The help desk is part of the security perimeter, not just customer service · Identity and directory control is where one compromise becomes many · Security should look like real operations work, not theory
Jason Edwards shares practical cybersecurity guidance on identity and directory defense, social engineering, and cybersecurity operations learning.
They connect security risks to everyday processes and decisions: how a help desk verifies someone requesting an account reset, how organizations limit and monitor privileged access, and how analysts build operational skills.
The MGM incident analysis shows how support workflows can become security controls; the directory-defense post turns that concern into concrete safeguards.
Edwards also promotes ISACA CCOA learning resources in audio, study-guide, and flash-card formats, adding a training-focused element to the security analysis.
Edwards makes identity security tangible by showing how a routine process can affect an entire organization.
In the MGM post, they trace the reported service-desk impersonation and access reset to wider operational disruption, then argue that account recovery and identity checks belong to the security perimeter—not merely customer service.
The directory-defense post complements that case with practical measures: separating privileged accounts, limiting service-account rights, reviewing permissions, and monitoring changes to high-value groups.
Together, the posts explain the risk and offer specific defensive actions.
The CCOA post takes a different approach, presenting learning resources and formats rather than analyzing an incident.
The three posts span security explanation, operational advice, and training promotion.
Across the three posts reviewed, Jason Edwards returns to one claim: security work is operations work, and seemingly administrative functions — directory services, help desk scripts, password resets — are where real breaches are won or lost.
Read more
A service desk that can reset access at speed exercises privileged administrative power, whether or not anyone treats it that way.
Defending identity means limiting what any single account can do as well as keeping intruders out.
The guidance stays concrete: named controls, named log sources, named incidents, and something readers can carry into the next workday.
The help desk is part of the security perimeter, not just customer service
Edwards treats support work as an identity control plane.
Read more
Password resets, MFA recovery, account unlocks, and identity verification scripts are administrative power, so a rushed support process can override an organization’s strongest authentication controls.
The perimeter includes the person on the phone, the questions they ask, the data they trust, and the exceptions they are permitted to make under pressure.
Social engineering, in this framing, is not just about tricking someone into clicking a link; it targets support processes built for convenience, speed, and empathy, turning them into a privileged access channel.
The September 2023 MGM Resorts disruption: digital room keys failed, slot machines and ATMs were affected, and reservations stumbled.
Reporting tied the intrusion to Scattered Spider (also tracked as UNC3944) working with ALPHV/BlackCat.
Attackers reportedly used publicly available employee information to call the service desk, impersonate staff, and persuade support personnel to reset access.
MGM estimated the cost at about $100 million.
Edwards closes by asking whether a given environment treats the help desk as customer service with scripts or as a human-operated identity control plane.
Identity and directory control is where one compromise becomes many
Edwards argues that directory services sit at the center of identity, authentication, and access, so an attacker who controls that layer can spread damage fast through password resets, privilege escalation, unauthorized group changes, and lateral movement.
Read more
A single compromised administrator or over-permissioned service account can turn one incident into a much wider identity breach.
The remedy has two equally weighted parts.
Prevention means enforcing MFA for administrators, separating privileged accounts from everyday use, reviewing permissions regularly, and limiting service account rights.
Detection means logging and alerting on key actions: privilege changes, account creation, replication activity, and failed or abnormal sign-ins.
Edwards’s summary: good identity security is not only about who gets in, but about spotting misuse quickly and limiting what any one account can do once compromised.
The post lays out controls readers can act on within a week: MFA for admins, separate privileged accounts, regular permission reviews, capped service account rights, and monitoring for unusual authentication patterns or changes to high-value groups. It invites readers to copy the accompanying image and use it as they like.
Security should look like real operations work, not theory
The throughline is that security knowledge has to hold up in practice: threat evaluation, vulnerability thinking, incident detection, and defensive decision-making under pressure, not just abstract frameworks.
Read more
Edwards uses concrete cases and listable controls, and gives readers something usable — a checklist, a case narrative, or an asset free to reuse. One of the three posts heavily promotes named ISACA CCOA study products, so readers weighing its instructional value should ask how much of the material is independent guidance versus product promotion.
Edwards describes ISACA’s CCOA as a hands-on cybersecurity operations certification and presents its supporting materials as one connected path from first exposure to reinforcement: a free audio course podcast for commutes and other gaps in the day, a paper and ebook study guide for structured learning and clearer explanations, and a 1,000-card flash-card ebook for repetition and exam prep.
Teach by bringing the argument home to the reader’s own environment
Edwards’s recurring move is to state a claim, ground it in an inspectable case or control, then turn the question back on the reader rather than leave the lesson general.
Read more
That closing move makes the material useful to someone deciding what to do next, across formats — a single-incident narrative, a control checklist, or a learning-resource roundup.
The MGM post ends by asking which side of the truth the reader’s own environment is closer to.
The directory post invites readers to copy the image and use it as they wish.
Both give the audience an action rather than a conclusion.
This is the clearest single post for understanding how Jason Edwards thinks about identity risk: it takes a well-known breach and reframes it around the support process rather than the attacker's tooling.
Read more
A newcomer gets both a concrete event and a line of argument in one read.
Edwards walks through the September 2023 MGM disruption, when digital room keys failed, slot machines and ATMs were affected, and reservations stumbled at a hospitality brand that suddenly looked manual.
The post follows reporting that tied the intrusion to Scattered Spider (also tracked as UNC3944) working with ALPHV/BlackCat, and that the attackers used publicly available employee information to call the service desk, impersonate staff, and persuade support personnel to reset access.
The argument they build from that is the useful part: password resets, MFA recovery, account unlocks, and identity verification scripts are administrative power.
If a rushed support process can override the strongest authentication controls, the real perimeter includes the person on the phone, the questions they ask, and the exceptions they are allowed to make under pressure.
They note MGM shut systems down to contain the damage and that the company later estimated about $100 million in cost, then close by asking whether the reader's own environment treats the help desk as customer service with scripts or as a human-operated identity control plane.
For brands planning a campaign
For a training company building an identity and access management course, this post supplies the narrative spine for a help-desk social engineering module: a real incident, the specific attack sequence, the operational consequences, and a framing sentence that can carry the module's thesis. It also signals that Jason Edwards is comfortable teaching through a post-mortem rather than abstract controls, which fits a case-based course format.
Where the MGM post explains why the help desk matters, this one shows what Edwards recommends doing about identity risk in concrete, listable form.
Read more
Start here to judge whether their guidance can become lessons an analyst can apply the same week.
Edwards frames directory services as the layer at the center of identity, authentication, and access, and argues that control of that layer lets damage spread through password resets, privilege escalation, unauthorized group changes, and lateral movement.
A single compromised admin or over-permissioned service account can turn one incident into a much larger identity breach.
The recommendations are specific: enforce MFA for admins, keep privileged accounts separate from everyday use, review permissions regularly, limit service account rights, and watch for unusual authentication patterns or changes to high-value groups.
They also name what logging and alerting should prioritize, including privilege changes, account creation, replication activity, and failed or abnormal sign-ins.
The point, they summarize, is not only who gets in but how quickly misuse is detected and how much any one account can do once compromised.
The post ends by inviting readers to copy the accompanying image and use it as they like.
For brands planning a campaign
This is directly reusable course material: the controls list and logging priorities can become a module's practice checklist or a downloadable job aid, and the image offer shows Edwards already distributes teaching assets. A training partner could approach them about co-developing or licensing that kind of material rather than featuring them only as an interview subject.
This post shows a different side of Edwards's output: promoting exam preparation rather than analyzing threats.
Read more
Read it to understand how they package learning for busy professionals and what kind of commercial relationships they already work within.
Edwards presents ISACA's CCOA as a hands-on cybersecurity operations certification and explains why it matters by listing the analyst skills it targets: evaluating threats, identifying vulnerabilities, working through incident activity, and making practical decisions under pressure.
They then describe three supporting resources.
A free audio course podcast, available wherever podcasts are found, is pitched for people who want to absorb threat evaluation, vulnerability thinking, incident detection, and defensive decision-making during commutes or other gaps in the day.
A study guide in paper and ebook on Amazon is described as the deeper companion for structured learning, better organization, and clearer explanations.
A flash cards ebook on Amazon adds 1,000 cards for review, repetition, and exam prep.
The post closes by presenting the three together as a connected path from first exposure to reinforcement.
For brands planning a campaign
This post shows that Edwards already produces and promotes structured training content within an established certification vendor's ecosystem, spanning audio, print, ebook, and flash-card formats.
For a course creator, that signals how they package material.
Before proposing a co-branded identity and access management course, check whether existing ISACA-related commitments create any conflict.
Cybersecurity operations training and certification prep1
Directory and identity defense
Edwards treats directory services—the layer that holds identity, authentication, and access—as the place where a single compromised administrator or over-permissioned service account can turn one incident into a wider identity breach.
Read more
The post pairs prevention (MFA for administrators, privileged accounts kept separate from everyday use, regular permission reviews, limited service-account rights) with detection (logging and alerting on privilege changes, account creation, replication activity, and failed or abnormal sign-ins). It emphasizes both who gets in and how quickly misuse is spotted, as well as how little any one account can do if compromised.
A control-by-control structure names both the defensive setting and the signal that shows it failed.
For brands planning a campaign
For an identity and access management vendor or a training company building an access-control course, this post offers a ready-made checklist an audience can act on and a clear prevention-versus-detection framing for a module.
What looked like a ransomware crisis in Las Vegas was, in Edwards's telling, a lesson about a help desk operating as a security control without being treated like one.
The post walks through the opening move—attackers reportedly using publicly available employee information to call the service desk, impersonate staff, and persuade support personnel to reset access—and links the intrusion to Scattered Spider (UNC3944) working with ALPHV/BlackCat.
Edwards makes the argument explicit: password resets, MFA recovery, account unlocks, and identity verification scripts are administrative power.
If a rushed support workflow can override the strongest authentication controls, the person on the phone is part of the perimeter.
The post cites MGM's roughly $100 million estimated cost and the operational fallout: failed digital room keys, affected slot machines and ATMs, and stumbling reservations.
Reconstructs a public incident as a sequence of ordinary, plausible steps, then turns the operational detail into a control-design lesson. Closes with a direct question that puts the reader's own environment on the spot.
For brands planning a campaign
This is the strongest single piece for a course module on help desk and identity-verification attacks: a named incident, a narrated attack path, and a conclusion about designing support processes. A training company can build the module and its exercise directly from the case, while the closing question offers a natural prompt for discussion or assessment.
Cybersecurity operations training and certification prep
Edwards promotes ISACA's CCOA, presented as a hands-on cybersecurity operations certification, alongside its supporting study materials: a free audio course distributed as a podcast, a paper and ebook study guide sold on Amazon, and a flash-card ebook with 1,000 cards.
Read more
The post argues for analyst skills that hold up in practice—threat evaluation, vulnerability thinking, incident detection, and defensive decision-making—and presents the formats as a connected path from first exposure to deeper understanding to reinforcement for learners with tight schedules.
Frames the products as a progression rather than a list, pitching each format against a specific constraint: commutes and walks for audio, structured study for the guide, and repetition for the cards.
This is promotional material for named third-party products, not analysis or instruction. Treat it as evidence of format and audience, not as an independent endorsement.
For brands planning a campaign
A training company or certification body can see that Edwards will promote multi-format learning bundles and write copy around them. The post also shows the audience: practitioners preparing for exams and building analyst judgment.
The same argument runs through all three posts: security should look more like real operations work and less like theory.
Read more
Edwards uses concrete cases and controls—privileged access rules, help desk scripts, incident detection, and defensive decision-making—instead of abstract frameworks, and gives readers something usable, including an image one post invites them to copy and reuse. The formats differ: a control checklist, a single-incident narrative, and a learning-resource roundup.
Each post is organized around a claim the reader can test, then closes with something to do, ask, or use.
For brands planning a campaign
A brand can expect collaboration material built on applied detail, written so an audience can act on it or pass it along without rewriting.
Jason Edwards promotes ISACA CCOA exam preparation resources in one promotional relationship.
Read more
Ask whether this is a sponsorship, affiliate arrangement, or client work.
ISACA
Disclosed partnership
Jason Edwards promotes ISACA CCOA as a hands-on cybersecurity operations certification and points readers to a free audio course, study guide, and flash cards.
Read more
Ask whether the post is sponsored, affiliate, or client work.
Jason Edwards writes about identity and access management as operational work rather than theory.
Read more
The clearest way into the material is the MGM Resorts post, which reconstructs how attackers reportedly used publicly available employee information to call the service desk, impersonate staff, and talk support personnel into resetting access.
They argue that password resets, MFA recovery, and account unlocks are administrative power whether or not an organization treats them that way.
The directory-defense post gives a working checklist for the same problem from the other direction: MFA for administrators, privileged accounts kept apart from everyday use, regular permission reviews, limited service-account rights, and alerting on privilege changes, account creation, replication activity, and abnormal sign-ins.
The third post promotes ISACA's CCOA certification and its audio course, study guide, and flash-card set; it shows how Edwards packages learning material and who it is aimed at.
Read together, the three pieces show a consistent method: name a specific incident or control, explain why it changes what an organization should do, and turn the question back on the reader's own environment.
Both start from a named incident or a publicly known weakness and argue that operational basics decide the outcome.
Read more
They write for people running security day to day, not an abstract strategy audience.
Richards asks how many organizations still treat MFA as sufficient while ransomware groups exploit known Fortinet VPN vulnerabilities.
Edwards makes a parallel argument: a support workflow that can reset access may override an organization's strongest authentication controls.
Richards writes from a customer success and managed-services vantage point, identifying patch and vulnerability management as the recurring gap in a TechDecanter discussion. Edwards focuses on identity, directory services, and service-desk verification, developing the argument as a single author and closing with concrete controls readers can apply.
Both treat identity and access management as the layer where ordinary mistakes become serious breaches.
Read more
Motola's series has leaders describe unauthorized data access, overlooked legacy systems, and privileged access gaps as the failures that escalate; Edwards makes the same case for directory services and help desk resets.
Motola's posts are short recaps promoting an interview series and handing the argument to guests such as Kayla Williams and Barry Gordon, so the ideas arrive as reported highlights. Edwards develops the analysis, building one incident into a control-design lesson and spelling out prevention and detection measures.
For a campaign promoting an identity and access management course, the posts support a LinkedIn-first placement decision.
Read more
The only measured audience figure is a LinkedIn account with 77,646 followers, observed on 8 October 2026.
The three posts address working security practitioners and certification candidates rather than a general business audience: the MGM help-desk social engineering post targets identity and incident-response professionals; the directory services post targets identity and access administrators; and the ISACA CCOA post targets learners preparing for cybersecurity operations certification.
The posts include no audience composition or engagement data.
A buyer should ask for recent results on comparable topics and formats — such as a help-desk social engineering explainer or a certification study post — and a documented source covering followers’ geography, job role, and seniority.
The teaching approach is concrete and operations-focused, consistent with a course aimed at practitioners.
Across the three posts, the commercial activity is promotion of third-party cybersecurity learning resources: the ISACA CCOA audio course, paper and ebook study guide, and a 1,000-card flash card ebook on Amazon, with a pointer to links in the first comment.
Read more
The post shows Jason Edwards publishing promotional content around certification study material, but discloses no sponsorship terms, pricing, deliverables, audience guarantees, or booking process.
For a buyer planning a campaign, partnership terms cannot be set from the posts.
A cybersecurity training company building an identity and access management course could approach them to develop or promote course content; ask directly through their LinkedIn profile about scope, exclusivity, disclosure wording, and compensation.
A cybersecurity training company is building an identity and access management course and wants Jason Edwards to help develop or front a module on help desk social engineering, drawing on the MGM analysis and directory defense insights.
Read more
Decision: strong fit for an editorial or course-development role on practitioner-facing IAM material.
Why: the MGM post already contains the narrative spine for a case-based module.
It walks through the September 2023 MGM disruption, the reported link to Scattered Spider (UNC3944) working with ALPHV/BlackCat, the use of publicly available employee information to call the service desk and impersonate staff, the reset of access by support personnel, the roughly $100 million estimated cost, and the operational fallout — failed digital room keys, affected slot machines and ATMs, stumbling reservations.
It then makes the teaching point explicit: password resets, MFA recovery, account unlocks, and identity verification scripts are administrative power, and a rushed support process can override strong authentication.
The closing question — whether an environment treats the help desk as customer service with scripts or as a human-operated identity control plane — is a natural discussion or assessment prompt.
The directory defense post supplies the practical half.
It lists prevention controls (MFA for admins, privileged accounts kept separate from everyday use, regular permission reviews, limited service-account rights, monitoring for unusual authentication patterns or changes to high-value groups) and detection priorities (logging and alerting on privilege changes, account creation, replication activity, and failed or abnormal sign-ins).
That combination gives a course builder both the incident story and a checklist students can apply.
The audience details support a LinkedIn-first placement.
The only measured audience figure is 77,646 LinkedIn followers observed on 8 October 2026, and the posts are written for working security practitioners and certification candidates.
The commercial details show promotional content for third-party learning products in the ISACA CCOA post, across audio, print, ebook, and flash-card formats.
The posts do not document sponsorship terms, rates, deliverables, audience guarantees, or a booking process.
Treat them as an editorial collaborator whose published work demonstrates the asset, and open any commercial conversation directly through LinkedIn.
Before buying reach, ask for engagement on comparable posts and any audience survey covering job role, seniority, and geography.
Check for conflicts with existing ISACA-related commitments before proposing a co-branded course.
When to choose a specialist
A consumer identity-protection app or general business association wants a broad, non-specialist awareness campaign about identity theft for everyday consumers or small-business owners with no security background.
Read more
Decision: poor fit based on the posts reviewed.
Why: all three posts are written for working security practitioners and certification candidates.
They assume an operations context and use terms such as directory services, privileged access, MFA recovery, replication activity, UNC3944, ALPHV/BlackCat, and ISACA CCOA.
The two analytical posts are close readings for people who already know the environment; the third is certification study promotion.
The posts do not show Jason Edwards writing for a general consumer audience, translating technical identity risk into everyday language, or reaching non-security decision-makers.
The audience details cannot rescue this campaign.
They include a LinkedIn follower count of 77,646 observed on 8 October 2026, but no geography, job role, seniority, engagement, or survey data.
A consumer campaign cannot be scoped from that.
The commercial details are also thin: no media kit, rate card, sponsorship terms, or partnership inquiry route appears.
The ISACA CCOA post shows promotional content for named third-party learning products, but it does not disclose whether the arrangement is paid, affiliate, or unpaid, and no payment is inferred here.
Before judging the fit, ask for examples of consumer-facing work, audience data for a non-practitioner segment, and negotiated commercial terms.
A worked campaign example
Worked campaign angle for an identity and access management course module: “The Help Desk Is a Security Control.”
Opening case: Use the MGM Resorts disruption as Jason Edwards describes it.
Digital room keys fail.
Slot machines and ATMs are affected.
Reservations stumble.
Systems are shut down to contain damage.
The company later estimates about $100 million in cost.
Then show the attack chain as ordinary steps: publicly available employee information is used to call the service desk, impersonate staff, and persuade support personnel to reset access.
Reporting tied the intrusion to Scattered Spider, also tracked as UNC3944, working with ALPHV/BlackCat.
The point for the module is that the opening move was not exotic tooling; it was a support process doing exactly what it was designed to do under pressure.
Reframe: Password resets, MFA recovery, account unlocks, and identity verification scripts are administrative power.
If a rushed support process can override the strongest authentication controls, the real perimeter includes the person on the phone, the questions they ask, the data they trust, and the exceptions they are allowed to make.
That sentence can carry the module's thesis slide and the instructor's opening.
Controls lab: Convert the directory services post into a practice checklist.
Prevention side: enforce MFA for administrators, separate privileged accounts from everyday use, review permissions regularly, limit service-account rights, and watch unusual authentication patterns or changes to high-value groups.
Detection side: log and alert on privilege changes, account creation, replication activity, and failed or abnormal sign-ins.
Students can apply the checklist to a provided help-desk scenario and mark where verification should have stopped the reset.
Discussion or assessment: Use their closing question as a written prompt or tabletop exercise: does your environment treat the help desk as customer service with scripts, or as a human-operated identity control plane? Ask learners to defend their answer with one control they have and one exception they allow.
Job aid: Build a one-page help-desk identity verification decision aid from the controls and logging priorities. The directory post explicitly invites readers to copy its accompanying image and use it, so a co-developed visual job aid is plausible — subject to rights, disclosure, and negotiated terms.
Commercial shape: Position them as an editorial collaborator, module author, or instructor for practitioner-facing content, not as a guaranteed lead generator.
Negotiate deliverables, exclusivity, disclosure wording, and compensation from scratch.
Check for conflicts with existing ISACA-related commitments before proposing a co-branded identity and access management course.
Before buying reach, request comparable engagement metrics and audience composition data covering job role, seniority, and geography.
Choose Bradley Richards when the module should open with exploit-and-patch discipline rather than social engineering.
Read more
Two posts link ransomware to Fortinet VPN vulnerabilities that had been public for months and to the PAYLOAD group, which used compromised domain credentials and Active Directory Group Policy to disable security controls.
Writing from a customer-success role at Atruent, Richards argues that the organizations recovering fastest are not the biggest spenders but those with disciplined vulnerability management, operational accountability, and proactive remediation.
Richards fits better than Jason Edwards when the lesson is how identity compromise pairs with unpatched infrastructure or the buyer wants a vendor-services and resilience viewpoint.
Richards routes his analysis through a recurring conversation series, crediting a named host, rather than walking through one incident end to end as Edwards does with the MGM help-desk intrusion.
That puts the close reading one step removed.
A course built on Richards alone would lose the help-desk-as-identity-control-plane thesis and the copyable directory defense checklist, and lean instead toward patch governance and recovery readiness.
Choose Muli Motola when the course needs named expert testimony and a compliance consequence.
Read more
The Identity Nightmares posts package interviews with practitioners: Kayla Williams, CISO at Devo, on unauthorized access itself being a reportable incident capable of triggering large GDPR fines, and Barry Gordon on privileged access and overlooked legacy systems.
Each interview becomes numbered takeaways, making the material a good fit for a segment on regulatory exposure and the prevent-respond-recover scope of IAM resilience.
Motola is the stronger source when the buyer wants outside experts quoted directly or a privacy-regulation angle.
Both posts summarize someone else's interview and wrap the analysis in series promotion and calls to comment.
That leaves less original close reading to teach from and no single narrated case as vivid as the MGM story.
A module built on this work gains external credibility but loses firsthand incident detail and a reusable student checklist.
Choose Travis Bittecuffer when the audience is technology leadership and the module needs the business case for identity visibility.
Read more
Bittecuffer argues the biggest technology risk is a compromised identity that bypasses millions of dollars of controls by looking like a trusted user, and that with MFA already in place the next problem is detection: watching privileged access and unusual behavior and responding before a compromised account becomes a business disruption. If the course is aimed at CIOs and technology leaders rather than help-desk analysts, or needs a leadership framing that connects identity work to business alignment and people, this is the better fit.
Bittecuffer stays at the leadership altitude.
The material offers no help-desk procedure, attack timeline, or prevention or logging checklist, making it much less useful for a hands-on social engineering module.
A course built on this work would explain why identity monitoring matters to executives, but would not teach an analyst what to do at the service desk.
Three LinkedIn posts by Jason Edwards cover a directory services defense checklist, an analysis of the September 2023 MGM Resorts service-desk intrusion that reporting tied to Scattered Spider (also tracked as UNC3944) and ALPHV/BlackCat, and a post promoting ISACA CCOA exam preparation materials across audio, study-guide, and flash-card formats.
The posts carry no publication dates, so readers cannot see how Edwards's positions have changed over time, and three posts limit how firmly recurring themes can be described.
The LinkedIn profile showed 77,646 followers on 8 October 2026.
The posts publish no engagement figures, audience composition data, or commercial terms, and the ISACA post does not say whether that arrangement was paid, affiliate, or unpaid; no payment is inferred here.
Similar-creator comparisons draw on two posts each from Bradley Richards, Muli Motola, and Travis Bittecuffer, dated between August and October 2026.
No dated archive, longer-form article, video, or transcript appears here, and the posts do not establish a signature book, show, or business, so readers should revisit the profile if primary material of that kind surfaces.
