John Ellingson writes about cybersecurity, focusing on how attackers exploit identities, credentials and trusted access—and why Ellingson believes conventional perimeter defenses are falling behind.
John Ellingson is most useful for thought leadership that reframes cybersecurity around identity, credentials and trusted access instead of perimeter defenses.
Best for
A cybersecurity vendor launching identity security and seeking thought leadership against legacy perimeter defenses.
Not for
Security awareness training or employee learning campaigns that sell better human training as the answer.
Key takeaways
Attackers now log in rather than break in, with 82% of detections cited as malware-free.
They propose removing humans from the authentication path instead of relying on training or stronger authentication.
A post says 40 years treating cybersecurity as a technology problem failed to improve breach rates.
Check first: Confirm whether their audience includes security buyers and ask for partnership terms and comparable performance.
Main ideas
The perimeter is ceremonial; identity and trust are the real attack surface · AI has created a structural speed-and-scale mismatch, not just an efficiency gap · Cybersecurity treats the wrong problem as technical, so the fix must be structural
John Ellingson writes about cybersecurity, especially identity-based attacks and the limits of perimeter-focused defenses.
In four LinkedIn posts, they argue that attackers increasingly use valid credentials, trusted identity flows and approved integrations rather than breaking through a network boundary.
Their work is known for a clear progression: diagnose that shift, argue that adding defensive tools may not solve it, and make the case for changing the architecture.
Readers can follow their posts for that sustained argument and their interpretation of current threat reporting.
Ask for a broader portfolio to assess their books, shows, businesses or earlier work.
Ellingson connects threat statistics to a structural argument rather than treating them as isolated warnings.
In “The Boiling Frog of Cybersecurity,” they use reported attack speed and malware-free activity to explain why trust and identity, not just the perimeter, are central concerns.
In another post, they take the argument further: instead of relying on training or stronger authentication, they propose removing humans from the authentication path.
That is a strong, opinionated architectural thesis, not a neutral summary of industry consensus.
Their ten-year forecast is explicitly an extrapolation from cited reports, not a finding those reports make.
Across the four posts, they consistently advance the same case.
Ask for examples that show how they handle counterarguments or topics beyond this thesis.
Across four LinkedIn posts, John Ellingson argues that cybersecurity's center of gravity has shifted from the perimeter to identity and trust, that AI gives attackers a structural speed-and-scale advantage, and that more controls cannot close the gap.
Read more
A recurring priority is treating human involvement in authentication as a root problem; one post proposes removing humans from the authentication loop through an approach called EKI.
The posts also use a boiling-frog frame for institutional complacency and a ten-year extrapolation of cited threat reports to argue for architectural change.
Figures are attributed to CrowdStrike, the World Economic Forum, Verizon and CISA, not presented as Ellingson's own measurements.
The perimeter is ceremonial; identity and trust are the real attack surface
John Ellingson argues that attackers increasingly log in rather than break in.
Read more
They abuse valid credentials, identity flows, SaaS trust and approved integrations, making the old fortress-and-moat model a poor fit for where intrusions now succeed. The post calls the perimeter ceremonial and says the system is failing where organizations insisted it was strongest.
The post cites CrowdStrike's 2026 Global Threat Report: 82% of detections were malware-free, AI-enabled adversaries rose 89% year over year, average breakout time was 29 minutes, and the fastest observed breakout took 27 seconds. It uses those figures to argue that defenders remain focused on signatures and perimeter defense while attackers move through trusted access.
AI has created a structural speed-and-scale mismatch, not just an efficiency gap
The posts say defenders remain trapped in review, validation, escalation and human approval while attackers use AI to accelerate reconnaissance, social engineering, credential theft and evasion at machine speed.
Read more
John Ellingson calls that mismatch a structural defect, not an efficiency gap. They argue that adding tools, layers and automation to a model that cannot match machine-speed adversaries may still fall far short.
The argument draws on the same benchmark figures: an 89% increase in attacks by AI-enabled adversaries, a 29-minute average eCrime breakout time and a 27-second fastest breakout. The post also cites World Economic Forum figures showing that 94% of cyber leaders identify AI as a defining force and 77% of organizations already use it in cyber operations, then argues that activity is not the same as adaptation.
Cybersecurity treats the wrong problem as technical, so the fix must be structural
John Ellingson argues that the industry has spent 40 years and billions of dollars treating cybersecurity as a technology problem—improving encryption, detection and response—without reducing breach rates.
Read more
In this argument, the exploited surface is not digital. Because 68–82% of breaches involve a human element, the proposed alternative is not better training or more sophisticated MFA, but removing humans structurally from the attack surface: no human in the authentication loop to phish and no persistent credential to steal.
The post's reasoning: you cannot phish a system with no human in the authentication loop, socially engineer a credential out of a system that issues no persistent credentials, or operationally exploit urgency, authority, fear and trust when those cognitive states have no operational effect. John Ellingson calls that system EKI and frames it as eliminating the attack class behind most breaches rather than improving authentication.
John Ellingson uses the boiling-frog metaphor for institutions that normalize each new trusted automation layer, identity dependency and increment of attack speed.
Read more
The failure is gradual enough to seem normal, while a security posture built on slowing attackers cannot withstand one who moves in seconds and blends into normal activity. The post asks how long institutions will keep calling denial risk management.
The post argues that each new trusted automation layer and identity dependency makes the environment hotter, yet institutions keep acting as if the old controls still work. The perimeter is now ceremonial; the real battleground is trust, where credentials can be stolen, users manipulated, approvals redirected and deception industrialized at scale.
Extrapolate threat-report curves to force an architectural decision
In the CrowdStrike post, John Ellingson distinguishes cited findings from a personal forecast, projecting scale, speed and scope over ten years.
Read more
The point is that if the curves keep bending the same way, AI-enabled attack stops being a category and becomes simply what attack means. The post calls the projection conservative because it holds the growth rate flat rather than accelerating it.
The extrapolation runs in three phases: years 1–3, scale compounds first, with AI-enabled volume on pace to reach roughly 6–7 times today's level by year three; years 4–7, speed catches up to scale, with volume on pace to reach 40 times or more today's level by year six; years 8–10, adversaries hold effective standing control of networks, able to act when and where they choose.
The post says defenders also gain AI but argues it cannot close the gap on the current architecture.
It states that the extrapolation is the author's own, not a finding of the cited reports.
This is the clearest statement of John Ellingson’s central argument: the old perimeter model is being quietly replaced, not simply attacked.
Read more
A newcomer who reads only one piece should start here; everything else builds on the same frame.
The post argues that attackers no longer need to break in—they log in, hijack identity flows, abuse SaaS trust and move through approved integrations.
CrowdStrike’s 2026 Global Threat Report is cited for four figures: AI-enabled adversaries up 89% year over year, average breakout time down to 29 minutes, fastest observed breakout at 27 seconds, and 82% of detections malware-free.
The boiling-frog metaphor is the point: each new trusted automation layer and identity dependency raises the temperature, while institutions keep acting as if the old controls still hold.
John Ellingson calls the mismatch a structural defect, not an efficiency gap, and says the real battleground is trust rather than the perimeter.
For brands planning a campaign
A strong anchor for a vendor message that reframes the problem as identity and trust rather than the network edge. Specific figures give a thought-leadership piece concrete, citable proof points, while the “ceremonial perimeter” framing sets up a contrast with legacy controls without sounding purely promotional.
The shortest version of the argument, and the easiest to hand to someone who wants the thesis in one screen.
Read more
It answers the question, “What does this writer actually claim is going wrong?”
This is the tightest version of the case.
The defense model is not adapting, and the posts cite the same 89% rise in AI-enabled attacks, 29-minute average breakout time, 27-second fastest breakout and 82% of detections occurring without malware as attackers move through valid credentials and approved SaaS integrations.
John Ellingson adds World Economic Forum figures—94% of cyber leaders call AI a defining force, and 77% of organizations already use it in cyber operations—then argues that activity is not the same as adaptation.
The conclusion: adding tools, layers and automation to a model that cannot match machine-speed adversaries may still fall short.
For brands planning a campaign
Useful when a campaign needs to challenge “more tools” messaging and argue for a different security architecture rather than another layer. The WEF figures let a brand address the gap between adoption and adaptation, a softer entry point than criticism of named competitors.
This explains where the argument leads: if humans are the attack surface, the fix is structural, not better training.
Read more
It is the post most directly relevant to a brief about removing rather than hardening access paths.
The post argues that the industry has spent 40 years and billions on encryption, detection and response while breach rates failed to improve, because the exploited surface is not digital.
Verizon’s Data Breach Investigations Report is cited as showing that 68–82% of breaches involve a human element—phishing, stolen credentials, social engineering or privilege misuse.
The proposed answer is structural: remove humans from the attack surface rather than train them better.
The reasoning: a system with no human in the authentication loop cannot be phished; one that issues no persistent credentials cannot have them socially engineered; and urgency, authority, fear and trust lose operational consequence.
John Ellingson describes that system as EKI and frames it as eliminating the attack class behind most breaches rather than improving authentication.
For brands planning a campaign
The strongest supporting piece for an identity-security launch. It makes the case for a categorically different value proposition instead of incremental improvement, names the legacy controls it challenges—training, MFA and behavioural analytics—and gives a vendor a defensible “eliminate the class, not the instance” claim to build a campaign around.
This shows how John Ellingson reasons beyond the current cycle: what the writer thinks the next decade looks like if nothing architectural changes.
Read more
Read it for the method and forecast, not as a summary of the reports it cites.
The post lays out three published curves: attack volume up 89% year over year, breakout time down to 29 minutes (a 65% acceleration), and 82% of intrusions using no malware and moving through valid credentials across identity, cloud and edge.
World Economic Forum material notes that visibility is weakest in energy, finance and infrastructure.
John Ellingson clearly labels the rest as a personal extrapolation: years 1–3 bring compounding scale; years 4–7, speed catches up to scale, with volume on pace to exceed today’s level many times over; by years 8–10, “AI-enabled attack” dissolves as a category because it is simply what attack means, with adversaries holding standing control of networks.
The post argues that defenders get AI too, but it cannot close the gap on this architecture.
It cites the human element in 62% of breaches in Verizon’s 2026 DBIR and the computational cost of layered deep inspection against traffic growth of roughly 20% a year.
For brands planning a campaign
Fits campaigns aimed at long-horizon or board-level audiences, where the ask is to fund an architectural change rather than buy another product. Separating reported figures from the author’s forecast gives editorial reviewers a clear line to check, and the “conservative read” framing suits a cautious, credibility-first brand voice.
A recurring evidence base of third-party threat reports4
Identity is the attack surface, not the perimeter3
AI-driven speed and scale as a structural mismatch3
The boiling-frog thesis: normalized decline2
Removing humans from the attack surface (EKI)2
Extrapolating threat-report trends a decade out1
Identity is the attack surface, not the perimeter
Across the posts, John Ellingson argues that attackers increasingly log in rather than break in: 82% of detections in the cited threat reporting are malware-free, and intrusions move through valid credentials, trusted identity flows and approved SaaS integrations.
Read more
The perimeter is ceremonial; the real battleground is trust.
For brands planning a campaign
For an identity-security vendor, the core opening is to position the product against the trust layer where attacks now succeed—not as another layer of perimeter defense. A thought-leadership angle can contrast “log in” attacks with legacy “break in” assumptions.
AI-driven speed and scale as a structural mismatch
The posts cite an 89% year-over-year increase in attacks by AI-enabled adversaries, an average eCrime breakout time of 29 minutes and a fastest observed breakout of 27 seconds.
Read more
John Ellingson says the defender remains stuck in review, validation, escalation and human approval while the attacker moves at machine speed, calling that a structural defect rather than an efficiency gap.
Uses published incident benchmarks to frame the argument: the defense process cannot match the adversary’s tempo.
For brands planning a campaign
A vendor selling automation, detection or response can use the speed mismatch to justify investment. Focus on closing machine-speed gaps, not simply adding more tools to a review-heavy process.
John Ellingson uses the boiling frog metaphor to describe institutions that normalize each new trusted automation layer, identity dependency and increment in attack speed.
Read more
In this telling, denial passes for risk management, and a security posture built on slowing attackers no longer survives contact with one moving in seconds.
For brands planning a campaign
A brand can build a thought-leadership campaign around the cost of incrementalism: why “better than before” may still be nowhere near enough. The message suits a vendor arguing for architectural change rather than a faster version of the same controls.
In the post on human error, John Ellingson argues the industry has spent 40 years treating cybersecurity as a technology problem while 68–82% of breaches involve a human element.
Read more
The proposed alternative is not better training or more sophisticated MFA but structural removal of humans from the authentication loop through EKI, so there is no human to phish and no persistent credential to steal.
Frames a segmentation thesis as a security thesis, then tests it against breach statistics and the mechanics of phishing and credential theft.
Ellingson allows that defenders also get AI but argues it cannot close the gap on the current architecture; the removal thesis is presented as the correction.
For brands planning a campaign
This is the most direct fit for a campaign aimed at identity security: the pitch is to eliminate an attack class, not incrementally harden defenses. A campaign can take John Ellingson’s framing—remove humans from the attack surface while preserving them as beneficiaries—and test it against legacy identity controls.
In the CrowdStrike post, John Ellingson takes published 2026 figures—89% growth in AI-enabled attack volume, 29-minute breakout time, 82% malware-free intrusions—and projects scale, speed and scope over ten years.
Read more
They label the projection as their own, not a finding of the reports, and call it the conservative read because it holds growth flat rather than accelerating.
Separates cited threat-report findings from Ellingson’s own trend extrapolation and states the assumption behind the curve.
For brands planning a campaign
A vendor can use this scenario-planning format for a longer-range thought-leadership piece, provided it clearly distinguishes cited data from its own extrapolation. The format offers a provocative frame for why point fixes may not hold.
A recurring evidence base of third-party threat reports
The posts consistently anchor claims in named external sources: CrowdStrike’s 2026 Global Threat Report, the World Economic Forum’s 2026 cybersecurity outlook, Verizon’s 2026 Data Breach Investigations Report and CISA’s 2019 National Critical Functions material.
Read more
Specific figures—89%, 29 minutes, 27 seconds, 82%, 94%, 77%—carry the argument.
For brands planning a campaign
Outreach that brings a citable report with specific numbers is more likely to fit how Ellingson builds a case. A vendor can offer data that extends or challenges the figures they already use.
Ellingson's LinkedIn posts do not disclose a sponsorship, affiliate, client, employment or ownership relationship.
Read more
The only commercial entity they name in their own argument is EKI, which they present in a post on identity security as the system that removes humans from the attack surface.
The post does not say how they are connected to it; ask about the relationship.
The threat reports they cite (CrowdStrike, Verizon DBIR, the World Economic Forum, CISA) support their arguments, not disclosed relationships.
EKI
Mention
In a post arguing that the industry has spent 40 years hardening digital defenses while humans remain the primary attack path, Ellingson writes that removing humans from the authentication loop eliminates the breach class behind most incidents, then names EKI as the system that answers that question: "That is the question EKI answers.
Read more
And to date, no one else is even asking it."
They credit the "parallel systems architecture" framing to the person they are addressing.
The post does not state an ownership, employment, sponsorship, client or investment tie; ask what the commercial relationship is.
John Ellingson's posts build an argument in three moves: identity and trust have replaced the perimeter as the place attacks succeed; AI gives adversaries a speed and scale advantage that review-heavy defenses cannot match; and the response should be architectural, including a proposal to remove humans from the authentication loop.
Read more
Read the CrowdStrike report post for the decade-long extrapolation and the human-error post for the EKI argument, then follow the identity-security and AI-enabled-attacks threads into related work. The posts cite named external reports, giving readers interested in data-rich commentary figures to compare with the more operational, detection- and OT-focused writing of the similar creators below.
Reilyn Garton's posts make the same identity-first argument: attackers are signing in rather than breaking in.
Read more
Detection should focus on valid accounts, session hijacking, OAuth abuse, MFA fatigue, and token replay instead of malware signatures.
The treatment is more operational and checklist-oriented, covering lateral-movement logging, admin-behavior baselining, and detection validation. John Ellingson offers a broader architectural critique and a human-removal thesis rather than a detection-engineering checklist.
Derek Boxdell writes about cybersecurity as an operational and leadership risk, including AI shortening breakout time, human distraction as a security gap, and trust as a battleground.
Read more
Those themes overlap with John Ellingson's focus on AI speed and the human factor.
Derek Boxdell applies these themes to manufacturing and OT environments, with field-note summaries on downtime, dark factories, compliance, and industrial resilience. John Ellingson focuses more on identity architecture and threat-report extrapolation.
Deepen Desai's posts describe AI-driven attackers moving faster, chaining exploits, and compressing response time, and argue for platform and architecture change.
Read more
This aligns with John Ellingson's machine-speed mismatch thesis.
Deepen Desai writes from a vendor product and SOC platform perspective, highlighting Zscaler launches, frontline threat research, and AI agent capabilities. John Ellingson writes argument-led essays about identity, trust, and removing humans from the attack surface.
A limited test with a cybersecurity vendor makes sense for a campaign centered on identity security and current attack dynamics.
Read more
The only measured audience figure is 1,526 LinkedIn followers on 9 October 2026.
Four posts published 11 June–22 July 2026 address AI-enabled attack growth, malware-free intrusions, identity and trust as the battleground, and the limits of perimeter defense, for an audience already following threat reporting and defense architecture.
Before buying, ask for recent performance on comparable topics and formats, plus LinkedIn audience demographics or a survey covering job function, seniority, industry, company size, and geography.
If the data show security practitioners or decision-makers, the creator can support a thought-leadership placement; otherwise, the audience fit is weaker.
John Ellingson's posts offer no stated partnership or sponsorship opportunity.
Read more
They provide analytical commentary on cybersecurity threats — identity-based attacks, malware-free intrusions, and the limits of perimeter defenses — with no disclosed sponsor, paid-partnership label, media kit, rate information, or inquiry route.
The posts state no brand relationship, and the linked LinkedIn profile lists no partnership contact or sponsorship terms.
A buyer planning a campaign should treat the format list below as empty and ask directly about availability and terms before budgeting.
Fit for a limited test, not an open-ended commitment. Two of the vendor's needs already appear in the posts; the main open question is whether the audience includes security buyers.
Read more
Brief
A cybersecurity vendor is launching an identity-security product positioned against legacy perimeter defenses. The brief calls for thought leadership that reframes the problem around identity and trust rather than network edges.
Reasons
The vendor's core contrast is already part of the argument. The posts say attackers now log in rather than break in: 82% of detections are cited as malware-free, with intrusions moving through valid credentials, trusted identity flows and approved SaaS integrations. The second and third posts use that framing directly, calling the perimeter ceremonial and trust the real battleground.
The product needs a 'different class of fix' argument. In the post on 40 years of treating cybersecurity as a technology problem, John Ellingson writes that the answer is not better human training, more sophisticated MFA or deeper behavioral analytics. It is structurally removing humans from the authentication loop so there is no one to phish and no persistent credential to steal. That is a categorically different value proposition, not an incremental hardening claim—the distinction the vendor wants to make.
The writing carries citable proof points. CrowdStrike's 2026 Global Threat Report is cited for an 89% year-over-year rise in AI-enabled attacks, a 29-minute average breakout time, a fastest observed breakout of 27 seconds and 82% malware-free detections. World Economic Forum material is cited for 94% of cyber leaders calling AI a defining force and 77% of organizations already using it in cyber operations. Verizon's DBIR is cited for the human element in 62% of breaches and for 68-82% across a decade. A vendor can extend or challenge any of these figures.
The writing distinguishes cited findings from the author's projections. The ten-year extrapolation post labels the forecast as John Ellingson's own, not a finding of the reports it cites, and calls it the conservative read because it holds growth flat. That is a safer editorial posture for a vendor than blurring report data and speculation.
The recurring method suits a thought-leadership placement: anchor on a named report, extract specific numbers, then argue that the defense process cannot match machine-speed adversaries. A campaign can slot in new data without changing how the posts are built.
Caveats
Audience composition is unverified. The only measured figure is 1,526 LinkedIn followers observed 9 October 2026; the posts do not establish whether security buyers are among them. Before scaling, ask for performance on comparable topics and audience demographics covering job function, seniority, industry, company size and geography.
The posts document no sponsorship or partnership format, sponsor disclosure, paid-partnership label, media kit, rates or inquiry route. Confirm terms directly.
The posts are short LinkedIn posts; they show no long-form article, video, transcript or interview. Ask whether longer-form placements are available before including one in the brief.
When to choose a specialist
Reject. The product's central claim conflicts with what John Ellingson has published.
Read more
Brief
A security-awareness training provider or employee learning platform wants to position phishing simulation and staff training as the answer, selling to the same enterprise security buyers.
Reasons
In a post on human error, John Ellingson says the industry has spent 40 years and billions treating cybersecurity as a technology problem while breach rates failed to improve. They name training first among the things that are not the answer. A campaign built on better human training would have the creator arguing against the product being sold.
The same post attributes 68-82% of breaches to a human element—phishing, stolen credentials, social engineering and privilege misuse—then argues that the exploited surface is not digital, so better awareness does not remove the path. The reasoning: a system with no human in the authentication loop cannot be phished, and a system issuing no persistent credentials cannot have one socially engineered.
The boiling-frog post frames each added trusted automation layer, identity dependency and increment of attack speed as accumulation, not progress. A message of incremental improvement through training would fall within the pattern they describe as normalized decline.
The posts offer no basis for a mass-reach consumer campaign: they focus on enterprise security, and the only audience figure is 1,526 followers, with no demographic detail. Ask for audience data before considering a consumer brief.
What would change it
Before reconsidering this brief, collect and review evidence that John Ellingson has published about awareness training or human-risk programmes as a working control, or documentation of a change in position.
A worked campaign example
Angle
Log in, not break in: the perimeter was never breached; it was bypassed.
Brief
Identity-security vendor launching a product that removes standing credentials from the authentication path, with a thought-leadership campaign against legacy perimeter defenses.
Deliverable
A two-part sponsored analytical series in John Ellingson's existing pattern: a short anchor post with cited figures, followed by a longer post carrying the architectural argument. The posts show no other format, so this is the realistic ask.
Guardrails
Do not present the placement as an endorsement or existing partnership; the posts show no brand relationship.
Keep cited report findings distinct from the creator's own projections, as in the ten-year extrapolation post.
Do not promise long-form, video or interview output; the posts show none. Confirm availability before including any of these formats in the brief.
Before committing, ask for audience composition and sponsorship terms. The posts also show no long-form work; confirm its availability if the campaign requires it.
Handoff
For a campaign using the five-step structure, provide John Ellingson with the vendor data pack and set a limit against unverified performance claims. Before committing beyond the test, ask for recent post performance on comparable identity and threat-report topics and LinkedIn audience demographics. Confirm sponsorship terms directly; the posts contain no rate card, disclosure or inquiry route.
Structure
Content
Lead with the published numbers: an 89% year-over-year rise in AI-enabled attacks, a 29-minute average breakout time, 27 seconds fastest observed, and 82% of detections malware-free, with attackers moving through valid credentials and approved SaaS integrations. These figures appear in John Ellingson's posts.
Step
1
Content
State the vendor's contrast: attackers aren't defeating the math; they're walking through a door a person opened. John Ellingson's post on human error uses that image and attributes 68-82% of breaches to a human element.
Step
2
Content
Name the wrong answers: more training, more sophisticated MFA, deeper behavioral analytics. The 40-years post lists those as approaches that haven't worked, setting up the vendor's product as an alternative.
Step
3
Content
Make the architectural claim: remove humans from the authentication loop and issue no persistent credentials, leaving no one to phish and no credential to social-engineer. John Ellingson's post frames this as eliminating the attack class behind most breaches rather than improving authentication.
Step
4
Content
Close on the cost of incrementalism: each new trusted layer raises the temperature, while institutions call denial risk management.
Step
5
Vendor inputs
Supply identity-attack telemetry that extends or challenges the 82% malware-free figure and the 29-minute breakout time. Bring a citable report with specific numbers.
Provide evidence that the product removes standing credentials, in a form an editorial reviewer can check. Ask for a source supporting the mechanism.
Reilyn Garton is the stronger choice when a vendor needs operator-level identity-attack tradecraft rather than a broad reframing of the perimeter.
Read more
The posts cover Volt Typhoon's use of valid accounts and living-off-the-land techniques, then session hijacking, OAuth abuse, MFA fatigue and token replay.
They ask defenders directly whether they log and correlate SMB, WMI and WinRM lateral movement, alert on anomalous service accounts, and fuse identity signals with endpoint and network data.
A vendor launching an identity-security product can use that detail to make the product argument concrete: which control breaks which attacker step, and what telemetry a buyer should demand.
This is a better fit than John Ellingson when a campaign needs detection-engineering specifics and actionable operator questions, while still staying on the theme that attackers sign in rather than break in.
The tradeoff is a narrower editorial frame.
Reilyn Garton's posts are tactical and citation-led, reference CISA and Mandiant, and focus on detection and identity telemetry.
They do not supply the larger cost-of-incrementalism argument, the ten-year extrapolation or the claim that removing humans from the authentication loop eliminates the attack class found in John Ellingson's posts.
A vendor that wants a thought-leadership piece built around a report-to-forecast structure would need to bring that macro argument itself or pair the alternative with the original creator's framing.
Before scaling, ask for audience demographics, post performance and commercial terms.
Derek Boxdell is the better choice when the buyer task shifts toward manufacturing and operational technology risk.
Read more
The posts cover a Manufacturers Alliance session on cybersecurity, industrial operations and AI, with production downtime framed as existential, OT resilience treated like uptime, and security built into automation design rather than added later.
A second post is a field-notes format on human distraction, trust after ransomware and breach exposure, and compliance as a competitive edge, citing laws and regulations including Texas safe harbor, EU RED and DORA.
For a vendor selling identity security into manufacturers, they can connect the product to plant uptime, automation and regulatory pressure in a way John Ellingson's posts do not.
The tradeoff is that the identity-security argument is weaker in Derek Boxdell's posts.
They do not develop the 82% malware-free or valid-credentials-instead-of-malware thesis with the same specificity, and they do not make the architectural case against perimeter defenses.
Derek Boxdell is adjacent rather than a direct substitute: a manufacturing buyer may be more receptive, but a campaign whose central claim is that the perimeter was bypassed by identity would still need John Ellingson's posts or new research.
Before committing, ask for audience composition, sponsorship terms and performance data.
Deepen Desai is the stronger alternative when the vendor needs a security-operations and AI-defense narrative rather than an identity-only argument.
Read more
The posts announce an agentic security operations launch, describe attackers automating and chaining exploits with AI, and argue that fragmented tools, incomplete visibility, high data-ingestion costs and manual steps leave many security operations centres unable to respond.
The second post covers early access to frontier AI models for testing against attack and defence scenarios, including multi-step reasoning used to construct exploit paths and the case for Zero Trust, continuous scanning and exposure management.
A vendor that wants to place an identity product inside a broader security-operations, exposure-management and AI-defence story can use that frame.
The tradeoff is commercial proximity.
Deepen Desai's posts read as product-launch and platform advocacy tied to a named security vendor; the first announces a specific agentic security operations solution and the second credits named AI-model access programmes.
That makes the material useful for a security-operations narrative but less neutral for an identity-security vendor that needs an outside editorial voice.
It also spends less time on the mechanics of credential theft, session hijacking and standing identity trust than John Ellingson or Reilyn Garton.
A competing vendor should confirm whether a sponsored campaign can sit alongside their platform advocacy, and ask for audience data and sponsorship terms.
Four LinkedIn posts attributed to John Ellingson carry no publication dates; they reference the CrowdStrike 2026 Global Threat Report, the World Economic Forum's Global Cybersecurity Outlook 2026, the Verizon 2026 Data Breach Investigations Report, and CISA's 2019 National Critical Functions material.
As of 9 October 2026, John Ellingson had 1,526 LinkedIn followers.
No long-form articles, videos, interviews, or other channels are available here, so nothing here speaks to work outside these posts.
The posts do not mention any signature book, show, business, or earlier career history.
A targeted name search is still needed before these posts can provide a complete account of who John Ellingson is, and they do not provide information about audience composition, post performance, or sponsorship terms.
