Kevin Nanns

Rather than telling readers that authenticator codes are safe, the TOTP piece describes the secret key the app and the login service both hold, the 30-second window each code covers, and why a phone with no signal can still produce a working code when you sign in on a connected device.

• The reasoning is that a reader who understands the mechanism can also spot where it breaks, which is why the same post names a phone clock that drifts far enough to generate a code for the wrong time window.
• Posts on passkeys and text-message codes follow the same instinct: point at which login codes hold up against a fake login page rather than repeating the advice.

The LinkedIn TOTP explainer walks through the shared secret and the 30-second windows; the Instagram caption keeps the same shared secret, the same windows, and the same clock caveat in two paragraphs.

The Instagram caption is the same explanation cut down, so the teaching point survives compression into a short post.

Read original · Original 2

The argument is that what you hand an agent depends on the consequence of a mistake, so a tired human working at 2 a.m. is a worse bet for some changes and a fine one for others. The post states a personal boundary rather than a general rule, and closes by asking readers where their own line is.

A post labeled as sponsored by Cisco Enterprise Networking opens with a 2 a.m. maintenance where one mistyped VLAN takes down something that was not supposed to go down.

• Kevin Nanns cites Cisco and Omdia research finding that 82% of organizations are comfortable letting AI make at least some production changes without prior human approval, then keeps routing changes waiting for a person because one bad route can take a whole site off the map.
• The research is the sponsor's and a third party's; the limit is his own.

Read original

The question does the work of a headline, and the posts then ask for a specific workplace anecdote rather than a general opinion. Where a video exists on the subject, the post points at it and asks what actually changed things for readers.

'Is your email still on a text message code, or did you set up a passkey?

• Tell me which one.
• No judgment from me.' The same question runs on Instagram and TikTok, and another post asks IT staff what finally moved their users off SMS codes, 'was it a policy, or a bad day?', alongside a short video about which login codes hold up against a fake login page.

Read original · Original 2 · Original 3 · Original 4 · Original 5

The case rests on audience numbers for deliberately narrow material rather than on a general claim about what audiences want.

A Halloween skit about a routine midnight change and the one command left out, made years earlier and never posted because it seemed too technical for anyone but other network engineers, then finally cut to 36 seconds and published. Kevin Nanns credits a network-engineer rules video that reached over 28,000 impressions in a month as the reason to put it out.

The skit sat unpublished for years before the performance of an equally niche video changed the decision.

Read original

The reasoning is that the audience has been signalling a preference and the posting plan had not caught up.

Facebook added about 23,500 followers in 90 days while Kevin Nanns posted roughly one day in three; X added 27 over three months; LinkedIn posts about their career or behind-the-scenes work averaged about 12,000 impressions against about 1,900 for reposted reels.

• On YouTube the best-performing videos were about the job itself, some almost a year old.
• The stated change is less recycled short video and more on how a sponsored video gets made and what the architect role teaches.

The post announces a change of direction for how the LinkedIn account is used.

Read original · Original 2

The post is a request for other people's stories rather than a claim about how careers should be planned.

About four years of teaching before moving into networking, set off by 'one word in a search bar', followed by an invitation to readers to describe the moment that pulled them into their own field, especially those who came from somewhere else.

Read original

Each step names a specific document, which makes the post usable rather than just readable, and the explanation stays neutral on whether the project is welcome.

Five steps: the city or county planning commission agenda for the applicant named on the rezoning or site plan; the state business search to tie the LLC to the company behind it; water utility board minutes for the water service agreement and whether cooling runs closed-loop, air or reclaimed water; state utility commission filings for whether the operator pays for the grid upgrades it needs; and council records for the tax-break vote and any community benefit agreement attached to it.

Read original

The pattern is a measured problem, the exact fix, and one plain warning, which keeps the recommendation attached to its limits instead of reading as a blanket endorsement.

After a macOS update showed Apple Intelligence using about 29.66 GB, the post points to RemoveMacAI, describes it as free, open code, one profile to approve, one command to undo, and notes it is not from Apple and that readers should check what it does before running it. The same restraint appears in the sponsored Cisco post, which states its own limit instead of endorsing automation wholesale.

Read original · Original 2 · Original 3

Kevin explains why the rotating code in an authenticator app still works with no Wi-Fi or cell service.

• The app and the login service hold the same secret key and each combines it with the current time in 30-second windows, so the phone can stay offline while the sign-in happens on a connected device.
• The piece also names the failure most people never hear about: a phone clock that drifts far enough generates a code for the wrong time window.

For brands planning a campaign

The strongest template for an opening episode of the proposed explainer series: one concept, one mechanism, one caveat, and a concrete failure a viewer can check on their own phone.

A two-paragraph version of the TOTP explanation.

• The shared-secret idea, the 30-second windows and the clock caveat all survive, with hashtags for cybersecurity, MFA, TOTP and the account name.
• Nothing is lost except length.

For brands planning a campaign

Plan a series as a long-form explanation per topic plus a short cut of the same topic; Kevin has already demonstrated the compression works inside his own voice.

Rather than explaining passkeys, Kevin asks whether people are still on text-message codes for email or have set up a passkey, and says there is no judgment either way.

• The same question runs on Instagram.
• It invites replies instead of delivering a verdict, and the two answer options map to a real split in most workplaces.

For brands planning a campaign

A ready-made engagement opener: run the question before the explainer, then answer it with the TOTP-versus-passkey comparison the audience asked for.

Several posts open the same way: 'Be honest,' followed by a question about a common bad habit, such as how old the office Wi-Fi password is or how much battery a phone really gets in a workday. The question does the work of a headline, and the post then asks readers to compare notes rather than presenting them with a conclusion.

For brands planning a campaign

Reusable in awareness copy: name the habit the audience is quietly guilty of, then ask rather than lecture.

A paid collaboration with Cisco Enterprise Networking built around a 2 a.m. maintenance story, where a tired engineer fat-fingers one VLAN.

• Kevin cites Cisco and Omdia research finding 82% of organizations are comfortable letting AI make at least some production changes without approval, then draws his own line: he would hand over plenty of tasks, but routing changes still wait for him because one bad route can take a whole site off the map.
• Sponsorship is disclosed in the hashtags and the post ends with a question to the audience.

For brands planning a campaign

The workable shape for a brand collaboration here is a specific personal anecdote, a cited finding, and a stated limit rather than a blanket endorsement.

After the macOS 27 update, Kevin's storage screen showed Apple Intelligence using 29.66 GB.

• The post points to a tool, RemoveMacAI, that reclaims the space: free, open code, one profile to approve, one command to undo.
• Kevin notes the tool is not from Apple and tells people to read what it does before running it.
• The same post appears in a second LinkedIn entry.

For brands planning a campaign

Any explainer about settings or tools should keep this shape: the real number, the exact steps, and one plain caution instead of a blanket recommendation.

A five-step public-records guide.

• City or county planning commission agendas name the applicant on a rezoning or site plan.
• The state business search ties the LLC to the company behind it.
• Water utility board minutes show the water service agreement and whether the cooling runs closed-loop, air or reclaimed water.
• State utility commission filings show whether the operator pays for the grid upgrades it needs.
• Council records show the tax break vote and any community benefit agreement.
• The post closes by asking operators what they wish the public knew before the next petition.

For brands planning a campaign

Direct evidence that Kevin can turn an institutional topic into steps a layperson can act on, which is the same translation an awareness campaign needs.

Kevin describes a horror skit about a routine midnight change and one command left out, made years ago and never posted because it seemed too niche, and admits doing that change for real is probably why it struck him as funny.

• The post credits a network-engineer rules video with over 28,000 impressions that month as the reason to publish it, finally cut to 36 seconds.
• Reviewed through its caption rather than a transcript.

For brands planning a campaign

Supports letting a narrow, in-joke concept run in a campaign instead of flattening it for a general audience; the audience numbers are the argument.

Kevin pulls numbers across seven accounts: Facebook added 23,500 followers in 90 days on roughly one posting day in three, X added 27, YouTube grew by more than a quarter with the best-performing videos about the job itself, and LinkedIn posts about his career or behind-the-scenes work medianed about 12,000 impressions against about 1,900 for reposted reels. The stated conclusion is a change of approach: less recycled short video, more on how the work gets made.

For brands planning a campaign

Worth reading before pitching a format: the stated preference is original behind-the-scenes and career material over reposted short video.

A TOTP explainer describes the shared secret that the authenticator app and the login service both hold, the 30-second window each code covers, and why a phone with no signal can still produce a working code as long as its clock is right; a second version of that post says the same thing as a caption. Other posts ask readers whether their email still uses a text-message code or a passkey, and one asks IT staff what finally moved their users off SMS codes, pointing to a short video about which login codes hold up against a fake login page.

Explain a single mechanism, keep the vocabulary everyday, and close by asking readers about their own setup.

For brands planning a campaign

This is the closest match to a short explainer series on TOTP versus passkeys for non-technical employees.

• The working pattern is one mechanism per post, a plain description of how it works, and a question back to the audience.
• The passkey and SMS posts ask the question without explaining the mechanism, so a series would need to add that explainer beat rather than reuse the posts as they stand.

Examples: Source 1 · Source 2 · Source 3 · Source 4 · Source 5

The same passkey-versus-text-code question appears on more than one platform, so one question is written once and reused. The posts usually ask for a specific workplace anecdote rather than a general opinion.

Question first, then explanation or follow-up; ask for one concrete example from the reader's own workplace.

For brands planning a campaign

The hook format transfers directly to an explainer series: open with a question the employee can answer about their own habits, explain the mechanism, then invite the workplace story. Campaigns that want employee-level input can use the question as a lightweight pulse check, but the posts are not built to collect structured answers.

Examples: Source 1 · Source 2 · Source 3 · Source 4 · Source 5 · Source 6

A later post reports that LinkedIn posts about the creator's career and behind-the-scenes work drew roughly 12,000 impressions over three months against about 1,900 for reposted reels, and says future posts will cover how a sponsored video gets made and what working as an architect teaches. A Halloween post about an unposted switch-command skit notes that a deliberately narrow network-engineer-rules video reached over 28,000 impressions in a month.

For brands planning a campaign

Useful for employer-brand and day-in-the-life briefs, and it is the angle the creator says performs on LinkedIn. A plan that expects reposted short video to carry a LinkedIn campaign is pushing against the creator's own stated numbers; career reflection and behind-the-scenes material are the better fit.

Examples: Source 1 · Source 2 · Source 3

A separate post points readers to a third-party tool for reclaiming macOS storage used by Apple Intelligence and cautions that the tool is not from Apple; it is not labeled as a sponsorship.

The macOS and Apple Intelligence posts recommend a tool the creator does not own and are not presented as sponsored; do not read vendor status into them. The Cisco post labels itself sponsored, so payment is stated rather than inferred.

For brands planning a campaign

Shows a repeatable sponsored shape: a first-hand practitioner story, the sponsor's research or product as the turn, a stated personal limit, and an open question.

• For a security-awareness client the equivalent would be the sponsor's data plugged into an employee-habit story, with the creator's own limit kept in to preserve practitioner credibility.
• The macOS post is a different pattern, a personal tool recommendation, so a brand should decide separately whether that kind of endorsement suits it.

Examples: Source 1 · Source 2 · Source 3

It ends by asking operators what they wish people knew before the next petition.

Numbered steps, each naming the exact public body and document, closing with a question to the people who run the facilities.

For brands planning a campaign

For infrastructure, utility, or data-center clients this is the model to copy: each step names a specific body and record the reader can look up, which makes the post usable rather than just readable. It also shows a procedural tone on a contested local topic, worth noting if a client needs the subject handled without taking a side.

Examples: Source 1

The same post points to a deliberately niche network-engineer-rules video as evidence that narrow material can travel.

For brands planning a campaign

Relevant for brands willing to sponsor in-joke humor for a technical audience; the creator's argument is that niche material performed. It also means an explainer series aimed at non-technical employees sits outside the creator's more technical, joke-driven work, so tone and audience should be agreed before production.

Examples: Source 1 · Source 2

The post says the LinkedIn account's focus is shifting from reposted reels toward career and behind-the-scenes posts.

For brands planning a campaign

Directly relevant to creator-economy and social platform clients, and a planning constraint for any campaign that assumes short-video reposting travels on every channel. The same post is a reminder that the creator's stated audience interest is career material, not only how-to content.

Examples: Source 1

For brands planning a campaign

Fits device-management, mobile, or Wi-Fi campaigns aimed at ordinary users. The macOS post shows the creator is comfortable recommending unaffiliated utilities, so a client considering a comparable post should settle the disclosure and endorsement approach first.

Examples: Source 1 · Source 2 · Source 3 · Source 4

It cites a Cisco and Omdia report finding that 82% of organizations are comfortable with AI making at least some production changes without prior human approval. Nanns uses his own 2 a.m. maintenance story to argue that an agent does not get tired the way an engineer does, while routing changes should still wait for a human because one bad route can take a site offline.

Original disclosure

#Sponsored

View example

No commercial relationship is disclosed.

View example

Both close by handing the question back — how many texts it takes to get help, or where your own line is with automation.

Caleb Markovich works in fleet maintenance and parts supply, not networks, and the posts stop at the operational insight rather than explaining a mechanism underneath it. There is no equivalent of the TOTP walkthrough or the public-records checklist here — the same short, direct register, applied to a different trade.

Read original · Original 2

Both treat the reader as someone who may already be affected.

Tom DiMercurio writes first-person victim narratives — what happened, over how many weeks, what it cost — while Kevin Nanns explains how a mechanism works and points at the exact fix. Longer, chronological storytelling against short, mechanism-first posts, and no teaching tool is offered at the end.

Read original · Original 2

Both write numbered advice a non-technical reader can act on, and both keep the language free of jargon.

Tim Plumridge gives five basic steps and a set of predictions, addressed outward at readers and their older relatives; Kevin Nanns tends to explain how a system behaves and then ask the audience what they do, which reads more as an exchange than as advice given. Tim Plumridge's retained posts are also older, from January 2024, against Kevin Nanns's 2026 material.

Read original · Original 2

One supplied post is a first-person account of a call-centre scammer claiming to be from BT, ending in five plain steps (check who is calling, use strong passwords or passphrases, think before clicking or sharing, check links before clicking, keep devices updated) and a note about helping older relatives.

• Another looks at 2024 cyber predictions: AI-assisted phishing, deepfakes and audio manipulation, and a call to move away from perimeter security toward zero trust.
• If the client wants a UK voice speaking to non-technical or older employees about recognising an attack, this is closer to the ask than a mechanism explainer.

Tim Plumridge's supplied posts give advice and threat framing, not a working explanation of authentication.

• Kevin Nanns's supplied posts explain how a TOTP code is calculated from a shared secret and the current time in 30-second windows, why an offline phone still works but its clock matters, and point to a short video on which login codes hold up against a fake login page.
• A TOTP-versus-passkeys series needs that mechanism content and client-approved security claims; choosing Tim Plumridge means supplying both and accepting a tip-list, awareness-campaign tone rather than a technical walkthrough.

Examples: Source 1 · Source 2 · Source 3 · Source 4

The two supplied posts are a first-person account: a phone provider redirected both cell and home numbers, attackers opened and redirected cards and bank funds, two PayPal accounts approved over $5,000 in gift cards, and the writer ultimately paid a cybersecurity expert about $2,000.

• The posts name concrete steps taken, including a fraud alert, credit freezes with all three bureaus, wiping a desktop, randomising passwords up to 32 characters, and an RSA device for bank identity checks.
• For an internal awareness session or an executive-facing piece arguing that authentication failures have long tails, this lived detail persuades in a way that a code explanation does not.

The narrative is one person's experience, not instruction an employee can follow.

• The supplied posts do not explain TOTP or passkeys, compare sign-in methods, or recommend what a workplace should deploy; the practical resolution is hiring an expert and closing off access.
• A series that must teach employees how codes work, or answer whether text-message codes survive a fake login page, needs the explainer material Kevin Nanns already produces.
• Choosing Tom DiMercurio means the client supplies the teaching content and the collaboration becomes a cautionary story, which suits some briefs better and a how-to series worse.

Examples: Source 1 · Source 2 · Source 3 · Source 4

The two supplied posts argue that waiting for parts, not breakdowns, drives unplanned downtime (37% of it, by the post's figure), and that trust in a vendor shows in how few words are needed to get help at 2 a.m. If the cybersecurity awareness company also sells to fleet and operations buyers who care about service continuity and vendor dependence, this framing matches their world more closely than an authentication explainer does.

For a TOTP-versus-passkeys series aimed at non-technical employees, there is no overlap: the supplied posts address fleet downtime and mechanic trust, and say nothing about login codes, passkeys, phishing or employee security habits.

• Choosing Caleb Markovich means changing the campaign subject, not just the voice.
• The relevant tradeoff is that this comparison is worth keeping only as a pointer for briefs about operations resilience; on this brief it should not displace an authentication-focused creator.

Examples: Source 1 · Source 2