Eric Taylor researches ransomware and other cyber threats, publishing detailed threat-actor profiles with intrusion methods, indicators of compromise, detection guidance, and practical security steps.
Eric Taylor is most useful for grounded threat-actor research and practical defender context.
Best for
Threat-intelligence or incident-response vendors wanting a technical webinar built from Eric Taylor's own research.
Not for
Security-awareness training or consumer tech brands seeking sponsored keynotes or product endorsements.
Key takeaways
Verify a threat actor's claims instead of amplifying them.
Patch the exposed appliance and the old CVE first.
Consolidate scattered vendor reporting into one defender document.
Check first: Ask for LinkedIn follower analytics, comparable session results, and commercial terms.
Main ideas
Verify a threat actor's claims instead of amplifying them · Patch the exposed appliance and the old CVE first · Consolidate scattered vendor reporting into one defender document
Eric Taylor writes about ransomware and other cyber threats, with a focus on what defenders can verify and do next.
Taylor’s threat-actor profiles bring together attack methods, technical indicators, detection guidance and practical security steps.
The Blacknet-00 post shows a useful habit: comparing the group’s claims with its tools and the evidence behind its alleged victims, rather than repeating its claims at face value.
The reviewed posts do not establish other signature books, shows or earlier work, so Taylor is best known here for this threat research and security commentary.
Taylor’s strongest work connects technical detail to a decision.
In the profile of The Gentlemen, Taylor describes an intrusion path, names vulnerabilities to prioritize, and points readers toward detection and remediation guidance.
In the Blacknet-00 post, Taylor contrasts the ransomware’s marketing claims with the code review and reported victim evidence, then identifies routes of access and defensive steps.
Shorter posts show a more cautious, uneven side of the feed: the Stripe extortion post treats impersonation as a possibility rather than a confirmed breach, while the Windows Print Spooler post mainly points to outside research and does not itself analyze the flaw.
Follow Taylor for grounded threat-actor analysis and practical defender context, while distinguishing detailed research summaries from brief commentary and links.
Across the retained posts, Eric Taylor works as a threat researcher who investigates ransomware and extortion groups and then packages the findings for defenders.
Read more
Three habits recur: reading an attacker's actual tooling and claims before repeating them, treating unpatched public-facing devices and old CVEs as the practical front line, and consolidating scattered vendor reporting into a single document a security team can act on.
A fourth pattern is restraint — saying out loud when a headline-making claim is unproven or looks like impersonation.
The posts mix long research write-ups with short pointers to other people's disclosure work and quick reactions to industry news.
Verify a threat actor's claims instead of amplifying them
Eric Taylor's most consistent stance is that a group's marketing is not evidence.
Read more
The method is to read the tools being sold, check the claimed victims against what is publicly checkable, and state the result plainly, including when it makes the attacker look weaker than advertised. This is presented as a service to defenders: knowing that a ransomware strain is breakable changes a victim's options.
In one post, Eric Taylor says the group obtained and reviewed Blacknet-00's tools and found that ransomware sold as RSA-2048 with AES-256 is a simple repeating-key XOR that can be reversed without the key, meaning a victim could most likely recover files for free.
The same post says several of the group's claimed hits fall apart under inspection — a "bank breach" full of placeholder data and an aerospace "breach" built on a 2009 maintenance document.
Access routes described are an exploit for a 2017 Apache Struts bug sold from October 1, default passwords, and open SNMP and router admin ports left facing the internet.
See the original at https://www.linkedin.com/posts/ransomware_ransomware-threatintel-dfir-activity-7513614388671553536-zDzd.
The verification habit runs in both directions: in a later post, the same approach is applied to an extortion claim that may have no substance at all.
A recurring priority is prioritization rather than alarm.
Read more
Eric Taylor repeatedly narrows the question to which vulnerabilities deserve attention now and what to close first, then supplies a short numbered list. Edge devices, virtualization, and backup infrastructure come up as the systems worth checking, and old vulnerabilities remain relevant because they are still being probed.
A long profile of the "Gentlemen" operation names Fortinet CVE-2024-55591 at the top of the entry list and describes a working database of roughly 14,700 FortiGates, then lists six CISA KEV-listed CVEs and tells readers running Fortinet, VMware ESXi or Veeam to check the profile.
The Blacknet-00 post ends with seven fixes that close the doors that actor uses and notes how often the old CVEs it leans on are still being probed.
A short client-facing video post frames recent PHP vulnerabilities around where the actual risks are and what requires immediate attention.
A separate short post flags an unpatched Windows Print Spooler heap overflow in form enumeration and points to a public 60-page exploit write-up, a mirror, and a video — those linked documents are not part of the evidence here, so only the post's own labels and claims are visible.
Consolidate scattered vendor reporting into one defender document
The signature output is a single profile that gathers what several security vendors have already published, organizes it into one intrusion narrative, and attaches the operational material a defender needs: a stage-by-stage walkthrough, a numbered patch list, a MITRE ATT&CK mapping, indicators with hunting guidance, and a containment plan.
Read more
The argument behind the format is that defenders are busy and should not have to assemble the picture from five separate reports.
For the "Gentlemen" ransomware-as-a-service operation, tracked by Microsoft as Storm-2697, Eric Taylor says the profile pulls together public reporting from Microsoft, Check Point, Group-IB, Huntress and Trend Micro.
The post describes growth from Qilin affiliate activity in mid-2025, more than 320 claimed victims in 2026 across healthcare, education, manufacturing, transportation and financial services, entry through an unpatched edge device, endpoint detection disabled with vulnerable signed drivers, and encryption pushed across a whole domain through Group Policy — fast enough that an environment can go down in hours.
It also cites a leaked negotiation that opened at $250,000 and settled at $190,000.
Read it at https://www.linkedin.com/posts/ransomware_ransomware-threatintel-dfir-activity-7511078431846223872-7i2h.
Say when a claim is unproven rather than repeat the headline
When the evidence is thin, the posts say so and leave the question open.
Read more
This comes through in two ways: an extortion claim assessed against the attacker's own deadline and the target's public silence, and a release-day exploit described as part of a wider pattern rather than as a one-off event. Eric Taylor attributes claims to the groups making them instead of restating them as fact.
A short post describes an October 20 Telegram channel claiming a shared effort by ShinyHunters, Lapsus$ and UNC6783 that said it had access to Stripe and demanded a million-dollar payment.
Eric Taylor notes that the 72-hour deadline has passed with no further comment from the group and no visible notice of an investigation from Stripe, and suggests the claim may be an impersonation.
In another post, Eric Taylor says not to update to iOS 27.0.1 on the iPhone Duo and quotes the attacker's own words — "Just in case it wasn't clear: we popped the iPhone Duo on release day" — before commenting that weekly critical exploits now feel like the new normal.
Threats directed at Eric Taylor are treated as concrete, not rhetorical
One post sits outside the research work and shows a boundary rather than an argument.
Read more
It is a short reply thanking another person, Ranuja Randira, and stating that a claim about wanting Eric Taylor assassinated is not the first in a month, adding that roughly two weeks earlier someone from TN drove to their main office with plans to act on it.
The claim about the assassination wish comes from others; the post is Eric Taylor's response to it.
Read it as context on the person, not as threat research.
The whole post reads: "Thanks for sharing this Ranuja Randira - this is not the first time in a month they claimed to want me assassinated.
Two weeks ago (roughly) someone from TN drove to our main office with plans to act on this."
See https://www.linkedin.com/posts/ransomware_thanks-for-sharing-this-ranuja-randira-activity-7519874731404156928-HZGK.
This is the clearest single example of what Taylor produces at full length: a named actor, a numbered attack chain, a patch list, detection material and a remediation plan in one document.
Read more
A newcomer gets the format and the level of specificity immediately, rather than a general statement about covering ransomware.
A long post describing a consolidated threat-actor profile built from public reporting by Microsoft, Check Point, Group-IB, Huntress and Trend Micro.
Taylor describes a ransomware-as-a-service operation tracked by Microsoft as Storm-2697 that grew out of Qilin affiliate activity in mid-2025 and claims more than 320 victims in 2026 across healthcare, education, manufacturing, transportation and financial services.
The stated entry route is an unpatched edge device, with Fortinet CVE-2024-55591 named first and a working list of roughly 14,700 FortiGates; once inside, the operators disable endpoint detection with vulnerable signed drivers and spread the encryptor across the domain through Group Policy.
The post lists what the profile contains: an intrusion walkthrough from initial access to impact, six CISA KEV-listed CVEs, a MITRE ATT&CK mapping, indicators of compromise with detection and hunting guidance, and a containment plan.
One leaked negotiation opened at $250,000 and settled at $190,000.
For brands planning a campaign
The structure maps cleanly onto a technical webinar segment: the intrusion walkthrough and ATT&CK mapping carry the middle, and the settled-negotiation figure gives a business-risk hook for a vendor audience. A proposal could build a session around the six KEV CVEs and the patch-priority argument.
This shows the verification habit behind the research: Taylor examines the code and the claimed victims rather than repeating the group's own numbers.
Read more
A reader can see how the conclusions are reached, which is the part that is normally missing from breach coverage.
Taylor states the group obtained and reviewed Blacknet-00's tools and found that ransomware sold as RSA-2048 with AES-256 is a simple repeating-key XOR that can be reversed without the key.
The post tells victims of a BLACKNET-00 infection that files can most likely be recovered for free.
It contrasts the group's loud claims since September about government ministries, militaries, banks and a power plant with weaker evidence: a bank breach containing placeholder data, and an aerospace breach built on a 2009 maintenance document.
Access routes described are an exploit for a 2017 Apache Struts bug sold from October 1, default passwords, and open SNMP and router admin ports on the internet.
The full profile covers what the TRK25 SCADA tool can actually do to industrial controllers versus which features are for show, the old CVEs the group relies on, indicators and detection rules, and seven fixes.
For brands planning a campaign
A natural session angle is capability claims versus demonstrated capability in ransomware tooling, paired with practical decryption guidance for defenders. The SCADA tool assessment also gives an industrial-control audience a specific reason to attend.
It answers the question of how Taylor handles an unverified claim: the deadline is checked, the public record is checked, and the post states the uncertainty instead of amplifying the headline.
Read more
For a reader deciding whether to trust the research, that restraint is as informative as the long reports.
A short post about a Telegram channel claiming a shared effort by ShinyHunters, Lapsus$ and UNC6783 that said it had access to Stripe and demanded a million-dollar payment. Taylor notes the 72-hour deadline has passed with no further comment from the group and no visible investigation notice from Stripe, and suggests the claim may be an impersonation rather than a real breach.
For brands planning a campaign
Useful for a session or segment on rumour control and reporting discipline in incident coverage, where the practical advice is what to verify before repeating a breach claim. Also a short example of how quickly a claim can be assessed with only public signals.
It shows the other half of Taylor's output: surfacing current vulnerability research and disclosure material quickly, alongside the longer actor profiles.
Read more
A reader can judge how much of the feed is original analysis versus curation.
A short post pointing to a heap overflow in Windows Print Spooler form enumeration, naming the internal functions InternalEnumForms, CopyIniFormToFormInfo and PackStrings, and the memcpy involved.
It links a 60-page public exploit write-up, a mirror on Blackstorm Security, and an accompanying video.
The post body itself is a pointer plus the technical label, not an analysis.
For brands planning a campaign
Supports a patch-management or disclosure-cadence topic, or a short segment on which current unpatched issues deserve attention. The linked write-up and video are not in the available evidence, so only the post text supports what is claimed here.
Assessing threat claims against available evidence2
Ransomware threat-actor profiles
Taylor turns multiple vendors’ reporting into practical profiles of ransomware operations.
Read more
In a post about the Gentlemen, tracked by Microsoft as Storm-2697, Taylor traces an intrusion path from unpatched edge devices through EDR evasion to domain-wide encryption, and points defenders to vulnerabilities and detection guidance. A BLACKNET-00 post takes a different angle: reviewing the group’s tools, Taylor reports that its ransomware uses repeating-key XOR rather than the advertised RSA-2048 and AES-256, potentially allowing victims to recover files without paying.
Combines public reporting with technical findings, then organizes the results around intrusion methods, indicators, detection and hunting, and defensive steps.
For brands planning a campaign
A fit for a threat-intelligence session that moves from how an operation works to what defenders can prioritize. The named examples and action-oriented guidance give a brand more substance than a general ransomware overview.
Taylor connects emerging vulnerabilities to the practical question of what security teams should address first.
Read more
A short post about PHP vulnerabilities frames the issue as distinguishing actual risk from headlines.
In the Gentlemen profile post, Taylor highlights six CISA KEV-listed vulnerabilities and directs attention to Fortinet, VMware ESXi and Veeam; the BLACKNET-00 post also points to older vulnerabilities that remain in use.
A separate post shares a public write-up about an unpatched Windows Print Spooler heap overflow.
Pairs brief, client-facing commentary with threat-profile remediation lists and links to technical material.
For brands planning a campaign
Could suit a vulnerability-management webinar or briefing focused on turning threat reporting into a defensible patch-priority list. The examples span concise risk framing and deeper technical references; the underlying reports and video were not available here for assessment.
Assessing threat claims against available evidence
Taylor’s posts distinguish a group’s claims from evidence that supports them.
Read more
In the BLACKNET-00 profile post, Taylor describes a purported bank breach built on placeholder data and an aerospace claim tied to an old maintenance document. In a post about a Telegram extortion claim against Stripe, Taylor notes the lack of visible follow-up after the stated deadline and raises impersonation as a possibility—not a confirmed conclusion.
Uses specific inconsistencies and observable public signals to question claims, while leaving uncertainty explicit when the evidence is inconclusive.
For brands planning a campaign
A strong angle for a threat-intelligence discussion on evaluating extortion claims without amplifying unverified allegations. The Stripe example is particularly useful for showing how to communicate a cautious assessment rather than present suspicion as fact.
The posts reviewed for this section are threat-research write-ups, and the brands in them are subjects of investigation rather than sponsors, clients, or employers.
Read more
Microsoft, Check Point, Group-IB, Huntress and Trend Micro appear because Taylor pulled their public reporting into a threat-actor profile; Fortinet, VMware ESXi and Veeam appear as products targeted by attackers; the FBI/NSA-style government sources and the criminal groups named in the posts are likewise subjects, not partners.
No post states a commercial or employment relationship with any brand, so no relationship items can be documented from this material.
This is not a claim that Taylor has none — only that nothing in the reviewed posts discloses one.
To get a feel for Eric Taylor's work, start with the long consolidated threat-actor profiles, which assemble public reporting from several security vendors into one intrusion walkthrough plus a patch list, ATT&CK mapping, indicators and containment steps.
Read more
From there, the shorter posts show the same method at a smaller scale: checking an attacker's tooling or a public extortion claim against the evidence before repeating it, and pointing teams to the specific appliances, CVEs and fixes that matter first. Read alongside them for the version of this work that arrives faster and in smaller units: near-real-time exploitation alerts, operational-technology and critical-infrastructure analysis, and structured single-vulnerability teardowns.
Both turn vulnerability and exploitation research into something a defender can act on the same week.
Read more
Garrity posts about the VulnCheck initial access team releasing 26 exploits with detection artifacts and about exploitation observed against Rejetto HFS hosts, telling readers to remediate if they have not and offering free alerts for evidence that a vulnerability is being exploited in the wild. The habit of naming the specific bug, the affected software and the next action is the same one Eric Taylor applies to ransomware entry points.
Garrity's posts work as short, fast notifications about newly exploited vulnerabilities and where exploitation has been observed, with an alert sign-up as the follow-through. Eric Taylor's longer pieces consolidate what several vendors have already published into a single actor profile with an intrusion narrative, indicators and a containment plan.
Both write for the people responsible for keeping critical systems running, and both push the same conclusion that visibility comes before protection.
Read more
Tonkin describes original research into activity affecting Mexican government organisations, where commercial AI tools helped identify an internally accessible SCADA/IIoT interface as a high-value target, and sets out three priorities covering operational visibility, exposure between enterprise and operational systems, and response plans built for industrial realities.
Tonkin's focus is operational technology and critical infrastructure, and much of the material is framed around his own writing and conference speaking. Eric Taylor stays with ransomware and extortion actors and their tooling, and the practical output is a numbered patch list and hunting guidance rather than an argument about industrial exposure.
Both publish structured technical breakdowns that end in a short action list.
Read more
Ahmed's post on a Telegram Desktop proof of concept lays out the affected version, severity, the IPC flaw, the conditions required, and then a do-now list covering updates, group invitation settings, automatic downloads and local passcodes, with a clear note that a public PoC demonstrates feasibility rather than confirmed attacks.
Ahmed's format is a single-vulnerability teardown tied to a product message, such as a sandbox integration and faster mean time to resolution, and an invitation to discuss in the comments. Eric Taylor's signature output is a multi-source actor profile, and the posts do not close with a vendor pitch.
The evidence allows one placement call and no others.
Read more
Eric Taylor's available LinkedIn posts show a steady subject focus, so a threat-intelligence webinar can be built around his own research; the same evidence says nothing measured about who his audience is, so it cannot yet support a claim that his followers match a particular buyer profile.
What the posts show about appeal: he writes long threat-actor profiles.
One selected example is a full write-up of the ransomware operation Microsoft tracks as Storm-2697, covering the intrusion path, a MITRE ATT&CK mapping and indicators of compromise; another is a code review of Blacknet-00 ransomware showing that what is sold as AES-256 is a repeating-key XOR.
A third is an unpatched Windows Print Spooler heap-overflow write-up.
The same account also carries short reaction posts, including a Stripe extortion claim, an iPhone exploit claim and a comment about an assassination threat, so the repeated thread is threat reporting rather than one fixed format or length.
What the evidence does not measure: audience composition.
His LinkedIn profile showed 14,934 followers when observed on 8 October 2026.
That is a platform follower count, not a breakdown by job function, seniority, industry or country, and no audience survey, demographic export or per-post engagement figures were supplied.
Different posts accumulating different reaction or view totals would not by itself show that a topic or format caused the difference.
Next step for the buyer: before committing the webinar slot, ask for LinkedIn follower analytics covering industry, job function, seniority and location, and for recent results from a comparable live or recorded session.
If documented survey results exist, ask for those as well, since a follow count alone cannot show whether the people watching are the security practitioners and buyers the vendor wants to reach.
No partnership, sponsorship, or commercial-collaboration formats are documented in the material reviewed for Eric Taylor.
Read more
The available posts are threat research and security commentary: threat-actor profiles, vulnerability write-ups, and short observations on industry incidents.
None carries a sponsor disclosure, a media kit, rate information, or an official inquiry route for partnership discussions.
A buyer planning a sponsored placement or paid collaboration with Taylor should treat the commercial terms as an open question and confirm them directly with Taylor before budgeting, rather than assuming ad or sponsorship inventory exists.
If a future inquiry establishes a formal offer, this section should be revised with the documented format, its requirements, and the verified contact route.
A threat-intelligence platform or incident-response vendor wants a practitioner to lead a 30-minute technical webinar for security teams: how ransomware affiliates get in, what to patch first, and how to hunt the tools they use. The audience is SOC analysts, incident responders and vulnerability-management leads, and the vendor wants the session built from the speaker's own research rather than a general briefing.
Reasons
The available work already contains the material a technical webinar needs. The write-up of the Gentlemen operation, tracked by Microsoft as Storm-2697, supplies a named actor, an intrusion walkthrough from initial access to impact, six CISA KEV-listed CVEs, a MITRE ATT&CK mapping, indicators of compromise with detection and hunting guidance, and a containment plan. That is a session structure, not a topic idea.
There is a specific patch-priority argument to deliver. The same post names Fortinet CVE-2024-55591 first and describes a working list of roughly 14,700 FortiGates, then tells readers running Fortinet, VMware ESXi or Veeam to check the profile. The post on PHP vulnerabilities frames the question as where the real risk sits and what needs attention now, which suits a vulnerability-management audience.
The verification habit is unusual and useful on stage. Taylor obtained and reviewed Blacknet-00's tools and found a repeating-key XOR routine where the group advertised RSA-2048 with AES-256, then contrasted the group's loud claims with a bank breach full of placeholder data and an aerospace breach built on a 2009 maintenance document. A segment on claimed capability versus demonstrated capability is well supported.
There is a business-risk hook for viewers who are not deep technical specialists. The leaked negotiation that opened at $250,000 and settled at $190,000, plus more than 320 claimed victims in 2026 across healthcare, education, manufacturing, transportation and financial services, gives a mixed audience a reason to stay.
The tone is checked rather than promotional. The post on the Stripe extortion claim notes that the 72-hour deadline passed with no follow-up from the group and no visible investigation notice, and raises impersonation as a possibility. A vendor worried about credibility gets restraint rather than amplification.
The repeated subject focus means a session can be built from Taylor's own output: ransomware and extortion group profiles, practical patch guidance, and technical teardowns recur across the available posts.
Constraint
Follower count is the only audience number available, and it does not show who is watching. Before promising a particular room, the vendor should ask for LinkedIn analytics covering industry, job function, seniority and location, and results from a comparable live or recorded session.
When to choose a specialist
Not a fit on the evidence available.
Read more
Brief
A security-awareness training company or a consumer technology brand wants a paid, sponsored slot: either a high-energy keynote aimed at non-technical employees, or a sponsored post tied to a product launch. The brief assumes a large, broadly engaged audience and asks for an on-stage or on-post endorsement of the sponsor's product.
Reasons
No commercial format is documented. The available posts contain no sponsor disclosure, media kit, rate information or inquiry route for partnership discussions. The absence is a gap in the reviewed material, not proof that Taylor never accepts paid work, so a sponsor should confirm terms directly rather than budget against assumed inventory.
The audience cannot be matched to a buyer profile. The only figure available is 14,934 LinkedIn followers recorded on 8 October 2026, with no breakdown by role, seniority, industry or country, and no engagement or survey data. A brief that depends on reaching a specific group of employees cannot be checked against the evidence.
The strongest work is written technical analysis, not mass-appeal performance. The long items are actor profiles and code reviews with attack chains, CVE lists, ATT&CK mappings and detection guidance. The short items are technical reactions, such as the iPhone and iOS update post or the Stripe claim assessment, and they are not general-awareness explainers for non-technical staff.
The tone works against endorsement-led content. Blacknet-00's marketing claims are tested against its code, and a group's loud breach claims are described as falling apart when examined closely. A sponsored message would sit badly next to that scrutiny.
Part of the output is a boundary rather than a campaign angle. One post is personal-safety content about a claimed threat and a person who drove to the office. It should not be repurposed for marketing under any framing.
Constraint
If a sponsor still wants to work with Taylor, the first step is a direct conversation about commercial terms, and any message should keep the technical, verification-first framing rather than asking for a broad consumer endorsement.
A worked campaign example
Angle
From one missed patch to a locked domain: inside the Gentlemen ransomware operation, and how to tell which of this week's headlines are real.
Brief
The first brief, worked through as a session proposal for a threat-intelligence or incident-response vendor: a 30-minute technical webinar for security teams on how ransomware affiliates operate, what to patch first, and how to tell a real breach claim from a publicity stunt.
Next steps
Confirm the format is a technical webinar with a practitioner audience, not a general-awareness keynote.
Ask for follower analytics covering industry, job function, seniority and location, plus results from a comparable session, before committing the slot.
Confirm commercial terms, recording rights and any sponsorship arrangement directly with Taylor, since no partnership route or format is documented in the reviewed material.
Agree that the personal-safety post is out of scope for promotion.
Obtain the full reports and linked write-ups if any segment will go deeper than the post text, since the underlying documents were not part of the available evidence.
Outline
Open on the business risk with one number: a leaked negotiation that opened at $250,000 and settled at $190,000, against more than 320 claimed victims in 2026 across healthcare, education, manufacturing, transportation and financial services.
Walk the intrusion path: entry through an unpatched edge device with Fortinet CVE-2024-55591 named first, a working list of roughly 14,700 FortiGates, endpoint detection disabled with vulnerable signed drivers, and the encryptor pushed across the whole domain through Group Policy, which can take an environment down in hours.
Move to patch priority: the six CISA KEV-listed CVEs, the advice to put Fortinet, VMware ESXi and Veeam at the top of the list, and the framing of risk as a question of what needs immediate attention.
Turn to claimed capability versus demonstrated capability: Blacknet-00's RSA-2048 and AES-256 sales pitch against a repeating-key XOR that can be reversed without the key, and the placeholder bank data and 2009 aerospace document behind the group's louder claims.
Add a claim-hygiene segment: the Telegram extortion claim against Stripe, the 72-hour deadline that passed without follow-up, the absence of a visible investigation notice, and impersonation as a live possibility.
Close on the containment plan: close the doors the operators use, watch for the moves they make, and rehearse the day it happens, with the indicators and hunting guidance from the profile.
Why it works
Every segment rests on a specific, inspectable example from Taylor's own posts, and the arc moves from business consequence to technical detail to a defender action list. The claim-hygiene portion keeps the session from becoming another alarmist ransomware hour, and the code-review segment gives the audience a method they can reuse, not just a case study.
Choose Garrity when the vendor's webinar is tied to a breaking vulnerability or an exploitation-in-the-wild alert and the goal is a fast, current briefing that drives a remediation or sign-up action.
Read more
The two available posts are short, dated alerts: 26 exploits released by the VulnCheck initial access team with detection artifacts, a warning about possible Citrix NetScaler zero-days, and observed exploitation of Rejetto HFS and HFS2 using two different CVEs, closing with a link to free exploitation alerts.
The tradeoff is depth.
The available posts do not contain an actor profile, an intrusion walkthrough, an ATT&CK mapping, indicators of compromise, or a containment plan.
A vendor that wants a 30-minute session built from the speaker's own ransomware research would need to supply that structure elsewhere or accept a shorter alert-style segment.
No audience breakdown or commercial terms are established for Garrity in the reviewed material.
Choose Tonkin when the audience is operational technology and critical-infrastructure security rather than general threat intelligence.
Read more
The available posts stay on OT ground: an investigation into commercial AI tools used to identify an internally accessible SCADA/IIoT management interface at Mexican government organisations, three priorities for governments and operators (visibility across the operational environment, less exposure between enterprise and operational systems, and response plans built for industrial realities), and a speaking slot at the techUK OT Security Conference.
The tradeoff is subject fit.
The available posts do not cover ransomware affiliates, extortion negotiations, or patch priority for Fortinet, VMware ESXi or Veeam, so a session built from Tonkin's own research would look different from the one Taylor's material supports.
The evidence is also thinner and older (September 2025 and July 2026), with no audience data or commercial terms in the reviewed material.
Choose Ahmed when the vendor wants a speaker already comfortable with product-led content and a direct call to action.
Read more
One available post is a detailed Telegram Desktop vulnerability teardown (CVE-2026-107181, CVSS 8.6, an IPC record-separator flaw, account takeover conditions, and the fix commit and version) that ends by inviting discussion. The other reviews the FBI's Operation Blackout scam-center disruption, notes missing malware names, phishing domains, crypto addresses and IOCs, and closes with a SOC hardening message and a direct ANYRUN sandbox product call to action.
The tradeoff is that the content is partly promotional and narrower.
The Telegram post is a client-application vulnerability write-up, not a ransomware actor profile; the Operation Blackout post is a scam-infrastructure and SOC message with a vendor tie-in.
A vendor that wants a neutral technical webinar built from independent threat-actor research would need to separate the teaching from the product pitch.
No audience breakdown or commercial terms are established in the reviewed material.
