E.C. Scherer-Malone writes about cybersecurity, with a focus on Microsoft Purview, data protection, and designing security programs around people and organizational context.
958 followersData governanceBased on 11 posts · latest Aug 2026
Most useful for practical Microsoft Purview thought leadership about labels, DLP, insider risk, and people-centered security design.
Best for
A cybersecurity software company's LinkedIn series for practitioners planning or improving Microsoft Purview data governance.
Not for
Consumer fraud-prevention campaigns promising product results with verified case studies and broad reach.
Key takeaways
Sensitivity labels should answer how sensitive information is, not what type it is.
Data loss prevention failures are usually maturity failures.
Insider risk needs an agreed response before it needs detection.
Check first: Confirm scope, deliverables, commercial terms, audience composition, and samples of longer technical work.
Main ideas
Microsoft Purview is a protection platform, not a discovery tool · Sensitivity labels should answer how sensitive information is, not what type it is · Data loss prevention failures are usually maturity failures
Scherer-Malone writes about cybersecurity, especially Microsoft Purview, data protection, and how organizational context affects whether security programs work.
The posts make a consistent case that security tools cannot compensate for unclear policies, immature processes, or controls that ignore the people using them.
A post about a cancelled grocery order extends that argument beyond Purview: verification should help a person move forward, not make them repeat the process.
Scherer-Malone turns abstract security design into recognizable failure patterns and practical questions.
For Purview, the examples include label sprawl, DLP policies built on assumptions about identity and collaboration, and insider-risk programs that begin with detection before deciding how to respond.
The advice connects configuration to readiness, governance, and employee trust rather than treating a product setting as the whole solution.
The fraud-prevention post shows that this people-first perspective extends beyond Microsoft tools, though it is a personal account, not a documented case study.
Readers interested in making data-protection programs workable—and weighing their effects on the people subject to them—can follow this line of analysis.
Ask to see the longer field notes referenced in the posts to assess how far the examples develop into step-by-step guidance.
Scherer-Malone’s recurring argument is that data security programs fail for organizational reasons long before tooling becomes the problem.
The short, first-person field notes follow a consistent shape: name a recognizable failure, explain why the usual framing is wrong, and offer a principle practitioners can test.
The posts prioritize people and context over policy counts and feature configuration: Purview as a protection platform rather than a discovery tool, labels based on sensitivity rather than data type, response agreed before detection, and controls that adapt to how people behave instead of restarting them.
Microsoft Purview is a protection platform, not a discovery tool
Scherer-Malone argues that organizations often adopt Purview to find data, then wonder why the program stalls.
Read more
Dozens of DLP policies, label sprawl and everything quietly running in simulation mode signal a program built on the wrong premise. A people-first approach, not more configuration, changes the outcome.
Opening a Purview portal to find DLP policies and labels with nothing enforced is enough, in about five minutes, to see that a program started in the wrong place.
Sensitivity labels should answer how sensitive information is, not what type it is
A seemingly reasonable request for labels covering PII, PHI, client data, legal and HR can push a labeling strategy from classification toward taxonomy.
Read more
Type-based labels make users guess, put policies in conflict, multiply with every new business scenario and eventually stop scaling. The test: a label should answer one question—how sensitive is this information?
Adding a label for every data type—and then another whenever a business scenario changes—is a failure pattern. Asking how sensitive the content is keeps the model bounded.
Data loss prevention failures are usually maturity failures
Scherer-Malone writes that DLP policies can fail before a single user encounters them, usually for reasons beyond the policy text.
Read more
Designs typically assume clean identity, clear classification and defined collaboration, but reality rarely matches. The right starting point depends on the organization’s maturity, not a universal rollout order.
A correctly written policy that users never see because its assumptions—clean identity, clear classification and defined collaboration—do not hold.
Insider risk needs an agreed response before it needs detection
The argument is that most insider risk programs fail before they start because teams jump to detection without deciding how they will respond to what they find.
Read more
Scherer-Malone warns against turning insider risk management into surveillance, paranoia, or a "SIEM-with-feelings," and states that context matters, one-off situations still matter, and policy matters more than configuration. Discomfort with a program is treated as a signal to examine rather than suppress.
Teams build detection use cases, then discover nobody has agreed who responds to a flagged employee or on what grounds—a gap that can make a risk program look like surveillance to employees.
Security controls should be designed around people, not around systems
The same priority applies beyond Microsoft tooling: judge verification and fraud controls by whether they protect a person or only a system.
Read more
Scherer-Malone argues for adaptive, risk-based controls where successful verification lets a legitimate user proceed instead of sending them back through the process. The consumer fraud example is one person’s account, not vendor data or a documented enterprise case; it illustrates a design principle, not a Purview result.
A grocery order is cancelled twice after successful verification, then explained by a recent move using the same account, device and behavior. The control mistakes an ordinary change for fraud and restarts the customer instead of letting them through.
One method runs through all of it: diagnose the failure, then state the principle
Across the posts, the recurring structure is clear: open with a practitioner-observed failure, explain why the usual framing is wrong, then close with a governance or design principle readers can apply.
Read more
The subjects change—label design, DLP readiness, insider risk, fraud—but the people-first conclusion remains, making the position identifiable rather than a collection of unrelated topics.
A portal walkthrough that starts in the wrong place, a label request that becomes a taxonomy, DLP assumptions that ignore maturity, insider risk without a response plan and a cancelled verified order all trace the same arc from failure to principle.
Start here for the question every newcomer has: what does Scherer-Malone actually do, and what assumption do they bring to a data security programme?
Read more
This post answers that in the first two lines and names the viewpoint the other posts build on.
Scherer-Malone says that opening a Microsoft Purview portal to dozens of DLP policies, label sprawl and everything quietly running in simulation mode is enough to tell, in about five minutes, that the programme started in the wrong place.
The problem, they argue, is usually not the technology: organisations treat Purview as a data discovery tool when it is a data protection platform.
The post points to a longer field note on the patterns they see most often and how a "people-first" approach changes the outcome.
For brands planning a campaign
A strong opening for a Purview thought-leadership series: it offers a diagnostic, not a feature walkthrough. A practical follow-up would have Scherer-Malone apply the five-minute diagnostic to a reader's scenario or a vendor's environment, giving the series a repeatable structure rather than a general opinion.
This is the clearest worked example of how Scherer-Malone reasons through a single Purview design decision.
Read more
It explains the difference between a taxonomy and a classification scheme in a way a non-specialist can follow.
The post starts with a request Scherer-Malone says is common: "Can we add labels for PII, PHI, Client data, Legal, and HR?"
They argue that building labels around data types rather than sensitivity pushes a labeling strategy away from classification and towards taxonomy.
Four consequences follow: users struggle to choose the right label, policies begin conflicting, a new label gets created for every new business scenario, and the model stops scaling.
The test is a single question a label should answer: how sensitive is this information?
Ask for the fuller field note on the mistake and how to avoid it.
For brands planning a campaign
A vendor could build a short technical piece, checklist or webinar segment on sensitivity label design from this example: it names the failure mode and gives four consequences a ready-made structure. It also works as a comment-bait post; practitioners tend to have strong opinions about label taxonomies.
It answers a question newcomers often miss: why a correctly written policy can still fail.
Read more
Read it after the labeling post to see how Scherer-Malone connects configuration to organisational readiness.
Scherer-Malone describes DLP policies failing before any user encounters them, not because the policy was wrong but because the environment could not support it. Most DLP designs assume identity is clean, classification is clear and collaboration is defined; the post says reality usually looks different, and the right starting point depends on organisational maturity.
For brands planning a campaign
This supports content aimed at buyers who already own or are deploying Purview and are stuck, rather than prospects comparing tools. A campaign could ask for a maturity-stage breakdown or self-assessment, since the post stops short of prescribing one starting point for everyone.
It explains what can go wrong when an insider risk programme is treated only as a detection problem.
Read more
It also states the values behind Scherer-Malone's technical advice more clearly than any other post.
The post argues that most insider risk programs fail before they start, not because the tooling is bad but because organizations jump straight to detection without agreeing on how they will respond.
Scherer-Malone writes that insider risk management should be approached without becoming surveillance, paranoia, or, in their phrase, a "SIEM-with-feelings," adding that context matters, one-off events still matter, and policy matters more than configuration.
The post closes by saying discomfort with an insider risk program is probably a signal worth examining.
For brands planning a campaign
A strong fit for content addressing privacy and employee-trust objections alongside technology, often where insider risk deals stall. It also offers a natural debate or panel angle: the detection-versus-response framing invites disagreement from security operations audiences.
It applies the people-first argument outside Microsoft tooling, using the author's own experience rather than a product scenario.
Read more
Read it to see how the same reasoning carries into fraud and adaptive controls.
Scherer-Malone describes a grocery order placed through Walmart that was cancelled twice after successful verification.
The "fraud" was later explained by a recent move, despite the same account, device and behaviour.
The post uses the episode to discuss fraud models, adaptive controls and verification that unlocks progress rather than restarting the process.
Ask for a documented case study or vendor data before using the account as evidence of broader results.
For brands planning a campaign
Best used for a human-centred framing of risk controls rather than a product claim. A brand could pair the anecdote with its own data on verification drop-off, or ask Scherer-Malone to analyse a customer journey step by step, turning one personal episode into a repeatable teardown format.
Short field notes that diagnose a failure before prescribing a principle5
Purview as a data protection platform, not a discovery tool1
Sensitivity labels should answer how sensitive information is, not what type it is1
DLP begins with organizational maturity1
Insider risk needs response policy before detection1
Fraud prevention and adaptive, human-centered controls1
Purview as a data protection platform, not a discovery tool
Scherer-Malone describes opening the Purview portal and seeing dozens of DLP policies, label sprawl, and everything quietly running in simulation mode.
Read more
They argue that most organizations approach Purview like a data discovery tool when it is really a data protection platform, and that a people-first approach changes the outcome. The post is a short field note on recurring implementation patterns.
Diagnostic field note that names visible portal symptoms before reframing the problem.
For brands planning a campaign
A cybersecurity software company can use this as the opening argument for a technical thought leadership series on Purview strategy: distinguish discovery from protection, then show assessment questions that move a buyer from tool installation to program design.
Sensitivity labels should answer how sensitive information is, not what type it is
A common request to add labels for PII, PHI, client data, legal, and HR can pull a labeling strategy away from data classification and toward data taxonomy.
Read more
Scherer-Malone says labels built around data types lead to users struggling to choose the right label, conflicting policies, new labels for every business scenario, and a model that stops scaling. The proposed test is whether a label answers how sensitive the information is.
For brands planning a campaign
Supports a practical post or webinar on sensitivity-label design for Purview governance. The content can contrast type-based labels with sensitivity-based labels and offer a governance exercise for mapping label choices to business risk.
Scherer-Malone writes that DLP policies can fail before a single user sees them, not because the policy is wrong but because the environment cannot support it.
Read more
Typical design assumptions include clean identity, clear classification, and defined collaboration; reality usually looks different. The field note points to organizational maturity and where to start a DLP journey.
For brands planning a campaign
Useful for thought leadership aimed at buyers planning DLP. A vendor can offer a maturity assessment, a phased rollout model, or prerequisite checks to prevent early DLP failure.
Insider risk needs response policy before detection
Most insider risk programs fail before they start because organizations jump straight to detection without agreeing on response, according to Scherer-Malone.
Read more
They argue against turning insider risk management into surveillance, paranoia, or a SIEM-with-feelings.
Context and one-off situations still matter, and policy matters more than configuration.
Discomfort with an insider risk program is a signal worth examining.
For brands planning a campaign
Strong fit for technical content on insider risk governance and cross-functional response planning. A brand can frame an IRM series around policy, response ownership, and ethical boundaries rather than detection features alone.
Fraud prevention and adaptive, human-centered controls
In a consumer example, a Walmart grocery order is cancelled twice after successful verification; the fraud turns out to be a recent move, with the same account, same device, and same behavior.
Read more
Scherer-Malone uses this to argue that fraud prevention is supposed to protect people, not just a system, and that verification should unlock progress rather than restart the process. The post connects the story to fraud models, adaptive controls, and risk-based security design.
This is a consumer transaction example, not an enterprise Purview deployment. Use it to illustrate a design principle, not as a Purview case study.
For brands planning a campaign
Broadens a security-design narrative toward human-centered controls and adaptive verification. For a Microsoft Purview data governance brief, this is adjacent rather than core, but it can open a series on designing controls around real user behavior.
Short field notes that diagnose a failure before prescribing a principle
Across the posts, the recurring format is a short first-person field note: name a recognizable failure, explain why the usual framing is wrong, and offer a principle.
Read more
Examples include seeing a program start in the wrong place, requests to build labels around data types, DLP assumptions that ignore organizational maturity, insider risk programs that skip response planning, and a fraud system that cancels a verified order.
Short field note with a failure-to-principle arc.
For brands planning a campaign
A brand can adapt this format for technical thought leadership: open with a practitioner-observed failure, add a diagnostic question, and close with a governance or design principle. It is more useful than a generic explainer because it starts from a decision point.
Scherer-Malone writes short, first-person field notes about Microsoft data security.
Most follow the same shape: describe a failure a practitioner would recognize — a Purview portal full of DLP policies and labels where nothing is enforced, labels built around data types, an insider risk program that jumped to detection before anyone agreed on response — then explain why the usual framing is wrong and leave one principle to test.
The recurring position is that Purview is a protection platform rather than a discovery tool, that a label should answer how sensitive information is, and that policy, agreed responses, and people-first design matter more than configuration counts.
To explore the work, start with the Purview and sensitivity-label notes and read each one for the diagnostic question it poses.
For more Microsoft 365 hardening detail or a wider digital-identity and data-governance conversation, see the similar creators below.
Microsoft PurviewData securitySensitivity labelsData loss preventionInsider risk managementData governanceFraud preventionHuman-centered securityShort field notesSecurity practitioners
Jeff Willinger
Writes from the same Microsoft 365 ecosystem about getting Copilot and governance right in practice.
Read more
The AI Center of Excellence case study walks through Purview sensitivity label refinement, a SharePoint and OneDrive data security review, and a Copilot readiness assessment before scaling — the same protection-before-rollout sequence Scherer-Malone argues for.
Willinger frames the work around adoption, business value, and partnerships — Centers of Excellence, co-sell opportunities, role-based enablement, and measured ROI — in long case studies and career narratives. Scherer-Malone writes short conceptual field notes about program design and people-first principles.
Also a Microsoft 365 security practitioner writing for the same audience, covering overlapping ground directly: Purview data readiness before turning on Copilot, field-tested DLP gotchas, sensitivity configuration, and hardening Microsoft 365 in GCC High.
Read more
Suthar writes long-form reference and compliance material — hundreds of pages of control mappings to CMMC, HIPAA, CJIS, and SOC 2, assessment scripts, and auditor-facing evidence. Scherer-Malone stays with short, principle-first field notes and rarely cites control frameworks.
Shares the underlying concern that security and identity systems get designed around institutions rather than the people they affect, and that governance, consent, and data minimization should shape what gets built — the same people-first thread Scherer-Malone applies to DLP, insider risk, and fraud controls.
Read more
Dahan works at the policy, investment, and international level — digital identity, data sovereignty, blockchain, and biometrics, discussed through interviews and conference reflections. Scherer-Malone stays inside operational Microsoft data security and writes for practitioners configuring tools.
For a Microsoft Purview thought-leadership series, E.C.
Read more
Scherer-Malone is on LinkedIn, where the profile showed 958 followers when recorded on 9 October 2026.
The five posts target people who run or evaluate Microsoft security controls, including Purview administrators, data security and DLP leads, and insider risk or compliance staff.
That makes the content a fit for practitioner audiences rather than general business or executive readership.
Before committing budget, ask for recent results on comparable topics and formats—a Purview sensitivity-labeling or DLP post, a field-note style critique such as the fraud-prevention piece, and any audience survey they hold—so you can compare reach and engagement with your campaign targets and another Purview-focused creator on your shortlist.
Scherer-Malone offers sponsorships, sponsored-post formats, or other commercial partnership arrangements.
Each post is a short field note that points readers toward longer writing elsewhere; none names a paying partner, discloses a rate, or describes a package a brand could buy.
Scherer-Malone does not appear in the posts here to publish media kits, rate cards, or audience demographics for advertisers.
Because the posts here do not describe an offer, this section cannot tell a buyer what formats exist or what they cost.
That leaves a buyer without information about sponsorships, but does not mean Scherer-Malone never accepts them.
A buyer who wants to explore a paid arrangement should treat the established working topics — Microsoft Purview labeling and DLP design, insider risk, and human-centered security — as the subject matter any collaboration would likely sit inside, and confirm terms directly.
Strong subject fit if the campaign focuses on practical analysis rather than product endorsements or unverified performance claims.
Read more
Brief
A cybersecurity software company wants a LinkedIn thought-leadership series for practitioners planning or improving Microsoft Purview data governance.
Why
The posts address Purview labeling and DLP directly. Scherer-Malone argues that labels should reflect sensitivity rather than data type, and that DLP can fail when identity, classification, or collaboration practices are not ready. They also connect security design to people and governance, including the view that insider-risk response policy should come before detection. These ideas offer useful starting points for a practitioner series. The posts are short field notes, so ask for samples of longer technical work before commissioning. The only audience figure published in the posts here is 958 LinkedIn followers. Ask for audience-composition data, as well as confirmation of scope, deliverables, and commercial terms.
When to choose a specialist
Poor fit for this brief.
Read more
Brief
A consumer fraud-prevention app wants a campaign promising that its product will prevent account fraud and reduce checkout cancellations, supported by verified case studies and broad consumer reach.
Why
One post describes a personal Walmart grocery-order experience: an order was cancelled twice after verification, and a recent move was identified as the reason. Scherer-Malone uses it to discuss adaptive controls and designing verification to let people proceed. That offers a relevant human-centered security perspective, but it is not a verified case study, product test, or evidence of consumer reach. The other posts focus mainly on enterprise security and Microsoft Purview. The LinkedIn following published in the posts here is 958; ask for audience-composition data and verified campaign results before considering a consumer-facing brief.
A worked campaign example
Campaign angle
A short LinkedIn series: “Before you configure Purview, check whether the organization is ready.” Each post starts with a recognizable design failure, identifies the underlying readiness question, and ends with a practical next step.
Example post
Start with DLP readiness. The reviewed field note says DLP designs often assume clean identity, clear classification, and defined collaboration, while organizational reality may not meet those assumptions. Turn those three assumptions into a readiness check: What identity issues could undermine policy enforcement? Can employees and administrators apply the classification model consistently? Are collaboration rules clear enough to set useful controls? Close by asking readers to identify the prerequisite to address before expanding policy coverage. Keep the post focused on readiness; do not imply that the checklist or a vendor product guarantees successful deployment.
Why this works
This turns a specific argument in Scherer-Malone’s DLP post into a practical reader exercise without presenting the short post as a complete deployment guide. A sensible series could pair it with the distinction between classifying by sensitivity and creating labels for every data type, followed by a separate post on agreeing response policy before insider-risk detection. Confirm the commissioned format and terms directly; no paid format is documented in the posts.
Choose Jeff if the series should center on enterprise Copilot governance and adoption rather than Purview design decisions.
Read more
A case-study post lays out a phased AI Center of Excellence, including data-security review, Purview label refinement, user enablement, and usage measures. That gives a campaign a broader implementation-and-business-value storyline.
The post is a single case study, and its reported outcomes are not independently verified. It focuses less directly on Purview labeling and DLP readiness than Scherer-Malone’s posts.
Choose Arvind if the campaign needs detailed Microsoft 365 security guidance for GCC High and defense contractors.
Read more
A post describes a substantial, regularly updated guide, with concrete coverage of CMMC controls, Purview data readiness, DLP issues, and evidence for auditors. That is a closer fit for a campaign built around technical configuration and compliance preparation.
The posts focus on GCC High and CMMC-related work, making them less suited to a general Purview governance series for organizations outside that environment. They promote a guide rather than demonstrating a series of short, people-centered Purview field notes.
Choose Mariana if the campaign’s main question is how digital identity, AI, and security choices affect privacy, consent, and data governance.
Read more
Their posts connect surveillance and identity infrastructure to questions of accountability and data minimization, broadening a series from Purview implementation to governance implications.
The examples address digital identity and surveillance at a policy and infrastructure level, not practical Microsoft Purview deployment. They offer less direct material for posts about labels, DLP readiness, or insider-risk response.
This profile draws on five complete public LinkedIn posts by E.C.
Scherer-Malone, read in full rather than judged from titles or previews.
The posts cover Purview labeling strategy, sensitivity labels, data loss prevention readiness, insider risk management, and a personal fraud-prevention experience used to illustrate adaptive control design.
Publication dates were not consistently recorded in the posts here, so the page does not claim a timeline or describe how the thinking has changed.
Several posts refer to longer field notes that are not among the posts here, and no books, shows, businesses, or earlier career material appear here — those remain open research gaps rather than settled facts.
The similar-creator comparisons elsewhere on the page rest on two LinkedIn posts each from Jeff Willinger, Arvind Suthar, and Mariana Dahan, so they reflect a sample of those people's writing rather than a full review of their output.