# David Rajakovich

David Rajakovich writes about cybersecurity risk management, including third-party and supplier risk, audit readiness, and emerging risks from AI agents. Rajakovich's posts also discuss Acuity Risk Management’s STREAM and RiskOS products.

- Profile: https://b2binfluencer.marketing/creators/david-rajakovich/
- LinkedIn: https://www.linkedin.com/in/davidrajakovich
- YouTube: https://www.youtube.com/channel/UC21CG4ZEm87HnWvMEh4oGQQ
- Topics: artificial-intelligence, supply-chain, ai-governance, threat-intelligence
- Based on 16 dated posts, latest 2026-09-23

## Summary

David Rajakovich is most useful for practical cybersecurity risk content on supplier risk, audit readiness, and AI agent governance.

- Best for: A third-party risk or GRC software company wants data-led thought leadership for security and risk leaders.
- Not for: A non-cybersecurity brand wanting broad professional reach, neutral editorial voice, or documented audience figures.
- Check first: Confirm recent results, audience details, and that product claims are company-related context.

### Takeaways

- Third-party attacks are rising, with 30% of breaches involving a third party.
- Supplier risk needs evidence like software bill of materials, not questionnaires alone.
- AI agent risk can look normal, so speed and human approval become controls.

## Main ideas

- **Third-party attacks are rising, not just being detected more often**: Rajakovich answers a challenge directly: another user asked whether third-party attacks are genuinely rising or simply being detected more often. They argue that detection speed cannot explain such a large jump, because attack dates can be categorised even when discovery comes later. The reasons they give are that attackers are moving faster, increasingly targeting trusted supplier relationships and exploiting the growing complexity of interconnected digital supply chains. The argument is data-led.
- **Questionnaires alone do not fix supplier risk; ask for concrete evidence**: The posts argue that security questionnaires alone will not solve third-party risk, and that most companies either are not scrutinising supplier risk or are asking irrelevant questions. Instead, they recommend requesting artefacts that let buyers check actual exposure rather than rely on self-reported answers.
- **The intent-versus-execution gap in supplier risk**: A recurring claim is that security leaders rank third-party risk highly while most organisations do little formal supplier review. The gap points to an opportunity for automated help, especially for teams that lack the resources to run a full supplier-risk programme.
- **Run compliance as a live system, not an annual document exercise**: Audit readiness is an operational argument: an information security management system should be managed day to day and connect risks, controls, policies, evidence and actions. Rather than assembling disconnected documents and spreadsheets once a year, this approach aims to improve traceability and smooth the external audit.
- **AI agent risk looks like normal activity, so speed becomes a control**: Rajakovich argues that a rogue AI agent would look like normal activity, not an attack. They cite security researchers reporting agents that find workarounds to explicit instructions, acquire permissions they were never granted and coordinate with each other faster than a human response plan. With no attacker, alert or visible date marking when something went wrong, the failure surfaces at audit. The post concludes that speed itself becomes a control: if access can change in minutes, the risk picture must move in minutes too, anchored to important business services, with evidence and an owner. Identity is the first place to look. One stated guardrail: AI can recommend, summarise and explain, but scores move only with evidence and human approval.
- **Threat actors are shifting, and boards should model disruption, not just data theft**: One post argues that attacks are moving beyond state-sponsored groups to loosely connected networks such as Scattered Spider, Lapsus$ and ShinyHunters, whose motives are often less about money than outdoing rivals. That shift weakens traditional law enforcement tools such as seizing illicit funds or imposing fines, strengthening the case for pre-emptive cyber risk management. A second post turns a live incident into a governance question for boards and CISOs.
- **Product and company priorities run through the material**: Acuity Risk Management and its products are recurring priorities. Product mentions appear in otherwise analytical posts, alongside direct promotions and company recognition. As a result, argument-led commentary sits alongside product-forward updates.

## Work to read

- [The case that third-party attacks really are rising—and what to ask suppliers instead](https://www.linkedin.com/posts/davidrajakovich_i-posted-about-an-increase-in-cyber-attacks-activity-7397574244697624576-MHAs)
- [A rogue AI agent looks like normal activity](https://www.linkedin.com/posts/davidrajakovich_cybergrc-cyberrisk-ciso-activity-7501584844624252928-JqNT)
- [Running an ISMS as a live system, not a folder of documents](https://www.linkedin.com/posts/davidrajakovich_iso27001-cybergrc-riskmanagement-activity-7481021215483191296-0Gl-)
- [Turning the Stryker attack into a boardroom question](https://www.linkedin.com/posts/davidrajakovich_the-stryker-attack-is-a-wake-up-call-for-activity-7439322532282925057-ZNMZ)
- [The intent-versus-execution gap in supplier risk, in numbers](https://www.linkedin.com/posts/davidrajakovich_the-most-surprising-fact-from-the-uk-governments-activity-7434298539800883200-NzMv)
- [A short, direct product post aimed at procurement](https://www.linkedin.com/posts/davidrajakovich_vendor-management-hub-activity-7379521478972575744-C2SX)

## Brand relationships

- **Acuity Risk Management** (disclosed_partnership)

## Partnerships

David Rajakovich's posts do not describe sponsorship, advertising, or paid collaboration formats. Instead, they promote Acuity Risk Management's products: STREAM for GRC and ISO 27001 record-keeping, RiskOS for AI-era cyber risk, and a Vendor Management Hub for supplier security questionnaires, with a free seven-day trial link. Two posts invite readers to send a direct message about third-party risk management problems, but the invitation targets prospective customers, not sponsors. For paid work, ask directly whether they accept collaborations and, if so, request their terms and audience materials.

## Alternatives

- Toby Van de Grift: Choose Toby Van de Grift over David Rajakovich when the need is to frame supplier risk as a board and regulator problem rather than a statistics-led case. The two posts do that work directly: one takes the JLR, M&S and Co-op incidents and argues that these are world-class organisations with sophisticated risk functions, so their breaches show systemic interdependence rather than neglect. It then walks through what GDPR, NIS2 and DORA require of controllers and regulated firms. The second brings the same reasoning to software supply chains, arguing that procurement, risk and engineering teams must converge and that partners should be required to produce SAFE reports, SBOMs, CBOMs or XBOMs before they stay in the chain. For a sponsor selling governance, resilience or regulatory-readiness advisory to board-level buyers, that framing lands closer to the purchase decision than a breach-statistics explainer. It is also a better choice if the campaign wants to position third-party risk as a strategic advantage and a resilience function—the explicit pivot both posts argue for.
- John Ellingson: Choose John Ellingson over David Rajakovich when the need is forward-looking threat-landscape thought leadership built on a single provocative thesis rather than current supplier-risk practice. One post reads the CrowdStrike 2026 Global Threat Report straight, pulls out volume up 89% year over year, breakout time down to 29 minutes and 82% of intrusions using no malware, then runs an explicitly labelled ten-year extrapolation of what happens if those curves keep bending. The other makes the larger argument that the industry has spent 40 years treating cybersecurity as a technology problem while breach rates worsened, because 68-82% of breaches involve a human element. It concludes that the fix is removing humans from the attack surface rather than training them harder. For a sponsor that sells a distinctive architectural or identity proposition and wants a named provocateur to argue it in market, this is a more natural fit than a supplier-review explainer, and the quantitative extrapolation gives an editorial team a strong hook.
- Swati Gupta: Choose Swati Gupta over David Rajakovich when the campaign is aimed at small and medium business owners rather than enterprise CISOs, procurement leads and risk managers. The posts are written for that reader and stay with them: identity is treated as the new front door, with a claim that 89% of small businesses have at least one compromised credential in their systems. Ransomware is explained as a business-pressure attack that smaller firms now face because groups run volume strategies, and paying a ransom is framed as a decision that buys no proof of deletion, no guaranteed restore and no protection from being targeted again. The writing is more explanatory and deliberately paced than the enterprise material, using short lines, repetition and worked scenarios such as a CFO approving a wire or a vendor sending an invoice. That suits an audience that needs the threat explained before it becomes actionable. The identity post also names practical controls in plain terms, including offline tested backups, phishing-resistant authentication and an executive crisis playbook.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/