Jay Bavisi works in cybersecurity education and workforce development at EC-Council. Their LinkedIn posts discuss AI governance, cybersecurity training, and offensive security, and they host conversations for the EC-Council Cybersecurity Podcast.
They are most useful for connecting AI governance, security practice, and workforce development for enterprise security leaders.
Best for
A cybersecurity training or certification provider seeking thought leadership on AI governance and offensive security.
Not for
A consumer smart-home brand seeking broad lifestyle endorsement or household privacy claims.
Key takeaways
AI adoption needs security, governance, and trained people to keep pace.
A malicious Terraform provider had 1,449 downloads but 18 machines on attackers' channel.
Precautions include isolating interview repositories, pinning dependencies, and monitoring unusual network behavior.
Check first: Confirm audience evidence, available formats, and commercial terms before booking.
Main ideas
The AI race is a trap: adoption is outrunning the ability to govern it · Governance is a capability, not a document — workforce development is the missing link · Exploitation now outruns the patch cycle, so control belongs at board level
Jay Bavisi works in cybersecurity education and workforce development at EC-Council.
Their posts argue that AI adoption needs security, governance and trained people to keep pace.
Their work spans practical security commentary and conversations for The Cybersecurity Podcast by EC-Council, with topics ranging from AI governance and software supply-chain attacks to offensive security research.
The posts also show workforce-development discussions with the Office of the National Cyber Director at the White House.
For details on the substance or outcomes of that meeting, ask for more information.
Readers interested in how cybersecurity risks connect to organizational accountability and skills can start with their AI-governance argument and supply-chain examples.
Bavisi connects technical incidents to decisions security teams and leaders can act on.
In a post about a malicious Terraform provider, they use the mismatch between 1,449 downloads and 18 machines on the attackers’ channel to show why a small-seeming software supply-chain incident matters, then give concrete precautions: isolate interview repositories, pin dependencies and monitor unusual network behavior.
In their AI-governance post, they move from the pressure to deploy AI to questions of defensible security, regulatory scrutiny and workforce capability.
Specific technical examples followed by organizational implications are the clearest reason to follow their work.
The podcast announcements suggest a range of practitioner and executive guests, but are previews, not evidence of what the episodes contain.
Jay Bavisi's recurring argument is that security is failing because of capability, not technology.
Read more
Across AI governance, incident response and supply-chain attacks, the posts return to the same claim: organizations are deploying faster than they can explain, defend or staff what they deploy.
The proposed fixes are consistent—trained people, certification pathways that turn risk into applied skills, and named executive ownership of the pipeline.
So is the method: open with a fresh incident, extract checkable numbers and habits, then point to the accountability gap underneath.
The AI race is a trap: adoption is outrunning the ability to govern it
Writing after RSA Conference 2026 and follow-up meetings with leaders at large financial institutions, Jay Bavisi argues that most organizations are accelerating AI far beyond the governance and security frameworks that support it.
Read more
Three shifts follow: adoption over implementation—ask whether something should be built, not whether it can be; proactive defense, as the field enters an era of AI used against AI; and governance rigorous enough to survive regulator scrutiny.
In finance, the argument goes, if you cannot explain to a regulator how your AI makes decisions, you should not be using it.
The post closes by asking whether audiences are building systems they can defend and explain or just scaling risk.
The post credits David Gee's CSO Online coverage of AI governance, to which Jay Bavisi contributed, and links EC-Council's AI programs. Its bluntest line: deploying AI without a real defensive layer or a governance framework that holds up under scrutiny creates exposure, not advantage.
Governance is a capability, not a document — workforce development is the missing link
The posts repeatedly locate the security gap in people, not tooling.
Read more
In this framing, governance is not a framework sitting on a server; it is a capability, and "you cannot defend what your teams do not understand."
Certification names are tied to specific gaps rather than offered as generic training: COASP (Certified Offensive AI Security Professional) addresses whether coding agents and MCP servers will execute a poisoned package; CCISO (Certified Chief Information Security Officer) is described as an executive-level certification for senior information security leadership and as the place pipeline accountability should sit.
An EC-Council organizational assessment is also offered to help leaders benchmark whether their AI governance can defend developer infrastructure at the new tempo.
The supply-chain post ends by naming two gaps: few teams test whether their coding agents and MCP servers will run a poisoned package, and no clear owner at leadership level is accountable for the pipeline.
It maps each gap to a named certification, with the line "The process stayed the same.
Exploitation now outruns the patch cycle, so control belongs at board level
Jay Bavisi argues that it is time to retire the assumption that normal patch cycles plus compliant logs equal safety.
Read more
The software development lifecycle is itself a primary trust system, and at AI speed, control has to sit at board level. The case rests on timing and blast radius, not technical detail: how fast a public disclosure becomes exploitation, and how much damage one unauthenticated request can do to the systems downstream releases depend on.
CVE-2026-19478 in GitLab was patched on August 17, 2026 across CE and EE versions 19.2.4, 19.1.6, 19.0.8 and 18.11.11.
WatchTowr reproduced the flaw within minutes using only the advisory and patch details, and saw exploitation attempts hit its honeypots roughly two days later.
One unauthenticated HTTP request to the GraphQL endpoint could delete public projects, rewrite state, delete repositories, forge merge records or ban maintainers.
The post quotes Patrick Münch of WatchTowr: deleting a repository ruins a day, while forging merge approvals and audit trails can silently poison every downstream release.
That is a guest's argument, not Jay Bavisi's own technical finding.
One misspelled package is enough: turn the incident into habits and an owner
The posts follow a consistent teaching pattern: lead with a current intrusion, use a counterintuitive number to make the case, offer three checkable habits, then close with an accountability gap.
Read more
The habits—disposable environments, pinned dependencies, behavioral alerts—are aimed at working developers; the conclusion targets leadership, bringing the two audiences together.
Drawing on Aikido research, the post describes a remote access trojan in two Terraform providers and two Go modules linked to North Korea's Graphalgo campaign.
One provider was a single letter off a legitimate Docker provider with 56 million downloads.
The number that carries the argument: 1,449 downloads of the fake provider and 18 machines on the attacker's channel were enough.
The recommended habits: run every interview repository and take-home task in a disposable virtual machine with no credentials; pin providers and modules to an approved list and review lock files like code; and alert when developer machines or build agents call blockchain endpoints or poll Slack's API on a fixed timer.
A Terraform provider runs with your cloud keys, the post notes — that is its job.
Guest conversations carry the research depth and the policy reach
Three posts promote The Cybersecurity Podcast by EC-Council, recorded around Black Hat 2026.
Read more
The announcements name the guests and their subjects: James Kettle on HTTP request smuggling, web cache poisoning and new agentic AI research; John Inglis, the first Director of the White House Office of the National Cyber Director; and Jeremy Hehl of Foresite Cybersecurity on agentic security and operations.
Jay Bavisi calls Kettle "legendary," a personal characterization rather than an assessed claim.
The material includes only the announcements, not the recordings or transcripts, so ask for those to assess the guests' arguments.
The Kettle episode announcement showcases the research-level end of the guest list, the Hehl announcement the commercial-vendor end, and the Inglis announcement the policy end—three different audiences reached through one format.
The written posts focus on governance, risk and accountability, while the announced episodes tackle research-level technical work such as request smuggling and cache poisoning. The formats cover different ground rather than repeating each other.
Workforce development is treated as national infrastructure
The policy engagement is organizational, not personal commentary: Jay Bavisi led an EC-Council delegation to the Office of the National Cyber Director at the White House to discuss the organization's contribution to workforce development in AI and cybersecurity.
Read more
Colleagues in senior North America, academic and public-sector roles joined the delegation. The post announces the meeting but does not state positions taken or outcomes; ask for those before drawing conclusions about EC-Council's policy stance.
The delegation post names Steve Graham, Lata Bavisi and Tim C. as colleagues who joined, indicating company-level activity rather than an individual visit. A separate post promotes a podcast conversation with John Inglis, the office's first Director, showing the same policy relationship on the content side.
The clearest statement of Jay Bavisi’s argument about AI.
Read more
Start here to understand the position, not just the job title.
Drawing on sessions and conversations at RSA Conference 2026 and follow-up meetings with financial institution leaders, the post argues that organizations are moving into AI faster than they are building the governance and defenses to support it.
It names three shifts: adoption over implementation (asking whether something should be built, not just whether it can be); proactive defense in an era of AI against AI; and governance rigorous enough to withstand regulator scrutiny in finance.
The argument then turns to workforce development, with the claim that governance is a capability rather than a document — "You cannot defend what your teams do not understand" — and points to EC-Council certification pathways as a way to close that gap.
For brands planning a campaign
Build an AI governance partnership around a concrete failure mode in a regulated sector, not general AI optimism, and include a training or certification component. The natural format is an argument post with a named problem, three responses and an audience question at the end.
The post shows the teaching method in miniature: turning a news event into habits a security team can act on, a more useful introduction than a topic list.
Read more
The post examines the Graphalgo campaign, drawing on Aikido research: a remote access trojan in two Terraform providers and two Go modules, including one provider a single letter away from a legitimate Docker provider with 56 million downloads.
The detail that carries the argument is the asymmetry — 1,449 downloads of the fake provider and 18 machines on the attacker’s channel were enough.
Three defensive habits follow: run interview repositories and take-home tasks in disposable virtual machines with no credentials; pin providers and modules to an approved list and review lock files like code; and alert when developer machines or build agents call blockchain endpoints or poll Slack’s API on a fixed timer.
The post also names two organizational gaps: few teams test whether their coding agents and MCP servers will execute a poisoned package, and the pipeline has no clear owner at leadership level.
For brands planning a campaign
A template for a certification-linked partnership: a current incident, one counterintuitive number, three checkable habits and a named accountability gap that maps to a course or credential. A brand can co-produce the format using its own incident data rather than asking for a generic endorsement.
The post shows how Jay Bavisi frames urgency for executives, a tone many certification campaigns seek.
Read more
The post tracks a critical unauthenticated code injection in GitLab from disclosure to exploitation in about 48 hours.
It names the patched versions and notes that WatchTowr reproduced the flaw from the advisory and patch details within minutes, then saw exploitation attempts against honeypots roughly two days later.
A single unauthenticated HTTP request against the GraphQL endpoint can delete public projects, rewrite state, delete repositories, forge merge records or ban maintainers.
The argument moves from technical detail to executive implications: normal patch cycles and compliant logs do not guarantee safety, because the software development lifecycle is itself a primary trust system.
At AI speed, the control belongs at board level.
The post points to an EC-Council assessment tool and the CCISO executive certification.
For brands planning a campaign
For an executive-focused campaign, the post pairs a technical advisory with a board-level control question and a self-assessment offer. A partnership could sponsor the assessment framing rather than the vulnerability news itself.
The post shows what Jay Bavisi does at the organizational level beyond posting commentary, and connects workforce-development work with US federal policy conversations.
Read more
The post announces that Jay Bavisi led an EC-Council delegation to the Office of the National Cyber Director at the White House to discuss the organization’s contribution to workforce development in AI and cybersecurity.
It names the colleagues who joined: Steve Graham, Lata Bavisi and Tim C.
Ask for the meeting’s outcomes before making claims about positions or results.
For brands planning a campaign
For a workforce or public-sector campaign, the post establishes a policy dimension that fits briefs about national skills gaps or government-facing training programs. Ask for a specific policy position before presenting it as an endorsement of one.
The post shows the topic Jay Bavisi puts on the podcast when speaking with a security vendor, helping readers judge whether it fits their brief.
Read more
The post announces a conversation with Jeremy B.
Hehl of Foresite Cybersecurity about agentic security and operations, recorded alongside Black Hat 2026 for The Cybersecurity Podcast by EC-Council.
Review the recording or transcript before describing the discussion beyond its announced topic.
For brands planning a campaign
Agentic security and operations sit alongside AI governance in the written posts, so a partnership could pair an AI governance argument with a podcast episode on agentic operations. Review the episode before citing its content.
The guest list includes research-level practitioners, helping marketers assess whether the podcast reaches beyond executives.
Read more
The post announces a Black Hat 2026 conversation with James Kettle for The Cybersecurity Podcast by EC-Council, covering HTTP request smuggling, web cache poisoning, and new agentic AI research. Bavisi calls Kettle legendary.
For brands planning a campaign
The post signals that the podcast can carry deep technical material alongside executive governance themes, making it a fit for technical certification or offensive-security briefs. Review the episode recording or transcript before quoting it.
Offensive security and offensive AI as a taught discipline2
Board-level ownership of the developer pipeline2
Public-sector and policy engagement2
AI governance and the shift from implementation to adoption1
AI governance and the shift from implementation to adoption
In a post written after RSA Conference 2026, Jay Bavisi argues that most organizations are speeding up AI adoption much faster than they are building the governance and security frameworks to support it.
Read more
The argument has three parts: stop asking whether AI can be built and ask whether it should be (adoption over implementation); defend at the same pace as deployment, now that AI is used against AI; and hold governance to a standard a regulator can interrogate, especially in finance where trust is everything. They credit a CSO Online article by David Gee that they contributed to, point to EC-Council AI programs, and ask their network whether they are building systems they can defend and explain or just scaling risk.
For brands planning a campaign
This is the clearest thought-leadership position in the available material. A partnership can extend it beyond a short caption, and the claim that governance is a capability rather than a document gives training- or certification-led content a natural hook for financial-services and enterprise audiences.
One announces an EC-Council delegation to the Office of the National Cyber Director at the White House to discuss the organization's contribution to workforce development in AI and cybersecurity.
Another states that governance is not a framework sitting on a server but a capability: “You cannot defend what your teams do not understand,” with EC-Council certification pathways translating AI risk, governance, and defense into applied skills.
A separate post defines CCISO (Certified Chief Information Security Officer) as executive-level certification for senior information security leadership.
For brands planning a campaign
Workforce readiness and certification are the recurring commercial thread, while policy-level engagement adds credibility. A content partnership on AI governance can carry a training or certification call to action without inventing an offer.
Offensive security and offensive AI as a taught discipline
A post on a supply chain attack describes a remote access trojan in two Terraform providers and two Go modules linked to North Korea's Graphalgo campaign, with one provider a single letter away from a Docker provider that has 56 million downloads.
Read more
It names COASP (Certified Offensive AI Security Professional) as covering whether coding agents and MCP servers will execute a poisoned package. A podcast post with Jeremy Hehl of Foresite Cybersecurity covers agentic security and operations.
Opens with a concrete incident and a specific number, then connects it to two named certifications and three defensive habits.
For brands planning a campaign
Supports an incident-led offensive-security content partnership that pairs a real attack story with offensive-AI or agentic-security training. The format recurs across posts, making it a ready option for a brand.
The supply chain post closes on ownership: the process stayed the same while accountability did not.
Read more
It connects CCISO to the question of where pipeline responsibility sits at leadership level.
A GitLab post makes a related argument: CVE-2026-19478 moved from disclosure to in-the-wild exploitation in about 48 hours; normal patch cycles and compliant logs no longer equal safety; and the control has to be board level.
It links an EC-Council assessment leaders can use to benchmark AI governance over developer infrastructure.
Uses a dated incident and reproduction timeline to make a management-level argument, not just a technical one.
For brands planning a campaign
Puts the buying conversation at CISO and executive level, not just among practitioners, making it a fit for campaigns promoting governance, assessment, or leadership certification offers.
Three posts promote The Cybersecurity Podcast by EC-Council, recorded around Black Hat 2026.
Read more
Named guests include James Kettle on HTTP request smuggling, web cache poisoning, and agentic AI research; John Inglis, the first Director of the Office of the National Cyber Director; and Jeremy Hehl on agentic security. The posts are short announcement captions, not episode transcripts.
The captions announce episodes but do not describe their conversations. Ask for episode details to confirm the substance of each discussion.
For brands planning a campaign
An interview-led partnership fits an established format, and the named guests offer entry points into current research and policy topics. Ask for episode details before building a campaign around a specific guest topic.
Jay Bavisi led an EC-Council delegation to the White House Office of the National Cyber Director to discuss the organization's contribution to workforce development in AI and cybersecurity, naming colleagues in senior North America, academic, and public-sector roles.
Read more
A podcast post references the office's first Director as a guest.
For brands planning a campaign
The policy-and-workforce angle suits campaigns for government or regulated-sector training, and the delegation shows convening power beyond commentary. The named colleagues indicate organizational activity, so brands should expect EC-Council involvement rather than an individual-only engagement.
Jay Bavisi's brand relationships center on EC-Council, the cybersecurity certification and training body.
Read more
Posts show them leading an EC-Council delegation to the White House's Office of the National Cyber Director, writing in the first person about EC-Council certification pathways, and recording conversations for The Cybersecurity Podcast by EC-Council.
Any certification or training company weighing Bavisi as an outside thought-leadership voice should view them as working at a provider selling into the same market, not as an independent commentator.
The other organizations named in the posts — Aikido, WatchTowr, and CSO Online — appear only as sources or outlets Bavisi cites or contributes to.
Ask about their job title and any sponsorship, affiliate, investment, or client terms.
EC-Council
Employment
Bavisi's posts present them as acting for EC-Council.
Read more
They led an EC-Council delegation to the Office of the National Cyber Director at the White House to discuss AI and cybersecurity workforce development, describing "our contribution" to that work, and write "At EC-Council, we're focused on closing that gap by building certification pathways" when arguing that training, not policy documents, makes governance real. Posts also promote EC-Council offerings — CCISO, COASP, an AI programs link, and the ADG Organizational Assessment — and record conversations for The Cybersecurity Podcast by EC-Council, including guests James Kettle and Jeremy Hehl of Foresite Cybersecurity around Black Hat 2026.
In a post on a North Korea-linked campaign that hid a remote access trojan in misspelled Terraform providers and Go modules, Bavisi credits Aikido researchers with the finding and builds a supply-chain control argument on it.
Bavisi's post on CVE-2026-19478 cites WatchTowr reproducing the GitLab flaw from the disclosure and patch details within minutes, then seeing exploitation attempts in their honeypots about two days later.
Read more
WatchTowr is a named research source for the argument that patch cycles alone no longer equal safety.
Office of the National Cyber Director, The White House
Mention
Bavisi describes leading an EC-Council delegation to meet the Office of the National Cyber Director on AI and cybersecurity workforce development, and separately records a podcast conversation with John Inglis, described as the office's first Director, around Black Hat 2026.
Start with the AI governance post, which sets out the argument running through the rest of the work: organizations are adopting AI faster than they build the governance, defense, and skills to support it.
Read more
Two incident posts — one about a misspelled Terraform provider, the other a GitLab vulnerability — show the method in full: a fresh attack, a number that carries the point, three checkable habits, and a closing claim about who owns the pipeline.
The podcast announcements indicate where the technical depth sits, but provide only guest names and subjects.
Ask for the episodes before judging their research-level detail on web exploitation and agentic security.
Read the posts for governance and workforce arguments aimed at security leadership.
Covers the same ground — application security, supply chain attacks, AI plus security — and points readers to primary research, much as Jay Bavisi builds arguments around advisories and vendor reports.
Read more
Both help readers keep up with current offensive and defensive security work.
Gibler's format is a recurring digest, summarizing and linking other people's research across many topics; each item gets a line or two.
Jay Bavisi takes one incident per post, argues who is accountable and what training can close the gap, then ends with a named certification.
Gibler surveys the field; Bavisi argues about who is responsible for it.
Makes the same core argument: AI makes code abundant, so the hard problem shifts from producing software to defending and governing it.
Read more
Both write for enterprise security leadership, treat agents as privileged actors that need policy in the execution path, and argue that detection at machine speed demands remediation at machine speed.
Staples argues from inside a software platform vendor, tying the case to a model-neutral control plane and a published company point of view.
They also post about teams and regional business.
Jay Bavisi's answer to the same problem is trained people and certification pathways, from a training organization rather than a platform company.
Follow Staples for product-level architecture; follow Bavisi for the workforce and governance side.
Writes for a CISO and board audience about pipeline and supply chain risk.
Read more
The posts open with a concrete incident, spell out blast radius, compliance exposure, and business continuity, then turn the analysis into an executive agenda with numbered actions. The structure is close to Jay Bavisi's.
Jurga's prescription is data resilience — immutable, isolated backups and tested recovery — framed around a vendor brief and the pay-or-not-pay decision.
Jay Bavisi's prescription is workforce capability and named ownership of the pipeline.
Both identify trusted delivery paths as the attack surface, but their remedies point in different directions.
The only published audience figure is Jay Bavisi’s LinkedIn follower count: 21,274, recorded on October 23, 2026.
Read more
It offers a rough reach estimate on one professional network, but not a profile of those followers.
No platform demographics or audience survey are published, so there is no breakdown by country, age, gender, employer, occupation or job seniority, nor per-post impression or engagement counts.
The content targets enterprise security and IT leaders: AI governance for financial institutions, CISO-level accountability for developer pipelines, and supply-chain and GitLab vulnerability analysis for teams running cloud and build infrastructure.
Podcast interviews with James Kettle on HTTP request smuggling and web cache poisoning, and John Inglis, the first director of the Office of the National Cyber Director, point to a practitioner and policy-adjacent readership.
These topics show the intended reader, not the audience’s measured composition.
Follower totals cannot show whether a specific topic or format drew a particular audience, and no comparative post data is published.
For a thought-leadership partnership on AI governance and offensive security, the published material shows clear topic alignment, but the audience is not quantified.
Before committing, ask for LinkedIn impressions and engagement on recent posts covering AI governance and offensive security, podcast download or listener figures for comparable episodes, and audience survey or registration data on sector and seniority.
Jay Bavisi's posts do not set out a sponsorship policy, rate card or named partnership programme, and no official partnership inquiry page is published.
Read more
They show a working collaboration pattern attached to EC-Council: recorded conversations with named security practitioners for the EC-Council Cybersecurity Podcast around Black Hat 2026, and participation in industry events such as RSA Conference 2026.
These activities sit inside their own organisation and its products, not as paid third-party deals.
The certification hashtags alongside them (COASP, CCISO, AIE) are EC-Council course names rather than partner credits.
For a thought-leadership content partnership on AI governance and offensive security, ask directly about available formats and rates; no bookable inventory is published.
Calls to action in the posts point to EC-Council's own AI programmes and its ADG Organizational Assessment, indicating the subject matter a partner would be working with, but not a partnership offer.
Strong subject fit; confirm the audience and partnership terms before booking.
Read more
Brief
A cybersecurity training or certification provider wants a thought-leadership partnership connecting AI governance with offensive security for enterprise security leaders.
Angle
Build the partnership around the question: “Can your team defend and explain the AI it deploys?” Pair an incident-led post about a concrete security failure with a discussion of the governance and workforce skills needed to respond. Clearly identify any certification call to action as the provider’s offer, not as an independent endorsement by Jay Bavisi. Before committing, request topic-level LinkedIn reach and engagement, audience evidence by role and sector, and confirmation of available formats and commercial terms.
Why
Jay Bavisi’s posts connect AI governance, security practice, and workforce development. One argues that organizations are adopting AI faster than they are building governance and defense, then calls for adoption decisions, proactive defense, and governance that can withstand regulatory scrutiny. Another turns a supply-chain attack into three concrete safeguards, including isolating interview code in disposable virtual machines and reviewing provider lock files. The posts also connect these issues to security training and certification. Together, they offer a campaign aimed at executive and practical security audiences both an executive-level argument and a practical security example. The existing EC-Council podcast is an interview format, but the posts do not establish a third-party sponsorship offer or the performance of that format. The LinkedIn follower count does not show how many followers match the buyer’s target audience; request audience evidence before booking.
When to choose a specialist
Poor fit for a campaign aimed at executive and practical security audiences.
Read more
Brief
A consumer smart-home brand wants a broad lifestyle endorsement claiming that its AI assistant is safe, private, and suitable for every household.
Why
The available posts address cybersecurity leadership, enterprise AI governance, developer supply-chain risk, workforce development, and security research. They do not show consumer lifestyle content, smart-home product reviews, or evidence for household privacy claims. An enterprise security argument would not substantiate product-specific safety or privacy claims. The available audience information is limited to a LinkedIn follower count; request evidence of consumer reach and audience composition before booking. A buyer seeking this campaign should choose a creator with documented consumer product coverage, relevant audience evidence, and support for the proposed product claims.
A worked campaign example
Campaign angle
Start with a specific software supply-chain incident: a malicious Terraform provider was one letter away from a legitimate provider, and the post says it was downloaded 1,449 times. Use that detail to make the risk concrete, then give readers three actions from the post: use disposable virtual machines for interview repositories and take-home tasks, approve and pin providers and modules, and alert on suspicious developer-machine or build-agent traffic. Close by asking who owns the pipeline’s security decisions and how teams will test whether coding agents execute poisoned packages. Follow up by connecting those practical questions to AI governance and workforce skills.
Campaign brief
For a cybersecurity training provider seeking to reach enterprise security leaders, develop a short thought-leadership campaign on AI governance and offensive security.
Next steps
Ask for recent LinkedIn impressions and engagement on comparable posts, audience information relevant to enterprise security roles, and confirmation of whether a third-party post or interview is commercially available. If proposing a podcast episode, review the recording or transcript before attributing statements to a guest; Jay Bavisi’s posts contain announcements, not episode content.
Why this fits
The post demonstrates a repeatable teaching approach: a named incident, a memorable detail, practical controls, and an organizational accountability question. That gives the campaign a more specific angle than a general AI-security endorsement. Distinguish the incident’s reported facts from the provider’s training offer, and avoid suggesting that the post proves any particular course’s effectiveness.
Choose Clint Gibler when the campaign needs to reach hands-on application security, cloud security and offensive-security practitioners rather than security leaders.
Read more
The posts reviewed are issues 344 and 347 of a weekly curated security newsletter from September 2026, each bundling a dozen or more links across AppSec, cloud security, supply chain, blue team, red team, and AI and security. The items are specific and current — "VMs won't contain cyber-capable agents," autonomous AI agents breaking into online retailers for $25 a target, MCP configuration poisoning — giving a training provider that wants to place its research, course or tool in a stream practitioners already read a wider technical surface per post than one argument-led essay provides.
The newsletter gives each item a title and a sentence, rather than developing a sustained argument.
A training or certification provider making an executive-level case for AI governance and workforce skills would get distribution and technical credibility, but its message would sit alongside unrelated research.
Jay Bavisi's posts make that governance and workforce argument directly, including a certification call to action; this newsletter reaches practitioners.
Confirm whether sponsorship, advertising or placement terms are available before planning.
Choose Bill Staples when the campaign should speak in the voice of an enterprise software executive about how agentic AI changes software delivery.
Read more
A September 2026 post argues that as implementation becomes abundant, trust becomes scarce, every agent should be treated as a privileged actor with policy enforced in the execution path, and detection-to-remediation must run at machine speed.
An October 2026 post describes a day with GitLab's Asia-Pacific sales and customer-success teams and frames the platform as "cloud-neutral, model-neutral."
A provider seeking a partner who can tie AI security to the software factory and a commercial platform narrative gets an executive perspective not offered by the reviewed Jay Bavisi posts.
These are company and platform communications advancing a software vendor's view of securing the software factory.
They do not present training, certification or workforce pathways, where Jay Bavisi's argument lands.
A training provider using this voice would borrow a platform narrative and need to attach its own skills message separately.
Confirm whether third-party sponsorship placements are available and how the content performs with a training buyer's audience.
Choose Bartosz Jurga when the need is to move from AI governance and offensive security to executive data resilience.
Read more
A September 2026 post treats the compromise of the keyv package and the ChainDrop campaign — more than 400 infected packages and 500 million weekly downloads — as a board-level message for CEOs, CISOs and CTOs, covering blast radius, compliance exposure under NIS2 and ISO 27001, and business continuity.
An August 2026 post asks whether to pay a ransom, notes that over half of enterprise victims now refuse, and argues for immutable, air-gapped backups and tested recovery.
For a provider seeking to reach executives about supply-chain and recovery decisions, this is a closer topical match than an AI-governance campaign.
The scope is narrower, and the close is a product message for a backup and recovery vendor rather than a training outcome.
AI governance, agentic defense and workforce certification — the ground Jay Bavisi covers — are absent, so a training provider would have to graft its offer onto a resilience argument rather than make skills and governance the natural conclusion.
Confirm sponsorship terms and audience composition before planning.
These seven LinkedIn posts by Jay Bavisi cover 2026 material that includes RSA Conference 2026, Black Hat 2026, and a GitLab advisory patched on August 17, 2026.
The posts cover AI governance, software supply-chain and developer security incidents, workforce development, and podcast conversations for The Cybersecurity Podcast by EC-Council.
Three posts are episode announcements; the posts do not include the recordings or transcripts, so guest topics are reported only as the announcements describe them.
The posts link to articles and EC-Council pages, but do not describe their contents.
No posts before this window are included here.
Comparisons with other creators draw on selected posts available for those creators rather than on each creator's full body of work.
