# Jay Bavisi

Jay Bavisi works in cybersecurity education and workforce development at EC-Council. Their LinkedIn posts discuss AI governance, cybersecurity training, and offensive security, and they host conversations for the EC-Council Cybersecurity Podcast.

- Profile: https://b2binfluencer.marketing/creators/jay-bavisi/
- LinkedIn: https://www.linkedin.com/in/jaybavisi
- LinkedIn followers: 21,274
- Topics: artificial-intelligence, leadership, supply-chain, cybersecurity, ai-governance, workforce-development, software-supply-chain-security
- Based on 15 dated posts, latest 2026-10-08

## Summary

They are most useful for connecting AI governance, security practice, and workforce development for enterprise security leaders.

- Best for: A cybersecurity training or certification provider seeking thought leadership on AI governance and offensive security.
- Not for: A consumer smart-home brand seeking broad lifestyle endorsement or household privacy claims.
- Check first: Confirm audience evidence, available formats, and commercial terms before booking.

### Takeaways

- AI adoption needs security, governance, and trained people to keep pace.
- A malicious Terraform provider had 1,449 downloads but 18 machines on attackers' channel.
- Precautions include isolating interview repositories, pinning dependencies, and monitoring unusual network behavior.

## Main ideas

- **The AI race is a trap: adoption is outrunning the ability to govern it**: Writing after RSA Conference 2026 and follow-up meetings with leaders at large financial institutions, Jay Bavisi argues that most organizations are accelerating AI far beyond the governance and security frameworks that support it. Three shifts follow: adoption over implementation—ask whether something should be built, not whether it can be; proactive defense, as the field enters an era of AI used against AI; and governance rigorous enough to survive regulator scrutiny. In finance, the argument goes, if you cannot explain to a regulator how your AI makes decisions, you should not be using it. The post closes by asking whether audiences are building systems they can defend and explain or just scaling risk.
- **Governance is a capability, not a document — workforce development is the missing link**: The posts repeatedly locate the security gap in people, not tooling. In this framing, governance is not a framework sitting on a server; it is a capability, and "you cannot defend what your teams do not understand." Certification names are tied to specific gaps rather than offered as generic training: COASP (Certified Offensive AI Security Professional) addresses whether coding agents and MCP servers will execute a poisoned package; CCISO (Certified Chief Information Security Officer) is described as an executive-level certification for senior information security leadership and as the place pipeline accountability should sit. An EC-Council organizational assessment is also offered to help leaders benchmark whether their AI governance can defend developer infrastructure at the new tempo.
- **Exploitation now outruns the patch cycle, so control belongs at board level**: Jay Bavisi argues that it is time to retire the assumption that normal patch cycles plus compliant logs equal safety. The software development lifecycle is itself a primary trust system, and at AI speed, control has to sit at board level. The case rests on timing and blast radius, not technical detail: how fast a public disclosure becomes exploitation, and how much damage one unauthenticated request can do to the systems downstream releases depend on.
- **One misspelled package is enough: turn the incident into habits and an owner**: The posts follow a consistent teaching pattern: lead with a current intrusion, use a counterintuitive number to make the case, offer three checkable habits, then close with an accountability gap. The habits—disposable environments, pinned dependencies, behavioral alerts—are aimed at working developers; the conclusion targets leadership, bringing the two audiences together.
- **Guest conversations carry the research depth and the policy reach**: Three posts promote The Cybersecurity Podcast by EC-Council, recorded around Black Hat 2026. The announcements name the guests and their subjects: James Kettle on HTTP request smuggling, web cache poisoning and new agentic AI research; John Inglis, the first Director of the White House Office of the National Cyber Director; and Jeremy Hehl of Foresite Cybersecurity on agentic security and operations. Jay Bavisi calls Kettle "legendary," a personal characterization rather than an assessed claim. The material includes only the announcements, not the recordings or transcripts, so ask for those to assess the guests' arguments.
- **Workforce development is treated as national infrastructure**: The policy engagement is organizational, not personal commentary: Jay Bavisi led an EC-Council delegation to the Office of the National Cyber Director at the White House to discuss the organization's contribution to workforce development in AI and cybersecurity. Colleagues in senior North America, academic and public-sector roles joined the delegation. The post announces the meeting but does not state positions taken or outcomes; ask for those before drawing conclusions about EC-Council's policy stance.

## Work to read

- [The AI arms race is a trap: deployment without governance](https://www.linkedin.com/posts/jaybavisi_ec-council-cyber-security-courses-online-activity-7445183541845516288-BB_t)
- [One misspelled Terraform provider: teaching a supply-chain intrusion](https://www.linkedin.com/posts/jaybavisi_coasp-cciso-supplychainsecurity-activity-7509937659688022016-_-uY)
- [GitLab CVE-2026-19478 and the 48-hour exploitation window](https://www.linkedin.com/posts/jaybavisi_cciso-aie-ecgreen-activity-7497721917873926144-Kl-l)
- [Leading an EC-Council delegation to the Office of the National Cyber Director](https://www.linkedin.com/posts/jaybavisi_i-am-pleased-to-announce-that-yesterday-morning-activity-7420450267529375745-XE4A)
- [Podcast conversation with the first Director of the Office of the National Cyber Director](https://www.linkedin.com/posts/jaybavisi_amazing-conversation-with-the-1st-director-activity-7491516040619831296-oe22)
- [Podcast conversation on agentic security with Foresite Cybersecurity](https://www.linkedin.com/posts/jaybavisi_i-had-such-an-interesting-conversation-with-activity-7491599063143038977-pfJI)
- [Podcast conversation with James Kettle on request smuggling and cache poisoning](https://www.linkedin.com/posts/jaybavisi_conversations-with-the-legendary-james-kettle-activity-7491266866838069248-ok1B)

## Brand relationships

- **EC-Council** (employment)
- **CSO Online** (mention)
- **Aikido** (mention)
- **WatchTowr** (mention)
- **Office of the National Cyber Director, The White House** (mention)

## Partnerships

Jay Bavisi's posts do not set out a sponsorship policy, rate card or named partnership programme, and no official partnership inquiry page is published. They show a working collaboration pattern attached to EC-Council: recorded conversations with named security practitioners for the EC-Council Cybersecurity Podcast around Black Hat 2026, and participation in industry events such as RSA Conference 2026. These activities sit inside their own organisation and its products, not as paid third-party deals. The certification hashtags alongside them (COASP, CCISO, AIE) are EC-Council course names rather than partner credits. For a thought-leadership content partnership on AI governance and offensive security, ask directly about available formats and rates; no bookable inventory is published. Calls to action in the posts point to EC-Council's own AI programmes and its ADG Organizational Assessment, indicating the subject matter a partner would be working with, but not a partnership offer.

## Alternatives

- Clint Gibler: Choose Clint Gibler when the campaign needs to reach hands-on application security, cloud security and offensive-security practitioners rather than security leaders. The posts reviewed are issues 344 and 347 of a weekly curated security newsletter from September 2026, each bundling a dozen or more links across AppSec, cloud security, supply chain, blue team, red team, and AI and security. The items are specific and current — "VMs won't contain cyber-capable agents," autonomous AI agents breaking into online retailers for $25 a target, MCP configuration poisoning — giving a training provider that wants to place its research, course or tool in a stream practitioners already read a wider technical surface per post than one argument-led essay provides.
- Bill Staples: Choose Bill Staples when the campaign should speak in the voice of an enterprise software executive about how agentic AI changes software delivery. A September 2026 post argues that as implementation becomes abundant, trust becomes scarce, every agent should be treated as a privileged actor with policy enforced in the execution path, and detection-to-remediation must run at machine speed. An October 2026 post describes a day with GitLab's Asia-Pacific sales and customer-success teams and frames the platform as "cloud-neutral, model-neutral." A provider seeking a partner who can tie AI security to the software factory and a commercial platform narrative gets an executive perspective not offered by the reviewed Jay Bavisi posts.
- Bartosz Jurga: Choose Bartosz Jurga when the need is to move from AI governance and offensive security to executive data resilience. A September 2026 post treats the compromise of the keyv package and the ChainDrop campaign — more than 400 infected packages and 500 million weekly downloads — as a board-level message for CEOs, CISOs and CTOs, covering blast radius, compliance exposure under NIS2 and ISO 27001, and business continuity. An August 2026 post asks whether to pay a ransom, notes that over half of enterprise victims now refuse, and argues for immutable, air-gapped backups and tested recovery. For a provider seeking to reach executives about supply-chain and recovery decisions, this is a closer topical match than an AI-governance campaign.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/