# E.C. Scherer-Malone

E.C. Scherer-Malone writes about cybersecurity, with a focus on Microsoft Purview, data protection, and designing security programs around people and organizational context.

- Profile: https://b2binfluencer.marketing/creators/e-c-scherer-malone/
- LinkedIn: https://www.linkedin.com/in/ecscherer
- LinkedIn followers: 958
- Topics: data-governance
- Based on 11 dated posts, latest 2026-08-27

## Summary

Most useful for practical Microsoft Purview thought leadership about labels, DLP, insider risk, and people-centered security design.

- Best for: A cybersecurity software company's LinkedIn series for practitioners planning or improving Microsoft Purview data governance.
- Not for: Consumer fraud-prevention campaigns promising product results with verified case studies and broad reach.
- Check first: Confirm scope, deliverables, commercial terms, audience composition, and samples of longer technical work.

### Takeaways

- Sensitivity labels should answer how sensitive information is, not what type it is.
- Data loss prevention failures are usually maturity failures.
- Insider risk needs an agreed response before it needs detection.

## Main ideas

- **Microsoft Purview is a protection platform, not a discovery tool**: Scherer-Malone argues that organizations often adopt Purview to find data, then wonder why the program stalls. Dozens of DLP policies, label sprawl and everything quietly running in simulation mode signal a program built on the wrong premise. A people-first approach, not more configuration, changes the outcome.
- **Sensitivity labels should answer how sensitive information is, not what type it is**: A seemingly reasonable request for labels covering PII, PHI, client data, legal and HR can push a labeling strategy from classification toward taxonomy. Type-based labels make users guess, put policies in conflict, multiply with every new business scenario and eventually stop scaling. The test: a label should answer one question—how sensitive is this information?
- **Data loss prevention failures are usually maturity failures**: Scherer-Malone writes that DLP policies can fail before a single user encounters them, usually for reasons beyond the policy text. Designs typically assume clean identity, clear classification and defined collaboration, but reality rarely matches. The right starting point depends on the organization’s maturity, not a universal rollout order.
- **Insider risk needs an agreed response before it needs detection**: The argument is that most insider risk programs fail before they start because teams jump to detection without deciding how they will respond to what they find. Scherer-Malone warns against turning insider risk management into surveillance, paranoia, or a "SIEM-with-feelings," and states that context matters, one-off situations still matter, and policy matters more than configuration. Discomfort with a program is treated as a signal to examine rather than suppress.
- **Security controls should be designed around people, not around systems**: The same priority applies beyond Microsoft tooling: judge verification and fraud controls by whether they protect a person or only a system. Scherer-Malone argues for adaptive, risk-based controls where successful verification lets a legitimate user proceed instead of sending them back through the process. The consumer fraud example is one person’s account, not vendor data or a documented enterprise case; it illustrates a design principle, not a Purview result.
- **One method runs through all of it: diagnose the failure, then state the principle**: Across the posts, the recurring structure is clear: open with a practitioner-observed failure, explain why the usual framing is wrong, then close with a governance or design principle readers can apply. The subjects change—label design, DLP readiness, insider risk, fraud—but the people-first conclusion remains, making the position identifiable rather than a collection of unrelated topics.

## Work to read

- [Five minutes to spot a Purview programme that started in the wrong place](https://www.linkedin.com/posts/ecscherer_microsoftpurview-datasecurity-informationprotection-activity-7439375445583798275-xa5D)
- [Why sensitivity labels built around data types stop scaling](https://www.linkedin.com/posts/ecscherer_microsoftpurview-datasecurity-sensitivitylabels-activity-7440071318936379392-9MkL)
- [DLP policies that fail before a single user sees them](https://www.linkedin.com/posts/ecscherer_microsoftpurview-datalossprevention-datasecurity-activity-7442242581977194496-8-Ca)
- [Insider risk management without turning it into surveillance](https://www.linkedin.com/posts/ecscherer_insiderrisk-microsoftpurview-peoplefirstsecurity-activity-7417221767137759233-1ghX)
- [A cancelled grocery order, and fraud controls that protect a system instead of a person](https://www.linkedin.com/posts/ecscherer_fraudprevention-cybersecurity-securitydesign-activity-7408887822608429057-pgTy)

## Brand relationships

- **Microsoft** (mention)

## Partnerships

The five LinkedIn posts here do not say that E.C. Scherer-Malone offers sponsorships, sponsored-post formats, or other commercial partnership arrangements. Each post is a short field note that points readers toward longer writing elsewhere; none names a paying partner, discloses a rate, or describes a package a brand could buy. Scherer-Malone does not appear in the posts here to publish media kits, rate cards, or audience demographics for advertisers. Because the posts here do not describe an offer, this section cannot tell a buyer what formats exist or what they cost. That leaves a buyer without information about sponsorships, but does not mean Scherer-Malone never accepts them. A buyer who wants to explore a paid arrangement should treat the established working topics — Microsoft Purview labeling and DLP design, insider risk, and human-centered security — as the subject matter any collaboration would likely sit inside, and confirm terms directly.

## Alternatives

- Jeff Willinger: Choose Jeff if the series should center on enterprise Copilot governance and adoption rather than Purview design decisions. A case-study post lays out a phased AI Center of Excellence, including data-security review, Purview label refinement, user enablement, and usage measures. That gives a campaign a broader implementation-and-business-value storyline.
- Arvind Suthar: Choose Arvind if the campaign needs detailed Microsoft 365 security guidance for GCC High and defense contractors. A post describes a substantial, regularly updated guide, with concrete coverage of CMMC controls, Purview data readiness, DLP issues, and evidence for auditors. That is a closer fit for a campaign built around technical configuration and compliance preparation.
- Mariana Dahan: Choose Mariana if the campaign’s main question is how digital identity, AI, and security choices affect privacy, consent, and data governance. Their posts connect surveillance and identity infrastructure to questions of accountability and data minimization, broadening a series from Purview implementation to governance implications.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/