Kevin Martin is a cybersecurity professional associated with Living Security who advocates using broader human-risk signals to identify and reduce security risks before incidents occur.
Useful for arguing that awareness training scores miss real risk and for explaining broader human-risk signals.
Best for
A security vendor campaign targeting CISOs and awareness leads on human risk management.
Not for
A phishing simulation vendor seeking high-volume paid reach and benchmark click-rate ROI claims.
Key takeaways
Click rates fell 14% while four credential compromises occurred in a month.
Martin proposes aggregating identity, credential-exposure, endpoint, training-behaviour, and real-threat-response signals into ranked risk profiles.
A three-step playbook: analyze incidents, use broader threat and identity data, intervene proactively.
Check first: Confirm audience matches target and ask for incident reduction evidence.
Main ideas
Simulation scores and completion rates measure test performance, not risk · Build ranked risk profiles by aggregating signals across systems · Intervene before the breach, not after the click
Kevin Martin is a cybersecurity professional associated with Living Security who argues that organizations should manage human security risk, not rely on training completion or phishing-simulation scores alone.
In their LinkedIn posts, they make the case for using broader signals to identify risk and acting before incidents occur.
Follow their work for a practitioner’s view of Human Risk Management and how that idea is presented in security-industry discussions.
Martin makes an abstract security argument concrete.
In one post, they stage a CISO questioning why lower phishing-test click rates did not prevent credential compromises; in another, they turn the critique of participation metrics into three steps: analyze incidents, use broader threat and identity data, and intervene proactively.
This dialogue-and-action format helps readers see both the limits they attribute to conventional awareness metrics and the alternative they advocate.
Their work also includes industry commentary and product positioning: a post about threat intelligence connects the topic to Living Security’s Unify platform, while another presents adoption of Human Risk Management language as a sign of an industry shift.
Those examples show the commercial context alongside the argument.
Buyers evaluating the proposed approach should ask for evidence that it reduces incidents.
Kevin Martin's recurring argument is that security awareness programmes measure the wrong thing.
Read more
Training completion and phishing-simulation click rates describe how people perform on a test, not who is likely to cause a real incident.
They propose a different mechanism: aggregate identity, endpoint, credential-exposure, training and real-threat-response signals into ranked risk profiles, then intervene on the highest-risk people before anything happens.
The priority throughout is moving from reactive compliance to what they call working "left of BOOM".
The strongest posts make the case by staging a gap in programme logic rather than defining a product.
Simulation scores and completion rates measure test performance, not risk
Martin argues that standard awareness-programme metrics answer the wrong question.
Read more
A phishing platform can report who clicked a fake email, but it cannot say who is likely to enter real credentials because it does not pull in identity, credential-exposure, endpoint-behaviour or real-threat-response data.
On that reasoning, a falling click rate and a high completion rate are not evidence that risk has fallen.
The CISO and security awareness lead in the post are unnamed roles in a scenario Martin constructs, not quoted individuals.
A dialogue post walks through a month in which click rates fell 14% while four credential compromises occurred.
Three of the four people were in the simulation programme, and two of those had passing scores.
The lead concedes that the platform's scores "don't correlate with who actually causes incidents," and the CISO closes with "That's not risk management."
A separate post calls a falling click rate plus 95% training completion a "participation trophy," noting that a CISO's exposure is tied to the incidents reported to the board, not participation statistics.
Build ranked risk profiles by aggregating signals across systems
The alternative Martin proposes is a data problem before it is a training problem.
Read more
Combining identity, endpoint-behaviour, credential-exposure, training-behaviour and real-threat-response signals produces a ranked picture of who is most likely to cause harm—one security teams can act on before an incident.
In a threat-intelligence post, they make a parallel argument for security operations, describing human-risk insight as something to integrate with technical threat data so teams can act on behavioural signals alongside threat data rather than treating them as separate streams.
That post also names Living Security's Unify platform as the vehicle, putting the argument and a product claim together.
The dialogue post lists the signal types the simulation platform ignores. The threat-intelligence post responds to Recorded Future's 2024 State of Threat Intelligence Report, which Martin recommends, and positions human-risk insight within security operations alongside it.
Martin argues that post-click training arrives after the loss: the credential has already been entered and the link opened, making a nudge reactive and negative by design.
Read more
They argue that nudges should come earlier and foster a positive security culture rather than correct behaviour after the fact. The case rests on predictability: if the person behind tomorrow's incident is making predictable decisions today, pre-incident intervention is possible and post-incident training avoidable.
The dialogue post says nudges after a click are "reactive and negative by design" because "the incident already happened," concluding that human risk management works "left of BOOM." The participation-trophy post makes the same point in one line: "The person behind tomorrow's breach is making predictable decisions today."
Martin distils the argument into an ordered sequence for teams already running a mature programme: start with incidents and analyse what happened and why; identify who is most susceptible using holistic data, including threat and identity data rather than behavioural data alone; then intervene proactively so the incident does not recur.
Read more
The framing is a choice between playing to win and merely complying. The sequence is a decision order, not a technology description, making it their most portable argument.
The participation-trophy post sets out these three steps after contrasting a competitive CISO mandate with participation metrics.
The category argument has been won, and Martin claims a hand in winning it
Martin treats incumbent vendors adopting the language of human risk management as proof the argument has moved from contested to settled: "When incumbents scramble to adopt your language, your framework, your category?
Read more
You haven't lost the argument.
You've won it."
Alongside that sits a claim of authorship—Living Security "didn't disrupt #HumanRiskManagement, we built it"—backed by a third-party Top 25 cybersecurity companies placement alongside larger vendors.
The conference post says incumbent adoption "is not a criticism" and reads as generous, while the recognition post stakes an origin claim over the same shift.
One post reflects on a fourth consecutive year at the National Cybersecurity Alliance Convene meeting and recalls a stage where the framing was "politely tolerated" and quietly dismissed. Another announces a Top 25 Cybersecurity Companies listing and asserts the built-it claim.
The comparison is explicit: four years earlier, the framing was the smallest voice in the room; in the most recent account, the largest players in the old model are presenting it as their own.
Martin's interpretation shifts from arguing the case to arguing about who originated it.
In one post, they thank colleagues Ashley M.
Rose, Kaylyn Jenkins, Kevin Coffey, Will Andrews and Elise Peterson for leading the conversation; the colleagues are acknowledged, not quoted.
See how Martin explains the difference between phishing-test results and security outcomes.
Read more
The concrete incident numbers make the gap in the usual metrics easy to follow.
Martin builds the post as a CISO–security-awareness-lead dialogue.
The lead reports that click rates fell 14%, but four people had credential compromises; three were in the simulation program, and two had passing scores.
They use that contrast to argue that simulation results measure performance on a test, not necessarily real-world risk.
The post then points to identity, credential-exposure, endpoint, training, and threat-response signals as inputs for a broader risk picture.
For brands planning a campaign
A thought-leadership campaign could turn this contrast into a discussion of which signals security teams should combine and how they would evaluate whether interventions reduce incidents. Ask for independent evidence before presenting the post’s argument as verified incident research.
This is a concise example of Martin’s preferred teaching format: a memorable provocation followed by a short action sequence.
Read more
It helps newcomers understand the problem they want organizations to reconsider and the steps they recommend.
Martin opens with a deliberately sharp image: a participation trophy for lower simulation click rates and high training completion. They contrast those figures with the CISO’s accountability for incidents, then give three steps: analyze incidents, identify susceptibility using broader threat and identity data, and intervene before incidents recur.
For brands planning a campaign
The numbered sequence could anchor a practical campaign asset, such as a workshop or checklist for reviewing human-risk programs. Ask readers to apply each step to a specific incident rather than treating completion metrics as a substitute.
Read this to understand how Martin positions Human Risk Management as a category and interprets changes in industry language.
Read more
It gives context for the more specific operational arguments in their other posts.
Reflecting on the fourth year at the National Cybersecurity Alliance Convene meeting, Martin describes human security moving from annual training and compliance toward continuous mitigation and earlier risk reduction. They frame larger players adopting the language of Human Risk Management as evidence that the industry conversation has shifted.
For brands planning a campaign
This post could support a campaign about changing security practices or category adoption. Pair Martin’s interpretation of the shift with evidence from other industry participants rather than treating terminology adoption alone as proof of better outcomes.
This example shows how Martin moves from a broad security trend to a company product and its proposed role.
Read more
It helps readers assess both their subject matter and the commercial context of their posts.
Martin responds to a threat-intelligence report by arguing that security operations should connect technical threat intelligence with information about human behavior.
They present Living Security’s Unify platform as a way to make that connection.
The post combines an industry-report reaction with a product-related claim.
For brands planning a campaign
A vendor collaboration could explore how teams connect threat intelligence to human-risk decisions. Distinguish Martin’s product positioning from independently demonstrated results, and substantiate any performance claims separately.
Formats: dialogue scenes, numbered playbooks, and report commentary4
Human risk management, not security awareness training3
Click rates and completion rates do not measure risk2
Aggregate signals, then rank who is likely to cause harm2
Work left of the breach: an incident-first playbook2
Category validation and market position2
Human risk management, not security awareness training
Across Martin's posts, the central argument is that traditional security awareness programmes — annual training, compliance checkboxes, simulated phishing — address the wrong problem.
Read more
They frame the alternative as human risk management: continuous, adaptive mitigation that identifies who is likely to cause an incident and intervenes before it happens, rather than reacting after a click.
One post describes the framing as having been "politely tolerated" in industry rooms four years earlier and now being adopted by the largest incumbent vendors.
Martin treats this as a sign the argument has moved from contested to mainstream, not as a criticism of those vendors.
For brands planning a campaign
A vendor that sells human risk management can use this as ready-made category framing rather than starting with a definitional argument. The strongest collaboration would be a co-authored explainer or recorded debate that explicitly draws the boundary between awareness training and human risk management, with Martin making the category case and the vendor supplying product context.
Click rates and completion rates do not measure risk
Several posts challenge the metrics reported by awareness programmes.
Read more
A dialogue-style post walks through a scenario in which click rates fell 14% while four credential compromises occurred in a month; three involved users in the simulation programme, two of whom had passing scores.
Martin concludes that simulation scoring measures performance on a test, not the likelihood that a person causes an incident.
A separate post calls completion and click-rate milestones a "participation trophy" and argues that a CISO's exposure is tied to incidents reported to the board, not participation statistics.
The posts do not claim simulation data is worthless. Martin says simulation scores accurately measure test performance, but objects to using them as a proxy for incident risk.
For brands planning a campaign
This is the clearest hook for content aimed at security leaders who already run mature simulation programmes and are being asked to justify them.
A brand can build a piece around the measurement gap — which metrics to report to a board and which to retire — using Martin's scenario framing as the opening.
Avoid positioning this as an attack on phishing simulation vendors; the argument is about metric selection.
Aggregate signals, then rank who is likely to cause harm
The proposed mechanism is aggregation: combine identity, credential-exposure, endpoint, training-behaviour, and real-threat-response data to build ranked risk profiles, then intervene with the highest-ranked people before an incident occurs.
Read more
A post on threat intelligence makes a parallel argument: integrate human risk insight into security operations so teams can act on behavioural signals alongside threat data rather than treating them as separate streams.
Martin consistently starts with an operational symptom (missed incidents, stalled programmes, disconnected data) and reasons back to the signals and intervention model, rather than opening with a product or platform claim.
For brands planning a campaign
This is the most technical strand in the posts and suits a practitioner audience — security operations, identity, and detection-and-response teams.
Useful collateral includes a data-source inventory or signal-to-intervention diagram, with Martin making the case for combining human and threat signals and the brand supplying implementation detail.
It also suits a webinar for buyers who already have the data but lack a decision layer.
Work left of the breach: an incident-first playbook
One post sets out a three-step sequence for teams that want to move past compliance: start with incidents and analyse what happened and why; identify who is most susceptible using holistic data rather than behavioural data alone; and intervene proactively before incidents repeat.
Read more
The framing is that the person behind tomorrow's breach is making predictable decisions today, making pre-incident intervention worthwhile.
For brands planning a campaign
The three steps translate directly into a lead magnet — a worksheet or checklist a security team can complete using its own incident history.
A brand can sponsor it and pair it with a workshop or assessment offer, using Martin's sequence as the structure rather than introducing a new framework.
This is a practical, low-friction entry point for buyers sceptical of category talk.
Two posts establish standing rather than make an argument.
Read more
One celebrates inclusion in a Top 25 cybersecurity companies list alongside much larger vendors, claiming Living Security did not disrupt human risk management but built it.
The other notes that new entrants and incumbents took the same conference stage to present the human risk management framing as something they had led all along.
Together, they position Martin as an early and persistent advocate of the category.
For brands planning a campaign
Third-party recognition and incumbent adoption give a partner a defensible reason to join the human risk management conversation now, before the category label is fully commoditised. A brand can use this strand for executive-level content, such as a roundtable or short position paper, associating itself with the category's origin story rather than a specific methodology.
Formats: dialogue scenes, numbered playbooks, and report commentary
Three distinct formats recur.
Read more
Dialogue scenes stage a CISO and a security awareness lead in conversation, letting the gap in programme logic emerge through their exchange before ending with a short statement of the lesson.
Numbered playbooks compress the argument into two or three ordered actions readers can act on immediately.
Report commentary summarises third-party research, links the source, and places the finding within the human risk argument.
The short posts use arrows, emoji, and hashtags, and are written for practitioners scrolling a feed rather than reading long-form.
The 2540-follower LinkedIn audience suggests relatively limited reach for a category-level spokesperson; campaign planning should treat the content as a positioning asset rather than a distribution channel.
For brands planning a campaign
The dialogue format is the most portable asset: it can be adapted into a short video, an illustrated carousel, or a conference segment, and demonstrates a problem before naming a solution. A brand planning a campaign should expect short, quotable units with an explicit takeaway rather than long analytical articles, and budget for repurposing.
Kevin Martin’s posts center on Living Security, the human risk management vendor whose Unify platform they promote.
Read more
They speak about Living Security as “we” and “our,” but don’t state Martin’s role there; ask whether they’re an employee, owner or contractor. The same posts mention a Recorded Future threat intelligence report and four years of participation in the National Cybersecurity Alliance Convene meeting.
Living Security
Disclosed partnership
Martin's posts promote Living Security's human risk management position, describe Unify as “our Unify platform” and say “we built” the human risk management category.
Read more
They close multiple posts with the Living Security name and feature named Living Security colleagues. The posts don’t state Martin’s role at the company; ask whether they’re an employee, owner or contractor.
Martin says they read the Recorded Future 2024 State of Threat Intelligence Report and calls it a must-read, then contrasts its threat intelligence framing with what Living Security’s Unify platform does.
Read more
No commercial relationship with Recorded Future is described.
Martin writes that it’s their fourth year at the National Cybersecurity Alliance Convene meeting and describes how the human risk management framing they and others pushed was taken up at the event.
Read more
The post describes attendance and participation, not a sponsorship or client arrangement.
Kevin Martin's posts are short, argument-first pieces about human risk management: awareness training and phishing-simulation click rates measure performance on a test, not the likelihood that a person causes a real incident; identity, endpoint, credential-exposure and real-threat-response signals should instead be pulled together into ranked risk profiles.
Read more
The two dialogue-led posts make the argument clearest to readers new to the work: one stages a CISO and a security awareness lead working through a month in which click rates fell while credential compromises did not; the other distills the same case into a three-step, incident-first sequence.
Category-positioning posts and commentary on third-party threat-intelligence research add market context.
The posts are short-form, written for a practitioner scrolling a feed rather than for long-form reading.
Human risk managementSecurity awareness trainingPhishing simulation and awareness metricsBehavioural and identity risk signalsSecurity cultureSecurity leadershipDialogue postsNumbered playbooksReport commentaryCISOsSecurity awareness leads
Wright posts for the same security awareness and human risk community, writing about professional networking for security practitioners and running Cyber Security Awareness Forum sessions aimed at awareness managers, CISOs and human risk practitioners — the audience Martin writes for.
Read more
Both work in short LinkedIn-formatted posts with a stated takeaway, and both treat the people side of security as the subject rather than an aside.
Wright's posts are about relationships and careers — how a network built over years becomes a source of advice and collaboration, and a personal tribute to a networking mentor — rather than programme metrics, incident data or category ownership, where Martin's argument sits.
Hussain writes practitioner-facing analysis of attacks that target people rather than systems — executive impersonation and CEO fraud in the Gulf using AI, deepfake voice and video, and public business information — and closes with a short list of organizational actions.
Read more
Martin uses the same structure when they tell teams to start with incidents, identify who is susceptible, then intervene.
Hussain stays on the external threat landscape, covering deepfake-enabled fraud and AI features shipped without user consent, with verification and governance checklists as the remedy. Martin's argument is inward, about what an organization's own awareness programme measures and which category it belongs to.
Elizaire also writes for security leaders about where AI changes the work without removing the human, arguing that AI cannot grasp a business's risk tolerance or why taking one server offline costs more than isolating another, and that people, process and technology still decide outcomes.
Read more
That lines up with Martin's insistence that better simulation scoring does not substitute for understanding who is likely to cause harm.
Elizaire's frame is security operations — AI-driven detection, managed detection and response, analyst judgment under a shrinking attack timeline — rather than the awareness and human risk programme metrics Martin concentrates on.
For a cybersecurity vendor campaign aimed at security leaders rather than broad reach, this is a narrow but well-aimed placement.
Read more
Kevin Martin's measured public audience sits on LinkedIn: roughly 2,540 followers as of 9 October 2026, a practitioner-scale following rather than a broadcast channel.
Their posts do not say how many followers are in buyer roles, so treat the number as reach, not as a qualified audience.
The five posts point to a consistent intended reader: CISOs, security-awareness leads, and the teams running phishing simulations and training programs.
Selected examples: a June 2026 post written as a CISO / security-awareness-lead dialogue arguing that adaptive phishing simulations measure test performance rather than human risk; a March 2026 recap of the National Cybersecurity Alliance Convene meeting that names colleagues and frames the industry as catching up to human risk management; and a March 2026 post aimed at the CISO's board-reporting problem over "participation trophy" completion rates.
Each addressed that reader directly and closed with an invitation to reply.
Before committing budget, ask for recent LinkedIn analytics on comparable posts: reach and engagement rate for this topic and format, plus any audience survey or first-party job-function and seniority data.
YouTube-style demographic data can speak to age and geography for a video channel, but it cannot confirm employer, occupation, or seniority.
For a thought-leadership profile timed to a human risk management launch, the case rests on thematic alignment with security decision-makers; confirm the audience actually matches the launch's target audience before treating follower count as fit.
The posts show no sponsorship, advertising, or partnership offer from Kevin Martin.
Read more
Written in an in-house voice on behalf of Living Security, they cover human risk management, phishing simulation limits, and incident-driven security metrics; promote Living Security's Unify platform and link to a vendor report; and celebrate a third-party industry award for the company.
This is company marketing and earned recognition, not a disclosed creator partnership program.
The posts and linked LinkedIn profile include no media kit, sponsored-format list, rate card, audience specification, or partnership inquiry route.
Buyers considering a paid collaboration should ask directly about terms.
A human risk management platform vendor wants a CISO-facing thought-leadership program plus one practical asset its sales team can use in mid-funnel conversations. The campaign has to argue why training-completion and click-rate numbers do not predict incidents, show what signals to combine instead, and give security leaders something they can act on. Modest reach is acceptable; credibility with security decision-makers is the objective.
Read more
Reasons
The argument for replacing awareness-training test scores with incident-risk measures is already Kevin Martin’s. Across the posts here, the case is that awareness training measures performance on a test rather than the likelihood someone causes an incident. The clearest example is a dialogue post where click rates fall 14% while four credential compromises occur in a month, three of them involving people inside the simulation program and two of whom had passing scores. A vendor buying this collaboration licenses existing framing instead of building it from scratch.
Martin offers a mechanism, not just a complaint. The proposed approach aggregates identity, credential-exposure, endpoint, training-behaviour, and real-threat-response signals into ranked risk profiles, then intervenes on the highest-ranked people before an incident. A separate post extends the same logic to security operations, arguing human-risk insight should sit alongside threat intelligence rather than in a parallel stream.
A practical asset is already half-built. One post sets out a three-step sequence: start with incidents and analyse what happened and why; identify who is most susceptible using broader data rather than behavioural data alone; and intervene proactively before incidents repeat. That sequence maps cleanly onto a workshop or worksheet a security team completes against its own incident history.
The intended reader matches the buyer for a campaign aimed at CISOs. The posts address CISOs, security-awareness leads, and people running simulation and training programs, including the specific problem of what a CISO reports to the board.
The formats are portable. Dialogue scenes, numbered playbooks, and report commentary make short, quotable units suited to a feed, a carousel, or a short video. Plan for repurposing rather than a single long-form byline.
Reasons for restraint: the measured public audience is roughly 2,540 LinkedIn followers, with no engagement, geography, job-function, or seniority data. Ask for recent post analytics and audience data before setting reach targets. No sponsorship formats, media kit, rate card, or partnership inquiry route appears in the posts here; request commercial terms and a named contact. No long-form article, talk, or transcript appears in the posts here; request a sample before commissioning a long-form byline or keynote. Claims about incumbents adopting their category language are Kevin Martin’s interpretation of an industry shift and should be presented as opinion.
Verdict
Strong fit, with a scope limit: treat this as a positioning and co-distribution play, not a reach play.
When to choose a specialist
A phishing-simulation and security-awareness training vendor wants a peak-season campaign: a high-volume paid-reach push built on a benchmark data story about falling click rates, a sponsored head-to-head comparison against rival platforms, and an ROI promise aimed at IT generalists at small and mid-sized businesses.
Read more
Reasons
The campaign’s centrepiece contradicts the creator’s published position. Kevin Martin’s posts state that simulation scoring measures performance on a test rather than who causes incidents, and one post calls completion and click-rate milestones a participation trophy. Asking them to front a story about benchmark click-rate improvements puts them in open argument with the vendor’s own product claims.
The reach expectation is unsupported by the available data. Roughly 2,540 LinkedIn followers, with no engagement, geography, or professional-attribute data, make this a practitioner-scale audience. A high-volume awareness-month push needs distribution data this creator has not demonstrated; the writing reads as a positioning asset rather than a broadcast channel.
The audience is wrong for the brief. The posts are written for CISOs and security-awareness leads inside organisations that already run programs, not for IT generalists or small-business owners purchasing training for the first time.
There is no basis for comparative product claims. The posts compare metrics and category language; none benchmarks platforms or vendors against each other. A sponsored head-to-head would require evidence Kevin Martin has not published.
No media kit, sponsored-format list, rate card, audience specification, or inquiry route appears in the posts here. Request commercial terms, deliverables, and a named contact before planning the campaign.
An ROI promise has no support. Nothing reviewed measures whether interventions reduced incidents. The incident-versus-click-rate example is a scenario illustrating a metric problem, not independently verified outcome research, and the vendor cannot borrow it as proof of results.
Multi-format demand is untested. Only short LinkedIn posts were reviewed. Request samples of any long-form articles, video, podcast, or talk transcripts before commissioning a campaign that requires several formats or a recorded keynote.
What would make it work: drop the click-rate benchmark and head-to-head comparison, aim the content at security leaders evaluating metric selection rather than first-time buyers, and set reach expectations around co-distribution with the vendor’s own channels.
Verdict
Poor fit as written. The product the brief sells is the target of the argument this person makes in public.
A worked campaign example
Campaign angle
“Incident-first: what your click-rate dashboard cannot tell you about your next breach.” Lead with the decision security leaders are already being asked to defend, not with the vendor’s product.
Chosen brief
The human risk management platform brief: a CISO-facing thought-leadership program with one practical sales asset.
Evidence to gather first
Recent LinkedIn analytics for comparable posts: reach, engagement rate, and any audience survey or first-party job-function and seniority data.
Agreed commercial terms and a named sponsorship or partnership contact route, since none is documented.
A sample of any long-form, video, or recorded format the campaign would need.
Independent support for any comparative or outcome claim the vendor wants to make alongside Kevin Martin’s framing.
Sequence
Open with a co-authored dialogue post in Kevin Martin’s existing CISO and security-awareness-lead format. Stage the gap between a falling simulated click rate and real credential compromises, then close on who is actually most likely to cause the next incident. Write fresh numbers for the scene and label them as an illustrative scenario; the figures in Kevin Martin’s own post already belong to that post.
Follow with a mid-funnel asset: a worksheet built on Kevin Martin’s three steps. The partner supplies an inventory of data sources a buyer might connect (identity, credential exposure, endpoint, training behaviour, real-threat-response history); Kevin supplies the framing and review questions teams can answer about their own incidents. Test the completed and blank versions before publishing.
Host a practitioner webinar or roundtable that combines Kevin Martin’s case for combining human and threat signals with the vendor’s implementation detail. Keep the vendor’s product explanation separate from any claims about outcomes.
Close the program with a short executive position paper or roundtable on how the category conversation has changed. Treat this as association with the category’s early advocacy, and present the claim about incumbents adopting the language as Kevin Martin’s view, not established fact.
What to avoid
Do not present the scenario numbers as research findings or evidence that any approach reduces incidents.
Do not turn the program into an attack on phishing simulation vendors. The published argument is about metric selection, and the material allows that simulation scores accurately measure test performance.
Do not promise large reach or pipeline volumes from this creator’s own channels; there is no engagement or audience-composition data to support those claims.
Do not build the campaign around a long-form byline, keynote, or podcast without first requesting a sample; only short posts were reviewed.
Why it works
Every step starts with a decision the buyer already has to make: how to justify awareness spend to a board, and which metrics to keep or retire. That gives the collaboration a reason to exist beyond the vendor’s product, making the framing useful to a sales team in a mid-funnel conversation.
Choose Wright when the campaign needs a live practitioner venue rather than an individual author.
Read more
His posts show him convening CSAF (Cyber Security Awareness Forum) panel sessions for security awareness managers, CISOs and human risk practitioners, and arguing that professional relationships—not contact counts—do the work.
For a vendor whose mid-funnel asset should be a webinar, roundtable or community session with named participants, this is a more direct route than a written piece.
A second post, honouring a networking mentor, shows a personal register that could suit a human-risk campaign.
The posts do not make the campaign’s core argument.
Neither addresses click rates, completion rates, incident prediction or which signals to combine, leaving the vendor to supply the thesis while Wright provides the room and convening voice.
The sample comprises two posts; ask for the community’s size and session reach before relying on it for distribution.
Choose Hussain when the campaign targets the Gulf or shifts from training metrics to executive fraud and AI governance.
Read more
One post tracks rising executive impersonation and CEO fraud across the Gulf using AI voice and video, social engineering and publicly available company information, then lists five countermeasures: verifying payment and sensitive requests through an independent channel, dual approvals and separation of duties, impersonation training, assessing executives’ public digital exposure, and BEC simulations.
The other covers browser AI models installed without clear consent and frames the issue as one of consent, privacy, supply chain and AI governance.
Both are short alerts with actions readers can take, suiting a checklist-style mid-funnel asset.
The angle is threat and control, not measurement.
Neither post questions the value of training or simulation scores, or sets out a human-risk model or signal set; the vendor would still need to supply the campaign’s central argument.
The regional focus cuts both ways: audiences without Gulf exposure may get less from the executive-fraud framing.
Ask for audience size, composition and engagement data before booking.
Choose Elizaire when the campaign focuses on AI in security operations rather than human risk training.
Read more
The posts argue that AI changes every job rather than removing them, works as a force multiplier while business context and risk tolerance remain human decisions, and that AI-enabled ransomware compresses defenders’ time to detect and respond across identity, endpoint, network, cloud and email. Both name Sophos, including its Fusion and MDR offerings, as the direction of travel, giving a vendor a ready technical narrative and a speaker accustomed to presenting platforms to security leadership.
This is security-operations content, not the campaign’s argument that completion and click metrics measure test performance rather than incident likelihood; that claim appears in neither post.
A vendor buying here gets an AI-and-operations voice, while audience interest sits closer to technology buying than awareness-programme design.
Elizaire publicly prefers Sophos products, so a competing vendor should resolve that before briefing.
They cover a CISO-and-awareness-lead dialogue on the limits of phishing-simulation scoring, a post on participation metrics with a three-step incident-first sequence, a reflection on a National Cybersecurity Alliance Convene meeting, a Top 25 cybersecurity companies recognition post, and commentary on Recorded Future's 2024 State of Threat Intelligence Report.
The posts do not state publication dates, so they are grouped by argument rather than by chronology; the only timing signals inside them are a "four years ago" comparison and the 2024 report.
Comparison notes for the suggested similar creators draw on those creators' own public posts, dated November 2025 to July 2026.
The posts do not cover long-form articles, talks, video or podcast transcripts, or full report texts, so no extended written or spoken format could be assessed.
Martin's exact role at Living Security is not stated in the posts, and the posts do not state engagement, audience geography, or seniority data.