# Eddie Williams

Eddie Williams writes and speaks about cybersecurity, with a focus on AI security and governance, social engineering, and security culture.

- Profile: https://b2binfluencer.marketing/creators/eddie-williams/
- LinkedIn: https://www.linkedin.com/in/cyberexecutive
- Topics: artificial-intelligence, cybersecurity, ai-governance, ai-security, social-engineering
- Based on 17 dated posts, latest 2026-10-05

## Summary

Eddie Williams is most useful for speaking on AI security, governance, and social engineering training.

- Best for: A cybersecurity training company wanting a keynote on AI-driven social engineering and board governance.
- Not for: Paid social campaigns for AI email-security products with demos and signup targets.
- Check first: Confirm fees, audience data, and source for the deepfake wire-transfer story.

### Takeaways

- Found is not the same as exploited; false positives and validation need answers.
- Three-step training: route AI use cases through risk, question perfect language, tabletop exercises.
- Board answer uses NIST AI RMF and ISO 42001, repeatable by a CFO.

## Main ideas

- **Report AI vulnerabilities without turning them into ghost stories**: Their recurring complaint is that coverage strips nuance from serious AI security findings. A vulnerability being found is not the same as one being exploited. They say the details that matter — false positives, how much validation was required, duplicate findings and what was genuinely exploitable in practice — are usually left out. Their conclusion: AI speeds up discovery, so security leaders should sharpen validation, remediation and governance rather than raise the volume.
- **A board answer better than "we're working on it"**: They start with the question boards actually ask — can we trust the AI we are building? — and argue that securing AI is about frameworks, context and accountability rather than firewalls. Their closing test is communication: if controls cannot be explained in plain English to a CFO, they do not count.
- **Social engineering now blends AI, HUMINT and psychology**: They argue that the best social engineers need only a LinkedIn account and a chatbot, and that defenses focused solely on technical exploits miss human fallibility. Their conclusion is that the future of risk is blended — AI, human intelligence and psychology — and teams not training that way are not training at all.
- **Three controls for training people against AI deception**: They turn the blended-risk argument into an explicit checklist rather than a warning: route every AI use case through the risk team, teach people to question perfect language because it is not always human, and build low-tech threat simulations into tabletop exercises. Training audiences can apply the method immediately.
- **AI is a leadership, workforce and human conversation**: They place AI outside purely technical terrain — leadership, business, workforce and ultimately human — and connect that framing to security culture and talent development, describing cybersecurity as "people, process and tech." This priority sits alongside the governance and threat arguments rather than replacing them.

## Work to read

- [“Found is not the same as exploited”: how Williams talks about AI security](https://www.linkedin.com/posts/cyberexecutive_ai-cybersecurity-aisecurity-activity-7452395851450191872-at21)
- [A three-step training approach to AI-assisted social engineering](https://www.linkedin.com/posts/cyberexecutive_socialengineering-aisecurity-securityculture-activity-7344009963503050752-0CQZ)
- [What to tell a board that asks whether its AI can be trusted](https://www.linkedin.com/posts/cyberexecutive_ai-aigovernance-ciso-activity-7341473257172160513-_CJ9)
- [The deepfake CFO story and what it implies for tabletop exercises](https://www.linkedin.com/posts/cyberexecutive_deepfakes-socialengineering-humint-activity-7351620138565021696-0VIF)
- [Contributing author on The AI Opportunity](https://www.linkedin.com/posts/cyberexecutive_ai-artificialintelligence-leadership-activity-7475663898625470465-rc4B)
- [Sponsoring OzCon, a Kansas regional cybersecurity conference](https://www.linkedin.com/posts/cyberexecutive_tickets-ozcon-activity-7452056191192551426-iP0C)

## Brand relationships

- **OzCon** (sponsor)
- **The AI Opportunity** (disclosed_partnership)
- **CyberUp** (mention)

## Partnerships

Eddie Williams's partnership activity centers on speaking rather than product sponsorship. In their own posts, they offer to speak at executive offsites on people-driven, intelligence-based security-culture change and on weaving AI risk into board-level conversations, and invite people to start with a direct message. They also show a regional cybersecurity conference sponsorship and participation in multi-author book projects.

## Alternatives

- Patrick Keating: Choose Patrick Keating instead of Eddie Williams when the keynote should focus on board governance and how security leadership is positioned inside an organization. Keating’s posts synthesize governance research directly: CISO independence from IT, proximity to the CEO or top management team, and regular CISO-to-board engagement. They argue those structural choices improve detection of control gaps, incident response, and secure technology adoption. They also connect security to cash and operational risk in a Microsoft 365 setting through business email compromise, credential compromise, OAuth consent abuse, MFA fatigue, and session hijacking. For buyers seeking a speaker who can make the case for repositioning security leadership and address a board in business-risk terms, Keating’s material is a closer match on that axis.
- Brian Scott: Choose Brian Scott instead of Eddie Williams when the audience is nonprofit or association leadership and the session should start from sector survey evidence about cybersecurity culture and basic hygiene. Scott’s posts report findings from a cybersecurity webinar for associations: 36% of respondents were not doing monthly phishing testing or did not know, 50% graded their organization’s cybersecurity culture a C or below, and only 6% gave an A. They also summarize outside research on SMB underinvestment, underqualified general IT staff carrying security duties, and the share of SMBs without an incident response plan or cyber insurance. For buyers seeking a keynote that moves an association or nonprofit board from awareness to basic program investment, those numbers and that framing offer a sharper starting point than Williams’s AI-specific examples.
- Charles J. French: Choose Charles J. French instead of Eddie Williams when the buyer’s audience is a healthcare system, hospital, or clinical leadership group and the keynote should center on the voice channel as an AI-driven attack surface. French’s posts argue that vishing and AI-powered deepfake voice fraud are accelerating while most hospitals still have no technical defenses on the voice network. They tie nuisance and deceptive calls to patient experience, staff safety, and reimbursement, naming HCAHPS measures and CMS Value-Based Purchasing. They also describe Mutare’s Voice Traffic Filter as a voice firewall that blocks unwanted calls before they reach staff. For buyers seeking a healthcare-specific session on AI voice impersonation with a concrete technical control and a conference presence to point to, French’s material is more targeted than Williams’s cross-sector AI social-engineering talk.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/