits a campaign for security and infrastructure leaders who need to explain operational exposure to senior management.

Examples: Source 1

The post cites more than 400 infected packages and more than 500 million weekly downloads, then sets out the executive consequences: greater breach exposure through deployment secrets and cloud credentials, compliance and legal risk under frameworks such as NIS2 and ISO 27001, and disruption to software shipping and customer trust. It recommends strict version pinning, least-privilege pipeline access, automated credential rotation and independent immutable backups that preserve metadata, environments and workflows as well as code.

Executive brief built around a recent incident, business impact categories and numbered resilience measures.

For brands planning a campaign

This topic suits a partnership on third-party dependency governance and cyber resilience. A vendor can sponsor a practical executive explainer connecting supply-chain incidents to compliance, continuity and recovery, rather than relying on generic breach warnings.

Examples: Source 1

The post argues that paying is an unreliable recovery strategy: data can return corrupted, a large share of paying organisations are targeted again, and ransom transfers create legal and regulatory exposure.

• It shifts attention to downtime costs, lost developer productivity and brand damage, then challenges the assumption that cloud platforms cover data recovery under shared responsibility.
• The recommended response is immutable backups, isolated or air-gapped storage and tested automated recovery procedures.

Question-led myth-busting post with short claims, checklists and a direct question for a C-level audience.

For brands planning a campaign

A backup, ransomware recovery or cyber-resilience vendor can use this topic for board education aimed at C-suite audiences. The campaign angle is clear: make ransom demands obsolete through tested recovery, with evidence drawn from operational downtime and legal exposure rather than fear alone.

Examples: Source 1

Short paragraphs, bullet lists, bold labels and C-suite language lead to practical controls and a question or link to a fuller briefing. The subjects vary—pipeline misconfiguration, software supply-chain compromise and ransomware—but each post centres on decisions executives must make.

For brands planning a campaign

This format suits sponsored thought leadership: compact executive posts that set out a clear threat, a business consequence and a practical next step. Brands should provide specific examples and numbers to keep the posts concrete.

Examples: Source 1 · Source 2 · Source 3

The relationship structure is unstated; ask whether it involves employment, ownership, or a formal contract.

View example

One post argues that identity is the new front door and trust itself has become an attack vector for small businesses, citing compromised credentials sitting in systems now; another argues that paying a ransomware demand is a bad bet because payment brings no proof of data deletion, guarantee of restoration or assurance against another attack. Both writers land on the same practical ground: tested backups, strong identity controls and recovery planning before an incident.

Swati Gupta targets small-business owners with coverage of credential compromise and AI-driven social engineering; Bartosz Jurga targets enterprise CISOs, CTOs and CEOs with coverage of CI/CD pipelines, poisoned dependencies and board-level reporting.

Read original · Original 2

The post on the trivy-action compromise describes an attacker force-pushing malicious commits to 75 of 76 version tags, so any pipeline referencing a poisoned tag would silently exfiltrate secrets and cloud credentials — the same failure pattern in Jurga's keyv package and ChainDrop post, where an organisation's own authenticated build process fetches and executes a poisoned upstream dependency. Both treat CI pipelines as critical infrastructure and point to pinning, maintenance and proactive upgrading as the fix.

Sam Alba writes from inside a company building the tooling, mixing customer incident stories with product milestones such as the YC batch and autonomous CI investigations; Bartosz Jurga takes an executive-education approach and closes on backup and recovery rather than a product.

Read original · Original 2

One post asks how many organisations still believe MFA alone is enough, covering ransomware groups exploiting known Fortinet VPN vulnerabilities and stressing disciplined patch management; the other describes the PAYLOAD group using compromised domain credentials and Active Directory Group Policy to disable security controls, concluding that resilience matters as much as prevention. That mirrors Jurga's move from a technical incident to ownership, continuity and recovery readiness.

Bradley Richards writes commentary on another person's newsletter from a customer-success and managed-security perspective, focusing on vulnerability and patch management and privileged-account protection; Bartosz Jurga focuses on software delivery pipelines, dependency compromise, and recovery of code, metadata and workflows.

Read original · Original 2

One post addresses the cost of trust for small businesses, stating that 89% of small businesses currently have at least one compromised credential and that AI-powered attacks on small businesses rose about 340% in 2025.

• Another explains why paying ransomware is a bad bet for small businesses: ransomware groups now use a volume-based strategy targeting SMBs with automation, and many SMBs lack dedicated security teams and tested backups.
• For a brief on identity security or ransomware resilience for SMB owners, this creator's material is already framed for that audience and uses concrete figures.

The tradeoff is a shift in audience and subject.

• The vendor needs a campaign for enterprise C-suite readers about DevOps supply chain resilience.
• Swati Gupta's posts target small business owners and focus on identity and ransomware economics, not CI/CD pipelines or developer supply chains.
• The vendor would need to broaden the campaign to SMB identity and ransomware recovery, losing the enterprise DevOps angle.
• The posts do not source figures such as the 340% rise in AI-powered attacks; the vendor should verify them before publication.

One post tells the story of the Aqua Security trivy-action compromise, where an attacker force-pushed malicious commits to 75 of 76 version tags.

• It explains how Mendral's proactive upgrade put a customer on the only safe version, preventing credential exfiltration.
• The post shows detailed knowledge of supply chain attacks and practical prevention.
• Another post traces the building of Mendral, from leaving Dagger to YC W26 to shipping a supply chain security agent into the GitHub PR workflow.
• For a vendor seeking a technical founder's perspective and concrete incident storytelling, this creator is a stronger option.

The tradeoff is a move from executive thought leadership to a product-centric technical narrative.

• The posts are closely tied to Mendral's product and company milestones: one is a Mendral customer success story, and the other is a company progress update.
• They do not address C-suite readers as directly as the campaign requires or offer the same board-level framing of risk and recovery.
• There may also be a conflict if the vendor competes with Mendral or needs neutral thought leadership.
• The vendor should confirm the creator can produce vendor-agnostic executive content; otherwise, the campaign becomes a Mendral product story rather than a vendor thought-leadership series.

One post discusses organizations that believe MFA alone is enough and how ransomware groups exploit known Fortinet VPN vulnerabilities.

• It emphasizes that the fastest-recovering organizations have disciplined vulnerability-management processes and operational accountability.
• Another highlights the PAYLOAD ransomware group using compromised domain credentials and Active Directory Group Policy to disable security controls, stressing identity protection, privilege management, and recovery readiness.
• For a vendor targeting security leaders with a resilience message, this creator can speak to the operational and customer-success side of those decisions.

The tradeoff is subject focus and audience emphasis.

• Bradley Richards's posts cover general enterprise security, vulnerability management, and identity-based ransomware, not DevOps supply chain resilience or CI/CD pipelines.
• They are also framed from a customer success perspective at Atruent, which may suit a vendor selling managed security services better than one selling DevOps supply chain security.
• If the vendor wants to retain the DevOps supply chain angle and enterprise C-suite audience, Bradley Richards is a weaker match unless the campaign expands to broader cyber resilience.
• The posts also reference third-party newsletter Tech Decanter and its host; the vendor should account for that if the partnership involves that content.