Joseph P Jensen

The reasoning is about visibility: traditional security controls were never designed to monitor how AI handles sensitive information, intellectual property, customer data and business strategy. Jensen frames this as the sequel to Shadow IT, and the alternative to a ban is a short list — approved tools, clear usage policies, education on risk and responsibility, visibility into AI usage, and what they call innovation within guardrails.

Jensen defines the term by reference to how outside sources describe it — "employee use of AI tools without organizational approval or oversight" — then contrasts the wrong response with the right one and closes on the line that carries the whole argument: "The first AI win for most organizations isn't deploying a new model. It's governing the AI that is already being used."

Read original

The numbers set the stakes — almost 33% of untrained employees failing phishing simulations, 71% of new hires failing within three months, and a real-world click rate around 2.7% — and the stunt shows employees what to look for.

• The instruction that follows is usable the same day: add "How to spot a fake QR Code" to prevention training, put quishing into monthly simulations, and when a phone camera shows a link preview from a scanned code, check where it points instead of tapping automatically.
• The campaign described is credited to a colleague; the framing and statistics are Jensen's.

Shawn Hardee, described by Jensen as Nailor's cyber manager, ran a rarely used physical quishing campaign: bulletins from a fake local shelter offering a cute puppy were posted in work areas, each carrying a QR code.

• Jensen closes the post on the joke that carries the lesson — "We at Nailor love puppies!
• They keep us cyber safe!"

Read original

The work is described by function, team and location — a cross-functional group led by the IT Data Strategy Team — rather than by product category. Read next to the Shadow AI post, the two positions are complementary rather than contradictory: govern the tools people adopt on their own, and ship the ones the company controls.

Jensen wanted to show the order-processing screen but it held confidential data, so the team found a way with a few "call-outs" — "Pun intended" — and added a line about Oreo, "our tuxedo cat support agent." The post is framed as recognition for the team rather than as a product announcement.

Jensen's public account of AI moves between warning about ungoverned employee use and reporting governed tools the company builds itself; both posts treat the same underlying question of who can see and approve what is running.

Read original

The style matches the governance writing: reduce the concept until someone with no background can complete it in one sitting.

Working with youth at Camp Strake on cybersecurity and AI, Jensen describes one Scout who successfully encrypted and decrypted the message "I AM COOL BECAUSE I AM A SCOUT" using nothing more than a pencil and a secret message, and ties the day to problem-solving and Scouting.

This is the only education post in the reviewed set, so it demonstrates the method rather than a sustained program; its frequency is not established.

Read original

Jensen keeps a light, first-person tone and includes small personal asides, which keeps the posts from reading like company notices.

Named across the posts are Shawn Hardee for the quishing campaign, the IT Data Strategy Team and its cross-functional group for the order-processing launch, the Software Dev Group, and visitors Katelin Murray of Tusk Strategies and Vanessa Hope Schneider of Squint, thanked for coming to the facility to "share our Manufacturing AI Journey with the world" ahead of a full article Jensen says is coming.

Read original · Original 2 · Original 3

The same first-person, lightly humorous register carries career reflection, which tells a reader that this is a person who posts about more than security and technology.

Jensen encourages early voting in Texas, which they say opened the previous day and ran through Friday, October 30, 2026, quotes Samuel Adams from 1781 on voting as "one of the most solemn trusts in human society," and wishes everyone in their network a sticker. In a separate post they mark 19 years on LinkedIn with a then-and-now list: data strategy analyst in labor relations at United Airlines in Chicago in 2007, CIO at Nailor Industries in Houston in 2026.

Read original · Original 2

It is the clearest statement of the position his other posts assume.

Jensen writes that every organization he speaks and interacts with is focused on AI strategy, governance, and adoption, but that many are overlooking the AI initiative already underway: employees using ChatGPT, Claude, Gemini, browser extensions, meeting summarizers, and AI coding assistants whether or not IT has approved them.

• He calls this the era of Shadow AI, following Shadow IT, and points out that AI can process sensitive information, intellectual property, customer data, and business strategy in ways traditional security controls were never designed to monitor.
• His recommended response is not a ban but approved tools, clear usage policies, education on risk and responsibility, visibility into AI usage, and what he calls innovation within guardrails.
• The closing line is the argument in one sentence: the first AI win for most organizations is not deploying a new model, it is governing the AI that is already being used.

For brands planning a campaign

This is the natural spine for a Shadow AI governance webinar. It already contains a four-part agenda — policy, education, visibility, guardrails — plus a quotable framing line, and it lets a sponsor position approved-tools adoption rather than a ban.

Jensen opens with three numbers: almost 33% of untrained employees fail phishing simulations, 71% of new hires fail within three months of their start date, and the real-world average phishing click rate is around 2.7%.

• He then describes a rarely used physical quishing campaign completed by Shawn Hardee, Nailor's cyber manager, in which bulletins from a fake local shelter offering a cute puppy were posted in work areas.
• The instruction that follows is specific: add "How to spot a fake QR Code" to employee cyber prevention training and include quishing in monthly simulations, check the web link preview that appears when a phone camera points at a code, do not tap automatically, and verify the destination.
• The post ends on the joke that carries the lesson: "We at Nailor love puppies!
• They keep us cyber safe!"

For brands planning a campaign

A sponsor gets a differentiated training hook — physical QR-code attacks instead of generic phishing — plus named failure statistics to open a session and a demonstration of how Jensen writes for non-technical employees.

After a successful pilot, Jensen writes, the company planned an October launch of an internal, bespoke, AI-enabled order-processing program to streamline order handling in Houston.

• He frames the post as recognition for a cross-functional team led by the IT Data Strategy Team, following an earlier post that praised the software development group for a November 30 deployment of Online Select Works.
• He notes that he could not share an actual screenshot because it contained a lot of confidential data, so the team used a few "call-outs" — "Pun intended" — and adds a line about Oreo, "our tuxedo cat support agent."

For brands planning a campaign

A usable internal-adoption story: pilot-to-launch sequencing, cross-functional ownership, and the confidentiality constraints that come with showing real systems. The self-aware tone also suggests a customer-story format rather than a formal case study.

Jensen describes working with youth at Camp Strake on cybersecurity and AI, turning big concepts into hands-on challenges and real-world learning.

• The memorable detail is a Scout who successfully encrypted and decrypted the message "I AM COOL BECAUSE I AM A SCOUT," which Jensen uses to make the point that it sometimes starts with nothing more than curiosity, a pencil, and a secret message.
• He describes the day as one of learning, weather, problem-solving, and Scouting, and tags the post for cybersecurity education, AI education, mentorship, and leadership.

For brands planning a campaign

Supports education, STEM, and mentorship programming. It also shows Jensen can explain encryption to a room with no technical background, which matters when a campaign needs a beginner-level explainer rather than a deep technical talk.

Jensen marks what he calls a milestone, non-milestone: 19 years since joining LinkedIn, which he says places him in the high 99th percentile of members, and 6,940 days.

• In 2007 he lists his title as data strategy analyst in labor relations at United Airlines, in Chicago, and his reason for joining as an MBA professor who said so.
• In 2026 he lists CIO at Nailor Industries, in Houston, and his reason for staying as loving to see his network thrive and posting fun stuff.
• Favourite food moved from Italian to Indian, and the number of Minnesota Vikings Super Bowls stayed at zero in both years.

For brands planning a campaign

Useful raw material for speaker introductions and event bios: a compact career arc plus a self-deprecating format a host can adapt for a promotional post.

Jensen thanks Katelin Murray of Tusk Strategies and Vanessa Hope Schneider of Squint for visiting the facility last week "to share our Manufacturing AI Journey with the world," and says a full article is coming soon. The post is short: it does not describe the visit, the article, or the terms of the collaboration, and no payment or sponsorship is stated or implied.

For brands planning a campaign

Suggests that a facility visit or a documented case study is a realistic format for a partnership. Because the promised article was not available in the material reviewed, any campaign plan should confirm what was actually published before citing it.

Jensen argues against cutting people off over political differences, writing that differences of opinion are an inevitable part of human nature and a free society and that they make us all better.

• He encourages early voting in Texas, which he says started the previous day and ran through Friday, October 30, 2026, and quotes Samuel Adams from 1781 on voting as one of the most solemn trusts in human society.
• He closes with the wish that everyone in his network earns a sticker.

For brands planning a campaign

Not a fit for a cybersecurity brief, but worth knowing before planning a campaign: sponsored work would sit alongside personal and civic posts, so a brand should agree on scope rather than assume a single-topic feed.

He calls banning AI the wrong response and lays out the alternative: approved tools, clear usage policies, employee education on risk, visibility into what is actually being used, and innovation inside guardrails.

Frames the issue as a repeat of the Shadow IT era, defines "Shadow AI" by reference to how external sources describe it, then contrasts a wrong response with a right one and closes with a five-point action list — a structure that reads like a talk outline.

For brands planning a campaign

This is the topic the brief asks about, and the post already supplies a workable webinar spine: the ban-versus-govern debate, the visibility gap, and the five actions. A cybersecurity vendor can position Jensen as the practitioner who has to make AI governance work inside a manufacturer, rather than as a vendor analyst.

Examples: Source 1

He asks readers to add "how to spot a fake QR code" to employee training and quishing to monthly simulations, and gives a concrete rule: check the link preview before tapping.

Opens with numbers, moves to a named colleague's campaign, and ends with an instruction a reader can act on the same day.

For brands planning a campaign

Works for security-awareness and phishing-simulation vendors. Jensen brings an internal campaign story with a named owner rather than generic best-practice advice, and the quishing angle is specific enough to carry a short co-produced piece.

Examples: Source 1

He describes the work as cross-functional and led by an IT data strategy team, and notes that a screenshot had to be marked up with call-outs because the real screen held confidential data.

Uses pilot-to-launch milestones as the story unit and gives operational detail — function, location, team — rather than product names or vendor categories.

For brands planning a campaign

Suited to industrial software, ERP, and manufacturing-technology vendors who want a CIO describing internal AI builds and their limits. Because he does not name outside vendors, a partner would supply the product narrative while Jensen supplies the operations context.

Examples: Source 1

He ties the exercise to curiosity, problem-solving, and Scouting.

A teaching anecdote built around one concrete classroom artifact, written as a personal recap rather than a program announcement.

This is the only education post in the reviewed set, so the topic's frequency and depth are unproven.

For brands planning a campaign

Supports STEM-education, workforce-pipeline, and community programs. A vendor sponsoring youth cyber education could use Jensen as a credible practitioner voice, but the evidence shows one session, not a sustained program.

Examples: Source 1

Announcement-style post that credits the outside partners and trails forthcoming coverage.

The referenced article is not part of the reviewed evidence, so its content, claims, and byline are unknown.

For brands planning a campaign

Shows Jensen and Nailor already work with external communications partners on AI narrative, which lowers the barrier for a media, research, or agency collaboration. A vendor could propose a joint piece rather than a standalone sponsored post.

Examples: Source 1

He uses humor and small personal details — a cat called Oreo described as the support agent — to keep the posts human.

Recognition posts built around a specific project milestone, with named contributors and a light joke.

For brands planning a campaign

A partner or vendor that works with Jensen can expect public acknowledgement on his feed, which is useful for co-marketing. It also means a campaign should decide in advance how the partner is named and credited.

Examples: Source 1 · Source 2 · Source 3

One post marks 19 years on LinkedIn with a then-and-now comparison — data strategy analyst in Chicago in 2007, CIO in Houston now — and another urges people to vote in Texas early voting, quotes Samuel Adams, and rejects the idea of ending friendships over political differences.

Milestone and civic posts written in the same short, first-person, lightly humorous register as the professional ones.

For brands planning a campaign

A brand buying into Jensen's feed is buying into a person who posts about career, civic duty, and personal taste, not a topic-only channel. Political content is present, so a campaign should decide in advance how a brand message sits alongside it.

Examples: Source 1 · Source 2

View example

View example

The post describes the visit and the planned coverage; no commercial terms are stated.

View example

No commercial terms or client relationship are stated.

View example

The post presents this as community teaching, not a commercial relationship.

View example

One post argues the browser extension is "the data decision almost nobody is governing," and pairs CISO survey findings, 71% already testing or using AI agents and 78% naming agent security their top pain point, with the observation that agents are making decisions at scale before anyone can see them.

• Another takes a Reddit thread about an AI triage prompt and turns it into an architectural rule: keep the system's findings separate from the AI's presentation of them.
• Both writers treat AI governance as an operations problem rather than a model problem, and both build the argument from one concrete incident.

Juncker's raw material is other people's work, vendor posts, surveys and a Reddit thread, read from inside a security vendor's awareness campaign and turned into requirements for security teams.

• Jensen writes about programs he is responsible for at a manufacturer: an internal order-processing build, a quishing campaign run by a named colleague, a youth class.
• Juncker gives a reader market and architecture analysis; Jensen gives a reader a first-person account of running the work.

Read original · Original 2

It is an institutional trust, resilience, and governance function."

• That sits close to Jensen's argument that governing the AI already in use is the first win for most organizations.
• Both also post in a first-person, career-and-work register on LinkedIn rather than as a company account.

Washburn's reviewed posts are a hiring notice for a vulnerability management analyst and a career reflection, so the material shows direction and priorities rather than campaign case studies, attack simulations or teaching exercises of the kind Jensen publishes. The setting differs as well, a large research university against a manufacturer, so a reader gets institutional mission framing from Washburn and hands-on program detail from Jensen.

Read original · Original 2

One roundup collects a frontier-model release, agentic AI already running in production network operations, a Gemini testing incident and a browser-extension attack that hijacked privileged AI assistants, and asks what organizations are prepared to let AI do.

• A second post on a model escaping its sandbox lands on the same conclusion Jensen reaches from the inside: "The model is not the control boundary.
• The system around it is."
• Both put browser extensions and agent permissions at the center of AI governance and both argue that enterprise governance is behind the tools.

North's unit is the digest: model releases, vendor research, security incidents and source links, closing with a follow-and-contact line for a firm, and the argument is about autonomy and where control boundaries sit.

• Jensen's unit is the internal project recap, a pilot that shipped or a campaign a colleague ran, with no vendor news and no reading list.
• A reader who wants the market view should follow North; a reader who wants to watch governance practiced inside one company should follow Jensen.

Read original · Original 2

The reviewed posts curate three sources: a field CTO on how browser extensions move data in ways traditional controls were not built to catch; a CISO Village survey where 71% of CISOs are testing or using AI agents while 78% call agent security a top pain point; and a CISO AI leverage report where 67% name securing AI agents as their top AI security problem and only 37% have a dedicated AI security budget.

• The post closes on the question that can open the webinar: which AI tools did your employees install this year that you never approved?
• Juncker also argues the technical half well — an AI summary of security findings cannot become the system of record, prompts should be versioned and regression tested like code, and detection should stay separate from presentation.
• That suits a sponsor selling visibility or governance software, and it fits an awareness-month framing, since shadow AI appears alongside AI phishing, BEC and collaboration governance in the vendor awareness kit the post describes.

The session changes shape.

• Juncker's reviewed posts are curation and observation written from inside a security vendor's own deployments, not a first-person account of running governance at a non-security employer.
• A buyer who wants to hear what was deployed, what it cost, and what broke gets a briefing instead.
• The action list that makes Jensen's session practical — approved tools, clear usage policy, education, visibility into usage, innovation inside guardrails — has no equivalent here; Juncker's material ends in a question rather than a program.
• Because the posts speak from within a named security vendor's deployments and campaign, a sponsor in the same product category should check that relationship before treating the session as independent.
• No audience data or speaking record was available for Juncker either.

Examples: Source 1 · Source 2

The reviewed posts describe several years of work building and maturing cybersecurity and governance at a large research university: vulnerability management, incident response, security operations, awareness and training, zero trust, AI security and governance, data governance, and policy development, with the argument that security in higher education is an institutional trust, resilience and governance function rather than a purely technical one.

• That framing carries a session about governing AI across a distributed institution with research data, student records and shared decision-making, and it speaks to buyers whose customers are universities.
• A second option is a talent-and-program angle: the hiring post for a vulnerability management security analyst lays out the role from scanning, validating and prioritising across endpoint, server, network, identity, cloud and SaaS through SIEM and EDR triage and security dashboards, which fits a sponsor selling into security teams rather than selling governance software.

The topic has to move.

• Shadow AI does not appear in the reviewed material, and AI security and governance is one item in a list of capabilities rather than a developed argument.
• There is no equivalent to Jensen's list of unapproved tools, the ban-versus-govern framing, or the quishing and phishing campaign examples.
• The two posts are a job advertisement and a career reflection, so there is no published talk, article or framework to build a session spine from — the sponsor would be commissioning a talk from scratch.
• The audience differs too: higher education and research institutions, not manufacturing or general enterprise IT, so a vendor whose product is bought by industrial or commercial security teams should expect a narrower room.
• Reach, speaking history and audience composition are not documented in what was reviewed.

Examples: Source 1 · Source 2

His reviewed posts track the shift from model intelligence to autonomy with specifics: a Cisco and Omdia survey of 1,000 IT and network operations leaders where 51% already have agentic AI acting in production network operations and 82% are comfortable letting AI make at least some production network changes without prior human approval; a Google Gemini test that reached three real companies instead of the fictional targets; and the BragJack technique, in which a malicious browser extension hijacked privileged AI assistants across several browsers.

• His line that the model is not the control boundary and the system around it is gives a session its thesis, and the questions he lists — what can it access, what credentials can it use, what can it do without approval, how fast can an exception be contained — give the sponsor a panel structure.
• North cites his sources, so a news-driven or fast-turnaround format suits him, and he publishes a working contact address in his posts, which helps a sponsor that needs an inquiry route.

The conversation moves away from the sponsor's likely product.

• North's reviewed posts cover agent identity, credentials, permissions and network operations; they do not discuss employee-installed AI tools or how an organisation discovers, approves and governs them, so a vendor selling AI discovery, policy or usage visibility gets less direct relevance and has to bridge from agent security to employee use.
• His work is commentary on industry news rather than a first-person account of governing AI inside an employer, so the 'here is how we did it' evidence a webinar audience values is missing.
• His posts also carry promotional contact details and a follow request, so the sponsor should agree in advance how much of the session is analysis and how much is promotion.
• As with the other two, no speaking record, rate card or audience data was available.

Examples: Source 1 · Source 2