# David Daily

David Daily shares practical commentary on cybersecurity, including open-source software supply-chain threats, AI’s role in defense and attacks, and security patching.

- Profile: https://b2binfluencer.marketing/creators/david-daily/
- LinkedIn: https://www.linkedin.com/in/davidbdaily
- LinkedIn followers: 1,148
- Topics: artificial-intelligence, supply-chain, cybersecurity, software-supply-chain-security
- Based on 18 dated posts, latest 2026-06-26

## Summary

David Daily is most useful for concise LinkedIn commentary on open-source supply-chain threats, AI security risks, and patching.

- Best for: A cybersecurity software company planning a thought-leadership webinar on software supply-chain threats.
- Not for: A developer-tool vendor wanting a hands-on technical workshop with a live dependency-audit pipeline.
- Check first: Confirm whether their followers include security buyers and ask for past webinar attendance data.

### Takeaways

- Open-source dependencies are the soft target in the software supply chain.
- AI is both the defense and the attack surface.
- Patching is a security decision, not routine maintenance.

## Main ideas

- **Open-source dependencies are the soft target in the software supply chain**: David Daily argues that attackers have moved into open-source ecosystems because developers rely on built-in trust when consuming libraries. Harmful code can sit inside a seemingly legitimate library, or a whole package can imitate a trusted one, making detection unusually hard. The response repeated across posts is dependency analysis, continuous monitoring, and stricter governance over which open-source components teams adopt.
- **AI is both the defense and the attack surface**: In David Daily's framing, AI sharpens threat detection and continuous monitoring while also giving attackers better tools, so adoption is not an unqualified win. The proposed balance is technical and ethical: use AI to spot anomalies, set ethical boundaries around AI development, and keep human expertise in the loop rather than replacing it.
- **Patching is a security decision, not routine maintenance**: David Daily treats vendor patch cycles as live threat intelligence and argues that prompt patching mitigates exploitation risk, especially for critical vulnerabilities. The emphasis is on speed and follow-through.
- **Cybersecurity explained through shared culture**: David Daily sometimes explains security through a familiar fictional frame, using Star Wars to translate abstract ideas — continuous training, strategic wisdom, and ethical responsibility — into shorthand a general audience already shares. The tone and closing question invite conversation rather than offer instruction.

## Work to read

- [Navigating AI-Driven Cyber Threats: A Double-Edged Sword](https://www.linkedin.com/posts/davidbdaily_ai-opensource-cybersecurity-activity-7360659794535309313-l1sF)
- [Open Source Supply Chain Risks and Vulnerabilities](https://www.linkedin.com/posts/davidbdaily_opensourcesecurity-supplychainrisk-cyberresilience-activity-7359208609437638657-JzV4)
- [Cybersecurity Vulnerabilities in Open Source Software](https://www.linkedin.com/posts/davidbdaily_opensourcesecurity-supplychainattacks-cyberawareness-activity-7361387539477225472-zXAq)
- [Cybersecurity through the Lens of Popular Culture](https://www.linkedin.com/posts/davidbdaily_geekwisdom-starwars-cyberforce-activity-7359942442046906369-1o5b)
- [Defending Against Modern Threats: AI and Security](https://www.linkedin.com/posts/davidbdaily_aiinsecurity-cyberdefense-innovationchallenge-activity-7365736757994135554-bDty)
- [Patch Management in the Current Threat Landscape](https://www.linkedin.com/posts/davidbdaily_cybersecurity-patchmanagement-infosec-activity-7364288867262222337-E514)

## Brand relationships

- **Microsoft** (mention)

## Partnerships

David Daily's posts here contain no sponsorship formats, partner terms, rate information, or partnership inquiry route. Every post is a LinkedIn post from August 2025; none is a media kit, sponsor disclosure, or page explaining how a brand can work with them. Posts on open-source supply-chain attacks, AI in security, patch management, and Star Wars and cybersecurity read as their own commentary and carry no paid-partner label or #ad-style disclosure. Partnership terms cannot be planned from the available information: there is no published format list, stated turnaround or approval process, or verified inquiry route. A brand would need to establish contact and negotiate terms directly; any webinar or sponsored placement would have to be negotiated from scratch rather than matched to a published offer. Before proceeding, ask for a media kit, partnership terms, and a verified inquiry route; if a media kit, LinkedIn featured or services section, agency or representation page, or disclosed sponsored post is found, record the exact document and date.

## Alternatives

- Michael Abtar: Michael Abtar is the stronger choice for the same webinar when the audience belongs to one regulated sector and the session should run as a threat-by-threat agenda, with a control attached to each. The April 2024 posts reviewed here follow exactly that shape: pharmaceutical threats are set out one at a time — intellectual property theft, ransomware, clinical-trial data breaches, supply-chain vulnerabilities, connected medical devices, data-integrity tampering, employee training gaps, state-sponsored attacks and biomedical espionage. Financial-services threats follow the same format, covering advanced persistent threats, cryptocurrency, denial of service, insider dealing, mobile banking flaws, regulatory compliance, cloud risk, identity theft, algorithmic abuse and supply-chain attacks. A vendor selling to hospital groups or banks can lift that structure directly: name the threat, describe how it lands, state the control. It also places the supply-chain problem in the buyer’s own regulated context rather than leaving it as a developer concern.
- Salman Hussain: Salman Hussain is a better fit for a session that pivots from package attacks to the human and AI side of the threat. The 7 June 2026 post covers executive impersonation and CEO fraud in the Gulf, describing how AI, deepfake voice and video, social engineering and public business information are used to bypass controls. It then lists five concrete actions: verify money and sensitive requests through a separate channel, apply dual approvals and split duties, train staff to spot impersonation, audit executives’ public digital exposure, and run fraud and business email compromise simulations. The 13 May 2026 post takes a privacy line on the same theme, examining reports that Chrome downloads a 4 GB on-device AI model in the background and drawing out consent, local AI processing, supply-chain trust in software ecosystems and governance of AI features. For a vendor selling identity, endpoint or AI governance rather than code scanning, these talking points sit much closer to the product.
- Joe Decker: Joe Decker is the better pick when the webinar should focus on exposure management and risk prioritisation rather than packages. The September 2025 post builds the discipline around asset discovery, vulnerability assessment, threat intelligence and data protection, using a sailing metaphor to guide a mixed business audience through each step. It closes with the argument that preparation is about how ready you are when something strikes. The June 2026 post sharpens the point: the real risk is often the forgotten asset, the inherited exception, the misconfiguration everyone assumes someone else owns, or the quiet third-party exposure. Danger builds when visibility is partial and ownership is unclear. That gives a vendor a discussion-friendly spine for a fireside or panel format and a natural route from discovery to prioritisation to action, with a memorable image the audience will retain.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/