# Joseph P Jensen

Joseph P Jensen is the CIO at Nailor Industries. Jensen writes about cybersecurity and AI governance, shares examples of technology work at Nailor, and teaches cybersecurity and AI through hands-on activities.

- Profile: https://b2binfluencer.marketing/creators/joseph-p-jensen/
- LinkedIn: https://www.linkedin.com/in/josephjensen
- Median of last 7 posts: 26 reactions, 4 comments (checked 2026-11-02)
- Topics: artificial-intelligence, leadership, cybersecurity, ai-governance
- Based on 9 dated posts, latest 2026-10-07

## Summary

Jensen is most useful for grounded CIO perspective on governing Shadow AI and practical cybersecurity training.

- Best for: B2B cybersecurity or governance campaign needing a CIO speaker and co-produced content.
- Not for: Direct-to-employee AI productivity vendor promoting unapproved browser-based assistant to individual contributors.
- Check first: Confirm recent LinkedIn audience data and evidence of reaching CIOs or governance leaders.

### Takeaways

- Shadow AI is already in the building, and banning it is the wrong fix.
- Awareness training lands when the attack is physical and numbers are specific.
- Internal AI order-processing launch credited to a cross-functional team and IT Data Strategy Team.

## Main ideas

- **Shadow AI is already in the building, and banning it is the wrong fix**: Jensen's core position is that employees are using ChatGPT, Claude, Gemini, browser extensions, meeting summarizers and AI coding assistants whether or not IT has approved them, so the first AI win for most organizations is not deploying a new model but governing the use that already exists. The reasoning is about visibility: traditional security controls were never designed to monitor how AI handles sensitive information, intellectual property, customer data and business strategy. Jensen frames this as the sequel to Shadow IT, and the alternative to a ban is a short list — approved tools, clear usage policies, education on risk and responsibility, visibility into AI usage, and what they call innovation within guardrails.
- **Awareness training lands when the attack is physical and the numbers are specific**: Rather than urging general caution, Jensen pairs failure statistics with one concrete attack format. The numbers set the stakes — almost 33% of untrained employees failing phishing simulations, 71% of new hires failing within three months, and a real-world click rate around 2.7% — and the stunt shows employees what to look for. The instruction that follows is usable the same day: add "How to spot a fake QR Code" to prevention training, put quishing into monthly simulations, and when a phone camera shows a link preview from a scanned code, check where it points instead of tapping automatically. The campaign described is credited to a colleague; the framing and statistics are Jensen's.
- **Build the AI you can point to, and describe it by team and place**: When Jensen writes about AI, the examples are internal and bespoke rather than vendor products: an AI-enabled order-processing program built to streamline order handling in Houston, launched in October after a successful pilot, and an earlier software-development deployment of Online Select Works. The work is described by function, team and location — a cross-functional group led by the IT Data Strategy Team — rather than by product category. Read next to the Shadow AI post, the two positions are complementary rather than contradictory: govern the tools people adopt on their own, and ship the ones the company controls.
- **Teach the big idea through something a beginner can finish**: Jensen's teaching method is to turn abstract concepts into hands-on challenges and real-world learning, on the argument that entry into a technical subject can start with curiosity and simple tools rather than with theory. The style matches the governance writing: reduce the concept until someone with no background can complete it in one sitting.
- **Name the people who did the work**: Recognition is a consistent habit rather than an occasional flourish: project posts are written as credit to specific teams and individuals, with the milestone as the occasion. Jensen keeps a light, first-person tone and includes small personal asides, which keeps the posts from reading like company notices.
- **Disagreement is not a reason to cut people off**: In a civic post Jensen argues that differences of opinion are an inevitable part of human nature and a free society and that they make everyone better, rejects the idea of ending friendships over political views, and urges people to vote. The same first-person, lightly humorous register carries career reflection, which tells a reader that this is a person who posts about more than security and technology.

## Work to read

- [Shadow AI is already here, and banning it is the wrong response](https://www.linkedin.com/posts/josephjensen_ai-shadowai-cybersecurity-activity-7500266062442237952-4ATx)
- [A physical QR-code phishing campaign, with the failure rates behind it](https://www.linkedin.com/posts/josephjensen_almost-33-of-untrained-employees-fail-phishing-activity-7497840594141126656-8IN6)
- [An internal AI order-processing launch, credited to a cross-functional team](https://www.linkedin.com/posts/josephjensen_last-month-i-highlighted-the-amazing-work-activity-7512899308187176960-butX)
- [Teaching cybersecurity and AI at Camp Strake](https://www.linkedin.com/posts/josephjensen_cybersecurity-artificialintelligence-ai-activity-7507983143115784192-o3Yt)
- [Nineteen years on LinkedIn, as a before-and-after list](https://www.linkedin.com/posts/josephjensen_a-milestone-non-milestone-this-weekend-activity-7509416182631026688-0YTH)
- [Hosting Tusk Strategies and Squint for a manufacturing AI visit](https://www.linkedin.com/posts/josephjensen_thank-you-to-katelin-murray-of-tusk-strategies-activity-7523087922720497664-BvG4)
- [A civic post on voting and disagreement](https://www.linkedin.com/posts/josephjensen_i-will-never-be-friends-with-insert-name-activity-7518347125911392256-3PQg)

## Brand relationships

- **Nailor Industries** (employment)
- **United Airlines** (employment)
- **Tusk Strategies** (disclosed_partnership)
- **Squint** (disclosed_partnership)
- **Camp Strake** (mention)

## Partnerships

Joseph P Jensen does not publish a sponsorship offer, speaking-fee page, or partnership inquiry route in the available posts. The visible activity is tied to Jensen's role as CIO at Nailor Industries and to education and industry outreach. Nailor's internal work appears in posts about an AI-enabled order-processing program, a physical quishing campaign run by the company's cyber manager, and a visit from Tusk Strategies and Squint to discuss Nailor's manufacturing AI journey, with an article promised later. Jensen also describes teaching cybersecurity and artificial intelligence to youth at Camp Strake. For a B2B cybersecurity company planning a Shadow AI governance webinar or content collaboration, that absence matters. There is no published format to buy, no stated fee or deliverable, and no official partnership contact to use. Any approach would need to be negotiated directly, and Jensen's employer context and Nailor's confidential internal data would likely shape what Jensen can discuss publicly. The posts show comfort explaining Shadow AI governance and hands-on security awareness, but they do not show a commercial speaking or sponsorship offer.

## Alternatives

- Rob Juncker: Choose Juncker when the sponsor wants a market briefing built from current CISO data rather than one company's implementation story. The reviewed posts curate three sources: a field CTO on how browser extensions move data in ways traditional controls were not built to catch; a CISO Village survey where 71% of CISOs are testing or using AI agents while 78% call agent security a top pain point; and a CISO AI leverage report where 67% name securing AI agents as their top AI security problem and only 37% have a dedicated AI security budget. The post closes on the question that can open the webinar: which AI tools did your employees install this year that you never approved? Juncker also argues the technical half well — an AI summary of security findings cannot become the system of record, prompts should be versioned and regression tested like code, and detection should stay separate from presentation. That suits a sponsor selling visibility or governance software, and it fits an awareness-month framing, since shadow AI appears alongside AI phishing, BEC and collaboration governance in the vendor awareness kit the post describes.
- Ian Washburn: Washburn is the better choice when the audience is a university, research institution, hospital or public agency rather than an industrial company. The reviewed posts describe several years of work building and maturing cybersecurity and governance at a large research university: vulnerability management, incident response, security operations, awareness and training, zero trust, AI security and governance, data governance, and policy development, with the argument that security in higher education is an institutional trust, resilience and governance function rather than a purely technical one. That framing carries a session about governing AI across a distributed institution with research data, student records and shared decision-making, and it speaks to buyers whose customers are universities. A second option is a talent-and-program angle: the hiring post for a vulnerability management security analyst lays out the role from scanning, validating and prioritising across endpoint, server, network, identity, cloud and SaaS through SIEM and EDR triage and security dashboards, which fits a sponsor selling into security teams rather than selling governance software.
- Gregory North (He/Him): North is the stronger pick when the brief is about agentic AI — what agents are allowed to access and do — rather than employee use of unapproved tools. His reviewed posts track the shift from model intelligence to autonomy with specifics: a Cisco and Omdia survey of 1,000 IT and network operations leaders where 51% already have agentic AI acting in production network operations and 82% are comfortable letting AI make at least some production network changes without prior human approval; a Google Gemini test that reached three real companies instead of the fictional targets; and the BragJack technique, in which a malicious browser extension hijacked privileged AI assistants across several browsers. His line that the model is not the control boundary and the system around it is gives a session its thesis, and the questions he lists — what can it access, what credentials can it use, what can it do without approval, how fast can an exception be contained — give the sponsor a panel structure. North cites his sources, so a news-driven or fast-turnaround format suits him, and he publishes a working contact address in his posts, which helps a sponsor that needs an inquiry route.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/