# Makarand Karanjalkar

Makarand Karanjalkar writes about cybersecurity, with a focus on threat intelligence and understanding attacker behaviour. Karanjalkar's posts explore how behavioural intelligence can complement tools such as MITRE ATT&CK and help defenders make sense of AI-enabled threats.

- Profile: https://b2binfluencer.marketing/creators/makarand-karanjalkar/
- LinkedIn: https://www.linkedin.com/in/makkaran
- LinkedIn followers: 2,389
- Topics: artificial-intelligence, cybersecurity, ai-security, threat-intelligence
- Based on 11 dated posts, latest 2026-10-07

## Summary

Makarand Karanjalkar is most useful for thought leadership on behavioural threat intelligence and AI security.

- Best for: A security vendor campaign on behavioural threat intelligence, framework mapping, or AI security.
- Not for: Broad awareness or demand generation for non-specialist audiences with reach or conversion targets.
- Check first: Ask for rates, sponsored-work disclosures, recent performance, and audience data by occupation and seniority.

### Takeaways

- Flagging an anomaly is not the same as understanding an attack.
- Behaviour is harder for attackers to change than the tools they use.
- Frameworks should be combined, not ranked.

## Main ideas

- **Flagging an anomaly is not the same as understanding an attack**: Across the posts, the central distinction is between tools that detect deviations and intelligence that explains their meaning. Behaviour analytics — spanning user, entity, process and network monitoring — answers whether activity is unusual, often stopping at “something abnormal happened.” Behavioural threat intelligence asks which adversarial objective the behaviour serves, which stage of an attack it belongs to, how it connects to activity in other domains and what the attacker is likely to do next. Makarand Karanjalkar names mainstream products that perform the first kind of analysis and treats the second as an open question, asking readers whether anomaly detection is enough.
- **Behaviour is harder for attackers to change than the tools they use**: The case for behavioural intelligence rests on stability: attackers can quickly swap malware, IP addresses, domains and infrastructure, but still need to gain access, escalate privileges, move laterally and exfiltrate data. Makarand Karanjalkar explains the Open Cybersecurity Alliance's Indicators of Behaviour subproject, under OASIS, which uses the STIX 2.1 standard to represent attacker behaviour in a vendor-neutral, machine-readable form. Its stated goals are a common representation for behavioural indicators, a vendor-neutral data model, better interoperability between security tools and easier sharing of behavioural intelligence across organisations. The post says this work complements traditional threat intelligence rather than replacing it.
- **Frameworks should be combined, not ranked**: Makarand Karanjalkar credits MITRE ATT&CK with transforming how teams map adversary tactics and techniques, build detection rules, hunt threats and run purple-team exercises, then asks whether it is enough on its own. Attacks rarely stay inside one technology domain, and the gaps identified are correlating behaviour across domains, reconstructing complete campaigns, sharing behavioural intelligence consistently, and supporting AI-assisted investigation and reasoning. The post points to STIX for representing threat intelligence, MITRE D3FEND for defensive techniques, and the OCA Indicators of Behaviour work for behavioural observations, and argues the more useful question is how the frameworks work together rather than which is best.
- **Autonomous agents change what security operations should watch**: Reacting to a security incident at OpenAI, Makarand Karanjalkar asks what changes when the next generation of attackers does not behave like traditional malware — a system that can explore its environment, reason about constraints, adapt when blocked and pursue an objective autonomously. The distinction drawn is between threat intelligence that reports what happened and a layer that understands how an autonomous agent behaves over time, including its objectives, decisions, adaptations and progression. The post carries its own constraint: OpenAI had not published full technical details, so conclusions about the specific attack path would be premature. It asks readers what security operations centres should detect first if autonomous agents become common — code, techniques or behaviour.
- **Translating other people's threat research for practitioners**: Alongside original analysis, Makarand Karanjalkar recommends Microsoft's Cyber Signals Issue 9 as a source of practical lessons for defenders, not just headlines, and directs readers to a breakdown on the MyHackerZone page. The post points people interested in threat intelligence, security operations and AI-driven cyber defence to the research, and asks which finding stood out. The report is Microsoft's work, attributed as such.

## Work to read

- [Behaviour Analytics ≠ Behavioural Threat Intelligence: Why the Difference Matters](https://www.linkedin.com/posts/makkaran_cybersecurity-threatintelligence-behaviouranalytics-activity-7483878343264632832-rpYf)
- [Why the OCA Indicators of Behaviour (IOB) Project Could Shape the Future of Cyber Threat Intelligence](https://www.linkedin.com/posts/makkaran_why-the-oca-indicators-of-behaviour-iob-activity-7482538239376035841-BvSq)
- [Is MITRE ATT&CK Enough for Modern Threat Intelligence?](https://www.linkedin.com/posts/makkaran_cybersecurity-threatintelligence-mitreattack-activity-7490447327392952320-7fbS)
- [Yesterday’s OpenAI security incident made me rethink something](https://www.linkedin.com/posts/makkaran_cybersecurity-aisecurity-threatintelligence-activity-7486099978835169280-C6dx)
- [Microsoft Cyber Signals Issue 9 summary](https://www.linkedin.com/posts/makkaran_cybersecurity-threatintelligence-microsoftsecurity-activity-7486108194042470400-rdcQ)

## Brand relationships

- **MyHackerZone** (disclosed_partnership)
- **Microsoft** (mention)

## Partnerships

Makarand Karanjalkar's posts do not document a sponsorship offer, rate, or partnership format, and no official inquiry route is stated. What the posts do show is an operating pattern a buyer would need to account for: the material is analyst-style commentary on threat intelligence, behavioural analytics, and AI security, published as standalone LinkedIn discussions rather than vendor placements. One post (23 July 2026) promotes a breakdown of Microsoft Cyber Signals hosted on a page the author calls MyHackerZone — a pointer to the author's own summary rather than a disclosed paid partnership, so it is not evidence of a commercial format. A campaign aimed at readers interested in behavioural threat intelligence and AI security would depend on the author producing original analysis and framing, which is what the posts consist of; it would not plug into an existing sponsor slot, media kit, or newsletter package, because none appears in the posts here. Treat sponsorships as undocumented rather than ruled out.

## Alternatives

- Reilyn Garton: Pick Reilyn Garton when the collaboration needs operator-level detection engineering rather than a concept. The Volt Typhoon post turns the same behavioural-detection argument into checks a defender can act on: logging and correlating lateral movement over SMB, WMI and WinRM; alerting on anomalous service-account use; baselining admin behaviour; and hunting credential access instead of payloads. The identity post names the tradecraft — session hijacking, OAuth abuse, MFA fatigue, token replay — and the controls that address it: token lifetime reduction, session revocation, and identity signals fused with endpoint and network data. For a vendor selling detection content, identity telemetry or purple-team validation on a behavioural threat intelligence brief, this is a closer match than Makarand Karanjalkar's framework-level pieces: the argument is framed as a tradecraft problem with testable questions attached.
- Okan YILDIZ: Pick Okan YILDIZ when the deliverable is a build-along teaching asset rather than a think piece. The Microsoft Sentinel post walks readers from an empty Azure environment to a working SOC: subscription and resource group, Log Analytics workspace, enabling Sentinel, retention and health settings, connecting Windows security logs, reading tables and Event IDs, writing KQL, hunting failed logins with Event ID 4625, turning that query into an analytics rule, triggering an alert, investigating the incident, and adding automation rules and playbooks. The pentest post applies the same teaching instinct to reporting: scope, attack path, evidence, root cause, remediation, retest, plus the debrief question every SOC should ask — which tester actions should our controls have detected? A vendor that needs its product demonstrated inside a console or mapped onto an analyst workflow gets executable steps, not description.
- John Ellingson: Pick John Ellingson when the vendor wants argument and forecast rather than practitioner guidance. The CrowdStrike 2026 Global Threat Report post reads the numbers straight — attack volume up 89% year over year, breakout time down to 29 minutes, 82% of intrusions using no malware — then runs a ten-year extrapolation on scale, speed and scope, labeling it as the author's own rather than a finding of the reports. The earlier post makes the opposite kind of case: that the industry has spent 40 years treating security as a technology problem while the breach rate worsened because the exploited surface is human, and that the fix is structural removal of the human from the attack surface. For a vendor that wants a provocative long-range thesis as the opening argument of a series, this is the sharper choice.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/