# Jeff Williams

Jeff Williams writes about application security, including runtime protection for software and APIs, vulnerability response, and how AI may change secure software development.

- Profile: https://b2binfluencer.marketing/creators/jeff-williams/
- LinkedIn: https://www.linkedin.com/in/planetlevel
- LinkedIn followers: 24,012
- Median of last 7 posts: 10 reactions, 1 comments (checked 2026-11-02)
- Topics: artificial-intelligence, cybersecurity, ai-security, vulnerability-management
- Based on 8 dated posts, latest 2026-10-06

## Summary

Jeff Williams is most useful for technical content on runtime application security, software liability, and AI security.

- Best for: A cybersecurity vendor selling runtime application security and assurance-based development to enterprise security buyers.
- Not for: A WAF or perimeter-only security vendor, or a general B2B SaaS marketing audience.
- Check first: Confirm whether they have a public sponsorship format, rate card, or partnership intake.

### Takeaways

- Changing a P to %50 can bypass a WAF, but runtime controls see decoded input.
- AI-assisted vulnerability discovery could reduce protection once provided by software complexity, like a coral reef.
- EU Product Liability Directive applies to software and AI on December 9, 2026.

## Main ideas

- **Stop trying to fix every vulnerability; protect the running app**: Jeff Williams argues that adding runtime security to applications and APIs is a practical alternative to a "fix all vulns" strategy. With a one-time install, they say, a team can mitigate current and future CVEs in production without disruption, instead of scanning and patching continuously. The argument rests on runtime visibility: which libraries are present in a running application, which of those are actually in use, which CVEs in them are exposed, and which exposed CVEs have been attacked. Jeff Williams says that narrows attention to roughly the 1-2% of problems that matter.
- **WAFs cannot see what the application sees**: Jeff Williams argues that web application firewalls cannot reliably protect modern apps and APIs for two reasons. First, an "impedance mismatch": the WAF inspects different data than the code actually processes. Second, request data is no longer simple name=value pairs but complex structures in multiple serialization formats the WAF cannot look into. The proposed answer, application detection and response (ADR), works from inside running code, so it sees data after it has been decoded, and puts deserialization into a microsandbox that prevents harmful behavior. Jeff Williams extends the claim to custom code and library vulnerabilities, saying ADR keeps them from being exploited.
- **Software liability is arriving on a fixed calendar**: Jeff Williams treats software liability as an urgent deadline rather than a distant policy debate. They count down to December 9, 2026, when the EU Product Liability Directive starts applying to new products including software and AI systems, and explain the Development Risk Defense: if the state of scientific and technical knowledge was not advanced enough to discover the defect, a producer may have a defense. They compare that with the OWASP Secure Software Contract Annex, which they say they wrote more than 20 years ago, and its concept of "Novel Security Issues." The SSCA addressed contractual liability; the PLD creates statutory liability, almost like a non-waivable default term. The stated principle is that liability should fall on the party who can most easily avoid the costs when a defect was, or should have been, knowable.
- **AI is collapsing the window that made software accidentally safe**: Jeff Williams argues that software stayed relatively safe not because it was secure but because vulnerability analysis was slow: mapping paths through complex applications, dependencies, and environments took attackers time and effort. Automated discovery changes that calculus. They expect attackers to gain comparable mapping capability quickly, so the exposure window collapses. AI is also part of the remedy — Jeff Williams hopes it helps work through the vulnerability backlog over the next few years — but says that will take time, and recommends updating AppSec programs for what they call the "Dark Software Factory" and adding runtime security at the application layer in the meantime.
- **The end state is an assurance-based software factory, not better remediation**: Jeff Williams calls remediation "yesterday's problem." Their longer-range argument is that AI will streamline the workflows that make up secure by design into a software factory that autonomously produces good software from a specification and autonomously generates a compelling assurance case. That case would identify threats, the defenses against them, evidence that the defenses are correct and effective, and runtime data showing security in production. Jeff Williams frames this as a shift from a negative, risk-management approach — "hacking ourselves secure" — to a positive, assurance-based one. They say the shift will take many years not because the technology is missing, but because people, process, and security culture resist change.

## Work to read

- [Software liability arrives December 9, 2026 — and AI agents raise the hard question](https://www.linkedin.com/posts/planetlevel_secure-software-contract-annex-owasp-foundation-activity-7508906799358513152-wdgr)
- [Why AI changes the economics of exploiting software](https://www.linkedin.com/posts/planetlevel_todays-mythosglasswing-announcement-should-activity-7447404867226152961-hnDO)
- [From penetrate-and-patch to assurance-based software factories](https://www.linkedin.com/posts/planetlevel_on-one-hand-i-can-see-glasshouse-shaking-activity-7449203754005839872-CKP5)
- [A WAF bypass shows why runtime security sees what the edge cannot](https://www.linkedin.com/posts/planetlevel_geesh-mass-exploitation-campaign-by-shinyhunters-activity-7514338034985730048-lSTS)
- [The EU CRA reporting clock starts: 24 hours and 72 hours](https://www.linkedin.com/posts/planetlevel_contrast-cve-shield-real-time-protection-activity-7504241414013218816-R-E9)
- [A runtime CVE demo in under a minute](https://www.linkedin.com/posts/planetlevel_great-demo-from-dave-theres-nothing-like-activity-7519508803739070464-3Dg5)
- [Runtime security as an alternative to fixing every vulnerability](https://www.linkedin.com/posts/planetlevel_adding-runtime-security-to-your-apps-and-activity-7518530398319026176-aVCY)

## Brand relationships

- **Contrast CVE Shield** (disclosed_partnership)
- **ADR** (disclosed_partnership)
- **OWASP** (mention)
- **Anthropic** (mention)

## Partnerships

The reviewed posts do not document a creator sponsorship program, sponsored-content rate card, media kit, or partnership intake. They show Jeff Williams promoting Contrast runtime security products, especially free Contrast CVE Shield and ADR, with sign-up and demo links. For a buyer planning a webinar or thought-leadership collaboration, that means there is no verified public sponsorship format to book. Any partnership would need direct negotiation, and the buyer should confirm whether Jeff Williams is available for external vendor work, what disclosure would apply, and whether a collaboration can include product promotion beyond Contrast's own tools. The posts also show a strong point of view on runtime protection, software liability, and assurance-based development, so a collaboration would fit best as a technical or opinion session rather than a generic sponsored placement.

## Alternatives

- Varun Badhwar: Choose Varun Badhwar when the webinar or thought-leadership angle is upstream prevention and AI-code governance rather than runtime protection. The posts argue for intervening at the moment an agent selects a vulnerable package or generates an insecure pattern, and for measuring how often new risk is introduced alongside how quickly existing risk is fixed. A vendor selling secure coding, dependency vetting, or AI code-scanning would get a sharper fit here than from Jeff Williams, whose material starts after the code is running. A Cybersecurity Awareness Month vulnerability-eradication session is the concrete format the posts support.
- Renee Haas, M.S.: Choose Renee Haas when the campaign decision is a buyer's guide to selecting an exposure-management or attack-path-analysis platform, or an event-based thought-leadership slot. The posts write from inside a vendor partnership with RedSeal, Inc. and frame the buyer problem as too many findings and not enough clarity: reachability, attack paths, business-system impact, and whether a fix actually reduced risk. A vendor selling hybrid exposure management, risk prioritization, or attack-path analysis gets a more directly relevant collaboration than Jeff Williams offers, whose work is about protecting running applications and APIs.
- Tyler James Johnson: Choose Tyler James Johnson when the brief is about the control problem AI scale creates across data, identity, business logic, and execution paths rather than application CVE exposure. One post argues most organizations have a control problem, not a data problem, and that real-time control across data and systems is what is missing between DataOps and AI scaling. The other argues the perimeter security model assumes scarce attackers, slow attacks, and systems that can be reasoned about, none of which hold now. A vendor selling runtime control, AI-era security architecture, or data-and-AI governance finds a closer fit here than with Jeff Williams's CVE-and-liability material.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/