Derek Boxdell shares practical perspectives on cybersecurity, including protecting manufacturing operations, responding to AI-driven threats, and using breach data to guide security decisions.
Derek Boxdell is most useful for linking manufacturing cybersecurity risks to production, breach trends, and business decisions.
Best for
A manufacturing technology brand needing industrial cybersecurity positioning, keynote, or advisory work.
Not for
Consumer identity, VPN, or broad-reach short-form video campaigns needing direct-response app installs.
Key takeaways
In manufacturing, cybersecurity is production assurance, not IT compliance.
AI speeds operations and attackers, so shift from detect-and-respond to predict-and-prevent.
Third-party breaches doubled and vulnerability exploitation rose 34%, requiring asset visibility and patch prioritization.
Check first: Confirm audience composition, engagement data, and council session attendance before contacting them.
Main ideas
In manufacturing, cybersecurity is production assurance, not IT compliance · AI speeds up operations and attackers, so shift from detect-and-respond to predict-and-prevent · Breach reports are playbooks, and their value lies in the operating decisions they force
Derek Boxdell shares cybersecurity perspectives on LinkedIn, with a clear focus in these posts on manufacturing operations, breach trends, and enterprise risk. They connect security decisions to consequences leaders recognize, such as production downtime, supply-chain exposure, and customer trust.
Boxdell’s distinctive strength in these posts is translating security concerns into operational priorities.
In a manufacturing talk, they frame downtime as a threat to production and revenue, then argue for building security into automation rather than adding it later.
In a reaction to the Verizon Data Breach Investigations Report, they connect breach trends to asset visibility, patch prioritization, and tabletop exercises.
A partner-focused post shows another side of this approach: using the report to ground customer conversations in business priorities.
The monthly field-notes post broadens the discussion beyond manufacturing to human distraction, trust, and compliance.
Readers looking for security commentary that links technical risks to business decisions will find concrete starting points in this work.
Derek Boxdell argues that security decisions should be framed around production continuity and customer trust, not compliance checkboxes.
Read more
Their recurring positions: plant downtime is an existential risk, so security belongs inside automation design; AI accelerates operations and attackers alike; breach reports matter when they drive specific operating practices; human inattention causes more real breaches than sophisticated exploits; and regulation is becoming a way for companies to differentiate.
The arguments draw on Verizon’s Data Breach Investigations Report, KnowBe4 data, and named practitioners.
No sponsorship or paid-partnership format appears in the posts.
In manufacturing, cybersecurity is production assurance, not IT compliance
Derek Boxdell argues that when production stops, revenue stops, so a plant’s security team must increasingly assure production, not just satisfy an IT checklist.
Read more
OT resilience should get the same priority as uptime. Security must be designed into automation from the start, not added later: increasingly automated “dark factories” lower labor risk while raising cyber and system-dependence risk.
A talk to the Manufacturers Alliance Information & Cybersecurity and IS Management Councils, structured around three “bold realities”: downtime as existential risk, AI accelerating both operations and attackers, and dark factories already here. Each reality comes with an action: prioritize OT resilience as highly as plant uptime, and build security into automation design rather than bolting it on.
AI speeds up operations and attackers, so shift from detect-and-respond to predict-and-prevent
Derek Boxdell treats AI as two-sided, neither a pure tool nor a pure threat.
Read more
It powers predictive maintenance and faster operational decisions, while also shortening attackers’ breakout time. The recommended posture: predict and prevent rather than detect and respond.
The same manufacturing council talk lists AI as one of three realities and gives the action item plainly: replace “detect and respond” with “predict and prevent.”
The posts also argue that human inattention causes more real-world breaches than sophisticated exploits, making the recommended response technology-forward but not purely technical.
Breach reports are playbooks, and their value lies in the operating decisions they force
Derek Boxdell describes the Verizon Data Breach Investigations Report as a playbook, not just a report: a way to cut through noise and ground conversations in facts, tying security spending to outcomes.
Read more
The point is not to read the numbers but to act on the practices they imply. In a second post, they apply the report to partner conversations, using its findings to connect threat trends with customer engagement, business priorities, and investments that actually reduce risk.
The doubling in third-party breaches and a 34 percent rise in vulnerability exploitation are treated as warnings.
The recommended responses are relentless asset visibility, ruthless patch prioritization, and tabletop exercises that reach beyond the IT team.
Boxdell credits the resilience framing to Miguel Clarke and highlights Kris Philipsen’s summary of the report’s depth.
The human factor is the wildcard, and inattention beats sophistication
Derek Boxdell argues that attackers often do not need advanced exploits when they can target behavior instead—a mistimed click, a rushed approval, a spoofed invoice.
Read more
Awareness and human risk reduction are therefore breach-prevention activities, not training formalities; the human element remains the unpredictable variable in breach data.
A monthly field-notes post cites KnowBe4 data showing that inattention beats sophistication in real-world breaches. A DBIR commentary post calls the human element the wildcard and argues that organizations should empower their people or risk becoming the next headline.
A breach is a reputational event, not only an operational one
Derek Boxdell argues that when customer data is auctioned off, the fallout reaches beyond operations to customer trust, making trust a battleground rather than a byproduct of good security.
Read more
Incident response and communication therefore carry commercial as well as technical weight.
The field-notes post cites Colt Telecom being hit with ransomware and Orange Belgium’s breach exposing 850,000 records, framing the reputational damage as comparable to the operational disruption.
Derek Boxdell argues that companies can use compliance to differentiate themselves in the market rather than treating regulation as a cost to absorb.
Read more
The winners, in this framing, go beyond checking the box.
The field-notes post cites Texas’s “safe harbor” law protecting cyber-compliant small and midsize businesses, alongside EU RED and DORA reshaping expectations globally.
Shows what a manufacturing-focused cybersecurity conversation sounds like when aimed at plant leaders.
Read more
Start here for the clearest statement of the OT, AI, and downtime argument.
This post summarizes a talk to the Manufacturers Alliance Information & Cybersecurity and IS Management Councils.
It lays out three realities: downtime is existential risk, making security a form of production assurance; AI is accelerating both operational and attacker decisions, shifting the focus from detect-and-respond to predict-and-prevent; and dark factories are already here, raising system-dependence risk.
The call to action is to build security into automation design rather than add it later.
Derek Boxdell frames OT security for manufacturing leaders around uptime and production continuity, not IT compliance.
For brands planning a campaign
A keynote or advisory engagement could use these three realities to move security from a cost center to an operational priority. The dark-factory point adds a concrete automation-risk angle.
Shows how they translate a major industry report into concrete action.
Read more
A good entry point to their data-driven approach to third-party and supply chain risk.
The post highlights Verizon Data Breach Investigations Report findings on a doubling of third-party breaches and a 34% spike in vulnerability exploitation.
It references Kris Philipsen and a Miguel Clarke idea: cyber resilience requires relentless asset visibility, ruthless patch prioritization, and tabletop exercises beyond the IT team.
Supply chain risk and patching are treated as more than check-the-box work.
Derek Boxdell turns a major industry report into specific operational priorities.
For brands planning a campaign
A campaign could use this as evidence for a data-backed briefing on third-party risk. The statistics and siren framing lend themselves to a talk or workshop on supply chain resilience.
Shows how Derek Boxdell works with partners and channels, not just end customers.
Read more
Start here for a look at the collaborative, enablement-oriented voice.
The post describes sitting down with a partner to discuss the Verizon DBIR and presents the report as a playbook to help partners and customers cut through the noise.
It explains how partners can use DBIR insights to engage customers, connecting threat trends to business priorities and risk-reducing investments.
This highlights the partner-facing, conversational side of Derek Boxdell's work.
For brands planning a campaign
Useful for channel or partner-marketing briefs. The post models how to turn research into partner conversations, supporting a co-branded webinar or partner enablement session.
Demonstrates their recurring format and broad enterprise risk perspective.
Read more
Start here to see how they connect human behavior, reputational risk, and regulation.
A recurring field-notes post gathers observations from conversations with enterprise leaders.
It identifies three themes: human distraction as the biggest security gap, citing KnowBe4 data that inattention beats sophistication; trust as the new battleground, citing Colt Telecom ransomware and Orange Belgium's breach of 850,000 records; and compliance as a competitive edge, referencing Texas's safe harbor law, EU RED, and DORA.
It closes with a call to prove resilience and support distracted humans, synthesizing field conversations into themes.
For brands planning a campaign
A campaign could sponsor or collaborate on this monthly field-notes series, or draw on its themes for a panel on human risk and compliance. The specific incidents and regulatory drivers offer ready-made talking points.
In a talk to the Manufacturers Alliance Information & Cybersecurity and IS Management Councils, Boxdell framed manufacturing security as production assurance: if production stops, revenue stops, so OT resilience should get the same priority as uptime.
Read more
They argued that security belongs in automation design, not bolted on later, and pointed to increasingly automated “dark factories” as a reason system-dependence risk grows even as labor risk falls.
A keynote built around three numbered “bold realities,” each paired with a concrete action, such as prioritizing OT resilience as highly as plant uptime.
For brands planning a campaign
A manufacturing, industrial-automation, or OT security brand can book Boxdell for a conference keynote or council session linking security investment to plant uptime rather than generic IT risk.
In the same talk, Boxdell presented AI as a two-sided force: it powers predictive maintenance and faster operational decisions while shortening attackers’ breakout time.
Read more
They urged security teams to shift from “detect and respond” to “predict and prevent.”
For brands planning a campaign
Fits a vendor positioning AI-enabled OT security or predictive threat detection. Boxdell grounds the argument in the plant floor rather than a purely technical frame, suiting manufacturing and critical-infrastructure audiences.
Two posts focus on the Verizon Data Breach Investigations Report.
Read more
Boxdell calls the DBIR a playbook rather than a report, highlighting the doubling of third-party breaches and a 34% rise in vulnerability exploitation. They draw operational conclusions from the data: relentless asset visibility, ruthless patch prioritization, and tabletop exercises that reach beyond the IT team.
Commentary that turns a headline statistic into a named practice, often crediting another practitioner’s framing before adding their own interpretation.
For brands planning a campaign
Works for a research, threat-intelligence, or vulnerability-management brand seeking an interpreter who turns report data into grounded customer conversations rather than abstract trend talk.
Boxdell described sitting down with a partner to discuss DBIR implications and how partners can use the findings to open fact-based customer conversations, connect threat trends to business priorities, and focus on investments that actually reduce risk.
Read more
For brands planning a campaign
Suits a channel program or MSSP seeking someone to brief partners on translating threat data into pipeline and positioning. The material shows partner-facing discussion, not a documented paid engagement; ask for examples of paid partner work.
In a monthly field-notes post, Boxdell argued that human distraction is today’s biggest security gap, citing KnowBe4 data that inattention beats sophistication in real-world breaches and giving examples such as a mistimed click, a rushed approval, or a spoofed invoice.
Read more
They also called the human element the wildcard in DBIR analysis. They pointed to Colt Telecom’s ransomware incident and Orange Belgium’s exposure of 850,000 records, arguing that when customer data is auctioned, the fallout is as reputational as it is operational.
A recurring monthly “field notes” format collecting observations from conversations with enterprise leaders and closing with a takeaway and a question for the audience.
For brands planning a campaign
Fits a security-awareness, training, or incident-response brand. Boxdell frames awareness as a way to reduce breach risk and links incidents to customer trust, supporting messaging aimed at executives as well as security teams.
Boxdell pointed to Texas’s “safe harbor” law protecting cyber-compliant small and midsize businesses, and to EU RED and DORA as forces reshaping expectations.
Read more
They argued that winners will use compliance as a differentiator, not just check the box.
For brands planning a campaign
Relevant for a GRC, compliance, or advisory brand selling to mid-market organizations facing new regulation, particularly one that wants compliance framed as a market advantage rather than a mandatory cost.
The posts say there is no sponsorship, affiliate, employment, ownership, or investment relationship.
Read more
Two organizations appear explicitly: the Manufacturers Alliance, which invited Derek Boxdell to speak to its cybersecurity and IS management councils, and Verizon Business, whose Data Breach Investigations Report they discuss in a conversation with an unnamed partner.
Other companies named in the posts—KnowBe4, Colt Telecom, and Orange Belgium—appear as cited breach data or examples, not as relationships.
One post refers to "one of our partners" without naming the business; ask for the partner's identity.
Manufacturers Alliance
Mention
Derek Boxdell was invited by John Miller and the Manufacturers Alliance to speak to the organization's Information & Cybersecurity and IS Management Councils about manufacturing cybersecurity, industrial operations, and AI.
Read more
The post thanks the organizers and summarizes the three points discussed. It states no commercial terms, so this is recorded as a mention rather than a client or sponsorship relationship.
Boxdell describes sitting down with an unnamed partner to discuss the Verizon Data Breach Investigations Report and how partners can use its findings in customer conversations.
Read more
The post tags #DBIR and #VerizonBusiness but does not state a formal relationship with Verizon, so this is recorded as a mention.
Start with the manufacturing council talk, which sets out the central argument: plant downtime is the real risk, so security belongs inside automation design and should be framed in terms of production continuity.
Two posts show how they read breach data: the Verizon DBIR becomes a playbook for operating decisions on asset visibility, patch prioritization, and tabletop exercises beyond IT, including one post aimed at partner and channel conversations.
The monthly field-notes post shows the recurring format: observations from conversations with enterprise leaders on human-factor risk, reputational fallout from breaches, and regulation as a competitive differentiator, ending with a takeaway and a question for readers.
For practical framing aimed at manufacturing and OT audiences, read the talk and field notes together; for research interpretation, read the two DBIR posts.
Like Boxdell, Ellingson takes a named threat report beyond the headline numbers to argue what defenders should do differently: the CrowdStrike report’s trends in volume, speed, and scope on one hand, and the claim that most breaches run through human access paths on the other.
Read more
Both use report data as a starting point for a position, not just a summary.
Ellingson argues at the architecture level, sketching a ten-year extrapolation and making the case for structurally removing humans from the attack surface. Boxdell stays closer to the operating floor, turning data into practices such as patch prioritization and OT resilience for manufacturing and industrial audiences.
Policastro frames cybersecurity as a leadership and business-resilience question rather than a technology one, matching Boxdell’s focus on production continuity and customer trust.
Read more
Both treat partnerships and vendor relationships as part of the story and write for executives who have to justify security spend.
Policastro’s posts focus on provider-side news, including a Pondurance partnership with HSB offering warranty coverage and commentary on Pondurance’s threat download, with product detail of that kind. Boxdell’s posts discuss report findings, council sessions, and field observations; none uses a sponsorship or product format.
Richards, like Boxdell, takes a specific incident or campaign and turns it into a question defenders should be able to answer about their own environment.
Read more
Ransomware exploiting known Fortinet flaws and Active Directory abuse both prompt questions about patching discipline and privileged-account protection.
Richards writes from a customer-success angle at a managed security provider, building posts around an external newsletter’s coverage of vulnerability management and identity controls. Boxdell addresses manufacturing and OT risk and leadership-level resilience, drawing examples from council talks and field notes rather than a newsletter thread.
Derek Boxdell's LinkedIn profile shows 2,202 followers as of 11 October 2026.
Read more
Their posts cover industrial and OT security, AI-shortened attack timelines in manufacturing, breach data from the Verizon DBIR, and enterprise risk and compliance.
Boxdell spoke to the Manufacturers Alliance Information & Cybersecurity and IS Management Councils about manufacturing cybersecurity, industrial operations, and AI, describing a questioning, engaged group.
That points to reach among manufacturing security practitioners, but it reflects an event audience, not necessarily their followers.
For a campaign aimed at manufacturing technology, treat the follower count as a scale figure, not proof of audience fit.
2,202 LinkedIn followers is a small base by platform standards, making broad-reach plans a mismatch; a plan built around a credible practitioner voice and a manufacturing-security point of view has a plausible route.
Before committing, ask for the last three to six months of post-level results on comparable topics—impressions, reactions, comment counts, and, where available, commenters' and sharers' job titles or companies—plus any audience survey covering employer type, occupation, and seniority.
Also ask for the attendance size and composition of the manufacturers council session.
These details would show whether their readers match the people your campaign needs to reach.
LinkedIn followers
2,202
LinkedIn profile that published the four reviewed posts · 2026-10-11
The posts do not publish a sponsorship policy, package list, rate card, or partnership inquiry route.
Read more
Derek Boxdell spoke to the Manufacturers Alliance Information & Cybersecurity and IS Management Councils on cybersecurity, industrial operations, and AI, and ran a session with a partner on using the Verizon Data Breach Investigations Report to shape customer conversations.
These posts show speaking and partner-enablement work, not documented paid formats.
For a manufacturing technology company considering a keynote or advisory engagement, contact Boxdell directly to confirm price, lead time, deliverables, exclusivity, and booking.
Resolve those details before budgeting if the campaign depends on a defined sponsorship format.
Campaign need: A manufacturing technology company wants to strengthen its industrial cybersecurity positioning and is considering Derek Boxdell for a keynote or advisory engagement on OT security and AI-driven resilience.
Read more
Decision: a strong conditional fit.
Their posts show them speaking to the Manufacturers Alliance Information & Cybersecurity and IS Management Councils about manufacturing cybersecurity, industrial operations, and AI.
The argument is built for plant and security leaders: downtime is existential risk, so security becomes production assurance and OT resilience should be prioritized like uptime; AI cuts both ways because it speeds operational decisions and attacker breakout time, so teams should move from detect-and-respond to predict-and-prevent; dark factories are already here, so security belongs in automation design rather than being bolted on later.
Two other posts show them using the Verizon DBIR as a working playbook, not a trend report: third-party breaches doubled, vulnerability exploitation rose 34%, and the response is relentless asset visibility, ruthless patch prioritization, and tabletop exercises beyond the IT team.
A partner-facing post shows the same material being used to help partners open grounded customer conversations.
That is directly relevant to a manufacturing technology company selling into OT and industrial security.
The fit is conditional: the posts show a LinkedIn follower count of 2,202 but no audience composition or engagement data.
Ask for those figures, along with the fee, format, deliverables, lead time, exclusivity, and booking terms, before committing.
Treat them as a credible practitioner voice for a targeted manufacturing and OT-security audience, not as a mass-reach buy.
When to choose a specialist
Campaign need: A consumer identity-protection or VPN brand wants a high-volume short-form video creator to drive app installs among general consumers, with success measured in broad reach, entertainment value, and direct-response conversion.
Read more
Decision: poor fit.
Their posts are enterprise- and manufacturing-facing.
They cover an OT and industrial cybersecurity talk, breach-report analysis for partners and customers, and a monthly field-notes post on enterprise risk, compliance, and reputational fallout.
There is no consumer security content, lifestyle or entertainment format, short-form video content, or demonstrated direct-response campaign.
The audience information is a LinkedIn follower count of 2,202, with no demographics, geography, occupation, seniority, or engagement data, so the campaign's required broad consumer reach is unsupported.
Using them here would mean asking the audience to follow a topic and tone the posts do not show.
A better route is a creator whose posts already reach general consumers and whose engagement data can be inspected.
A worked campaign example
Campaign angle for a manufacturing technology campaign: 'Production assurance when AI accelerates the attack.' The company sells industrial cybersecurity or OT resilience.
Use Derek Boxdell as the keynote voice and advisory facilitator for a half-day session with plant operations, OT security, and manufacturing IT leaders.
The through-line from their posts: if production stops, revenue stops, so security should be framed as production assurance, not IT compliance.
The session opens with that reframe, then moves to three decision points.
First, AI is both an operations tool and an attack accelerant; the practical shift is from detect-and-respond to predict-and-prevent, with examples tied to predictive maintenance and shortened breakout time.
Second, dark factories are not a future scenario; automation reduces labor risk while raising system-dependence risk, so security must be designed into automation rather than added later.
Third, breach data should drive operating choices: third-party breaches have doubled, vulnerability exploitation rose 34%, and the response is asset visibility, patch prioritization, and tabletop exercises that include operations and suppliers, not only IT.
For the partner or channel part of the day, use the DBIR as a playbook: give partners a short set of fact-based questions that connect threat trends to customer priorities and risk-reducing investments.
Worked next step: a 90-minute keynote followed by a 60-minute closed-door advisory.
Pre-work asks each attendee to bring one live automation project and one third-party dependency.
The output is a one-page production-assurance risk map with owners and a 90-day action list.
Before booking, confirm that they will tailor the session to the company's automation stack and agree on the fee, deliverables, lead time, and exclusivity.
Choose John Ellingson for a forward-looking, quantified threat-landscape keynote rather than a plant-floor session on OT resilience.
Read more
The posts show a close reading of the CrowdStrike 2026 Global Threat Report, followed by a ten-year extrapolation: attack volume up 89 percent year over year, breakout time down to 29 minutes, and 82 percent of intrusions using no malware and moving through valid credentials across identity, cloud, and edge.
The argument then turns architectural: if 68 to 82 percent of breaches involve a human element, per the Verizon report cited in the post, the durable fix is to remove humans as an access path rather than improve training or detection.
A manufacturing technology company whose audience needs a long-range strategic frame, an AI-driven-attack thesis, and a deliberately provocative conclusion will get more from this than from a session built around production uptime.
The tradeoff is altitude.
Both posts stay above the plant floor: one synthesizes reports and makes a prediction; the other argues for a security architecture.
The ten-year projection is labeled as the author's own extrapolation, not a finding of the cited reports, and the closing section advocates for a specific technology approach.
Neither post uses manufacturing operations language or frames downtime as an existential risk; neither details industrial control environments, automation design, or third-party supplier exercises.
For a campaign aimed at moving plant operations leaders to concrete OT decisions, ask for examples that translate the argument into plant-floor action.
Choose Frank Policastro for sessions aimed at executives, risk owners, or the CFO, especially when the audience asks about recovery rather than prevention.
Read more
The posts frame security as a leadership and board-level issue in plain terms: attackers moving faster, AI accelerating both vulnerability discovery and exploitation, and a shrinking window to detect, contain, and respond.
The second post makes the commercial case: Pondurance managed detection and response offerings now carry up to $250,000 in warranty coverage for eligible expenses after a covered breach through the HSB Hartford Steam Boiler partnership, alongside immediate access to incident response specialists.
A manufacturing technology company selling resilience services, or one whose industrial buyers want to know how an incident gets paid for, gets a sharper, more concrete commercial frame here than from a pure practitioner talk.
The tradeoff is independence.
The work is anchored to Pondurance's own offerings and a named partnership announcement, so plant and industrial security leaders will quickly hear a services message.
Neither post covers manufacturing or OT, and neither offers the independent data analysis found in the breach-report posts: the threat points are attributed to a company threat download rather than analyzed in detail.
If the campaign needs to establish credibility with skeptical engineering and operations buyers before a commercial conversation, ask how the vendor-linked resilience narrative will be separated from the sales message.
Choose Bradley Richards when a campaign focuses more on managed security, vulnerability management, or identity risk than on industrial operations.
Read more
The posts draw on items from Aida Keehner's TechDecanter newsletter and turn them into practical questions for buyers: ransomware groups exploiting known Fortinet VPN vulnerabilities, why MFA alone is not enough, and how the PAYLOAD group used compromised domain credentials and Active Directory Group Policy to disable controls without dropping malware.
The perspective is customer success at a managed security provider, and the recurring claim is that the fastest recoveries go to organizations with disciplined patch prioritization and operational accountability, not the largest budgets.
A manufacturing technology company whose buyers are already discussing patches and privileged accounts will find the material familiar and close to their day-to-day.
The tradeoff is originality and scope.
Both posts comment on a third party's newsletter, credit that author, and point readers to the newsletter issue for the substance; neither presents the poster's own research or reporting.
The lens is service-provider customer success, with a recurring call to action to assess the reader's own environment.
That suits a managed-services conversation, but the posts offer no manufacturing or industrial framing, no AI-and-resilience through-line for a campaign built around those themes, and no broader view of where the threat landscape is heading.
Derek Boxdell's LinkedIn posts include one about a manufacturing council talk, two applying the Verizon Data Breach Investigations Report, and one set of enterprise field notes.
The posts have no publication dates.
They describe the themes and examples mentioned here, but do not establish a broader biography or signature work; the posts do not provide enough information to answer those parts of a name search.