Darius Radford focuses on helping organizations secure how they build and run software. At KnightsWatch Cyber, Radford's posts describe the Secure Software Factory, an operating model that connects software delivery, application security, supply-chain controls, risk management, and protection after deployment.
Darius Radford is most useful for explaining secure software delivery as an integrated operating model with governance and supply chain controls.
Best for
Cybersecurity vendors running webinars on secure software supply chains for engineering, AppSec, DevSecOps, and platform leaders.
Not for
CI/CD vendors seeking paid social campaigns with fast build and deploy claims and reach guarantees.
Key takeaways
Security tools alone don't solve a decision-making problem.
Secure software requires connected controls from commit to runtime.
Evaluate tools by how well they fit the operating model.
Check first: Ask for recent impressions and engagement on Secure Software Factory posts plus past webinar attendance.
Main ideas
Security tools alone don’t solve a decision-making problem · Secure software requires connected controls from commit to runtime · Evaluate tools by how well they fit the operating model
Darius Radford focuses on how organizations can secure the way they build and run software.
Through the Secure Software Factory, they argue that security tools work best as part of an integrated operating model: teams need to connect delivery, application security, software supply-chain controls, risk management and protection after deployment.
Their work includes practical explanations of this approach, including how AI governance fits into secure software delivery.
Radford turns application security from a question of which tools to buy into a question of how teams make decisions throughout the software lifecycle.
They point to the familiar mismatch between widespread scanning tools and persistent backlogs, developer frustration and security bottlenecks, then challenge readers to consider whether their processes—not just their products—can produce secure software.
Their Secure Software Factory framework develops that idea: an earlier version sets out four capability pillars, while a later version adds post-deployment protection and treats AI governance as cross-cutting.
They also apply the framework to tool evaluation, comparing CI solutions by how well they fit secure delivery rather than simply by build speed.
Darius Radford argues that secure software depends less on adding tools than on connecting them to a repeatable way to make decisions across development and operations.
Read more
The Secure Software Factory structures that approach: govern delivery and software components, prioritize risk, and protect software after release. Their later posts extend the framework to AI-generated code and AI governance.
Security tools alone don’t solve a decision-making problem
Radford argues that organizations can own many security products and still face backlogs, developer frustration, repeated vulnerabilities, and bottlenecks.
Read more
In their view, teams need a system to decide what matters and act across the software lifecycle.
Radford contrasts persistent security problems with common tools such as SAST, DAST, SCA, WAF, and vulnerability scanners, then asks whether a development process would still produce secure software if those tools disappeared.
Secure software requires connected controls from commit to runtime
Radford presents the Secure Software Factory as an operating model, not a single product.
Read more
Its capabilities connect delivery pipelines, developer workflows, software artifacts and dependencies, and risk information to help teams govern software across its lifecycle.
Their earlier four-pillar outline names orchestrated delivery, developer-centric application security, artifact and supply-chain control, and unified risk correlation. The vendor-neutral framework includes an assessment, maturity index, and phased roadmap.
Evaluate tools by how well they fit the operating model
Radford’s tool-evaluation approach shifts attention from isolated performance claims to whether a tool supports secure, governed delivery.
Read more
Tool choice becomes part of a broader process, not a substitute for one.
Radford announced a five-part video series organized around the Secure Software Factory’s pillars. The first episode compares Harness AI Continuous Integration with Jenkins, Azure DevOps, GitHub, and GitLab based on fit with orchestrated delivery, not which builds fastest.
Faster, AI-assisted software raises the stakes for trust and governance
In a later description of Secure Software Factory 2.0, Radford connects faster pipelines and AI-generated code with the need to verify dependencies, enforce policy, understand risk, and protect software in production.
Read more
AI governance spans the framework wherever agents or models help build or operate software.
The updated model adds post-deployment protection as a fifth pillar and describes AI governance as spanning the framework. Radford proposes assessing how an organization builds, tests, packages, deploys, and operates software to establish a maturity baseline and prioritized roadmap.
This post explains what the Secure Software Factory is and why Darius Radford says organizations need it.
Read more
Start here to understand the operating-model concept before reading the later update or tool comparison.
Darius Radford argues that organizations have invested heavily in DevSecOps tools—CI/CD platforms, static scanners, container security, and vulnerability management systems—yet high-profile breaches still stem from software supply chains, unpatched dependencies, misconfigured pipelines, and poorly prioritized vulnerabilities.
The problem, the post argues, is not a lack of tools but gaps in integration, governance, and operating discipline.
It presents the Secure Software Factory as a structured operating model with four capability pillars: orchestrated delivery, developer-centric application security, artifact and supply chain control, and unified risk correlation.
The framework also includes a structured assessment methodology, a four-domain maturity index, a phased transformation roadmap, and alignment with OWASP SAMM.
It is explicitly described as vendor-neutral.
For brands planning a campaign
For a co-marketing webinar on secure software supply chains, this post offers a ready-made four-pillar agenda and vendor-neutral maturity framework. A vendor could ask how its product supports one or more pillars without turning the session into a product pitch.
This post presents the current public version of the framework, with a new emphasis on AI-generated code, trust, and post-deployment protection.
Read more
Readers who start with the four-pillar post can open this next to see how the model has expanded.
This post connects the Secure Software Factory to WeAreDevelopers World Congress North America, where sessions covered the agentic software factory, software quality, and building a factory.
Darius Radford asks how organizations can trust what they release as software moves faster, especially with AI-generated code and faster pipelines.
Secure Software Factory 2.0 has five pillars: orchestrated delivery, developer-centered AppSec, software supply chain and artifact governance, unified risk correlation, and post-deployment protection.
AI governance runs across the model wherever agents or models help build or operate software.
The post also describes a Secure Software Factory Assessment that establishes a maturity baseline and produces a prioritized roadmap.
For brands planning a campaign
A webinar on secure software supply chains could use this five-pillar update to bring AI governance and post-deployment protection into the conversation. The assessment offer provides a concrete call to action, framed as an operating-model review rather than a tool demo.
This post gives the clearest short explanation of why Darius Radford sees the Secure Software Factory as different from buying another security product.
Read more
General readers can grasp the core argument in a few paragraphs.
Darius Radford calls it a misconception that organizations have a vulnerability problem, arguing that most have a decision-making problem.
The post lists common tools—SAST, DAST, SCA, WAF, cloud security, and vulnerability scanners—alongside persistent struggles: backlogged findings, developer frustration, repeated vulnerabilities, compliance gaps, and security teams becoming bottlenecks.
The argument is that tools do not reduce risk; systems do.
The Secure Software Factory is a repeatable system that helps developers, architects, DevOps, security, and compliance teams make better security decisions across the software lifecycle.
The post closes by asking whether a development process would still produce secure software if its security tools disappeared tomorrow.
For brands planning a campaign
This is a strong panel or webinar opener: it reframes the buyer problem from tool count to operating discipline. A vendor can use the closing question to prompt audience discussion and frame the co-marketing session around repeatable processes rather than another scanner.
This post shows Darius Radford moving from framework explanation to practical tool evaluation.
Read more
Readers interested in how the Secure Software Factory applies to buying decisions can open this post and then the linked video.
Darius Radford says the first video in a five-part series is complete.
The series examines tools and how they fit into the Secure Software Factory across its five pillars.
The first video covers pillar one, orchestrated delivery, and compares Harness AI Continuous Integration with Jenkins, Azure DevOps, GitHub, and GitLab.
The stated criterion is not who builds fastest but which tool best fits the Secure Software Factory.
The post includes text and a video link but no transcript; the actual comparison details and conclusions are therefore not assessed here.
For brands planning a campaign
A supply-chain webinar could adapt this pillar-by-pillar format into a live or recorded tool-fit discussion, starting with orchestrated delivery. The post also offers a vendor-comparison frame that a co-marketing partner could join or respond to, if comfortable being evaluated on operating-model fit rather than raw speed.
This post states Darius Radford's current priority question and identifies the audience they want to reach.
Read more
Readers can use it to assess whether the event and peer-discussion angle fits their campaign.
Darius Radford says they are headed to WeAreDevelopers in San Jose with one question: why has DevSecOps produced more tools and findings without always delivering safer or faster software?
At KnightsWatch Cyber, the Secure Software Factory connects delivery, AppSec, software supply-chain governance, unified risk, runtime protection, and AI governance in one measurable operating model.
The post invites engineering, AppSec, DevSecOps, platform engineering, and AI security leaders to compare notes at the event.
For brands planning a campaign
This event post offers a natural hook for event-based co-marketing or a webinar built around the same question. For a supply-chain brief, software supply-chain governance and AI governance provide two clear paths into the discussion.
Secure delivery as an operating model, not another tool purchase
Darius Radford argues that security tooling is not the bottleneck.
Read more
They list CI/CD platforms, static scanners, container security, and vulnerability management as already common, yet say high-profile breaches still stem from software supply chains, unpatched dependencies, misconfigured pipelines, and poorly prioritized vulnerabilities.
The problem, they say, is integration, governance, and operating discipline.
A later post sharpens the point: most organizations have a decision-making problem more than a vulnerability problem, and systems, not tools, reduce risk.
For brands planning a campaign
A vendor webinar can frame the discussion around operating-model maturity rather than product replacement. The vendor-neutral stance in the posts creates room for a co-marketing session comparing how different tools fit a shared process, with Darius Radford discussing where integration and governance usually break down.
The Secure Software Factory framework and its pillar structure
Darius Radford describes the Secure Software Factory as a structured operating model for securing software from commit to runtime.
Read more
Their earlier post outlines four capability pillars: orchestrated delivery, developer-centric application security, artifact and supply chain control, and unified risk correlation. It also names a structured assessment methodology, a four-domain maturity index, a phased transformation roadmap, and alignment with OWASP SAMM.
Structured assessment methodology, four-domain maturity index, phased transformation roadmap, and alignment with OWASP SAMM.
For brands planning a campaign
The framework gives a webinar a ready-made agenda. A vendor could co-host a session walking through one pillar, such as supply chain and artifact governance, and show how an assessment produces a maturity baseline and prioritized roadmap.
The framework has moved from four pillars to five, adding post-deployment protection and AI governance
A later post describes Secure Software Factory 2.0 with five pillars: orchestrated delivery, developer-centered AppSec, software supply chain and artifact governance, unified risk correlation, and post-deployment protection.
Read more
AI governance runs across the model wherever agents or models help build or operate software. This shifts from the earlier four-pillar description, which ended at unified risk correlation.
The five-pillar version renames some earlier pillars. Confirm which labels Darius Radford currently uses before publishing joint material.
For brands planning a campaign
A webinar can offer an update rather than a repeat: what changed when post-deployment protection and AI governance were added, and what that means for teams already working on the first four pillars.
Darius Radford argues that most organizations already own SAST, DAST, SCA, WAF, cloud security, and vulnerability scanners, yet still face backlogged findings, developer frustration, repeated vulnerabilities, compliance gaps, and security teams that become bottlenecks.
Read more
They ask whether a development process would still produce secure software if its security tools disappeared, or whether the organization has outsourced its security strategy to vendors.
For brands planning a campaign
This offers a direct webinar hook for a cybersecurity vendor: reducing alert fatigue and making better security decisions inside the development process. The angle works best if the vendor can show how its product supports a repeatable system rather than present itself as one more scanner.
Practical, comparative tool evaluation for secure delivery
Darius Radford announced a five-part video series examining tools and how they fit into each Secure Software Factory pillar.
Read more
The first video is a deep dive into pillar 1, orchestrated delivery, comparing Harness AI Continuous Integration with Jenkins, Azure DevOps, GitHub, and GitLab. They say the comparison moves beyond who builds fastest to who best fits the Secure Software Factory.
Five-part video series, one pillar per episode, with side-by-side tool comparisons.
For brands planning a campaign
A vendor could sponsor or co-create a comparison episode, or use the format as a model for its own content. Fit-based evaluation tied to a named pillar gives a webinar a concrete, product-adjacent demonstration rather than a general discussion.
At WeAreDevelopers World Congress North America, Darius Radford asks how organizations can know they trust what they release as software moves faster.
Read more
They point to AI-generated code and faster pipelines as increasing the need to verify dependencies, enforce policy, understand risk, and protect what reaches production. AI governance runs across the Secure Software Factory model wherever agents or models help build or operate software.
For brands planning a campaign
This supports a co-marketing webinar on secure software supply chains, with AI governance as the current pressure point. The vendor can bring its supply chain or artifact-control expertise and use Darius Radford's operating-model framing to organize the session.
Assessment-first conversations with engineering and security leaders
Darius Radford describes starting with a Secure Software Factory Assessment that examines how an organization builds, tests, packages, deploys, and operates software, then establishes a maturity baseline across the pillars.
Read more
The output is a clear view of strengths and gaps, plus a strategic roadmap with prioritized actions, owners, and practical milestones. A separate post from WeAreDevelopers in San Jose invites engineering, AppSec, DevSecOps, platform engineering, and AI security leaders to compare notes.
For brands planning a campaign
An assessment-led offer can serve as the webinar's follow-up or lead magnet.
A vendor partner could co-present the assessment structure and route attendees into a deeper supply chain conversation.
A WeAreDevelopers event post also shows Darius Radford is comfortable with in-person and peer-discussion formats, which could translate into a panel or fireside webinar.
Darius Radford's posts center on KnightsWatch Cyber, which they describe in the first person as the builder of the Secure Software Factory operating model and the firm behind a Secure Software Factory Assessment service.
Read more
The posts document no sponsors, paid placements, affiliate links, or named client engagements.
The tool-comparison video series is presented as vendor evaluation work, not a commercial partnership; the WeAreDevelopers appearance is framed as attendance and discussion, not a sponsored or paid role.
Ask Radford to disclose any commercial relationships relevant to a campaign.
KnightsWatch Cyber
Employment
Radford writes about KnightsWatch Cyber in the first person: “At KnightsWatch Cyber, we built the Secure Software Factory.”
Read more
They describe how “our work together” carries clients through a Secure Software Factory Assessment and the roadmap that follows.
The posts also point readers to the firm's whitepaper download and an assessment-booking link.
The posts identify them as part of the firm but do not state their job title or ownership stake; ask them to clarify.
In the first video of a five-part series, Radford evaluates Harness AI Continuous Integration against Jenkins, Azure DevOps, GitHub, and GitLab, judging each on fit with the Secure Software Factory's orchestrated-delivery pillar instead of raw build speed.
Read more
The post frames the series as tool analysis but does not state whether Radford has a commercial relationship with Harness or the other named vendors; ask them to clarify.
Radford says they are heading to WeAreDevelopers World Congress North America in San Jose to compare notes with people leading engineering, AppSec, DevSecOps, platform engineering, and AI security, and cites the event's sessions on the agentic software factory and software quality.
Read more
The posts do not specify whether they attend as a speaker, sponsor, or delegate; ask them to clarify.
Darius Radford writes about why security tooling alone has not made software delivery safer and how to organize the work around a repeatable operating model.
Read more
The Secure Software Factory material offers a clear entry point: an early post sets out four capability pillars and an assessment method; a later post updates the model to five pillars and adds AI governance; and a separate post argues that application security is a decision-making problem rather than a vulnerability-scanning problem.
A five-part video series shows the ideas in practice, beginning with a comparison of CI/CD tools judged by how well they fit secure, governed delivery.
Read the framework posts first for the model, then the tool-comparison announcement to see how they test it against real products.
Manico also works on application security and argues that AI is changing the economics of finding and fixing vulnerabilities.
Read more
Both reject a tooling-first approach: Manico says traditional scanners and standalone AppSec products will increasingly be replaced by AI-native capabilities, while Radford argues that organizations with plenty of tools still struggle because they lack an operating system for decisions.
Manico's posts diagnose and predict where AppSec economics are heading, using security requirements and standards such as OWASP ASVS and AISVS as an anchor. Radford packages a similar critique into a named, structured model with pillars, a maturity index, and an assessment-first sales conversation.
Sorani makes the practical point that detection is only the first step and remediation at scale is where security creates value.
Read more
Both stress that security has to fit into development workflows rather than sit beside them, and both draw on long personal histories in offensive and defensive security.
Sorani frames the problem around tangible ROI and the 'last mile' of fixing vulnerabilities, using co-founder conversation storytelling. Radford frames it as a full delivery-and-runtime operating model with named pillars, a maturity baseline, and a phased roadmap.
Slavin reaches the same conclusion from the AI side: as discovery gets cheaper, the bottleneck moves to remediation, triage, and confirming exploitability, while supply chain exposure accounts for a growing share of breaches.
Read more
Both connect AI-generated code and faster pipelines to a harder verification and governance problem.
Slavin writes about building the agentic security category and the primitives (context graphs, action layers, verification) a vendor needs to solve it. Radford presents a vendor-neutral operating model and an assessment of how an organization builds, tests, packages, deploys, and operates software.
The audience case for Darius Radford rests on topic alignment, not measured scale.
Read more
The only audience figure in the posts is a LinkedIn follower count of 704, observed on 23 October 2026.
No platform demographic data, engagement data, or audience survey is published.
A cybersecurity vendor weighing a secure-software-supply-chain webinar should treat that number as a starting point and ask for recent performance on comparable posts and events before committing budget.
The posts show who the content addresses and how it travels.
Radford speaks directly to engineering, AppSec, DevSecOps, platform engineering, and AI security leaders.
A 22 September post names those roles as the people to compare notes with at WeAreDevelopers in San Jose, and asks why DevSecOps has produced more tools and findings without always delivering safer or faster outcomes.
The subject matter closely matches a secure-software-supply-chain webinar: four of the five posts lay out the Secure Software Factory operating model, whose third pillar covers artifact and supply-chain control, SBOMs, dependency integrity, and provenance.
A 25 March post argues that despite DevSecOps tool investment, breaches still originate in unpatched dependencies and misconfigured pipelines.
Formats include a long-form framework explainer, a misconception-led post aimed at sparking replies, a five-part video series on evaluating tools for each pillar, and an event post.
Follower count and topical fit speak to reach and relevance, not buyer composition.
To assess a webinar aimed at secure-software-supply-chain audiences, ask for recent impressions and engagement on the Secure Software Factory posts and pillar video series, plus registration or attendance numbers from any past webinar KnightsWatch Cyber has run.
If employer, occupation, or job seniority matter, ask whether Radford has survey results or another documented source for those attributes.
Darius Radford's posts describe no partnership or sponsorship offer.
Read more
Every call to action in the five posts points to KnightsWatch Cyber's own assets and services: a downloadable Secure Software Factory whitepaper, an assessment conversation, and a five-part tool-comparison video series.
No rate card, media kit, sponsorship policy, audience package, third-party brand collaboration, or paid partner is identified.
The closest thing to vendor-facing content is the video series, in which Radford compares the Harness AI continuous integration product with Jenkins, Azure DevOps, GitHub, and GitLab, framing the comparison around fit with the Secure Software Factory rather than build speed.
The series shows they will evaluate commercial tooling in public, relevant context for a co-marketing proposal, but does not establish that it was sponsored or that they accept sponsored placements.
For a vendor planning a co-marketing webinar on secure software supply chains, any partnership would need to be negotiated directly and defined from scratch; the posts present Radford as a subject-matter practitioner promoting an operating-model framework, not a creator with published sponsorship inventory.
Before describing partnership formats, ask Radford or KnightsWatch Cyber for a sponsor policy, rate card, or disclosed collaboration.
A cybersecurity vendor wants Darius Radford to co-host a webinar on secure software supply chains for engineering, AppSec, DevSecOps, and platform leaders.
Read more
Decision: strong fit, with terms negotiated from scratch.
The topic match is direct.
Radford’s Secure Software Factory model gives software supply chain and artifact governance its own pillar, covering artifact, container, and dependency governance, SBOMs, integrity, provenance, and lifecycle management.
A supply-chain webinar fits within that pillar, joining an existing argument rather than asking them to adopt a new one.
The framing gives the vendor room to contribute.
Radford describes the framework as vendor-neutral and frames the problem as integration, governance, and operating discipline—not a lack of tools.
Their observation that most organizations already own SAST, DAST, SCA, WAF, cloud security, and scanners yet still face backlogged findings and bottlenecked security teams gives the session a workable premise: the vendor can explain how its product supports a repeatable process, not why it should replace the stack.
Their public work supports a co-appearance.
Radford evaluates commercial CI tooling in public, comparing Harness AI Continuous Integration against Jenkins, Azure DevOps, GitHub, and GitLab on how well each fits the operating model rather than raw build speed.
A partner willing to accept that standard is a realistic collaborator.
The offer gives the webinar a next step.
The Secure Software Factory Assessment is described as establishing a maturity baseline across the pillars and producing a prioritized roadmap with owners and milestones, which can serve as the follow-up for attendees.
Two points need to be settled in negotiations.
No sponsor policy, rate card, or disclosed partnership appears in the posts, so define scope, exclusivity, ownership of recordings, and promotional rights rather than assuming a standard package.
The visible audience figure is a LinkedIn follower count of 704, small for reach-based buying; judge the webinar on niche technical relevance and registration quality, not impressions.
Confirm which pillar labels Radford currently uses before publishing joint material: the model has been described with four pillars and later with five.
When to choose a specialist
A CI/CD vendor wants Radford to front a paid, high-reach social campaign built on a “fastest build and deploy” performance claim, with scripted short-form product endorsements and reach and impression guarantees tied to follower count.
Read more
Decision: poor fit on three counts.
The comparison criterion runs against the content.
Radford’s public tool evaluation shifts the focus from who builds fastest to which tool best fits the operating model.
A campaign centered on speed asks the audience to accept the very measure their work sets aside, weakening both the endorsement and the framework it borrows from.
The tone conflicts with the vendor-neutral position.
The posts argue that systems, not tools, reduce risk, and that most organizations have a decision-making problem rather than a vulnerability problem.
A scripted product endorsement is tool-first; the audience is invited to compare notes, not receive a recommendation.
There is no documented basis for buying reach.
The posts contain no sponsorship inventory, rate card, or disclosed brand collaboration; the only available audience number is 704 LinkedIn followers.
A campaign promising impressions or follower-based reach guarantees would sell a metric the posts cannot support.
A revised version of the same budget could work: an unscripted comparison episode for one pillar, or a technical session assessing the vendor’s product for process fit and stating its limits openly.
That puts the ask back on ground the existing work supports.
A worked campaign example
Working angle for the supply-chain webinar: “Who owns the artifact? Supply-chain governance from commit to production.”
Format: one 45-minute co-hosted webinar, with Radford as the primary voice and the vendor contributing a bounded pipeline segment. Run it as an extension of the pillar series, not a standalone launch.
Opening (5 minutes): Radford poses a recurring question from the posts: if the security tools disappeared tomorrow, would the development process still produce secure software? This shifts the session from tool selection to operating discipline and sets up the supply-chain focus.
Middle (20 minutes): cover the artifact and supply-chain control pillar in concrete terms: dependency inventory, SBOMs, provenance, integrity checks, and lifecycle handling of components that reach production.
Use the assessment structure as the spine: what a maturity baseline examines, what a typical gap looks like, and what a prioritized remediation sequence contains.
Show a redacted or illustrative baseline so attendees can see the output, not just hear it described.
Vendor segment (10 minutes): the vendor explains how its product enforces or evidences one step in that sequence—dependency admission, provenance capture, or policy checks in the pipeline. Assess its fit with the process and state plainly where it does not cover the pillar.
Close (10 minutes): Radford takes questions on where teams stall, then offers an assessment conversation as the next step, alongside one downloadable vendor resource.
Follow-up asset: a one-pillar self-assessment covering the questions a team should be able to answer about its artifacts and dependencies. Keep it useful outside the recording.
Measure success by registrations from supply-chain, platform, and AppSec roles; attendance and completion; assessment conversations booked; and questions asked during the session—not follower count or impression volume.
Pick Jim Manico when the webinar's subject is how AI is changing the economics of application security rather than the artifact side of the supply chain.
Read more
Manico argues that vulnerability discovery and remediation are both getting dramatically cheaper, that standalone scanners, SAST, DAST, IAST and CVE scanners will increasingly be replaced by AI-native capabilities, and that OWASP ASVS and AISVS matter more than ever because they define what security means and what must be verified.
For a vendor whose story is agentic remediation, or security requirements set during specification and threat-modeled continuously, that is a closer starting argument than a multi-pillar maturity model.
He also brings current incidents, such as the RubyGems attack by agent swarms, showing that the shift is already underway, and can speak to where human judgment still holds: architecture, business logic and novel attacks.
The session premise changes.
Manico's central claim is that finding and fixing flaws is getting much cheaper, casting the vendor's role as verification and continuous security engineering—not supply-chain governance.
A webinar briefed on securing software supply chains would need rebuilding around that thesis.
The register is argumentative and forecast-based, including a direct dismissal of the "AI cyber is BS" position as the real BS.
The dispute is with other practitioners, not only vendors, which can split an audience the partner needs to keep comfortable.
The pillar-and-assessment structure also gives the vendor a ready follow-up step and a maturity baseline to attach to; the reviewed Manico posts offer no equivalent.
Pick Motti Sorani when the webinar should be about the last mile: turning findings into fixes at scale without slowing development.
Read more
The argument, developed in conversation with co-founder Gil Regev, is that the industry over-invests in detection and visibility, engineers do not need more alerts, and remediation has to be integrated into development workflows, borrowing the telecom comparison of solving the hardest part of delivery.
If the vendor's product is remediation workflow, triage-to-fix automation or developer-experience tooling, that framing matches the product more directly than a pillars model.
Sorani can also open with an origin story that earns attention: learning assembly language to get more control out of a PC, reading computer viruses to do it, and writing a virus generator purely as an intellectual challenge.
It's a concrete route into offensive security rather than a credential list.
The posts do not cover artifact governance, SBOMs, provenance or component lifecycle management, the subject of a session on artifact governance, so those parts would have to come from the vendor or be dropped.
The posts are structured around a conversation with a co-founder, tying the narrative to one company's position rather than a vendor-neutral framework a partner can adopt without implying endorsement.
Both posts date from March and April 2025, older than the rest of this comparison set; ask for newer posts before using this argument as the session's spine.
Pick Ronen Slavin when the vendor wants quantified, analyst-framed material on the same supply-chain question.
Read more
Slavin cites the 2026 Verizon DBIR—vulnerability exploitation passing stolen credentials as the top initial access vector, median time-to-patch up 34% year over year, supply chain involvement in 48% of breaches—and Forrester's first Agentic Development Security Landscape, then places the bottleneck at remediation rather than discovery.
That is stronger raw material for a data-led opening than a maturity model, and the discussion of AI discovery pipelines (Anthropic's Mythos and Project Glasswing, OpenAI's Daybreak, Microsoft's MDASH feeding Windows CVEs into Patch Tuesday) gives the session a concrete hook: where do these disclosures land once they are public?
If the vendor's pitch is triage, exploitability confirmation and closing risk at machine speed, Slavin is arguing on the same ground.
The posts are first-party product positioning: Cycode is stated to be building against the problems described, and the close points to a Cycode resource hub.
A co-hosted session therefore reads as an alliance with, or a comparison against, a competitor in application security—something most vendor partners will want resolved before booking.
The argument is also narrower than a session on artifact inventory, provenance and policy enforcement: it stops at triage, exploitability and remediation speed, leaving the vendor to cover artifact inventory, provenance and policy enforcement.
The sample is only two posts from May and June 2026; ask for more examples before judging whether these themes are consistent.
Darius Radford's five LinkedIn posts cover the Secure Software Factory framework, a later version that adds post-deployment protection and treats AI governance as cross-cutting, an application security decision-making argument, a five-part tool-comparison video series, and a WeAreDevelopers appearance.
The posts here carry no publication dates, so the framework versions are presented in the order they appear rather than on a dated timeline.
The video series is announced in a post; no transcripts or video content are available, so its comparison conclusions are not reported here.
No third-party profiles, interviews, or press coverage are discussed here, and no sponsor policy, rate card, or disclosed brand partnership appears in the posts.
The comparison with Jim Manico, Motti Sorani, and Ronen Slavin draws on two LinkedIn posts each and considers how their ideas and approaches compare.
The LinkedIn profile showed an audience figure as observed on 23 October 2026.
