# Gaetan Gesret

Gaetan Gesret shares cybersecurity analysis and discusses how organizations can manage cyber exposure, vulnerabilities, and risk. Their posts cover Armis threat research and a ServiceNow cybersecurity workshop they moderated.

- Profile: https://b2binfluencer.marketing/creators/gaetan-gesret/
- LinkedIn: https://www.linkedin.com/in/gaetangesret
- LinkedIn followers: 2,742
- Topics: artificial-intelligence, cybersecurity, vulnerability-management, threat-intelligence
- Based on 11 dated posts, latest 2026-10-02

## Summary

Gaetan Gesret is most useful for turning technical security concerns into practical questions for leaders.

- Best for: A mid-size vendor seeking a French-language spokesperson on exposure management and remediation.
- Not for: An English-language consumer cybersecurity or privacy app wanting mass reach on TikTok or YouTube.
- Check first: Ask for recent reach, engagement and follower seniority data before proceeding.

### Takeaways

- Vulnerability scores alone cannot show whether a flaw is exploitable in a specific environment.
- Threat reporting covers edge devices, unmanaged assets, and misuse of remote-management tools.
- They moderated a ServiceNow cybersecurity workshop at Les Assises de la cybersécurité.

## Main ideas

- **The conventional vulnerability playbook no longer holds**: Gesret argues that when a digital asset can be compromised within 40 minutes of going online, traditional remediation timelines are obsolete. Severity scoring is not the deciding factor: neither CVSS scores nor CISA's known-exploited list, they argue, tells you whether a flaw is exploitable in your specific environment. The priority is reachability — whether the vulnerability can actually be reached and used in this organisation — with an architectural response rather than a faster patch cycle.
- **Going faster is not the same as being in control**: The counterweight to that urgency: automating patching without rigorous orchestration risks breaking production, so speed without control only adds risk. Gesret sets out three requirements for a proactive posture: know each asset's exposure through reachability rather than raw severity; manage the vulnerability lifecycle end to end, from visibility of critical, vulnerable and exposed assets to validation of the fix; and generate proof of remediation, so that in regulated environments an autonomous action produces an audit trail and updates the compliance record in near real time. The tension is deliberate: the old playbook is too slow, and simply accelerating it is a trap.
- **Watch how attackers work, not just that an alert fired**: Drawing on Armis Labs research, Gesret reports a sharp rise in regional cyber activity in the Middle East since February 2026, tracking more than 60 groups and roughly 1,300 IP addresses, including hacktivist proxies and state-linked groups such as APT33 and MuddyWater. They point to four shifts in tradecraft: AI-assisted reconnaissance that automates targeting of critical infrastructure and uses default credentials; systematic exploitation of edge devices and unmanaged "shadow" assets; a move away from extortion toward data-destroying wipers; and lateral movement that abuses legitimate remote monitoring and management tools to evade signature-based detection. The takeaway: waiting for a traditional, uncontextualised alert is no longer viable. Defenders need exhaustive visibility of edge and unmanaged assets, plus behavioural monitoring of administrative and remote-access tools. Gesret credits the research to Armis Labs threat analysts and notes that Armis co-founder and Group CTO Nadir shared it.
- **Judge AI in security by field experience, not by the debate**: Gesret moderated a session framed as "AI: firefighter or arsonist?" not to settle the argument, but to compare lived experience: what worked, what got stuck and what the speakers would do differently. The same preference for direct practitioner conversation over broadcast claims comes through in the promotion of the Armis France stand at a Cannes exhibition, offering a personalised platform demonstration and pre-booked one-to-one meetings with the team. The panel framing is Gesret's; the operational experiences reported on stage are the guests' own.

## Work to read

- [Vulnerability management playbook is breaking](https://www.linkedin.com/posts/gaetangesret_dsi-rssi-mythos-activity-7462777915559006208-ww-s)
- [Middle East threat activity: AI-assisted targeting and destructive payloads](https://www.linkedin.com/posts/gaetangesret_cybersecurity-threatintelligence-armislabs-activity-7439654852777013248-0cw3)
- [Moderating 'AI: firefighter or arsonist?' at Les Assises de la cybersécurité](https://www.linkedin.com/posts/gaetangesret_ia-activity-7511798239965380608-3bfD)
- [Meeting buyers at the IT & Cybersecurity One to One Meetings in Cannes](https://www.linkedin.com/posts/gaetangesret_c19-itcmeetings-cannes-activity-7434508321598021633-EbJJ)

## Brand relationships

- **Armis** (disclosed_partnership)
- **ServiceNow** (disclosed_partnership)

## Partnerships

Gaetan Gesret's four LinkedIn posts cover Armis Labs threat research on Middle East attack activity; commentary with Armis and ServiceNow on vulnerability management and exposure assessment; promotion of an Armis stand at the IT and Cybersecurity One to One Meetings in Cannes; and a ServiceNow cybersecurity workshop at Les Assises de la cybersécurité, which they moderated with speakers from Amadeus and Groupe Rocher. The posts place them on the vendor side of these relationships—presenting Armis research and hosting a ServiceNow event—rather than offering independent sponsored content. No sponsor policy, published formats, pricing, audience figures for paid placements, partnership contact, or official inquiry route is listed. A vendor considering them as a spokesperson for exposure management should ask directly whether they accept sponsorships or paid partnerships.

## Alternatives

- Matthieu Rousseau: If the campaign's buyer decision shifts from exposure management to modernising the enterprise data stack, Rousseau is the stronger choice. As co-founder of Modeo, a 30-engineer data agency, Rousseau writes in French for data leaders about platform and organisational tradeoffs: Snowflake pushing toward an all-in-one platform while clients stay wary of putting every egg in one basket; Databricks marketing self-service BI before it is genuinely accessible to non-technical users; the dbt acquisition as a blow to the Modern Data Stack idea even as MDS adoption widened among CMO, CRO, growth and RevOps teams; semantic layers becoming a prerequisite for agent tooling; FinOps turning critical as cloud bills climb; and the six pain points — siloed KPIs, manual rework, poor data quality, unexploited CRM data, infrastructure that will not scale, and self-service bottlenecks — that justify building a data platform. For a vendor whose audience is DSI and data leadership rather than security leadership, Rousseau offers the same translation layer Gesret provides, applied to a different operational domain.
- Pierre Duvergé: If the same vendor needed a French-language spokesperson for the marketing economics conversation — how acquisition costs have changed, which channels still work, why referral is under-structured, and how to audit marketing before spending more — Duvergé is a better choice. The posts offer a diagnostic frame for B2B marketing: the audits described start from prospects who cannot clearly explain how they win clients, and the useful audit takes five steps — compare the message with the market, re-read the public channels you actually use, track behaviour rather than stated intent, kill the signals that are failing, and turn the audit into a 90-day action plan. The CAC post adds concrete numbers: B2B acquisition costs up 40-60% between 2023 and 2025, Google Ads CPC up 12% year on year and up 164% since 2019, LinkedIn Ads cost per lead between €900 and €1,850 for B2B services, outbound cold at €1,820, referral at €140. It also attaches a Google Sheets kit for calculating real CAC. For a campaign aimed at CMOs or growth leadership, that material is directly usable.
- Charles M.: For a vendor seeking a bilingual product-management voice connecting cybersecurity to roadmap and compliance decisions, Charles M. is a credible alternative. Their posts treat security as an invisible product feature: hard-coded secrets still leaking into repositories, flagged again in OWASP's 2025 Top 10 for Non-Human Identities; stolen tokens and certificates enabling lateral movement; boards paying attention after breach-cost research; and the Jaguar Land Rover attack as an illustration of factory shutdowns, supplier job cuts and estimated losses of £50m a week. The second post links Gartner's finding that 62% of organisations had faced GenAI or deepfake-based attacks in 2025, research showing biometric systems can be fooled by AI-generated deepfakes, and the EU Cyber Resilience Act's mandatory requirements from 11 December 2027, concluding that security and compliance cannot stay as later backlog items. Both posts are published in English and French, and the audience is product leadership, not only security leadership. For a campaign that needs a product-side speaker on IAM, secrets management or the CRA deadline, Charles M. is closer to the need than either of the other two comparators.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/