# Dave Merkel

Dave Merkel writes about cybersecurity, including security policy, emerging threats, and how security teams should use AI.

- Profile: https://b2binfluencer.marketing/creators/dave-merkel/
- LinkedIn: https://www.linkedin.com/in/davemerkel
- Topics: artificial-intelligence, leadership, cybersecurity
- Based on 9 dated posts, latest 2026-09-11

## Summary

Dave Merkel is useful for clear arguments on AI in security operations, threats, and security policy.

- Best for: Campaigns on AI in security operations, threat landscape, and security policy for enterprise security leaders.
- Not for: Vendors seeking support for centrally deployed, government-mandated security software on citizen or employee devices.
- Check first: Confirm partnership terms, pricing, disclosure practice, and the longer framework behind the AI post.

### Takeaways

- AI will change cybersecurity jobs rather than eliminate them, because defenders still adapt to human attackers.
- AI in security operations earns autonomy through demonstrated results, with humans and AI monitoring each other.
- Government-mandated security software concentrates risk instead of reducing it, creating a single point of compromise.

## Main ideas

- **AI will change cybersecurity jobs rather than eliminate them**: In a year-ahead predictions post, Dave Merkel argues that AI will not eliminate cybersecurity positions: adversaries are still human, and human defenders are needed to identify patterns, adapt tactics, and think like attackers. Attackers already use AI, so defenders will have to as well or lose ground. Figuring out how becomes part of the job, not a separate project.
- **AI in security operations earns autonomy through demonstrated results, with humans and AI watching each other**: Dave Merkel argues that most AI implementations in security operations optimize speed at the expense of accuracy, or vice versa. They call that backwards: speed without accuracy is reckless, and accuracy without speed is useless. AI should not get the wheel on day one; it should earn autonomy through demonstrated outcomes. Humans should watch AI, and AI should watch humans—a necessary part of the architecture, not a limitation to engineer away.
- **Government-mandated security software concentrates risk instead of reducing it**: Reacting to India's order that new smartphones ship with a state-run cybersecurity app, Dave Merkel argues that requiring government-controlled software on every device makes nobody safer: one breach could give attackers or the government direct access to hundreds of millions of devices. Real security, they argue, requires transparency, independent auditing, accountability, and diversity of approach rather than an opaque monoculture. The post warns Western democracies not to treat India's policy as a roadmap, noting that corporations have already surrendered data access under regulatory pressure and that voluntary frameworks, limited access, and oversight mechanisms can expand into mandates and rubber stamps. The target is centralized, opaque, judicially unsupervised software—not regulation as such.
- **Expect the attack surface to widen and the year to contain at least one surprise**: The predictions post lays out five calls for 2026: federal cybersecurity policy and regulation heading toward disorder, with public-facing capabilities such as CISA dismantled while the administration takes what Dave Merkel calls a strange foreign-policy stance toward North Korea, China, and Russia; more M&A, especially around AI-enabled security companies and distressed assets, with IPOs remaining slow; AI changing security jobs; a widening attack surface; and a development nobody is currently thinking about. The piece presents talking points for practitioners, with a short reason for each call rather than a data-backed forecast, and closes by asking other security leaders what they are watching.

## Work to read

- [2026 cybersecurity predictions: five calls for the year ahead](https://www.linkedin.com/posts/davemerkel_another-year-another-round-of-predictions-activity-7412165881184681984-ZsRC)
- [India's pre-installed security app order and why Western democracies should not copy it](https://www.linkedin.com/posts/davemerkel_sanchar-saathi-india-scraps-order-to-pre-install-activity-7404589857957625856-Dlnm)
- [Speed without judgment: where AI belongs in a security operations center](https://www.linkedin.com/posts/davemerkel_speed-without-judgment-is-a-faster-way-to-activity-7458257378271141888-aoT8)

## Partnerships

The three posts read like a working security leader talking to peers, not a media kit: Dave Merkel comments on government security policy, publishes a framework through a company link, and asks other security leaders what they are watching for. They offer no partnership terms, sponsored formats, pricing, disclosure practice, or official inquiry route. Ask directly about those details; any keynote, advisory, or content engagement would otherwise need to be negotiated case by case rather than selected from a published menu. The posts point to two areas for a potential campaign: 2026 threat predictions and where AI genuinely belongs in a security operations centre.

## Alternatives

- John Ellingson: Choose Ellingson when the agenda calls for one quantified, data-anchored forecast and a provocative architectural argument, rather than a list of predictions. The threat-report post reads four 2026 sources — CrowdStrike's Global Threat Report, WEF's outlook, CISA's national critical functions list, and Verizon's DBIR — into three curves: attack volume up 89% year over year, breakout time down to 29 minutes, and 82% of intrusions using no malware. It then extrapolates ten years out in phases, ending with the claim that security architecture must change because layered inspection is computationally expensive and defenders stay reactive. The second post turns the human-element statistic into a structural thesis: if most breaches involve a person, the answer is not better training but removing humans from the attack surface. For a keynote built around one big, arguable idea, that is a closer fit than a five-call predictions format.
- Deepen Desai: Choose Desai when the buyer wants a speaker who can describe security operations from inside a shipping platform, with named capabilities and hands-on frontier-model testing, rather than a forecast. The launch post spells out what a modern SOC platform now covers: unified exposure and threat management in one place; inline telemetry across network, identity, endpoint, cloud, AI, and deception; specialized agents built from a decade of SOC and threat-hunting work; and closed-loop remediation that turns detection into action. The second post reports testing Anthropic and OpenAI frontier models against real attack and defense scenarios, with three concrete observations: multi-step reasoning lets AI construct exploit paths instead of only scanning for known CVEs; architectural context improves exploit accuracy; and context should be limited to grounding the model. For practitioners deciding what to buy or build, that operational specificity is more directly useful than a predictions list.
- Ido Geffen: Choose Geffen when the event wants the attacker's side of AI — autonomous agents collaborating, chaining exploits, finding zero-days — plus a contrarian argument about security staffing. The Black Hat post describes OpenAI's agents sharing a memory system, building on each other's discoveries, chaining exploits, finding zero-days, and compromising real systems during an internal evaluation. It frames the real shift as agents gaining the ability to collaborate, reason, and execute complex attack paths together. The other post argues that hiring more CISOs will not fix the “bug-pocalypse”: AI writes more code faster with more vulnerabilities, the same AI is getting good at finding and exploiting them, and a twenty-person security team cannot manually review what AI coding assistants ship in a single afternoon across a thousand engineers. That staffing argument is a harder-edged answer to the same AI question Merkel addresses, and it will land differently with a technical audience than “the jobs change rather than disappear.”

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/