# John Ellingson

John Ellingson writes about cybersecurity, focusing on how attackers exploit identities, credentials and trusted access—and why Ellingson believes conventional perimeter defenses are falling behind.

- Profile: https://b2binfluencer.marketing/creators/john-ellingson/
- LinkedIn: https://www.linkedin.com/in/john-ellingson-a7a22b3
- LinkedIn followers: 1,526
- Topics: artificial-intelligence, identity-security
- Based on 10 dated posts, latest 2026-09-11

## Summary

John Ellingson is most useful for thought leadership that reframes cybersecurity around identity, credentials and trusted access instead of perimeter defenses.

- Best for: A cybersecurity vendor launching identity security and seeking thought leadership against legacy perimeter defenses.
- Not for: Security awareness training or employee learning campaigns that sell better human training as the answer.
- Check first: Confirm whether their audience includes security buyers and ask for partnership terms and comparable performance.

### Takeaways

- Attackers now log in rather than break in, with 82% of detections cited as malware-free.
- They propose removing humans from the authentication path instead of relying on training or stronger authentication.
- A post says 40 years treating cybersecurity as a technology problem failed to improve breach rates.

## Main ideas

- **The perimeter is ceremonial; identity and trust are the real attack surface**: John Ellingson argues that attackers increasingly log in rather than break in. They abuse valid credentials, identity flows, SaaS trust and approved integrations, making the old fortress-and-moat model a poor fit for where intrusions now succeed. The post calls the perimeter ceremonial and says the system is failing where organizations insisted it was strongest.
- **AI has created a structural speed-and-scale mismatch, not just an efficiency gap**: The posts say defenders remain trapped in review, validation, escalation and human approval while attackers use AI to accelerate reconnaissance, social engineering, credential theft and evasion at machine speed. John Ellingson calls that mismatch a structural defect, not an efficiency gap. They argue that adding tools, layers and automation to a model that cannot match machine-speed adversaries may still fall far short.
- **Cybersecurity treats the wrong problem as technical, so the fix must be structural**: John Ellingson argues that the industry has spent 40 years and billions of dollars treating cybersecurity as a technology problem—improving encryption, detection and response—without reducing breach rates. In this argument, the exploited surface is not digital. Because 68–82% of breaches involve a human element, the proposed alternative is not better training or more sophisticated MFA, but removing humans structurally from the attack surface: no human in the authentication loop to phish and no persistent credential to steal.
- **Incremental trust layers normalize decline—the boiling frog**: John Ellingson uses the boiling-frog metaphor for institutions that normalize each new trusted automation layer, identity dependency and increment of attack speed. The failure is gradual enough to seem normal, while a security posture built on slowing attackers cannot withstand one who moves in seconds and blends into normal activity. The post asks how long institutions will keep calling denial risk management.
- **Extrapolate threat-report curves to force an architectural decision**: In the CrowdStrike post, John Ellingson distinguishes cited findings from a personal forecast, projecting scale, speed and scope over ten years. The point is that if the curves keep bending the same way, AI-enabled attack stops being a category and becomes simply what attack means. The post calls the projection conservative because it holds the growth rate flat rather than accelerating it.

## Work to read

- [The Boiling Frog of Cybersecurity](https://www.linkedin.com/posts/john-ellingson-a7a22b3_the-boiling-frog-of-cybersecurity-the-current-activity-7483464452248420353--vYF)
- [Why We Are Losing the Cyber War](https://www.linkedin.com/posts/john-ellingson-a7a22b3_why-we-are-losing-the-cyber-war-the-defense-activity-7483904002045292544-h3GW)
- [40 Years Treating Cybersecurity as a Technology Problem](https://www.linkedin.com/posts/john-ellingson-a7a22b3_the-industry-has-spent-40-years-treating-activity-7470783557716643840-kMaH)
- [CrowdStrike 2026 Global Threat Report—a ten-year extrapolation](https://www.linkedin.com/posts/john-ellingson-a7a22b3_crowdstrikes-2026-global-threat-report-activity-7485659253140242435-SZ88)

## Brand relationships

- **EKI** (mention)

## Partnerships

John Ellingson's posts offer no stated partnership or sponsorship opportunity. They provide analytical commentary on cybersecurity threats — identity-based attacks, malware-free intrusions, and the limits of perimeter defenses — with no disclosed sponsor, paid-partnership label, media kit, rate information, or inquiry route. The posts state no brand relationship, and the linked LinkedIn profile lists no partnership contact or sponsorship terms. A buyer planning a campaign should treat the format list below as empty and ask directly about availability and terms before budgeting.

## Alternatives

- Reilyn Garton: Reilyn Garton is the stronger choice when a vendor needs operator-level identity-attack tradecraft rather than a broad reframing of the perimeter. The posts cover Volt Typhoon's use of valid accounts and living-off-the-land techniques, then session hijacking, OAuth abuse, MFA fatigue and token replay. They ask defenders directly whether they log and correlate SMB, WMI and WinRM lateral movement, alert on anomalous service accounts, and fuse identity signals with endpoint and network data. A vendor launching an identity-security product can use that detail to make the product argument concrete: which control breaks which attacker step, and what telemetry a buyer should demand. This is a better fit than John Ellingson when a campaign needs detection-engineering specifics and actionable operator questions, while still staying on the theme that attackers sign in rather than break in.
- Derek Boxdell: Derek Boxdell is the better choice when the buyer task shifts toward manufacturing and operational technology risk. The posts cover a Manufacturers Alliance session on cybersecurity, industrial operations and AI, with production downtime framed as existential, OT resilience treated like uptime, and security built into automation design rather than added later. A second post is a field-notes format on human distraction, trust after ransomware and breach exposure, and compliance as a competitive edge, citing laws and regulations including Texas safe harbor, EU RED and DORA. For a vendor selling identity security into manufacturers, they can connect the product to plant uptime, automation and regulatory pressure in a way John Ellingson's posts do not.
- Deepen Desai: Deepen Desai is the stronger alternative when the vendor needs a security-operations and AI-defense narrative rather than an identity-only argument. The posts announce an agentic security operations launch, describe attackers automating and chaining exploits with AI, and argue that fragmented tools, incomplete visibility, high data-ingestion costs and manual steps leave many security operations centres unable to respond. The second post covers early access to frontier AI models for testing against attack and defence scenarios, including multi-step reasoning used to construct exploit paths and the case for Zero Trust, continuous scanning and exposure management. A vendor that wants to place an identity product inside a broader security-operations, exposure-management and AI-defence story can use that frame.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/