# Jim Manico

Jim Manico writes about application security and how AI is changing cybersecurity work, including vulnerability research, software testing, and fixing security issues.

- Profile: https://b2binfluencer.marketing/creators/jim-manico/
- LinkedIn: https://www.linkedin.com/in/jmanico
- LinkedIn followers: 10,131
- Topics: artificial-intelligence, cybersecurity, vulnerability-management, application-security
- Based on 11 dated posts, latest 2026-10-19

## Summary

Jim Manico is most useful for expert thought leadership on AI in application security.

- Best for: Cybersecurity software vendors needing a keynote or advisory on AI application security.
- Not for: Consumer campaigns about fraud, scams, or everyday online safety.
- Check first: Confirm LinkedIn analytics, follower demographics, and results for the specific topic and format.

### Takeaways

- AI can analyze code, find vulnerabilities, develop exploits, generate patches, and verify results.
- The goal should be continuous security engineering, not counting vulnerabilities.
- OWASP ASVS and AISVS matter more as AI takes over routine work.

## Main ideas

- **AI is collapsing the economics of finding and fixing vulnerabilities**: Manico argues that AI agents can already analyze entire codebases, discover vulnerabilities, develop exploits, generate patches, write regression tests, and verify their own results. As discovery and remediation get cheaper, they expect business models built around them to weaken — including penetration testing, vulnerability scanning, and standalone AppSec tools such as SAST, DAST, IAST, and CVE scanners. They frame this as the collapse of several traditional cybersecurity business models, not just an upgrade to existing tools.
- **The goal should be continuous security engineering, not counting vulnerabilities**: Manico's preferred future is a pipeline rather than a product: security requirements written into the specification; those specifications continuously threat modeled by AI; code generated against explicit security requirements; and independent AI agents repeatedly attacking, repairing, testing, and verifying the software. In that world, the competitive advantage is how quickly and reliably exploitable risk is removed from live systems, not how many flaws a team finds. They say this is already underway, not five or ten years out.
- **AI cybersecurity skepticism is mostly a measurement lag**: Manico treats the claim that AI cyber is overhyped as the real hype. Their reasoning is that capability advances before reported incident data does, and aggregate metrics lag by months while tools improve. They argue AI is already speeding up reconnaissance, code analysis, vulnerability research, and exploit development, and that the serious era of AI-driven cyber offense is only about six months old. Rather than dismissing all doubt, they invite disagreement specifically from people who use frontier AI security models daily with the relevant access approved.
- **Standards matter more as AI takes over routine work**: Manico's answer to cheaper AI-driven automation is not to loosen verification but to tighten its definition. They argue that OWASP ASVS and AISVS become more important because they define security and what has to be verified. In their framing, AISVS is useful because it separates what to do right from the wrong things to look for.
- **Human expertise keeps the hard problems**: Even while predicting that routine security work will need far less human labor, Manico reserves architecture, business logic, novel attacks, and security judgment for people. They do not treat models as reliable on their own: AI makes mistakes, as humans do, so independent verification, deterministic testing, and strong security requirements remain essential. The tension is deliberate — routine work shrinks toward automation while judgment calls stay human.
- **Approved model access comes before judging model capability**: One of Manico's shorter posts makes a practical point about how people evaluate AI security tools. They describe the common complaint that models keep blocking cybersecurity work, then ask whether the person applied for the program that grants access to cyber-capable frontier models. If not, the complaint looks premature. Their priority is for users to sort out approved access and configuration before concluding a model is bad at the job.

## Work to read

- [AI is shifting application security from finding flaws to continuously fixing them](https://www.linkedin.com/posts/jmanico_frontier-ai-trends-report-by-the-ai-security-activity-7514666647316733952-T076)
- [Why Manico rejects the claim that AI cybersecurity is hype](https://www.linkedin.com/posts/jmanico_i-think-the-entire-ai-cyber-is-bs-take-activity-7504598124221370368-ENBz)
- [A short exchange about model access and blocked cybersecurity work](https://www.linkedin.com/posts/jmanico_what-i-hear-often-these-models-are-terrible-activity-7517834461955256320-40Pl)

## Brand relationships

- **OWASP** (mention)

## Partnerships

No partnership or sponsorship offer is documented in Jim Manico's posts. The three LinkedIn posts about AI and cybersecurity work—how AI is changing vulnerability discovery, code analysis, exploit development, and application security tooling—do not describe a sponsorship format, partner arrangement, rates, deliverables, exclusivity terms, or a way for a brand to start a commercial conversation. They write for a professional cybersecurity audience and take positions a vendor could sponsor around, but the posts are commentary, not a media kit. Before planning a paid engagement, ask directly about available formats and commercial terms.

## Alternatives

- Darius Radford: Choose Darius Radford over Jim Manico when the keynote and advisory work needs to focus on the operating model that turns DevSecOps tooling into governed, measurable delivery. For the same cybersecurity software buyer, Radford is the stronger pick if the room is full of engineering leaders who already own CI/CD, scanners, container security, and vulnerability management but still face supply-chain and pipeline failures. The posts describe a framework built around orchestrated delivery, developer-centric AppSec, artifact and supply-chain control, unified risk correlation, and later post-deployment protection and AI governance. That’s a better match when the deliverable is a maturity assessment, a phased roadmap, or an executive risk view, and the buyer wants a vendor-neutral structure aligned with OWASP SAMM.
- Ido Geffen: Choose Ido Geffen over Jim Manico when the keynote and advisory work should center on the offensive side of AI: autonomous agents that pentest continuously, collaborate, and chain exploits. For the same buyer, Geffen is the stronger choice if the audience is security leaders responding to the “bug-pocalypse”—AI writing code faster with more vulnerabilities while the same AI gets better at finding and exploiting them. The posts point to high-profile AI security incidents, a news article on cybersecurity hiring, named AI systems, and OpenAI’s Black Hat talk, where agents used shared memory and chained exploits to find zero-days. Geffen also brings a product-side view through Novee Security, which the posts describe as building AI agents that pentest at machine speed. That fits a keynote or advisory session on autonomous defense and the AI attack race.
- Ricardo Camacho: Choose Ricardo Camacho over Jim Manico when the keynote and advisory brief is specifically about embedded and automotive security—software-defined vehicles, ISO/SAE 21434, static analysis, secure coding, fuzz testing, and CI/CD security gates. For the same cybersecurity software buyer, Camacho is the better match if the audience builds or verifies connected vehicle software and needs an engineering-led talk on finding exploitable weaknesses before deployment. The posts cover automotive attack surfaces such as telematics, ECU communications, OTA updates, and vehicle lighting; tie cybersecurity to functional safety and customer trust; and describe a testing guide built on static analysis, dynamic analysis and fuzz testing, and penetration testing, with security shifted left and continuously validated.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/