# Dan Sorensen

Dan Sorensen works on cybersecurity and AI governance, helping organizations assess risks such as shadow AI, data loss, and incident response.

- Profile: https://b2binfluencer.marketing/creators/dan-sorensen/
- LinkedIn: https://www.linkedin.com/in/cisodan
- LinkedIn followers: 32,112
- Topics: artificial-intelligence, supply-chain, ai-governance, ai-adoption, data-governance, vulnerability-management, identity-security, incident-response
- Based on 14 dated posts, latest 2026-08-24

## Summary

Dan Sorensen is most useful for connecting cybersecurity and AI governance risks to practical operational decisions.

- Best for: A security or AI governance vendor running thought leadership for security and risk leaders.
- Not for: A bottom funnel product launch needing demos, click attribution, or competitive differentiation.
- Check first: Ask for rates, sponsorship terms, reach, engagement, and audience demographics before committing.

### Takeaways

- Restricting AI tools does not stop shadow AI; it pushes it to less visible tools.
- A password reset may not remove an attacker; secure email and revoke sessions first.
- AI ROI failures are organizational, not technological, and depend on workflow and governance redesign.

## Main ideas

- **Restricting AI tools doesn't stop shadow AI; it pushes it somewhere with less visibility**: Dan Sorensen argues that traditional data loss prevention guards the perimeter — email, file transfers, USB devices — while shadow AI runs in the browser, inside already-approved productivity apps and through API calls embedded in sanctioned tools. The remedy is not a ban: restrictions without alternatives just push activity into apps the security team can see even less well. The useful move is governance in the loop: visibility at the content layer to detect when sensitive data heads toward an unapproved destination, then choose whether to block it, alert on it or authorize the app with controls.
- **AI ROI failures are organizational, not technological**: Dan Sorensen argues that the playbook that worked for cloud and SaaS — identify a use case, buy a tool, run a pilot, declare success — fails for AI because AI changes how decisions get made, how processes are designed and what capabilities people need. Drawing on vCISO and AI governance work with regulated firms, they report three traits shared by clients getting real returns: redesigning the workflow before deploying the model, building governance and security in from day one rather than treating them as a compliance afterthought, and treating capability building as part of the investment rather than a later HR problem.
- **A password reset doesn't remove an attacker; speed is the wrong instinct**: Dan Sorensen argues that recovery failures are usually self-inflicted ordering mistakes. Many services keep active sessions alive after a password change, so an attacker already logged in stays logged in and can watch reset codes arrive. The post lays out an order of operations, not a sprint: secure email first because it controls downstream password resets, and check for planted forwarding rules and filters; revoke sessions, connected apps, OAuth grants, API tokens and app passwords rather than only resetting; reset from a clean device so the compromised machine does not hand over new credentials; preserve headers, login alerts and timestamps before purging, since early deletion can sink an investigation, insurance claim or fraud reversal; and notify the security team early if work may be affected.
- **AI risk mapping stops too early at the model layer**: Dan Sorensen argues that teams routinely map risk at the model layer and almost never at the concrete-and-megawatts layer, even though every model an organization depends on runs on physical infrastructure with a location, a power source, a supply chain and a regulatory footprint. Concentration risk, critical infrastructure dependency and third-party risk are all visible on a map for those who know where to look. Questions like “where does the compute actually live” and “what is the grid dependency” should be answerable in a vendor assessment, not left as theory.
- **Detection is not protection: mitigation speed and runtime visibility decide outcomes**: Dan Sorensen argues that finding vulnerabilities early is no longer enough as exploits move faster from disclosure to attack, making runtime visibility and rapid mitigation essential. In a separate post, they highlight a vendor fireside chat on continuous exposure management — the vendor's framing, not Dan Sorensen's own research — which argues that the consequential question is whether an exposure is actually reachable, exploitable and connected to a path that could materially harm the organization. Boards, it says, should measure risk reduction rather than patched vulnerability counts.
- **AI-generated code can carry license obligations the developer never sees**: Dan Sorensen flags the GPL scenario as the one to watch now: generated code can inherit obligations the developer never sees because the license context died in the training pipeline, creating a supply chain risk hidden inside a productivity tool. Proposed near-term fixes include license-aware tooling, similarity warnings and surfacing license context at generation time. The post frames this as an open question, not settled guidance.
- **Channel businesses should stop reselling and start advising**: Reading an industry conference agenda, Dan Sorensen draws a business thesis for ITSPs, MSPs, solution providers and consultants: the practitioner sessions worth attending cover security culture at small businesses, assessing risk in open-source tools beyond SOC 2 reports and penetration-test summaries, maturity and gap assessment, AI regret, AI rules and liability for MSPs, and turning AI from prompts into a billable service line. The throughline they identify in the cybersecurity and AI tracks: stop reselling, start advising, and price accordingly.

## Work to read

- [Why perimeter DLP misses shadow AI](https://www.linkedin.com/posts/cisodan_how-to-govern-shadow-ai-without-killing-innovation-activity-7477087752065515521-IkqL)
- [Changing your password doesn't kick the attacker out](https://www.linkedin.com/posts/cisodan_what-to-do-if-you-get-hacked-activity-7483934150790619136-MO8d)
- [Mapping AI risk at the concrete-and-megawatts layer](https://www.linkedin.com/posts/cisodan_aigovernance-criticalinfrastructure-ciso-activity-7470954173644177408-vCri)
- [The AI ROI problem is an org chart problem](https://www.linkedin.com/posts/cisodan_barriers-to-ai-success-what-organisations-activity-7478854556760842240-63l8)
- [Patch speed, breach rates and runtime visibility](https://www.linkedin.com/posts/cisodan_80-of-organizations-that-miss-the-24-hour-activity-7480354458200207360-YO-I)
- [AI-generated code and hidden license obligations](https://www.linkedin.com/posts/cisodan_ai-open-source-and-intellectual-property-activity-7481435200502190080-_grK)

## Brand relationships

- **Cleanview** (mention)
- **XM Cyber** (disclosed_partnership)

## Partnerships

Dan Sorensen's posts do not describe a published partnership program. Eight LinkedIn posts published between 28 May and 17 July 2026 refer to other organizations' tools, research, and events — a U.S. data-center tracking platform, an XM Cyber fireside chat, Cloud Security Alliance and Miggo Security research, and ChannelCon 2026 sessions — but none of these are presented as disclosed sponsorships. No post states formats, deliverables, pricing, exclusivity terms, review turnaround, or disclosure practice. The posts do not document offers; that does not mean sponsorships are never accepted. For a buyer's plan this has one practical consequence: there is no published package to build against, so scope, deliverables, timing, and disclosure language would all have to be negotiated directly with the creator rather than selected from a public offer. Because the posts are technical commentary on AI governance, shadow AI, and incident response rather than promotion, they provide little information about commercial terms and should not be read as a rate card or an indication of how a paid engagement would be structured.

## Alternatives

- Nir Sofer, CISSP: Choose Nir Sofer when the campaign needs a number and checklist rather than an argument. The shadow AI post reports findings from a survey of 718 IT professionals, including that 9.9% of organizations have full visibility into their software estate. It reframes shadow IT as an AI assistant holding a delegated OAuth grant inside the identity provider, reading mail and files, invisible to the firewall and never revoked at off-boarding. The post closes with three actions a team can take without budget: pull the application list from the identity provider, pull OAuth grants sorted by scope, and pull twelve months of card spend filtered for SaaS. The difference between the three lists is the shadow estate. That maps directly to the buyer task in Sorensen’s shadow AI post and gives a sponsor a workshop or downloadable asset that does not depend on the reader accepting an argument. A second post extends the same ground upward, framing the CEO, CFO and CISO as a governing triad, with identity as the new perimeter and security controls aligned to financial cycles. That suits a campaign seeking finance and executive readers as well as security leaders.
- Patrick Keating: Choose Patrick Keating when the buyer is a small or mid-sized business CEO rather than a security practitioner, and the campaign needs a business-risk frame with a direct response mechanism. The email security post argues that email is now a financial system and a Tier-0 business asset because invoices, payment changes and payroll approvals run through it. It says that having multi-factor authentication is not a strategy against business email compromise, token abuse or OAuth persistence. The post walks through credential compromise, malicious app consent, MFA fatigue and hidden inbox rules, then offers a peer conversation and a risk assessment. The governance post makes a related case at board level: security leaders are more effective when they sit outside the IT reporting line, close to the chief executive and visible to the board. It presents this case as a synthesis of peer-reviewed studies. Both pieces give a sponsor language for discussing exposure with executives in terms of money.
- Reilyn Garton: Choose Reilyn Garton when the campaign centers on identity-based intrusion and detection, and the sponsor sells detection, identity telemetry or threat-hunting capability. The Volt Typhoon post makes the same underlying point as Sorensen’s governance writing—that malware-signature thinking leaves defenders behind—but applies it to the security operations centre: valid accounts, living-off-the-land techniques and operator questions such as whether lateral movement over SMB, WMI and WinRM is logged and correlated, whether service account behaviour is baselined and alerted on, and whether the team hunts credential and token abuse rather than payloads. The session post states the shift plainly: attackers are signing in rather than breaking in. It lists low-noise techniques including session hijacking, OAuth abuse, MFA fatigue and token replay, along with defender responses such as reducing token lifetime, revoking sessions, watching MFA abuse telemetry and fusing identity signals with endpoint and network data. A sponsor seeking practical credibility with detection engineers, purple teams and critical infrastructure operators will find it here.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/