Dan Sorensen

The remedy is not a ban: restrictions without alternatives just push activity into apps the security team can see even less well. The useful move is governance in the loop: visibility at the content layer to detect when sensitive data heads toward an unapproved destination, then choose whether to block it, alert on it or authorize the app with controls.

The post opens with an employee uploading a spreadsheet of customer personal data to ChatGPT and frames the consequence through disclosure rules as a materiality test rather than a breach-notification test. It closes by asking how a team can remediate before materiality kicks in if DLP cannot catch the activity and nobody knows it is happening.

Read original

Drawing on vCISO and AI governance work with regulated firms, they report three traits shared by clients getting real returns: redesigning the workflow before deploying the model, building governance and security in from day one rather than treating them as a compliance afterthought, and treating capability building as part of the investment rather than a later HR problem.

The engine analogy: dropping an AI copilot into an unchanged organization is like installing a high-performance engine in a car with no drivetrain — the power is there, but it goes nowhere.

• The sharpest line: if an AI strategy fits inside the IT budget, it is a procurement plan, not a transformation strategy.
• The roughly 95% no-measurable-ROI figure is attributed in the post to MIT research.

Read original

Many services keep active sessions alive after a password change, so an attacker already logged in stays logged in and can watch reset codes arrive. The post lays out an order of operations, not a sprint: secure email first because it controls downstream password resets, and check for planted forwarding rules and filters; revoke sessions, connected apps, OAuth grants, API tokens and app passwords rather than only resetting; reset from a clean device so the compromised machine does not hand over new credentials; preserve headers, login alerts and timestamps before purging, since early deletion can sink an investigation, insurance claim or fraud reversal; and notify the security team early if work may be affected.

The counterintuitive opening: changing your password doesn't kick the attacker out.

• The closing claim: most compromises aren't sophisticated, while most recovery failures are.
• The post ends by asking readers for the most common recovery mistake they have watched someone make under pressure.

Read original

Concentration risk, critical infrastructure dependency and third-party risk are all visible on a map for those who know where to look. Questions like “where does the compute actually live” and “what is the grid dependency” should be answerable in a vendor assessment, not left as theory.

Dan Sorensen describes Cleanview, a platform tracking U.S. data centers and power projects from first permit to completion, and highlights specifics: more than 500 data center developers and more than 1,500 projects, including Amazon at 72 projects, Google at 65 and Microsoft at 61; milestones from proposed through interconnection agreement and construction start to operational; and free state-by-state explorers that separate operating from planned projects, with Virginia and Texas singled out as showing where concentration is heading. The post closes by asking practitioners how deep they go into the physical layer of their AI supply chain and which sources they trust.

Read original

In a separate post, they highlight a vendor fireside chat on continuous exposure management — the vendor's framing, not Dan Sorensen's own research — which argues that the consequential question is whether an exposure is actually reachable, exploitable and connected to a path that could materially harm the organization. Boards, it says, should measure risk reduction rather than patched vulnerability counts.

The post cites a survey by Miggo Security and the Cloud Security Alliance covering more than 900 security leaders: organizations taking four to seven days to patch critical vulnerabilities face breach rates near 97%, versus 77% for those patching within 24 hours, and most teams confident in their application security programs still suffered production incidents. The post’s fireside-chat framing cites MGM, SolarWinds and 3CX to argue that identity compromise, social engineering and supply-chain attacks matter more than traditional CVE prioritization.

Read original · Original 2

Proposed near-term fixes include license-aware tooling, similarity warnings and surfacing license context at generation time. The post frames this as an open question, not settled guidance.

The post asks whether anyone has seen a vendor actually ship that kind of license-aware generation, turning the gap into a discussion prompt rather than a claim.

Read original

The throughline they identify in the cybersecurity and AI tracks: stop reselling, start advising, and price accordingly.

The post highlights an attorney-led session on AI policies, people and proof as an example of the governance and liability framing the channel is being asked to sell, and an AI-regret session as a look at lessons MSPs learn the expensive way. As an agenda preview, it signals where Dan Sorensen thinks the practitioner conversation is heading.

Read original

This is the clearest statement of the problem they work on.

Dan Sorensen opens with a concrete scenario: an employee uploads a spreadsheet containing customer personal data to ChatGPT, and the organization is a few business days from an SEC 8-K filing requirement.

• Traditional data loss prevention watches email, file transfers and USB devices, but shadow AI runs inside the browser, approved productivity apps and API calls—leaving a visibility gap where control should begin.
• The post treats the disclosure rule as a materiality test, not a breach-notification test.
• Restricting AI tools, they argue, pushes usage into apps with even less visibility; the better approach is detection at the content layer: block, alert or authorize the app with controls.

For brands planning a campaign

A strong anchor post for a shadow AI or AI governance campaign. It gives a vendor a ready-made argument against bans and for content-layer visibility, linking the technical gap to a regulatory consequence—an effective fit for executive-facing creative.

A password reset often leaves active sessions alive, allowing an attacker who is already logged in to stay logged in and watch reset codes arrive.

• Dan Sorensen lays out an order of operations: secure email first, since it controls downstream resets, and check for planted forwarding rules and filters; revoke sessions, connected apps, OAuth grants, API tokens and app passwords instead of only resetting the password; reset from a clean device; preserve headers, alerts and timestamps before purging; and tell the security team early if work accounts may be involved.
• The closing line—most compromises aren't sophisticated, most recovery failures are self-inflicted—is the thesis.

For brands planning a campaign

Useful for awareness or incident-response campaigns that need a concrete checklist rather than a scare statistic. A vendor could co-produce a downloadable recovery checklist based on this ordering and ask Dan Sorensen to walk readers through it in a webinar or follow-up post.

The post connects security to infrastructure.

Dan Sorensen describes Cleanview, a resource that tracks U.S. data centers and power projects from first permit to completion, and explains how it changed their approach to assessment.

• The post cites more than 500 data center developers and more than 1,500 projects, including Amazon at 72 projects, Google at 65 and Microsoft at 61.
• It lists project milestones—proposed, interconnection agreement, construction start and operational—and free state-by-state explorers for generation mix that separate operating from planned projects.
• Virginia and Texas stand out as revealing where concentration risk is heading.
• The post argues that model-layer risk mapping misses location, power source, supply chain and regulatory footprint, then asks practitioners how deeply they assess the physical layer and which sources they trust.

For brands planning a campaign

A differentiated angle for critical-infrastructure or third-party AI risk content. A vendor could commission a piece on physical AI supply chain exposure or use the Virginia and Texas concentration examples in a data-led campaign.

Dan Sorensen cites MIT research that roughly 95% of enterprise generative AI pilots deliver no measurable ROI, arguing that the failure is organizational, not technological.

• The cloud and SaaS playbook—pick a use case, buy a tool, run a pilot, declare success—fails because AI changes how decisions are made and processes designed.
• The post compares dropping an AI copilot into an unchanged organization to putting a high-performance engine in a car with no drivetrain.
• Drawing on vCISO and AI governance work with regulated firms, they identify three traits shared by clients getting returns: redesigning workflows before model deployment, building in governance and security from day one rather than bolting them on when scaling stalls, and treating capability building as part of the investment.
• Their sharpest claim: if an AI strategy fits inside the IT budget, it is a procurement plan, not a transformation strategy.

For brands planning a campaign

Gives a security vendor a way to reach executives, not just practitioners, by tying governance to measurable returns. A good fit for a thought-leadership series or executive roundtable theme.

Dan Sorensen summarizes research from Miggo Security and the Cloud Security Alliance, based on a survey of more than 900 security leaders.

• Organizations taking four to seven days to patch critical vulnerabilities face breach rates near 97%, compared with 77% for those patching within 24 hours.
• Most teams confident in their application security programs still had production incidents, and most still lack real-time visibility into AI behavior at runtime.
• The conclusion: finding vulnerabilities early is no longer enough as exploits move faster from disclosure to attack; runtime visibility and rapid mitigation are essential.

For brands planning a campaign

A data-backed item for runtime security or application security campaigns. The paired numbers work in a chart, short explainer or debate-style post; the AI runtime visibility gap extends the theme into AI governance.

The post flags a GPL scenario: generated code can inherit obligations the developer never sees because the license context died in the training pipeline.

• Dan Sorensen calls this a supply chain risk hiding inside a productivity tool.
• They point to license-aware tooling, similarity warnings and surfacing license context at generation time as the most actionable near-term fixes, then ask whether any vendor has actually shipped them.

For brands planning a campaign

A compact hook for developer-tooling or IP-risk campaigns. A vendor with license-scanning capability could answer the open question directly in a commissioned response post or joint webinar.

The shadow AI post says restrictions without alternatives push activity to less visible apps and calls for governance-in-the-loop at the content layer.

• The AI ROI post says the playbook of buying a tool, running a pilot and declaring success fails because AI changes decisions, processes and capabilities.
• Clients getting returns redesigned workflows first, built governance and security in from day one, and treated capability building as an investment.
• The runtime and exposure posts extend this argument to post-deployment visibility and attack-path disruption.

Builds arguments from a concrete failure scenario, a research statistic or named incident, then a management principle and an open question.

The posts make causal claims, including the MIT 95% ROI figure and SEC filing timing, without full citations. Verify both before reuse.

For brands planning a campaign

Strong campaign spine for a vendor selling AI governance or shadow AI controls. Commission thought leadership that presents governance-in-the-loop as an operating model, not a policy PDF, and pairs a practical maturity sequence with examples.

Examples: Source 1 · Source 2 · Source 3 · Source 4

It frames data loss through SEC cybersecurity disclosure rules and GDPR materiality, and proposes content-layer visibility that can block, alert or authorize an app with controls.

Uses a short trigger narrative, names the regulatory consequence and asks readers how they would remediate before materiality kicks in.

The post states that an SEC 8-K filing is required within four business days. Get the rule citation and have legal review the specifics before featuring it.

For brands planning a campaign

Use as an anchor post for a shadow AI campaign. Commission a follow-up that diagrams content-layer detection versus perimeter DLP, gives a block, alert or authorize decision tree, and walks through a materiality trigger with legal review.

Examples: Source 1

It argues the cloud and SaaS playbook fails because AI changes how decisions are made, processes are designed and people are capable. Three traits of clients getting returns: workflow redesign before model deployment, governance and security from day one, and capability building as part of the investment.

Uses a memorable analogy, a research statistic and three observable client traits.

The post references MIT research without a citation. Source the original study before repeating the 95% figure.

For brands planning a campaign

Feature in an AI governance thought-leadership campaign aimed at leaders beyond security. Commission a piece that turns the three traits into a campaign-ready sequence and avoids generic AI productivity claims.

Examples: Source 1

It highlights a platform tracking more than 500 data center developers and more than 1,500 projects, including Amazon at 72, Google at 65 and Microsoft at 61, with milestones from proposed through operational. It connects compute location, grid dependency, supply chain and regulatory footprint to AI vendor risk, third-party risk and critical infrastructure concentration.

Introduces a third-party data resource, pulls out concrete counts and milestones, then asks practitioners how deeply they assess the physical layer.

The post promotes a specific platform and links to it. If the campaign needs neutral analysis, pair it with independent infrastructure data.

For brands planning a campaign

Feature as differentiated AI risk content. Commission a vendor-risk assessment prompt or map exercise that asks where compute lives, what the grid dependency is and which concentration risks need contingency planning.

Examples: Source 1

The recommended order: secure email first, including forwarding rules and filters; revoke sessions, connected apps, OAuth grants, API tokens and app passwords; use a clean device; preserve evidence before purging; and notify the security team if work may be affected. It says most compromises are not sophisticated and most recovery failures are self-inflicted.

Uses a counterintuitive opening, a short ordered list and a closing question about common recovery mistakes.

Have an incident response lead review this operational guidance before publication; it is not a legal or forensic protocol.

For brands planning a campaign

Feature as a practical incident-response post.

• Commission a checklist, carousel or webinar segment on session revocation, clean-device recovery and evidence preservation.
• Position Dan Sorensen as hands-on incident response, not only governance commentary.

Examples: Source 1

It says most confident AppSec teams still had production incidents and most lack real-time visibility into AI runtime behavior, so finding vulnerabilities early is not enough.

• The exposure management post says AI compresses discovery-to-exploitation timelines and argues security leaders should ask whether an exposure is reachable, exploitable, and connected to material harm.
• It recommends using reachability as a signal and measuring risk reduction rather than patched counts.

Uses a survey statistic, a before-and-after comparison, and named incidents such as MGM, SolarWinds, and 3CX to frame a strategic shift.

The exposure management post promotes a fireside chat, showing how the topic is framed and what may interest the audience.

For brands planning a campaign

Pair them in a campaign about AI-era vulnerability management. Commission content on runtime visibility, reachability, and attack-path disruption, with a board-level metric that moves beyond patch counts.

Examples: Source 1 · Source 2

It calls this a supply chain risk inside a productivity tool and suggests license-aware tooling, similarity warnings, and surfacing license context at generation time, then asks whether a vendor has actually shipped it.

States a specific risk scenario, proposes near-term controls, and seeks evidence of vendor implementation.

The post poses an open question about whether a vendor has shipped the proposed tooling.

For brands planning a campaign

Feature if the campaign covers the security and legal intersection of AI adoption. Commission a post or webinar on license-aware generation and developer guardrails, using the open question as a discussion prompt.

Examples: Source 1

The throughline is stop reselling, start advising, and price accordingly.

Curates a practitioner agenda with pointed session hooks and a channel business thesis.

Ask for evidence of the delivered sessions before using the post to assess session quality.

For brands planning a campaign

Feature if the campaign targets the MSP and channel audience. Commission an event recap or sponsored session on AI governance for MSPs, with practical policy, liability, and service-line angles.

Examples: Source 1

The post gives no indication of sponsorship, employment, or client work, so treat it as a mention.

View example

The post does not say whether this is a paid partnership or an unpaid share; ask for confirmation.

View example

Sofer also gives three no-budget actions — pull the identity provider application list, pull OAuth grants sorted by scope, and pull twelve months of card spend filtered for SaaS — the same kind of bounded, this-week exercise Sorensen describes in the recovery order for a compromised account. Both also write about governance as a leadership alignment problem: Sofer's account of the CEO, CFO, and CISO as a working triad overlaps with Sorensen's argument that AI returns follow workflow redesign and security built in from day one, as well as the board-level risk framing in their exposure management post.

Nir Sofer draws on service-management survey data and inventory practice: a survey of 718 IT professionals on software visibility, plus measurable checks inside the identity provider.

• Dan Sorensen builds arguments from regulatory consequences, such as the materiality trigger behind an SEC filing, and from detection choices at the content layer.
• Nir Sofer writes longer, published-column-style analyses for IT service management, finance-adjacent and leadership readers; Sorensen writes shorter practitioner posts that end in a question rather than a service offer.

Read original · Original 2

Both argue that passwords and multi-factor authentication alone do not stop business email compromise, and both name the same persistence mechanisms: malicious OAuth app consent, MFA fatigue, session hijacking, hidden inbox rules and forwarding.

• Both also treat identity and exposure management as a business and board question rather than a purely technical one.
• They argue that security leadership's place in the organisation changes outcomes — Keating through reporting structure, independence from IT and access to the board; Sorensen through measuring reachable risk and risk reduction instead of patched vulnerability counts.

Patrick Keating writes for SMB chief executives, framing email as a financial system that moves money, with a business-first security pitch and a direct offer of an assessment conversation.

• Dan Sorensen writes for security practitioners and governance teams, drawing on vCISO experience rather than making a call to action.
• Keating's governance piece synthesises peer-reviewed studies on CISO reporting lines; Sorensen tends to open with a concrete failure scenario or named incident and close with an open question to readers.

Read original · Original 2

Garton's point that attackers are signing in rather than breaking in, using session hijacking, OAuth abuse, MFA fatigue and token replay, matches Sorensen's warning that a password reset leaves an attacker's session alive and that connected apps, OAuth grants and API tokens have to be revoked, not just reset. Both also explore the threat-intelligence angle of living-off-the-land activity: Garton through the Volt Typhoon advisory and valid accounts used against critical infrastructure, Sorensen through attack paths, supply-chain incidents and identity compromise in the exposure management conversation.

Reilyn Garton stays at the detection-engineering level — logging and correlating lateral movement, alerting on service-account anomalies, baselining admin behaviour, and purple team validation — and writes for red, blue and purple team operators. Dan Sorensen starts from the same adversary behaviour but carries it into governance, incident recovery order and board-level metrics, writing for security leaders and risk owners as well as hands-on defenders.

Read original · Original 2

The shadow AI post reports findings from a survey of 718 IT professionals, including that 9.9% of organizations have full visibility into their software estate.

• It reframes shadow IT as an AI assistant holding a delegated OAuth grant inside the identity provider, reading mail and files, invisible to the firewall and never revoked at off-boarding.
• The post closes with three actions a team can take without budget: pull the application list from the identity provider, pull OAuth grants sorted by scope, and pull twelve months of card spend filtered for SaaS.
• The difference between the three lists is the shadow estate.
• That maps directly to the buyer task in Sorensen’s shadow AI post and gives a sponsor a workshop or downloadable asset that does not depend on the reader accepting an argument.
• A second post extends the same ground upward, framing the CEO, CFO and CISO as a governing triad, with identity as the new perimeter and security controls aligned to financial cycles.
• That suits a campaign seeking finance and executive readers as well as security leaders.

The shadow AI case appears in a software vendor’s survey and links to its report, so a sponsor shares the narrative with a named platform and its service-management positioning.

• While Sorensen argues from named incidents and client patterns across several themes, Sofer’s posts cover two topics: software and shadow IT visibility, and executive governance structure.
• The executive post builds on a newspaper analysis rather than original research.
• A campaign seeking one voice to cover shadow AI, AI return on investment and emergency incident recovery will find less range here.
• A sponsor selling outside IT service management should expect the survey context to sit alongside its own product story.

Examples: Source 1 · Source 2

The email security post argues that email is now a financial system and a Tier-0 business asset because invoices, payment changes and payroll approvals run through it.

• It says that having multi-factor authentication is not a strategy against business email compromise, token abuse or OAuth persistence.
• The post walks through credential compromise, malicious app consent, MFA fatigue and hidden inbox rules, then offers a peer conversation and a risk assessment.
• The governance post makes a related case at board level: security leaders are more effective when they sit outside the IT reporting line, close to the chief executive and visible to the board.
• It presents this case as a synthesis of peer-reviewed studies.
• Both pieces give a sponsor language for discussing exposure with executives in terms of money.

The scope is narrower than Sorensen’s.

• Both posts focus on either Microsoft 365 and email fraud or security leadership structure; neither addresses shadow AI, data-loss visibility or which data reaches which tool, the spine of this campaign.
• The writing also includes an explicit commercial ask and a first-person advisory pitch, so a sponsored placement in this style can read as advertising rather than analysis.
• The sponsor also inherits a service-provider positioning rather than that of a neutral commentator.
• The governance post cites a research synthesis without naming the individual studies, giving a sponsor less to point skeptical readers toward than Sorensen’s use of specific incidents and survey figures, even where those figures also arrive uncited.

Examples: Source 1 · Source 2

The Volt Typhoon post makes the same underlying point as Sorensen’s governance writing—that malware-signature thinking leaves defenders behind—but applies it to the security operations centre: valid accounts, living-off-the-land techniques and operator questions such as whether lateral movement over SMB, WMI and WinRM is logged and correlated, whether service account behaviour is baselined and alerted on, and whether the team hunts credential and token abuse rather than payloads.

• The session post states the shift plainly: attackers are signing in rather than breaking in.
• It lists low-noise techniques including session hijacking, OAuth abuse, MFA fatigue and token replay, along with defender responses such as reducing token lifetime, revoking sessions, watching MFA abuse telemetry and fusing identity signals with endpoint and network data.
• A sponsor seeking practical credibility with detection engineers, purple teams and critical infrastructure operators will find it here.

This is detection of an intrusion in progress, not governance of which data reaches an unapproved AI tool.

• Neither post offers a policy, approval or visibility mechanism, so a shadow AI campaign would need a different argument to bridge the gap, and the sponsor’s product would have to supply the missing governance half.
• The material assumes readers have detection tooling and a team to run hunts, which may land poorly with small security teams and executives who need the business consequence spelled out.
• Before choosing this as an anchor voice, ask for a broader sample showing original data, client patterns or sustained publishing on AI risk; the two available posts center on named threat activity and external advisories.

Examples: Source 1 · Source 2