Eddie Williams

A vulnerability being found is not the same as one being exploited.

• They say the details that matter — false positives, how much validation was required, duplicate findings and what was genuinely exploitable in practice — are usually left out.
• Their conclusion: AI speeds up discovery, so security leaders should sharpen validation, remediation and governance rather than raise the volume.

Writing about Project Glasswing, Williams calls it a gamechanger but says some reporting turned it into "a damn ghost story," and that the discovery of a 27-year-old vulnerability should get attention without being inflated beyond what was publicly reported.

In the same post, they say they are writing and speaking more about AI and AI cybersecurity, positioning AI as a main subject rather than a side interest.

Read original

Their closing test is communication: if controls cannot be explained in plain English to a CFO, they do not count.

The governance ladder they outline: the NIST AI Risk Management Framework for governance, ISO 42001 to scale trust across teams, and cyber plus compliance plus ethics for real coverage.

Read original · Original 2

Their conclusion is that the future of risk is blended — AI, human intelligence and psychology — and teams not training that way are not training at all.

They describe three cases seen up close: a fake job recruiter using AI to write convincing DMs, a deepfake voicemail impersonating a CFO, and a chatbot that walked someone through bypassing MFA "for testing."

• Separately, they describe a Fortune 500 CFO authorizing a wire transfer after what looked like a routine video call, with an AI-generated CEO on screen.
• The company is not named and no report is cited; buyers should ask for sourcing before treating the anecdote as documented.

Read original · Original 2

Training audiences can apply the method immediately.

The three steps appear directly beneath the three observed scenarios in the social-engineering post, giving readers a sequence — review, question, simulate — to work through with their own teams.

Read original

This priority sits alongside the governance and threat arguments rather than replacing them.

They are a contributing author in The AI Opportunity: Unlocking Potential Within Civilization's Next Big Disruption, led by Erik Seversen.

• The posts describe it as a collaboration of 33 AI experts from multiple countries and disciplines, spanning research, cybersecurity, engineering, consulting and entrepreneurship; they also give the book's ASIN and purchase link.
• In another post, they share a quoted news passage reporting that CyberUp, a local nonprofit that bridges skills and training gaps for people entering IT and cybersecurity jobs, has moved into the former St.
• Louis Post-Dispatch building.
• Two posts announce the same book with overlapping framing.

Read original · Original 2 · Original 3 · Original 4

Start here for the argument and tone in one piece.

Williams argues against alarm-driven coverage of AI security news.

• Writing about a tool called Project Glasswing, they call it a real development but say some reporting “strips out the nuance” and turns a serious finding into a ghost story.
• They distinguish between a vulnerability being found and being exploited, and list details the public has not been given: false positives, how much validation was required, duplicate findings, and what was genuinely exploitable in practice.
• Their conclusion: AI is speeding up discovery, so security leaders should sharpen validation, remediation, and governance rather than turn up the volume.

For brands planning a campaign

For a security-literate audience, this is a differentiating keynote stance: a speaker who challenges the room’s own headlines rather than adding to them. It sets expectations: the delivery leans on governance and validation practice, not scare anecdotes.

Start here to see what the talk or workshop would contain.

Williams opens by claiming the best social engineers now need only a LinkedIn account and a chatbot, then gives three examples they say they have seen: a fake recruiter using AI to write convincing direct messages, a deepfake voicemail impersonating a CFO, and a chatbot that talked someone through bypassing multi-factor authentication “for testing.”

• Their three-step training approach: route every AI use case through the risk team, teach people to question suspiciously perfect language, and build low-tech threat simulations into tabletop exercises.
• The framing is that modern risk blends AI, human intelligence, and psychology.

For brands planning a campaign

This is conference-ready material with a named structure an audience can write down: three examples, three countermeasures. A keynote brief can ask for this section to expand on the list with exercised scenarios.

Start here for board-level governance content.

The post is framed as a boardroom question — can we trust the AI we are building — and warns against answering "we're working on it."

• Williams argues that securing AI is not about firewalls but about frameworks, context, and accountability, and names two standards used in that conversation: the NIST AI Risk Management Framework for governance and ISO 42001 for scaling trust.
• The stated combination is cyber, compliance, and ethics.
• The closing test is communication: if the controls cannot be explained in plain English to a CFO, they do not count.

For brands planning a campaign

Supports a governance keynote for mixed executive rooms and gives the event a specific standards vocabulary to advertise. It also points to the speaker’s strength in translating between security teams and finance leadership.

Start here for the vivid, incident-shaped version of the argument.

Williams describes a Fortune 500 CFO authorizing a wire transfer during what appeared to be a routine video call, with an AI-generated CEO on the call.

• The three takeaways: deepfakes are operational threats, not hypotheticals; controls must account for human fallibility as well as technical exploits; and social engineering defense must evolve as fast as the offense.
• Williams recommends adding human-intelligence-informed AI scenarios to tabletop exercises.

For brands planning a campaign

A strong opening story for a social engineering keynote.

• Ask Williams for the underlying source before repeating it as fact on stage or in promotion.
• The recommended use of realistic AI scenarios in tabletop exercises is a sellable follow-on to the speech.

Start here for the citable book credit.

Williams announces that they are a contributing author in The AI Opportunity: Unlocking Potential Within Civilization’s Next Big Disruption, a collection led by Erik Seversen with 33 AI experts across multiple countries and disciplines, including professors, researchers, cybersecurity leaders, engineers, consultants, executives, and entrepreneurs.

• The post gives the ASIN and says the book is available in print and ebook.
• They describe their contribution as a leadership, business, workforce, and human conversation about AI rather than a purely technical one.

For brands planning a campaign

Provides a verifiable publication for speaker bios and for a book-signing or panel angle at an event. The publisher listing is the place to confirm authorship details before quoting the book's contents.

Start here for evidence of conference-side activity and audience geography.

Williams promotes OzCon, a Kansas cybersecurity event on May 18, 2026, at the Overland Park Marriott Conference Center, and says they are proud to sponsor it, offering a discount code for registration.

• The pitch line is that the event “pulls back the curtain” on how attacks really happen and what defenders can do.
• The post states a sponsorship; it does not claim a speaking slot.

For brands planning a campaign

Shows an existing regional event footprint in the Kansas City area and experience with co-marketing and discount codes — useful for a campaign involving a Midwest venue or sponsor-funded keynote slot. Treat sponsorship and speaking as separate asks.

Writing about Project Glasswing, they say the discovery of a 27-year-old vulnerability deserves attention, but that "found" is not the same as "exploited."

• They point to questions left out of public reporting: false positives, how much validation was required, how many findings were duplicates, and what was genuinely exploitable.
• Their conclusion: AI is changing the speed and scale of discovery, pushing security leaders toward sharper validation, remediation and governance rather than louder panic.

For brands planning a campaign

A strong opening frame for a keynote that has to rise above AI hype. A brand selling AI security or vulnerability management can use the "found is not exploited" distinction as the spine of a session, but should expect them to challenge alarmist messaging and provide real validation and remediation detail.

Examples: Source 1

Securing AI, in their telling, is about frameworks, context and accountability rather than firewalls.

• They name NIST AI RMF for governance and ISO 42001 to scale trust across teams, and pair cyber, compliance and ethics as the combination that gives real coverage.
• The test: can the explanation work in plain English for a CFO?
• If not, the controls do not matter.

A named-framework ladder — NIST AI RMF for governance, ISO 42001 for scaling trust, cyber plus compliance plus ethics for coverage — followed by a plain-English test for non-technical executives.

For brands planning a campaign

The closest fit to a board-level governance keynote. A governance platform, compliance vendor or advisory firm can anchor a session on the NIST AI RMF and ISO 42001 mapping they already use, and brief around helping CISOs answer the board's question rather than around product features.

Examples: Source 1 · Source 2

They draw three takeaways: deepfakes are operational threats rather than hypotheticals; controls must account for human fallibility, not only technical exploits; and social-engineering defense has to evolve as fast as the offense.

• A companion post lists what they say they have seen up close: a fake job recruiter using AI to write convincing DMs, a deepfake voicemail impersonating a CFO, and a chatbot that walked someone through bypassing MFA "for testing."
• Their recurring recommendation is to include HUMINT-informed AI scenarios in tabletop exercises.

For brands planning a campaign

Ready-made incident narratives for an AI social-engineering keynote. A training or simulation vendor can build a session around these scenarios and offer to run the tabletop exercise they recommend, turning the talk into a follow-on engagement rather than a one-off appearance.

Examples: Source 1 · Source 2

Their closing thesis is that the future of risk is blended — AI, HUMINT and psychology — and that teams not training that way are not training at all.

A three-item checklist for team training (risk-team review of AI use cases, questioning flawless prose, low-tech simulations in tabletops) built on a blended-risk thesis combining AI, human intelligence and psychology.

For brands planning a campaign

Gives a brand a teachable framework to attach to, not just an awareness message. Simulation, phishing-training and security-culture vendors can co-build the exercise that closes the keynote and brief them with their own scenario library to keep the examples current.

Examples: Source 1

A separate post quotes coverage of CyberUp, a nonprofit that bridges skills and training gaps for people entering IT and cybersecurity jobs and has moved into offices in the former St. Louis Post-Dispatch building.

The CyberUp item is a quoted news passage they shared about the building's tenants, linking them to the organization.

For brands planning a campaign

Fits executive offsites and security-culture programming, and offers a second angle for brands whose audience is talent, upskilling or recruitment rather than tooling. A recruiting or training brand can pair a keynote with a workforce session without changing the core message.

Examples: Source 1 · Source 2

They frame the subject as a leadership, business, workforce and ultimately human conversation rather than a purely technical one. The post supplies the book's ASIN and purchase link.

Two posts announce the same book and repeat much of the same framing; the authorship and subject come from their own statements and the book's description.

For brands planning a campaign

Useful for thought-leadership sponsorships, panel or book-signing components, and co-marketing tied to a published book. A brand can use the authorship claim as a credibility marker, while limiting claims to authorship and subject.

Examples: Source 1 · Source 2

The post promotes the event and calls on readers to register.

The sponsorship appears in their own post. Ask for the terms and their role before treating it as a paid speaking engagement.

For brands planning a campaign

Shows willingness to appear at and promote regional cybersecurity events. Brands running regional conferences or community programs have a plausible activation route through a promoted discount code and event tie-in, separate from a keynote booking.

Examples: Source 1

They typically open with a provocative claim or a question someone else asked, move quickly into a short bulleted or numbered list of practices or takeaways, and close with an invitation or a question back to the audience.

• Examples include the board question that opens the governance post, the numbered training checklist, and the closing "real progress or just louder headlines?"
• Posts carry heavy hashtag sets and occasional links.

For brands planning a campaign

Set expectations for short-form assets: a quote card, punchy caption or single strong claim travels better than a long explainer. Negotiate long-form content explicitly; don’t assume it from the posting style.

Examples: Source 1 · Source 2 · Source 3 · Source 4

The post speaks as "we" but does not name the sponsoring organization; ask who the sponsor is. The event is listed for May 18, 2026 at the Overland Park Marriott Conference Center.

View example

Two posts announce the contribution and the global print and e-book launch, with a link to the book listing.

View example

The post does not identify their relationship with CyberUp; ask whether they have one.

View example

Both turn that into structural advice rather than tool talk.

• Keating argues that a CISO's impact depends on independence from IT, proximity to the CEO and board visibility, and that email is now a financial system rather than an IT utility.
• Williams makes the parallel case that AI governance only counts if it can be explained in plain English to a CFO.

Keating's examples come from SMB Microsoft 365 exposure, business email compromise and research on CISO reporting lines, and his posts close with an advisory offer at Keysec Advisors. Williams focuses on AI-specific threats such as deepfake impersonation and AI-assisted social engineering, and offers speaking and training rather than an assessment engagement.

Read original · Original 2

Both use survey-style evidence—Scott from webinar polling of nonprofit professionals and Williams from observed incidents—to argue that awareness work is a control, not a formality.

Scott's audience is nonprofits and associations, reached through a vCISO relationship with content framed around sector underinvestment and association governance. Williams focuses on AI risk, social engineering and team training, without the nonprofit-specific lens or fractional-CISO offer.

Read original · Original 2

Both argue awareness training alone is not enough and that a technical control has to sit on the channel being attacked, as it does on email and endpoints.

French's material is healthcare-specific, argued through patient safety, nursing workflow, HCAHPS and CMS reimbursement.

• It reads as vendor advocacy for a named voice-filter product around a trade show appearance.
• Williams ranges across AI governance, vulnerability reporting and general security culture for a broader executive audience.

Read original · Original 2

Keating’s posts synthesize governance research directly: CISO independence from IT, proximity to the CEO or top management team, and regular CISO-to-board engagement.

• They argue those structural choices improve detection of control gaps, incident response, and secure technology adoption.
• They also connect security to cash and operational risk in a Microsoft 365 setting through business email compromise, credential compromise, OAuth consent abuse, MFA fatigue, and session hijacking.
• For buyers seeking a speaker who can make the case for repositioning security leadership and address a board in business-risk terms, Keating’s material is a closer match on that axis.

The tradeoff is weaker information on AI-specific social engineering training.

• Eddie Williams’s posts do not show the impersonation examples, HUMINT-informed scenario design, or three-step AI risk training method that anchor their fit.
• Keating’s posts focus on governance and promote Keysec Advisors’ fractional CISO and board-reporting services.
• A buyer seeking a training-led keynote with tabletop exercises should ask for details on the AI-attack content and workshop capability; no talk recording, slide deck, or transcript is published to assess delivery style.

Examples: Source 1 · Source 2

Scott’s posts report findings from a cybersecurity webinar for associations: 36% of respondents were not doing monthly phishing testing or did not know, 50% graded their organization’s cybersecurity culture a C or below, and only 6% gave an A.

• They also summarize outside research on SMB underinvestment, underqualified general IT staff carrying security duties, and the share of SMBs without an incident response plan or cyber insurance.
• For buyers seeking a keynote that moves an association or nonprofit board from awareness to basic program investment, those numbers and that framing offer a sharper starting point than Williams’s AI-specific examples.

The tradeoff is less information on AI-driven social engineering and board-level AI governance frameworks.

• Eddie Williams’s posts do not contain deepfake impersonation examples, HUMINT-informed tabletop design, or frameworks such as the NIST AI RMF and ISO 42001.
• The argument is stronger on baseline phishing testing, culture grading, and SMB or nonprofit risk communication.
• A buyer seeking a keynote focused on AI attack methods and governance translation should ask how much of the session covers those topics.

Examples: Source 1 · Source 2

French instead of Eddie Williams when the buyer’s audience is a healthcare system, hospital, or clinical leadership group and the keynote should center on the voice channel as an AI-driven attack surface.

• French’s posts argue that vishing and AI-powered deepfake voice fraud are accelerating while most hospitals still have no technical defenses on the voice network.
• They tie nuisance and deceptive calls to patient experience, staff safety, and reimbursement, naming HCAHPS measures and CMS Value-Based Purchasing.
• They also describe Mutare’s Voice Traffic Filter as a voice firewall that blocks unwanted calls before they reach staff.
• For buyers seeking a healthcare-specific session on AI voice impersonation with a concrete technical control and a conference presence to point to, French’s material is more targeted than Williams’s cross-sector AI social-engineering talk.

The tradeoff is a narrower vertical and a product-centered frame.

• The posts focus on healthcare and promote Mutare and its HIMSS booth, so the keynote would likely lean toward a vendor solution rather than a neutral governance or training playbook.
• A buyer seeking a broad, cross-sector AI-governance keynote or training-led tabletop should ask how the session addresses those needs.

Examples: Source 1 · Source 2