Bradley Richards shares cybersecurity commentary from a customer success perspective, connecting topics such as ransomware, identity security, and patching to organizational resilience and trust.
They are most useful for managerial cybersecurity commentary linking threats to resilience, response, and trust.
Best for
A cybersecurity MSSP or vendor seeking managerial thought leadership on ransomware and identity security.
Not for
Technical launch campaigns needing configuration guidance, original data, or guaranteed reach.
Key takeaways
Security maturity comes from operational discipline, not tool spending alone.
The access attackers want is trusted access.
Recovery decisions should be made before the incident.
Check first: Confirm deliverables, disclosure, approval, rates, and audience analytics before committing.
Main ideas
Security maturity comes from operational discipline, not tool spending alone · The access attackers want is trusted access · Recovery decisions should be made before the incident
Bradley Richards shares cybersecurity commentary that connects technical threats to the decisions and routines that shape organizational resilience. In six LinkedIn posts, they cover ransomware, identity security, patching, small-business security, and incident response, often asking what a breach would mean for trust, recovery, or day-to-day operations.
Richards’s distinctive move is to take a security story and identify the practical weakness behind it: known vulnerabilities left unpatched, privileged access that can disable controls, or internal information that makes phishing more convincing.
Their posts turn that weakness into a business question—for example, whether a team could identify and fix a known flaw before attackers did, or whom stakeholders would trust during a breach.
This makes the work useful to readers looking beyond attack headlines for lessons about prevention, response, and organizational trust.
The emphasis is consistent, though the examples vary: they also return to basic small-business habits such as testing backups and keeping updates current.
Bradley Richards argues that cybersecurity failures often stem from lapses in operational discipline and trust rather than missing tools.
Read more
They draw on current stories, often from Aida Keehner's Tech Decanter newsletter, to develop customer-success and risk-management lessons, closing with questions that prompt readers to test their readiness. Recurring priorities include patching and basic controls, identity and privileged access, recovery relationships arranged before an incident, and communication during a breach.
Security maturity comes from operational discipline, not tool spending alone
Richards argues that many incidents begin with gaps organizations already knew about.
Read more
The key questions are whether known vulnerabilities are found, prioritized and fixed, and whether basic habits are repeated.
In smaller organizations, delayed updates, reused passwords, untested backups and optional phishing training create opportunity; attackers choose targets by opportunity, not only by company size.
They frame security maturity as consistent execution rather than one large initiative.
Richards discusses ransomware groups exploiting Fortinet VPN vulnerabilities that had been publicly known for months.
They contrast heavy spending on security tools with inconsistent patch management, noting that organizations recover fastest when they have disciplined vulnerability management, operational accountability and proactive remediation.
A separate post lists familiar small-business failures and captures the common post-breach response: "We planned to address it later."
Richards shifts attention from malicious software to identity.
Read more
If attackers can use compromised domain credentials, Active Directory Group Policy or privileged admin accounts, they can operate with the same tools as an IT team and disable controls.
Stolen employee directory data from Azure and Entra can make phishing more convincing by mapping reporting lines, service accounts and administrators.
They prioritize privileged-account protection, identity protection and recovery readiness alongside employee awareness.
Richards highlights a story from Aida Keehner's Tech Decanter about the PAYLOAD group using compromised domain credentials and Active Directory Group Policy to disable security controls.
They write: "What stands out isn't the attack.
It's the access."
In another post, they describe reports that threat actors were selling employee directory information allegedly obtained through compromised Azure and Entra credentials, then explain how that data could support phishing built around an internal org chart.
Recovery decisions should be made before the incident
Richards argues that incident-response decisions made under pressure carry business risk.
Read more
Organizations without trusted recovery, legal, insurance and security partners may have to make critical choices with incomplete information and little time. Cyber resilience therefore includes knowing who will guide the response, not just preventing the initial breach.
Richards discusses a report on a group called "Ransom Busters."
Investigators believed the group may have used insider access while offering victims recovery services costing between $20,000 and $60,000, raising the prospect of a second victimization.
They ask whether an organization would already know who was guiding its response if a ransomware event happened tomorrow.
Communication is part of incident response because trust outlasts the breach
Richards argues that breaches create headlines, but trust determines what happens afterward.
Read more
How leaders engage customers, employees and stakeholders during uncertainty can shape trust for years, and communication can matter as much as technical response.
They cite a line from Aida Keehner's personal message — "Technology changes.
Contracts change.
Relationships endure." — to connect incident response to customer success.
The line is Keehner's, used to frame the lesson.
Richards highlights a story from Aida Keehner's Tech Decanter about claims that ShinyHunters obtained information associated with thousands of federal employees and applicants. Rather than dwell on whether the allegations are confirmed, they turn to the trust question and close by asking: "If your organization faced a major security event tomorrow, who would your stakeholders trust to call first?"
Shows what this creator adds beyond technical threat commentary: a recurring focus on trust and communication.
Read more
Richards opens with a two-line contrast, then uses a ShinyHunters story about federal employees and applicants to make a point about uncertainty.
Rather than dwell on whether the allegation is confirmed, the post shifts to how leaders communicate with customers, employees, and stakeholders.
It closes with a direct question: "If your organization faced a major security event tomorrow, who would your stakeholders trust to call first?"
For brands planning a campaign
A useful starting point for MSSP thought leadership on incident communications and trust, beyond detection and response. It supports a campaign angle around who the client calls first during a crisis.
Shows how Richards turns a known vulnerability story into an operational question, with a practical, process-focused approach.
Read more
The post uses an Aida Keehner Tech Decanter discussion as a news hook, then makes a customer-success argument: recovery speed depends less on security budget than on disciplined vulnerability management, operational accountability, and proactive remediation.
It names a concrete failure pattern: organizations invest in tools while patch management stays inconsistent.
It ends with a self-audit question about whether a known vulnerability would be found, prioritized, and fixed before an attacker finds it.
For brands planning a campaign
Supports a patch and vulnerability-management message aimed at MSSPs and their clients. It gives campaign copy a practical diagnostic question instead of a generic "patch faster" slogan.
Shows why identity and privilege matter in ransomware coverage, with a concrete example of Richards explaining an attack path in plain language.
Read more
Richards highlights a PAYLOAD ransomware story involving compromised domain credentials and Active Directory Group Policy used to disable security controls.
The key line is "What stands out isn't the attack.
It's the access."
The post argues that malware detection can miss an attacker operating with the same tools as the IT team, then asks how much damage a compromised trusted admin account could do before anyone notices.
For brands planning a campaign
Points to identity protection, privileged access management, and recovery readiness as campaign themes. It fits an MSSP selling identity and resilience services better than a pure endpoint-detection pitch.
Shows how this creator connects a technical identity breach to everyday social engineering, with a clear focus on customer-facing risk.
Read more
The post describes reports that threat actors were selling employee directory information allegedly obtained through compromised Azure and Entra credentials.
It lists the kinds of details that may be exposed: organizational structures, service accounts, administrator details, and employee contact information.
Richards explains how phishing can exploit reporting lines and trusted relationships, then asks how vulnerable an organization is to an attempt built around its internal org chart.
For brands planning a campaign
Useful for campaigns that combine identity security with security awareness. It gives buyers a reason to fund both technical identity controls and employee training, rather than treating phishing awareness as a standalone module.
Shows what cyber resilience means in operational terms, moving from a news story to a concrete preparedness lesson.
Read more
Richards uses a report about a group called "Ransom Busters" to examine a second-victim scenario: investigators believe the group may have used insider access while offering recovery services costing between $20,000 and $60,000.
The post focuses on the business risks of incident-response decisions made under pressure.
Without trusted recovery, legal, insurance, and security partners, organizations may have to decide with incomplete information and little time.
For brands planning a campaign
Supports incident-response readiness and partner-network messaging. A campaign can use it to argue for pre-incident agreements and a named response chain, not just prevention tooling.
Shows how Richards addresses smaller organizations, with the clearest statement of the fundamentals-first argument.
Read more
Richards lists familiar small-business failures: delaying critical updates, reusing passwords, skipping backup testing, and treating phishing training as optional.
The post argues that attackers choose targets by opportunity, not only by company size.
It captures the common post-breach response as "We planned to address it later" and frames security maturity as consistent execution of fundamentals.
For brands planning a campaign
A direct fit for small-business and MSSP campaigns about baseline controls. It gives a plain-language rationale for recurring managed services rather than one-off security purchases.
Newsletter-led commentary with a customer-success lens6
Identity and privileged access as the real attack surface2
Patch discipline as ransomware defense1
Pre-incident trust and recovery partners1
Security fundamentals for small businesses1
Breach communication as a trust decision1
Patch discipline as ransomware defense
Bradley Richards uses the Fortinet VPN ransomware story to argue that many incidents begin with vulnerabilities organizations already knew about.
Read more
The post contrasts security-tool spending with inconsistent patch management and links faster recovery to disciplined vulnerability management, operational accountability, and proactive remediation rather than the largest budget.
For brands planning a campaign
A ransomware thought-leadership brief could ask Richards to write about patch prioritization and remediation accountability, not just MFA or tooling. A short commentary built around one current vulnerability story could end with a practical question: would a known exposure be found and fixed in time?
Identity and privileged access as the real attack surface
Two posts focus on attackers operating through trusted identities rather than malicious software.
Read more
One describes the PAYLOAD group using compromised domain credentials and Active Directory Group Policy to disable controls; the other covers stolen Azure and Entra data that could help attackers map reporting lines and craft targeted phishing. Richards shifts attention from malware detection to privileged-account protection, identity protection, and recovery readiness.
For brands planning a campaign
Position Richards for identity-security content aimed at business and IT leaders, covering privileged access reviews, admin-account compromise scenarios, and phishing that uses real organizational context. A strong campaign asset would be a tabletop-style checklist asking how much damage a compromised trusted admin account could cause before detection.
Richards discusses a report on a group allegedly offering paid ransomware recovery while exploiting insider access.
Read more
The lesson: incident-response decisions made under pressure carry business risk. Organizations without established recovery, legal, insurance, and security partners may have to choose with incomplete information and little time.
For brands planning a campaign
This supports campaign content about pre-incident readiness rather than breach response as a scramble. An MSSP could commission a piece on how buyers should select and test recovery partners before an incident, or a short guide to decisions that should be settled in advance.
Richards argues that attackers choose targets by opportunity, not only company size.
Read more
The post lists delayed updates, password reuse, skipped backup testing, and optional phishing training as common small-business gaps, and says security maturity comes from consistently executing fundamentals rather than launching one large initiative.
For brands planning a campaign
Useful for small-business and midmarket campaigns that need plain-language relevance.
Richards can frame an offer around recurring fundamentals checks, backup testing, and phishing habits without overclaiming technical depth.
A practical content format is a short self-assessment asking which abandoned habit would create the greatest risk.
A post on a reported ShinyHunters data exposure argues that breaches create headlines while trust determines what happens afterward.
Read more
Richards says communication during uncertainty can matter as much as technical response, and that how leaders engage customers, employees, and stakeholders can shape trust for years.
For brands planning a campaign
This gives a campaign a communications angle within incident response. An MSSP could pair Richards with a crisis-communications practitioner for a piece on who stakeholders trust to call first, or use the theme in executive-level content about response planning beyond technical containment.
Newsletter-led commentary with a customer-success lens
Across the posts, the recurring approach is to take one story from Aida Keehner's Tech Decanter, draw out a business or customer-success lesson, and close with a direct question to the reader.
Read more
The posts emphasize operational discipline, trust, and resilience rather than product promotion.
Start with a current cybersecurity story, interpret it through customer success and risk management, and turn the lesson into a diagnostic question for readers.
The posts do not demonstrate configuration-level technical detail. For a campaign that needs it, pair Richards with a technical practitioner.
For brands planning a campaign
Commission a recurring commentary format rather than a generic product post: give Richards a timely news hook and ask for an operator-facing lesson, a concrete example, and one question that helps a prospect assess exposure. Hold product claims until the editorial review stage.
Bradley Richards’s posts refer to Atruent in the first-person plural, indicating a connection to the business.
Read more
Ask whether they are an employee, owner, or partner.
Their posts also repeatedly draw on Aida Keehner’s Tech Decanter newsletter for cybersecurity stories.
Ask whether any sponsorship, affiliate, client, or investment relationships are involved.
Atruent
Disclosed partnership
Richards writes, “At Atruent, we regularly see organizations invest heavily in security tools and controls while patch management remains inconsistent” and “At Atruent, these conversations increasingly focus on identity protection, privilege management, and recovery readiness.”
Read more
Ask whether they are an employee, owner, or partner at Atruent.
Richards repeatedly uses stories covered by Aida Keehner in the Tech Decanter newsletter as a starting point for posts on ransomware, identity security, and incident response.
Read more
The posts cite Tech Decanter as an industry news source; ask whether there is a commercial partnership.
Bradley Richards writes short LinkedIn commentary that starts with a cybersecurity news item, often from Aida Keehner’s Tech Decanter, and turns it into a risk or customer-success lesson.
Read more
The posts return to a few practical questions: would a known vulnerability be found and fixed in time, how much damage could a trusted admin account do, who would guide recovery if ransomware hit tomorrow, and who would stakeholders trust to call first. Explore the posts in pairs: patching with small-business fundamentals, identity with privileged access, and recovery partners with breach communication.
Both write for smaller organizations about identity as the front line, arguing that ransomware response depends on tested backups, strong identity controls and planning before an incident.
Read more
They use direct questions and plain lists to push owners toward practical action.
Gupta writes long, emphatic list-style posts aimed squarely at small-business owners, building arguments around statistics and a “trust as attack vector” framing. Richards more often starts with a current newsletter story and draws a customer-success or risk-management lesson, with less statistical detail.
Both turn current cybersecurity and AI developments into governance and business-process guidance, using short action lists or diagnostic questions to help leaders verify trust and reduce exposure.
Read more
Hussain focuses on executive impersonation, deepfake fraud and AI privacy transparency, often with a checklist of controls. Richards stays closer to ransomware, identity access, patching and customer trust during incidents.
Both use identity and social-engineering incidents to argue that ordinary support and access processes are security controls, not side issues.
Read more
They ask readers to examine how trusted access could be abused.
Edwards writes longer historical incident analyses and resource guides, including certification study material, with a practitioner-education emphasis. Richards writes shorter current-news commentary and consistently frames the lesson through customer success and stakeholder trust.
Bradley Richards is a reasonable topic-fit test for an MSSP ransomware and identity-security campaign aimed at security leaders, but the posts do not support a reach or audience-composition buy.
Read more
The six posts consistently frame security as an operational and customer-success issue: patching known vulnerabilities, protecting identity and privileged accounts, preparing recovery partners, teaching small-business fundamentals, and preserving trust after a breach.
They appear intended for security leaders, IT and operations staff, MSP or MSSP customer-success teams, and small-business owners.
Their LinkedIn account shows 580 followers.
Before placing budget, request follower demographics and recent post analytics, including impressions, engagement rates, job titles, seniority, industry, company size, and geography, plus any audience survey.
Also ask for recent results from ransomware and identity-security posts of comparable depth and format.
Bradley Richards does not publish a partnership program, sponsorship menu, rate card, or official inquiry route in the posts here.
Read more
They regularly comment on cybersecurity, reference Atruent as company context, and link to Tech Decanter newsletter issues featuring Aida Keehner, but do not disclose paid formats, terms, or deliverables.
Treat any arrangement as a direct, individually negotiated conversation rather than a listed product.
Before committing, ask about deliverables, disclosure, approval, timing, usage rights, and measurement terms.
Qualified yes for a small, editorially led pilot. Bradley Richards is a credible fit for managerial thought leadership, but the posts do not support a reach-led or guaranteed-impression buy.
Read more
Brief
A cybersecurity MSSP wants a B2B creator to develop thought leadership on ransomware and identity security for business and IT leaders who buy managed security services. The work should propose content formats and key messages.
Reasons
The posts connect ransomware and identity stories to operational decisions managed-security buyers recognize: patch discipline, privileged-account protection, pre-incident recovery partners, small-business fundamentals, and breach communication.
Richards uses a repeatable method: take one current cybersecurity story, draw out a customer-success or risk-management lesson, and close with a diagnostic question. That approach suits a thought-leadership series better than a one-off product post.
The content stays at a managerial level, explaining why access, accountability, and readiness matter without pretending to be a configuration guide. That matches an MSSP audience of business and IT leaders.
The posts offer a clear identity-security angle: attacks often run through trusted credentials and admin tools, not only malicious software. That gives an MSSP campaign territory around privileged access, identity protection, and recovery readiness.
The trust-and-communication theme gives the campaign a second dimension beyond detection and response. It can support executive content about who a client calls first during a crisis.
Conditions
Agree on a small pilot with a defined baseline before scaling. The LinkedIn account showed 580 followers, with no engagement, demographic, or audience-composition data.
Negotiate any paid arrangement directly. No sponsorship menu, rate card, or published partnership program appears in the posts.
Keep product claims out of the first draft: the posts show no product promotion, technical testing, or measured client outcomes.
Key messages
Known vulnerabilities are an accountability problem, not an information problem.
The attack path often runs through trusted access, so privileged accounts need the same scrutiny as malware.
Recovery readiness is a purchasing decision made before an incident, not a scramble during one.
Trust after a breach depends on communication as well as technical response.
Recommended formats
A four-part LinkedIn commentary series, with each post built around one timely story and one buyer self-assessment question.
One short newsletter-style article on known exposure, privileged access, and pre-incident readiness.
A one-page pre-incident readiness checklist for an MSSP workshop or lead follow-up.
A 30-minute executive briefing outline for prospects, using the same themes as the written series.
When to choose a specialist
No for a campaign requiring this level of technical depth, original data, and a reach guarantee. A narrower managerial launch narrative could work with a technical co-author.
Read more
Brief
An identity-security software vendor wants a technical launch campaign for security engineers. Deliverables include an Entra ID hardening tutorial, original benchmark data, configuration-level guidance, and a guaranteed reach of 25,000 security practitioners.
Reasons
The posts offer commentary on secondary cybersecurity stories, not configuration steps, hands-on testing, original threat research, or benchmark data.
The content targets a managerial audience, explaining business risk and customer-success lessons rather than teaching security engineers to harden Entra ID or implement controls.
The available account metadata shows 580 followers, but no impressions, engagement rates, job titles, seniority, industry, or company-size data. Ask for audience and performance metrics before setting a reach guarantee.
A product-first launch campaign would conflict with the posts’ emphasis on operational discipline, trust, and resilience over product promotion.
No published sponsorship program or prior paid partnership example appears in the material. Negotiate deliverables, disclosure, approval, and measurement terms separately.
What would change the decision
Pair Richards with a named technical practitioner who can supply configuration detail and testing evidence.
Reframe the brief as a managerial launch narrative for business and IT leaders, with an engineering co-author delivering the technical tutorial.
Replace the reach guarantee with an agreed pilot baseline. Request LinkedIn follower demographics and recent post analytics before budgeting.
A worked campaign example
Brief
An MSSP wants a four-week thought-leadership pilot on ransomware and identity security for business and IT leaders. The goal is qualified conversations, not mass reach.
Campaign angle
The Known Exposure Question: a four-week LinkedIn commentary series that turns current ransomware and identity stories into buyer self-assessments, supported by a one-page pre-incident readiness checklist and a 30-minute MSSP-led review workshop.
Format
Week 1: Patch discipline. Open with a known-vulnerability story and ask: which known exposure in your environment is overdue, and who owns remediation?
Week 2: Privileged access. Explore how the attack path often runs through trusted credentials, not malware, and ask: what could a compromised admin account do before anyone notices?
Week 3: Pre-incident readiness. Ask: which recovery, legal, insurance, and security partners are already agreed, and who leads the response?
Week 4: Trust and communication. Ask: if a major security event happened tomorrow, who would your stakeholders trust to call first?
Support asset: a one-page Known Exposure Review checklist covering overdue vulnerabilities, remediation ownership, privileged-account exposure, pre-agreed response partners, and crisis communication ownership.
Call to action: invite readers to a 30-minute Known Exposure Review workshop with the MSSP. Use the checklist as the working agenda.
Key messages
A known vulnerability is an accountability gap, not a future problem.
Identity and privileged access are part of the attack surface, even when no malware is involved.
Recovery readiness is decided before the incident.
Communication during a crisis shapes trust after it.
Measurement
Run the four weeks as a pilot. Agree the baseline before launch, request LinkedIn follower demographics and recent post analytics, and track qualified workshop requests rather than impressions alone.
Sample opening
Most ransomware stories start with the exploit. The more useful question is why a known weakness was still open.
Choose Swati Gupta for the same MSSP thought-leadership pilot when the buyer is a small-business owner rather than a security executive and the campaign needs blunt, high-contrast education on identity and ransomware.
Read more
The posts argue that trust is the attack vector and identity is the front door, cite compromised credentials and AI-enabled attack rates, and explain why paying a ransom leaves no proof of deletion, restoration, or safety from a second attack.
The approach is more alarm-led and list-heavy than Bradley Richards's customer-success framing, so it suits attention-getting SMB education better than calm executive thought leadership.
The posts cover two topics: SMB identity risk and ransomware payment.
For a broader brief spanning patch discipline, privileged access, recovery partners and breach communication, ask for examples covering those areas.
Choose Salman Hussain when the pilot should center on executive impersonation, business email compromise, and AI-era verification rather than ransomware recovery.
Read more
The posts give compact leadership checklists: verify financial requests through an independent channel, use dual approvals and segregation of duties, train employees on deepfakes, and assess executives' public exposure. A second post extends the same practical tone into AI transparency and consent around browser-deployed models.
The posts are more checklist-driven and policy-oriented, with less close narrative and fewer buyer self-assessment prompts than Richards's.
They cover Gulf executive fraud and browser AI privacy.
For an MSSP campaign that requires ransomware incident-response depth, customer-success lessons or audience reach, ask for examples and audience data; the trade-off is sharper verification content but less of Richards's broader readiness narrative.
Choose Jason Edwards when the campaign needs a long-form incident story or a training-and-certification angle for security operations and help-desk leaders.
Read more
The MGM post walks through how a service-desk reset became the access path, names Scattered Spider/UNC3944 and ALPHV/BlackCat, and frames the help desk as a human-operated identity control plane. The CCOA post shows how to package audio, a study guide, and flashcards for busy analysts.
Edwards is a stronger fit for case-study explainers and learning-resource campaigns than for a four-week executive commentary series.
The CCOA post promotes study materials.
For an MSSP-oriented campaign requiring calls to action, buyer self-assessment questions or audience data, ask for examples; Richards is a cleaner fit for managerial ransomware and identity thought leadership.
