Bharat Sharma

An agent, in this account, gathers context, selects the right tools, performs investigative steps, evaluates evidence, and recommends or executes approved responses. Sharma lists the work this covers: continuous threat hunting across disconnected data sources, alert enrichment and prioritisation, phishing investigation and response, identity and access reviews, vulnerability prioritisation based on business context, and incident reporting and evidence collection.

An unusual login followed by a large data transfer, or one user signing in at the same time from widely separated locations.

• Rather than treating these as separate alerts, the agent reviews identity and authentication history, examines endpoint activity and running processes, correlates network, cloud and threat-intelligence data, identifies potentially affected accounts and assets, builds a timeline with supporting evidence, and recommends containment to the analyst.
• The post closes by asking readers where they would first deploy an agent in security operations.

Read original

Production agents therefore need least-privilege access, approved tools, clear action boundaries, audit trails, validation checks and human approval for high-impact decisions.

• The goal is a "digital teammate" that handles time-consuming investigative steps at machine speed while people make consequential decisions.
• The same governance logic runs through Sharma's broader AI writing: AI requires governance, transparency, security and accountability, while judgment, empathy and values remain with people.
• The post makes a strong case for autonomous investigation while firmly limiting what an agent may decide alone.

Isolating a device or revoking credentials—the actions Sharma says require human approval before an agent proceeds.

Read original · Original 2 · Original 3

The pressures include millions of security events a day, attack surfaces spanning cloud, endpoints, OT, IoT and SaaS platforms, and attackers using automation and AI.

• The promised gains are prioritising critical threats, reducing alert fatigue, accelerating investigations, spotting unusual patterns across large environments, improving response times and giving better visibility into enterprise risk.
• Sharma puts the shift plainly: the challenge is no longer collecting security data but turning it into actionable decisions.
• The same technology also brings risks: AI-powered phishing and social engineering, deepfakes and identity manipulation, prompt injection, model security and governance, and data privacy and intellectual property exposure.
• Sharma rejects an "AI versus humans" outcome in favour of security professionals empowered by AI and supported by governance.

AI-powered phishing and deepfakes, which Sharma identifies as risks created by the same AI capability being deployed for defence.

Read original

They acknowledge that some tasks will disappear, some roles will evolve and a few jobs will be lost, while new work emerges in AI governance, cybersecurity, data quality, process redesign, customer experience, cloud engineering, ethics and human-AI collaboration.

• Adoption is settled; the open question is whether organisations adapt responsibly.
• AI can calculate and automate but lacks human wisdom, empathy and values, so responsibility stays with people.
• Sharma's refrain: humans will not be replaced by AI, but those who learn to work with it will outperform those who ignore it.

Healthcare summarising information and detecting patterns, logistics optimising routes and predicting demand, customer service handling routine questions, and cybersecurity and finance detecting anomalies and strengthening compliance—the areas of demonstrated impact Sharma names.

Read original

The principle: technology creates value when it solves real operational problems.

• Sharma says they are building A1 Logix but gives no product detail, customers, scale, metrics, funding or company link.
• The broader AI post uses the same operational framing, listing logistics among the areas where AI is already having practical impact.

Route planning and delivery visibility at A1 Logix, described as modest practical improvements rather than a transformation.

Read original · Original 2

Start here for the argument, rather than a summary of the field.

Sharma draws a line between rule-based automation and agentic AI: automation follows "if X happens, perform Y," which works for predictable events, while an agent can gather context, choose tools, run investigative steps, weigh evidence, and recommend or execute approved responses.

• The concrete example is an unusual login followed by a large data transfer, or one user signed in simultaneously from widely separated locations (the post says "geologically different locations").
• Rather than treating those as separate alerts, the agent reviews identity and authentication history, examines endpoint activity and running processes, correlates network, cloud, and threat-intelligence data, works out which accounts and assets may be affected, builds a timeline with supporting evidence, and recommends containment to the analyst.
• Sharma lists where this applies: continuous threat hunting across disconnected data sources, alert enrichment and prioritisation, phishing investigation and response, identity and access reviews, vulnerability prioritisation based on business context, and incident reporting.
• The second half is a caution.
• Autonomy "must be earned — not assumed," because an agent that can isolate devices, revoke credentials, or block traffic carries operational risk.
• Production agents need least-privilege access, approved tools, clear action boundaries, audit trails, validation checks, and human approval for high-impact decisions.
• The stated goal is a digital teammate that does the slow investigative steps at machine speed while people keep the critical calls.
• It ends by asking readers where they would first deploy an agent.

For brands planning a campaign

For a security vendor, this post is effectively a webinar outline: the investigative sequence is demoable step by step, and the guardrails list gives the governance counterpoint risk-averse enterprise buyers will raise. It also shows Sharma arguing a position rather than pitching a product, which suits a moderated thought-leadership format.

This post gives the short version of the answer that runs through the rest of the material.

Sharma argues the conversation usually focuses on AI replacing analysts, when the bigger opportunity is helping security teams move faster and with more precision.

• The pressures named are millions of security events a day, a growing attack surface across cloud, endpoints, OT, IoT, and SaaS, and attackers using automation and AI.
• The key claim is that the challenge has moved on from collecting security data to turning it into actionable decisions.
• AI is described as a force multiplier that can prioritise the most critical threats, reduce alert fatigue, accelerate investigations, spot unusual patterns across large environments, improve response times, and give better visibility into enterprise risk.
• Sharma then lists the risks AI introduces: AI-powered phishing and social engineering, deepfakes and identity manipulation, prompt injection, model security and governance, and data privacy and intellectual property exposure.
• The post closes by rejecting an "AI versus humans" framing in favour of security professionals empowered by AI, supported by governance and sound business decisions, and asks how readers are balancing innovation against security and governance.

For brands planning a campaign

The paired list of benefits and new risks is ready-made debate material for a panel or fireside session, and shows Sharma stating the counterargument to their own case. It is short and list-driven, so pair it with the agentic AI post to assess whether they can carry a technical session.

Useful for the general worldview behind the security-specific posts, or a sense of how they open a non-technical audience.

Sharma compares AI to the early days of the internet and to earlier waves such as computers and mobile, arguing each round of disruption expanded human potential even as people feared it.

• The claim is that AI reshapes how organisations operate not by replacing people but by removing repetitive work, improving decisions, and freeing teams for higher-value problems.
• They concede that some tasks will disappear, some roles will evolve, and a few jobs will be lost, while new work appears in AI governance, cybersecurity, data quality, process redesign, customer experience, cloud engineering, ethics, and human-AI collaboration.
• Sector examples are given: healthcare summarising information and detecting patterns, logistics optimising routes and predicting demand, customer service handling routine questions, and cybersecurity and finance detecting anomalies and strengthening compliance.
• Cloud platforms, secure data foundations, and scalable compute are credited with making AI practical at enterprise scale.
• The post insists on limits — AI has no human judgment, wisdom, empathy, or values, and needs governance, transparency, security, and accountability — and closes on the line that humans who learn to work with AI will outperform those who ignore it.

For brands planning a campaign

This is opening-framing material for a thought-leadership webinar: accessible, sector-spanning, and explicitly about responsible adoption.

• It says nothing specific about security operations, so it should set the scene rather than carry the technical segment.
• The emphasis on governance, ethics, and accountability is useful for a vendor selling into regulated markets.

It directly supports the logistics venture named in the profile.

Sharma says that while building A1 Logix they have been exploring how AI can simplify logistics operations through route optimisation, real-time visibility, and intelligent decision-making.

• The improvements listed are modest and practical: smarter route planning, fewer delays and less operational waste, better visibility into deliveries and operations, and more time focused on customers and growth.
• The central line is that technology creates value when it solves real operational problems.
• The post closes by asking readers where they see the most practical use of AI in business.

For brands planning a campaign

This is the piece to cite if a brief wants an operator's angle on applied AI rather than a security angle. Sharma presents A1 Logix as a venture they are building; ask for specifics on its product, customers, scale, and outcomes before making claims about the business.

An agent layer should gather context, choose tools, run investigative steps, weigh evidence, and recommend or execute approved responses.

• The post works through one scenario — an unusual login followed by a large data transfer, or one account signed in from widely separated locations — and lists the steps an agent would take: review identity and authentication history, examine endpoint activity and running processes, correlate network, cloud and threat-intelligence data, identify potentially affected accounts and assets, build a timeline, and recommend containment.
• It then lists where agents fit: continuous threat hunting across disconnected data sources, alert enrichment and prioritization, phishing investigation and response, identity and access reviews, vulnerability prioritization by business context, and incident reporting and evidence collection.

Builds the argument around one concrete incident scenario, then generalizes to a use-case list.

For brands planning a campaign

The closest match to the proposed webinar.

• The worked example provides a ready demo script, and the use-case list maps to a segment-per-use-case agenda.
• Their closing question — where would you first deploy an AI agent in your security operations? — is a usable prompt for a live audience.

Examples: Source 1

The promised gains are prioritization of critical threats, less alert fatigue, faster investigations, anomaly detection across large environments, quicker response, and better visibility into enterprise risk. They also name the risks AI brings into the same environment: AI-powered phishing and social engineering, deepfakes and identity manipulation, prompt injection, model security and governance, and data privacy and intellectual property exposure.

For brands planning a campaign

Gives a vendor two halves for one session: AI applied to defense, then AI as a new attack surface. The augmentation framing is a more credible hook than automation-driven headcount cuts, and the risk list doubles as a second-act agenda.

Examples: Source 1

The goal is a “digital teammate” that handles time-consuming investigation steps at machine speed while people make consequential decisions. The broader AI post makes the same case for governance, transparency, security and accountability, with judgment, empathy and values remaining with people.

States the capability first and the constraints immediately after, making guardrails a condition of the pitch rather than an afterthought.

For brands planning a campaign

A governance segment or panel topic. It gives a vendor a natural place to show approval workflows, audit logging and policy controls, and to be precise about what an agent should be allowed to do unsupervised.

Examples: Source 1 · Source 2 · Source 3

The new work named includes AI governance, cybersecurity, data quality, process redesign, customer experience, cloud engineering, ethics and human-AI collaboration.

• Adoption is presented as settled rather than pending, with responsible adaptation as the open question, supported by cloud platforms, secure data foundations and scalable compute.
• The summary line: humans will not be replaced by AI, but humans who learn to work with it will outperform those who ignore it.

For brands planning a campaign

Best suited to an executive or transformation audience rather than a SOC audience.

• For the proposed webinar, it works as an opening frame or a closing “what changes for the team” segment.
• Pair it with security-specific material to keep the session focused.

Examples: Source 1

Its stated principle is that technology creates value when it solves a real operational problem, not when it is novel. The broader AI post also names logistics as one of four areas of demonstrated impact, alongside healthcare, customer service, and cybersecurity and finance.

For brands planning a campaign

Shows a second, operator-side domain beyond security. For a cybersecurity vendor it is adjacent rather than on-brief, but supports practitioner credibility on a cross-industry panel and illustrates the operational framing Sharma tends to use.

Examples: Source 1 · Source 2

Three of the four posts end with a direct question.

• The writing is plain and vendor-neutral, with almost no product names, customer names, figures or dated examples; the posts describe categories of work rather than report outcomes.
• The exception is the logistics post, which names Sharma’s own venture, A1 Logix.

The reviewed set contains no video, long-form article, podcast or conference talk; every item is a text post.

For brands planning a campaign

Easy to co-produce: a sponsor supplies the problem framing and use-case list, while Sharma supplies the structure and closing question to drive comments. Expect conceptual content rather than case-study proof; a vendor seeking metrics or named deployments should supply them.

Examples: Source 1 · Source 2 · Source 3 · Source 4

They name no title or ownership stake.

View example

Karanjalkar's posts on Indicators of Behaviour and on the gap between behaviour analytics and behavioural threat intelligence ask readers to treat behaviour as intelligence rather than only as an anomaly. Both end with a question to the audience.

Karanjalkar's route is standards and terminology: the OCA Indicators of Behaviour subproject, STIX 2.1, and a vendor-by-vendor survey of behaviour analytics platforms from Microsoft Defender to Google Chronicle. Sharma avoids named products and standards bodies, framing the same problem as an operational workflow, with a worked scenario and a use-case list an agent would run through.

Read original · Original 2 · Original 3

Both pair a capability case with the conditions attached to it: Hodges discusses AI governance, AI fluency, and the judgment and relationships models cannot supply; Sharma covers least-privilege access, audit trails and human approval for high-impact decisions.

Hodges writes for and about channel partners, MSPs and vendor enablement, naming Barracuda IQ and the BarracudaONE platform and framing adoption as a partner business opportunity around identity, access and exposure. Sharma's posts carry almost no product names or partner framing; they focus on investigating alerts rather than reselling or managing a security service.

Read original · Original 2 · Original 3 · Original 4

Both Yildiz and Sharma stress that the valuable skill is explaining why an alert matters and what should happen next, rather than producing the alert. Both end posts with a direct question and an invitation to save or repost.

Yildiz teaches through artifacts: a step-by-step Microsoft Sentinel home lab with KQL queries and a specific event ID, and an eighteen-page pentest field manual built around attack paths, evidence and retesting. Sharma's posts stay conceptual, without a lab, download, checklist or screenshots; the closest thing to an artifact is the agent investigation sequence in the agentic AI post.

Read original · Original 2 · Original 3 · Original 4

One post works through the Open Cybersecurity Alliance Indicators of Behaviour subproject under OASIS: a vendor-neutral way to represent how an attacker behaves, built on STIX 2.1 and covering initial access, privilege escalation, credential access, lateral movement, persistence, command and control, and data staging and exfiltration, so behavioural observations can be shared across security products.

• The argument is that attackers quickly change malware, addresses, domains and infrastructure, but changing behaviour is harder because they still have to reach the same objectives.
• The second post draws a distinction that matters to buyers: behaviour analytics answers whether something is unusual, while behavioural threat intelligence asks what adversarial objective the activity represents, which attack stage it sits in, how it relates to activity in other domains, and what the attacker is likely to do next.
• It names Microsoft Defender, CrowdStrike Falcon, Splunk, Exabeam, Darktrace and Google Chronicle as examples of platforms that stop at the anomaly.
• For a vendor selling detection, correlation or threat-intelligence capability, or an audience of detection and threat-intelligence engineers, this is a sharper and more contestable argument than Sharma's agentic-investigation walkthrough.

The tradeoff is audience fit and the through-line.

• Sharma's posts target CTI and SOC specialists, not the mixed audience of practitioners and funders who need executive-level framing.
• Their argument about what autonomy should be allowed to do translates more easily to decision-makers.
• Karanjalkar keeps the discussion product-neutral, which suits a standards conversation but leaves a vendor less natural room to place its own tool in the narrative.
• The vendor would also need to be comfortable with competing platforms being named.
• Sharma's posts offer a similar amount of material, with the same gaps: no video, talk or customer outcome, and no audience composition data.

Examples: Source 1 · Source 2

Both posts are written from inside a vendor's partner motion.

• One describes what partners ask about AI—governance, AI-enabled security practice, and AI fluency as distinct from buying tools—and names Barracuda IQ, the AI engine and intelligence layer behind the BarracudaONE platform, alongside natural-language capability, threat intelligence and privacy protections.
• It explicitly argues that AI should give security professionals more time for work that needs human judgement.
• The other argues that most breaches still start with something unsophisticated: a weak credential, an exposed service, or an account that should have been disabled months earlier.
• Attackers often do not break in; they simply log in.
• It sets out an ongoing managed-service approach to identity and access: reviewing privileged, inactive and third-party accounts, MFA and SSO, least privilege and zero trust through IAM and PAM, continuously monitoring login activity, and finding exposed services before attackers do.
• If the need is MSP enablement, managed services, or identity security sold as a recurring service line, this is closer to the buyer's own business than Sharma's agentic-operations frame.

The tradeoff is vendor alignment and a narrower method.

• The content is tied to one company's platform, partner program and channel language, so a competing vendor would ask a speaker to present material built around another vendor's engine—a conflict that Sharma's product-agnostic argument avoids.
• The posts stay at the level of theme, position and service motion.
• They offer no step-by-step investigative procedure, dated customer result or measured outcome.
• If the session needs the operational walkthrough that is Sharma's strongest material, this is a thinner spine.
• Ask for a speaking record, audience composition and commercial terms.

Examples: Source 1 · Source 2

One post lays out a Microsoft Sentinel home lab that runs from an empty Azure environment to a working SOC: subscription and resource group, Log Analytics workspace, enabling Sentinel, auditing, health monitoring and retention, connecting Windows security logs, understanding tables, fields and event IDs, basic KQL, hunting failed logins on Event ID 4625, turning that query into an analytics rule, triggering and validating the first alert, investigating the incident, reviewing entities, logs, evidence and timelines, deciding true or false positive, and building automation rules and playbooks.

• It closes with the claim that the real skill is not creating an alert but explaining why it matters and what should happen next.
• The other post is an 18-page field manual on reading pentest reports, organised around attack paths: where the attacker started, the final impact, which weaknesses enabled the path, how each finding is reproduced, what evidence supports it, which remediation breaks the chain, what could not be tested, and whether the retest proved the path was actually closed.
• It also offers a debrief question that turns offensive testing into detection engineering: which of the tester's actions should our controls have detected.
• For a live demonstration, hands-on exercise or detection-engineering session, this gives the vendor more to do than a speaking slot.

The tradeoff is that the centre of gravity is tooling and procedure.

• Both posts are how-to guides: one is Microsoft-centric and names Sentinel, Azure, Entra ID, KQL and MITRE ATT&CK; the other covers writing and reading pentest reports.
• Neither offers the broader argument about where autonomy belongs in a security operation or what conditions it must meet—the line Sharma already argues in writing and the basis for a vendor-neutral thought-leadership session.
• A step-by-step format is also hardest to adapt to a room that includes executives who fund security programmes.
• One specific caution: the Sentinel roadmap post credits another party, so the lab material attributed in it may not be Yildiz's own.
• Confirm provenance before building a session on it.

Examples: Source 1 · Source 2