# Florian Voss

Florian Voss shares practical cybersecurity content on security operations, endpoint protection, fraud detection, and using AI to support threat detection and SOC work. His posts also promote hands-on security workshops and webinars.

- Profile: https://b2binfluencer.marketing/creators/florian-voss/
- LinkedIn: https://www.linkedin.com/in/florian-voss-b23b4a96
- LinkedIn followers: 2,011
- Median of last 4 posts: 2 reactions, 0 comments (checked 2026-11-02)
- Topics: artificial-intelligence, social-engineering
- Based on 11 dated posts, latest 2026-10-07

## Summary

They are useful for cybersecurity vendor webinars and workshops on SOC operations, AI-assisted threat detection, endpoint protection, fraud detection, and NIS2 readiness.

- Best for: European cybersecurity vendors selling SOC tooling for co-branded technical webinars aimed at DACH enterprise security teams.
- Not for: Consumer fraud-awareness or identity-protection campaigns seeking high reach, impressions, or app installs.
- Check first: Confirm audience demographics and recent results on comparable posts before contacting them.

### Takeaways

- AI can reduce routine SOC work and leave more room for critical thinking.
- AlertZero preview has four AI agents propose evidence-backed actions for analyst approval.
- NIS2 asks whether a team can prove what happened and how it responded.

## Main ideas

- **AI is the baseline, so the real decision is how much to hand over**: In several posts Voss argues AI has become the standard operating condition on both sides, so debating whether to adopt it misses the point; the useful decision is the delegation boundary. The reasoning is that attacks now run at machine speed — breakouts in seconds, AI-generated phishing, exploits on demand — which a queue-based human workflow cannot match, while the consequential call should still be made by a person. In Voss's phrasing this is an "agentic SOC: AI executes, humans decide."
- **Social engineering got cheaper, not smarter — so the verification step is now the weak point**: Voss's claim is that AI collapsed the cost of an attack rather than raising its sophistication: one attacker can now do the research, personalisation and impersonation that used to take a team, including deepfake voice and video delivered at the point where an organisation verifies identity. The reasoning follows from that: if the attack is cheap and the fake arrives exactly where the checks are, then detection tuned to older signals falls behind, and the answer is not more of the same but a shift to behavioural analytics, unified identity data, and faster AI-assisted response.
- **Compliance is an operations question: can you prove what happened?**: Voss frames NIS2 not as paperwork but as a test of operational evidence: can a team quickly prove what happened, how it responded, and whether its controls were effective? The implicit argument is that the evidence an audit demands should fall out of how operations are run rather than be assembled after the fact; the session being promoted is about building audit-ready operations that support compliance "without adding more complexity."
- **One platform should carry ingest, detect, investigate and respond**: Voss's platform argument is a consolidation one. Rather than listing features, the post reduces Elastic Security to a single workflow — "One platform. Ingest, detect, investigate, respond." — with AI-powered triage. The reasoning implied is that splitting those stages across separate tools is where time and context are lost, and that the check on the claim is watching an analyst work rather than reading a specification.
- **Teach security by doing: hands-on sessions rather than product announcements**: A consistent priority in how Voss publishes is that sessions should be practical. The workshop invitations promise hands-on exercises, real-world use cases and tips from the sessions' own experts, with free registration — endpoint protection built around Elastic Agent and Elastic Defend, and fraud detection with machine learning. Voss also posts in German as well as English, which points to German-speaking security teams as part of the intended audience rather than an afterthought.

## Work to read

- [“AI didn’t just change cybersecurity — it reset the battlefield” (agentic SOC framing)](https://www.linkedin.com/posts/florian-voss-b23b4a96_the-ai-arms-race-in-cybersecurity-why-your-activity-7447245040432812032-ZSKf)
- [AlertZero: four AI agents with human approval](https://www.linkedin.com/posts/florian-voss-b23b4a96_ai-soc-automation-inbox-zero-for-your-alert-activity-7517888498302074880-tEaA)
- [“AI will replace SOC analysts” — a direct rebuttal](https://www.linkedin.com/posts/florian-voss-b23b4a96_why-ai-wont-steal-your-soc-analyst-job-activity-7455167177768235009-fT1P)
- [“Social engineering didn’t get smarter. It got cheaper.”](https://www.linkedin.com/posts/florian-voss-b23b4a96_ai-social-engineering-detect-defend-and-activity-7520428380501172224-QPr0)
- [Hands-on Elastic Security workshop (German)](https://www.linkedin.com/posts/florian-voss-b23b4a96_hands-on-elastic-security-workshop-vom-schnellstart-activity-7491040442369888256-iKSJ)
- [NIS2: proving what happened, how you responded, and whether controls worked](https://www.linkedin.com/posts/florian-voss-b23b4a96_from-alerts-to-audit-ready-automating-nis2-activity-7472244512141090816-yqZH)
- [Fraud detection in practice](https://www.linkedin.com/posts/florian-voss-b23b4a96_fraud-detection-in-practice-activity-7489951793443995649-8NzB)
- [Unifying security operations: ingest, detect, investigate, respond](https://www.linkedin.com/posts/florian-voss-b23b4a96_unifying-security-operations-with-elastic-activity-7520771705296932864-lnqo)

## Brand relationships

- **Elastic** (disclosed_partnership)

## Partnerships

Nothing in the reviewed posts sets out a sponsorship policy, a rate card, published specifications, or formats a brand can simply book. What they do show is a consistent commercial pattern around Elastic Security: Voss promotes the vendor's hands-on workshops and webinars — endpoint protection with Elastic Agent and Elastic Defend, fraud detection with Elastic and machine learning, an NIS2 audit-readiness session on 9 July, an on-demand session on unifying ingest, detection, investigation and response, and a preview of the AlertZero multi-agent triage tool — always linking readers to the vendor's own registration or replay page rather than to a media kit, booking form, or contact. That points to a co-promoted webinar or hands-on workshop, carried by the vendor's channels and amplified to Voss's audience, as the most plausible collaboration shape for a security vendor. What the material does not establish is that Voss offers this to brands generally, what it costs, whether any such activity has been paid or disclosed as a partnership, or who a brand should contact. Because no verified format or inquiry route exists in the evidence, the format list is deliberately empty and no inquiry link is shown; a buyer should confirm the terms and the approach route with Voss directly before building a plan around a webinar or workshop.

## Alternatives

- Paolo Andrade: Choose Andrade when the same vendor's differentiator is agent identity and authorization rather than SOC triage — for example a launch built around least-privilege controls, short-lived credentials, or approval at the moment an agent acts. Andrade's reviewed posts argue that AI agents are not another application but autonomous identities with credentials, API access, and access to sensitive data, that Zero Trust has to extend to those identities, and that the useful question is what authority an organisation gives AI and how it continuously verifies that authority. That targets security architects, risk owners, and AI-governance teams, a buyer group Voss's detection and triage material is less directly aimed at, and it gives a thought-leadership placement or a session on securing agentic AI a ready-made argument to build on.
- Greg Conti: Choose Conti when the vendor wants education-led credibility with practitioners instead of a product webinar — sponsoring or co-hosting a training track, a conference-adjacent lab, or an upskilling module for security teams. Conti's reviewed posts advertise two hands-on courses delivered through a named training provider: adversarial thinking at DEF CON Training, and military strategy and tactics for cybersecurity at Black Hat. Both are described as structured and exercise-based, down to lock picking, insider-threat role play, fraud scenarios, and an optional certification exam, and both name the exact skills participants leave with. That gives a vendor a concrete teaching format and a recognised conference setting to attach to, in the same way Voss's hands-on workshop posts give the vendor an event to build on.
- Brian Murphy: Choose Murphy when the same vendor needs to reach enterprise leadership — CIOs, boards, and AI-governance owners — rather than SOC analysts. The reviewed posts work at that level: one argues that the arms-race narrative confuses boards and that the organisations that gain are the ones that invest early in context infrastructure, clean data, semantic meaning, and identity-aware retrieval; the other examines self-evolving AI and reframes the question from how to maintain a system to how to govern one that keeps changing. A vendor with an executive-facing thought-leadership piece, an executive roundtable, or a strategy webinar would find the vocabulary and audience framing already established, which is a different sale from the technical delegation question Voss's material supports.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/