Justin Foster writes about cybersecurity, AI, cloud technology, and security operations. Foster's posts explain how security teams can use data and AI to investigate threats, prioritize action, and manage costs.
Most useful as a speaker and co-created editorial partner who explains AI, cloud security data, and security operations to enterprise buyers.
Best for
A cybersecurity vendor booking a webinar, panel, or co-authored explainer for security practitioners and decision makers.
Not for
Paid sponsored social posts bought mainly for reach, impressions, follower growth, and engagement rate.
Key takeaways
Security AI needs trustworthy context, not just a capable model
Choose cloud or on-premises based on the security problem
Token limits expose design and cost problems
Check first: Ask for audience job-title, seniority, industry, location data, media kit, and commercial terms.
Main ideas
Security AI needs trustworthy context, not just a capable model · Choose cloud or on-premises based on the security problem · Token limits expose design and cost problems
Justin Foster’s posts focus on cybersecurity, AI, cloud technology, and security operations.
They make a recurring case that useful security AI depends on sound engineering and context: reliable, connected data; retrieval and summarization; and clear limits on automated tool use.
In a cloud-security post, they argue that the choice between cloud and on-premises matters less than whether teams can find historical context and prioritize real, exploitable risks.
Other posts apply the same practical lens to AI costs and post-quantum risk.
A shorter post about a conversation with Rik Ferguson shows Foster pointing readers toward other experts’ work.
Foster turns broad technology claims into operational questions for security teams.
Rather than treating AI as a solution by itself, the posts emphasize the conditions for using it well: current, connected data; retrieval and task design; and controls on cost and tool use.
A cloud post makes that approach concrete, pairing security teams’ challenges—scale, decision overload, and reconstructing past activity—with examples of historical asset and event data, vulnerability context, and on-premises sensors.
A post about token limits offers a useful counterpoint to AI enthusiasm, treating exhausted context as a design problem.
Another about quantum computing shifts attention from the arrival of a machine to preparation for a possible change in encryption.
Marketers looking for practical, enterprise-focused explanations of security technology will find those themes across the five posts.
Justin Foster’s posts favor practical explanations over technology hype.
Read more
In cybersecurity, the useful question is whether teams have enough reliable context to understand what is happening and act on it.
For AI, that means treating data quality, system design, and operating costs as part of the product—not assuming a stronger model will solve everything.
They also apply this problem-first approach to infrastructure and emerging risks.
Security AI needs trustworthy context, not just a capable model
Foster argues that confidently wrong AI in cybersecurity is often a data problem: information is stale, fragmented, or trapped in disconnected tools.
Read more
Security teams need enough history and context to investigate events and distinguish actionable exposure from theoretical risk.
Foster writes, “The model isn’t the moat.
The context is,” and describes using asset history and security events to investigate how an intrusion developed.
In a product-focused post, they also describe correlating assets with known exploited vulnerabilities to surface what is exploitable in a particular environment.
Choose cloud or on-premises based on the security problem
Rather than treating cloud and on-premises as opposing camps, Foster asks what the team needs to accomplish.
Read more
They argue for matching each environment to its strengths: retain historical data and analyze it at scale in the cloud, while using on-premises sensors where they can see devices or network traffic that cloud services cannot directly observe.
Foster describes on-premises sensors for unagentable devices and east-west traffic, alongside cloud storage for 90 days of asset-state changes and a full year of security events. That history can help teams work out how a threat actor entered or persisted in a network.
Foster treats running out of tokens as a signal to examine how an AI task was designed, not as an unavoidable excuse.
Read more
Retrieval, summarization, task decomposition, and limits on repeated tool calls all affect whether an agent can finish its work. Usage costs and latency can also compound in production.
Foster compares “I ran out of tokens” to “the dog ate my homework,” then lists bad retrieval, missing summarization, lack of task decomposition, and unguarded tool-call loops as possible causes. They argue that teams should budget tokens because they carry real costs.
Plan for future security risks before the technology arrives
Foster presents post-quantum security as a planning concern rather than something to ignore until a machine capable of breaking current encryption exists.
Read more
Foster says the machine does not exist yet and names IonQ, IBM, and PsiQuantum in connection with roadmaps toward 2030, adding that AI is closing the gap. They also announce a discussion with Rik Ferguson about Mythos, GPT 5.5 for Cyber, and other frontier models, raising the question of whether vulnerability levels will plateau or become a new normal.
This post shows how Justin Foster explains a commercial security platform.
Read more
Start here to see whether they can turn product architecture into a clear enterprise buyer problem.
Justin Foster argues that the cloud-versus-on-premises debate misses the real question: what problem is a security team trying to solve?
They identify scale, historical context and decision overload as the pressures driving change.
The post names specific capabilities in Forescout Cloud: 90 days of granular asset state changes, a full year of security events, Vistaro AI correlating assets with known exploited vulnerabilities, and agentic AI doing skill-based reasoning across large datasets.
It also keeps on-premises sensors in the picture for unagentable devices and east-west traffic.
The piece replaces a familiar industry argument with a concrete operational case: long-term history, exploitability and prioritized action.
For brands planning a campaign
A campaign could use this as evidence that Justin Foster can explain the value of hybrid cloud and security operations to enterprise buyers without reducing the message to cloud-for-cloud's-sake.
This post shows how Justin Foster frames AI costs and reliability.
Read more
Start here for their practical view of what separates teams shipping value from teams hitting limits.
Justin Foster opens with a blunt analogy: is 'I ran out of tokens' the new 'the dog ate my homework'?
They describe projects that nearly finish before hitting token limits, acknowledge the value of large language models, and point to rising prices and tighter usage limits.
Their core argument: tokens are a budget, not an excuse.
When an agent burns through its context window, they treat it as a design problem caused by bad retrieval, no summarization strategy, no task decomposition or no guardrails on tool-call loops.
The post reframes a familiar complaint as an engineering discipline issue.
For brands planning a campaign
This post offers a direct way to discuss production constraints, latency and design quality rather than model hype, making it useful for conversations about AI cost governance or agent reliability.
This post shows how Justin Foster curates adjacent expert work.
Read more
Start here for their interview and referral voice rather than a standalone teaching post.
Justin Foster asks whether software vulnerabilities will peak and plateau after Mythos or settle into a new normal.
They say they are joined by Rik Ferguson to discuss the world after Mythos, GPT 5.5 for Cyber and other frontier large language models.
They also recommend Ferguson's book Assume Autonomy.
The short post points readers to a conversation and a book, showing how Justin Foster uses their platform to connect a technical audience with another expert's framework.
For brands planning a campaign
Justin Foster could suit moderated interviews or expert introductions on vulnerability management and AI security. Ask for examples of their depth in these areas before booking.
This post shows what Justin Foster sees as the main obstacle to useful generative AI in cybersecurity.
Read more
Start here for their concise data-readiness argument.
Justin Foster asks whether generative AI in cybersecurity is confidently wrong, then argues that the problem is context, not AI.
They explain that copilots and agentic SOC tools are only as good as the data underneath them, and that enterprise data is often stale, fragmented and scattered across tools that do not talk.
The post closes with a memorable line: the model is not the moat, the context is.
It shifts the cause of a common failure from the model to the data environment.
For brands planning a campaign
This post supports messaging around data quality, integration and context readiness for security AI. Justin Foster could suit campaigns seeking a practical counterpoint to model-centric claims.
Context, not the model, determines whether AI works in security
Justin Foster argues that confidently wrong answers from AI copilots or agentic security tools usually stem from the enterprise data underneath.
Read more
In one post they write, "the model isn't the moat.
The context is," pointing to stale, fragmented data spread across tools that do not share information.
In another, they describe using agentic reasoning across very large datasets to turn raw telemetry into clear, prioritized actions for human operators and correlate assets with known exploited vulnerabilities, helping teams see what is actually exploitable in their environment rather than theoretical risk.
Reframing complaints about bad AI output as a data and context problem, with specific gaps: stale data, fragmented sources, and missing long-term history.
For brands planning a campaign
Useful for vendors selling data platforms, security data lakes, or AI governance. Justin Foster can steer a product conversation toward data readiness rather than model choice—the question enterprise buyers have to answer before any AI tool delivers value.
Cloud and on-premises: start with the problem to solve
Justin Foster calls the cloud-versus-on-premises debate "the wrong conversation" and says security teams should start with what they are trying to solve: scale, historical context, and decision overload.
Read more
They describe a hybrid setup in which on-premises physical and virtual sensors handle what agents cannot reach and monitor east-west traffic, while the cloud keeps 90 days of granular asset state changes and a full year of security events so teams can reconstruct how an intrusion happened.
Turning an industry debate into a requirements question, then matching workloads to what each environment does well.
For brands planning a campaign
Fits cloud migration, hybrid infrastructure, and security operations vendors seeking an argument against one-size-fits-all positioning. The analysis comes from a vendor product perspective, making it better suited to a sponsored point of view or moderated discussion than a neutral comparison.
Justin Foster compares "I ran out of tokens" to "the dog ate my homework" and argues that an exhausted context window is a design failure, not bad luck.
Read more
They list bad retrieval, no summarization strategy, no task decomposition, and no guardrails on tool-call loops as the real causes.
They predict prices will rise and usage limits will tighten as features move to higher tiers and frontier models carry steep multiples.
In their account, the teams shipping real value with AI treat every token as if it costs something—because in production it does.
Opening with a workplace joke, then diagnosing engineering causes in a short, concrete list.
For brands planning a campaign
Strong material for AI platform, developer tooling, or cost-optimization vendors whose buyers face model spend and reliability challenges at scale. Foster translates production AI economics for a mixed audience while retaining the technical specifics buyers want to see.
Post-quantum encryption as a deadline, not a hypothetical
Justin Foster frames today's encryption as already carrying an expiration date, even though the machine that breaks it does not exist yet.
Read more
They name IonQ, IBM, and PsiQuantum as racing toward that capability before 2030 and say AI is now closing the last gap.
Leading with a question, then making a long-horizon technology risk a near-term planning concern.
For brands planning a campaign
Suits vendors selling cryptography, key management, or long-term data protection who need to make a future risk actionable against current budgets. The post is short; use it as an opening argument for a livestream, webinar, or follow-up explainer.
Frontier-model discourse and vulnerability management, in conversation
In one post, Justin Foster says they were joined by Rik Ferguson to discuss the world after Mythos, GPT 5.5 for Cyber, and other frontier large language models.
Read more
They ask whether a spike in software vulnerabilities will settle into a plateau or become a new normal. The post also recommends Ferguson's book Assume Autonomy rather than only promoting their own view.
Pairing with another named practitioner and pointing readers to outside reading spreads credit and makes the discussion feel less like self-promotion.
The posts give only the announcement, not the discussion's content. Ask for a recording or outline before booking if the substance of the conversation matters to the campaign.
For brands planning a campaign
A bookable format: a moderated interview or co-hosted discussion between two named experts on vulnerability management and frontier AI. Brands get a second credible voice and a less promotional tone, with less control over the conversation.
Justin Foster's posts document one company relationship: Forescout.
Read more
They write as part of the team behind Forescout Cloud, tag Forescout Technologies Inc., and use the #Forescout hashtag across the posts, pointing to employment rather than sponsorship or client work.
The posts mention no sponsorships, affiliate arrangements, clients, investments, or owned businesses.
Other companies, including IonQ, IBM, and PsiQuantum, appear only as passing market context in a post about quantum-computing roadmaps, with no stated relationship.
Forescout
Employment
Forescout is the only company with a documented relationship in the collected posts.
Read more
In a post about cloud security, Justin Foster writes as part of the team behind the product — "This is why we built Forescout Cloud (part of the 4D platform)" — describes its asset-history and event-retention features, and points readers to Forescout.com.
The other posts tag Forescout Technologies Inc. and use the #Forescout hashtag.
The posts give no job title or dates; ask for the role and its duration.
Start with Justin Foster's short posts on why AI in security depends on data context, how to budget tokens in production, and how to plan for post-quantum risk.
Read more
The tags below cover those themes: cybersecurity, agentic AI, security operations, AI data context, cloud and hybrid security, vulnerability management, post-quantum cryptography, AI cost and reliability, and their short-form analysis format. Use the similar creators to compare their arguments with those of other practitioners writing about AI's impact on offensive and defensive security work.
Both write about how AI agents are changing security operations, including exposure management, threat research, and testing frontier models against real attack scenarios.
Read more
Desai's posts center on named vendor launches and trusted-access programs at Zscaler, while Foster makes shorter industry arguments from a product and platform perspective.
Both treat AI as a step-change in offensive and defensive security, arguing that adding people alone will not keep pace with AI-generated and AI-exploited vulnerabilities.
Read more
Geffen focuses on the economics of security hiring and on AI pentesting and offensive-security automation, while Foster focuses on data context, telemetry history, and security operations.
Both examine how AI changes the economics of finding and fixing vulnerabilities, and stress verification and human judgment over model hype.
Read more
Manico focuses more on application security tooling, SAST and DAST, and software engineering standards, while Foster writes about security operations, asset context, and cloud versus on-premises architecture.
Justin Foster's LinkedIn following of roughly 4,000 makes reach a secondary reason for a cybersecurity vendor to work with them.
Read more
The stronger case for a speaking or thought-leadership partnership is topical fit with security practitioners and decision makers.
Their posts make close arguments about cloud-based security telemetry, agentic AI in security operations, token and inference cost control, and post-quantum encryption, using the vocabulary security teams know.
The posts do not report audience geography, age, gender, job function, seniority, or employer.
For a cybersecurity campaign aimed at enterprise buyers, ask Foster for audience survey results or recent platform analytics covering follower job titles, seniority, industries, and locations, ideally alongside results for posts comparable to the proposed campaign topic and format.
Until then, base the partnership case on the content's credibility with security teams, not an assumed audience of enterprise buyers.
Across five LinkedIn posts published between late April and late June 2026, Justin Foster shares commentary and product explanations, not partnership formats or sponsored-content offers.
Read more
Several posts reference Forescout and Forescout Cloud, establishing a recurring commercial context, but the posts do not say whether any arrangement is paid.
They include no media kit, rate card, audience specification, sponsorship policy, or inquiry form.
A cybersecurity vendor considering Foster as a speaker or thought-leadership partner would need to contact them through LinkedIn and ask about available formats, rates, and audience details.
Fit for speaking and co-created editorial; weak fit for anything bought on reach.
Read more
Brief
A cybersecurity vendor wants a speaker and thought-leadership partner who can explain AI, cloud security data, and security operations to enterprise buyers — someone for a customer webinar, moderated panel, or co-authored explainer rather than a paid social post.
Reasons
The posts build arguments a buyer would follow in a session: take a common industry claim, reject it, and replace it with a specific operating requirement. The cloud-versus-on-premises post does this directly — it calls the debate "the wrong conversation," then answers with scale, historical context, and decision overload, and names what each environment is actually for. That is a speaker's structure, not a slogan.
Justin Foster already works in formats a vendor can book. One post announces a discussion with Rik Ferguson on frontier models and vulnerability management and points readers to Ferguson's book. That shows a willingness to share the stage and credit another expert, useful for a vendor seeking a less promotional tone. Ask for the recording or other evidence of how the pairing performs; only the announcement text was reviewed.
The material is specific enough to hold up before a technical audience. The cloud post cites 90 days of granular asset state changes, a year of security events, correlation of assets with known exploited vulnerabilities, and on-premises sensors for unagentable devices and east-west traffic. Buyers in the room can check those claims against their own environments.
A recurring thesis gives a campaign a clear through-line. Across several posts, the argument is that AI output in security fails on data, not models — "the model isn't the moat. The context is." A vendor selling security data platforms, SIEM, or AI governance can build a session around that line without inventing a position for the speaker.
Justin Foster can also carry the cost and reliability conversations enterprise buyers raise privately. The token post treats an exhausted context window as a design failure caused by bad retrieval, no summarization strategy, no task decomposition, and no guardrails on tool-call loops, and predicts rising prices and tighter usage limits. That is the language of production reality rather than model hype.
Conditions
The posts suggest topical authority with security practitioners and decision makers, but do not establish audience reach. The only audience figure is roughly 4,000 LinkedIn followers, observed 2026-10-08. Ask for follower job-title, seniority, industry, and location data before committing to an audience-targeted activation.
If the vendor needs delivery to a large existing audience, the fit weakens. If it needs a credible voice who can hold a technical room and produce a defensible angle, the fit holds.
When to choose a specialist
Poor fit for a reach-based sponsorship.
Read more
Brief
A brand wants paid sponsored social posts as a reach play: a fixed set of standalone posts, judged mainly on impressions, follower growth, and engagement rate, with a rate card, usage rights, and a firm delivery date. The brand is buying distribution, not a point of view.
Reasons
The posts offer no media kit, rate card, audience specification, sponsorship policy, commercial terms, or inquiry route. Several reference Forescout products and carry Forescout hashtags, but that does not establish a paid arrangement. Ask for the media kit and commercial terms before pursuing a sponsorship.
The reported figures cannot support a reach KPI. The only measured figure is around 4,000 LinkedIn followers. With no engagement, impressions, or audience-composition data, any impression or engagement guarantee would have to be invented rather than planned.
The five posts are brief LinkedIn updates, not long-form articles or videos. A campaign needing a multi-asset sponsored package — long read, video, newsletter placement — has no demonstrated precedent. Ask for examples of comparable work before building that package into the brief.
The strongest arguments in the posts are tied to Forescout's own platform. The cloud post names Forescout Cloud, Vistaro AI, and the 4D platform. Asking the same voice to make an equivalent argument for a competing vendor's product is different from booking a topical speaker, and the posts do not show that it has been done.
The posts do not address paid disclosure, exclusivity, or category conflicts. Set those terms directly in the sponsorship contract.
What would change this
Before committing to reach-based deliverables or impression targets, ask for a published partnership or media kit route, audience analytics covering follower job titles, seniority, industries, and locations, and post-level reach and engagement for comparable content.
A worked campaign example
Angle
Open with the failure buyers already see — a copilot or agentic SOC tool answering confidently and wrongly — and locate the cause in the data environment rather than the model. Make the case that stale, fragmented data spread across tools that do not share information is the real obstacle, and land the line that the model is not the moat, the context is. Then move from diagnosis to requirements: what long-term asset and event history a team needs, and how much of a security event timeline it must be able to reconstruct before it can answer how an intrusion happened. Close the second session on production discipline, using the token-cost argument: retrieval quality, summarization strategy, task decomposition, and guardrails on tool-call loops determine whether an agent finishes the job.
Format
A two-part moderated session or webinar for enterprise security buyers, with Justin Foster as the outside expert and a vendor product lead or customer as the counterpart. One session on the context problem in generative and agentic security tooling; the other on running those tools in production without burning budget.
Measurement note
With no audience demographics published, measure the activation by session attendance, question quality, follow-up asset downloads, and pipeline conversations rather than follower count or impressions. Ask for platform analytics and, if possible, past panel or webinar results before setting targets.
Risk
If the vendor's product is genuinely model-centric — and it wants the conversation to focus on model quality rather than the data underneath — this angle argues against its positioning, and the fit disappears. Treat the Forescout references in the posts as context, not as an exemption from conflict checks; settle category exclusivity and disclosure terms directly.
Title
A moderated discussion series on why security AI fails on context, not models
What the vendor supplies
Set a named moderator, the customer or product counterpart, the environment for one live session with a recorded version for later use, and a follow-up asset that turns the discussion into an internal business case buyers can circulate — for example, a one-page checklist of the data-readiness questions raised in part one. Agree in advance whether the recording can be edited and reused; the posts do not establish a default position on usage rights.
Why it works
The argument sequence is already in the posts, so the speaker need not adopt a vendor's position. Each step gives buyers something to check against their own environment, keeping a technical audience engaged. Pairing the outside voice with a vendor or customer keeps commercial content in a separate, clearly labelled part of the session rather than inside the expert's argument.
Choose Deepen Desai when the vendor wants a speaker who can describe a security-operations platform from the inside: unified exposure management, inline telemetry across network, identity, endpoint, cloud, AI, and deception, and closed-loop remediation through a zero trust architecture.
Read more
The posts frame the AI shift as a race between attackers automating more attack stages and SOCs constrained by fragmented tools, incomplete visibility, and high data-ingestion costs—the argument a vendor selling a consolidated SecOps platform wants on stage.
The tradeoff is perspective.
Deepen Desai's posts read as launch and partnership announcements from a platform builder.
They name Zscaler Agentic Security Operations and the Zero Trust Exchange, and describe early access to frontier models through trusted programs at Anthropic and OpenAI.
That gives the material direct product alignment rather than independent analysis.
Vendors with different positioning, or those seeking an outside voice with no platform tie, may find it less transferable.
Choose Ido Geffen when the vendor wants an urgent, attacker-first thesis that can hold a security audience: AI is creating a bug-pocalypse; AI agents can collaborate through a shared memory system and chain exploits into zero-days; and hiring more CISOs alone cannot match a machine-speed offense.
Read more
Ido Geffen is a stronger choice than Justin Foster when the session is meant to provoke debate about autonomous offense and defense rather than explain cloud data context and production discipline.
The tradeoff is narrowness and product adjacency.
The posts focus on AI-driven offensive security and Novee Security's AI pentesting agents, so the argument lands hardest for vendors selling autonomous security or testing products.
For campaigns about cloud security data, historical event context, or general SecOps data readiness, Justin Foster's context thesis is more directly usable.
Ido Geffen's posts are short opinion pieces; ask for a longer-session sample if delivery in that format matters.
Choose Jim Manico when the vendor needs a speaker who can connect AI in security to software engineering practice and standards: secure SDLC, independent verification, deterministic testing, and frameworks such as OWASP ASVS and AISVS.
Read more
Jim Manico argues that AI is collapsing the economics of vulnerability discovery and remediation, shifting competitive advantage from finding vulnerabilities to continuously eliminating exploitable risk in live systems. They are a better fit than Justin Foster when the audience is AppSec and engineering leaders rather than security operations buyers, or when the campaign needs an explicit standards and verification argument.
The tradeoff is a different center of gravity.
The posts focus on AppSec and software engineering economics, not cloud security data or security operations history.
A vendor selling cloud telemetry, asset context, or SOC data platforms would be moving Jim Manico off their strongest ground.
Their argued, skeptical voice—challenging a prevailing 'AI cyber is BS' take—works for debate and standards advocacy but is less suited to a neutral educational webinar.
The posts are short-form; ask for a longer-session sample if that format matters.
Justin Foster's five LinkedIn posts cover AI in security operations, cloud and on-premises security architecture, AI token and inference costs, data context for generative and agentic tools, and post-quantum encryption, plus a short post pointing readers to a discussion with Rik Ferguson and to Ferguson's book.
The posts have no publication dates, so they do not establish how Justin Foster's themes have changed over time; recent and older material are treated alike.
One audience figure is available: roughly 4,000 LinkedIn followers, observed 8 October 2026.
The posts do not report engagement, impressions, follower job titles, seniority, industry or location, so no reach or audience-composition claim is made here.
The recurring ideas, brand relationship and similar-creator comparisons reflect the full text of the posts rather than titles or snippets.
Justin Foster writes as part of the team behind Forescout Cloud, tags Forescout Technologies Inc. and uses the #Forescout hashtag.
The posts do not include a media kit, rate card, sponsorship policy, client list or inquiry route, so no commercial format is described as available.
Gaps that would change a decision remain: there is no transcript or recording of the referenced discussion with Rik Ferguson, any longer-form articles or videos, or any published account of Justin Foster's earlier career, books, shows or businesses.
Those sources would be most likely to explain why people search this name beyond the recent posts.
