Makarand Karanjalkar writes about cybersecurity, with a focus on threat intelligence and understanding attacker behaviour. Karanjalkar's posts explore how behavioural intelligence can complement tools such as MITRE ATT&CK and help defenders make sense of AI-enabled threats.
Makarand Karanjalkar is most useful for thought leadership on behavioural threat intelligence and AI security.
Best for
A security vendor campaign on behavioural threat intelligence, framework mapping, or AI security.
Not for
Broad awareness or demand generation for non-specialist audiences with reach or conversion targets.
Key takeaways
Flagging an anomaly is not the same as understanding an attack.
Behaviour is harder for attackers to change than the tools they use.
Frameworks should be combined, not ranked.
Check first: Ask for rates, sponsored-work disclosures, recent performance, and audience data by occupation and seniority.
Main ideas
Flagging an anomaly is not the same as understanding an attack · Behaviour is harder for attackers to change than the tools they use · Frameworks should be combined, not ranked
Makarand Karanjalkar writes about cybersecurity, especially threat intelligence and how defenders can understand attacker behaviour.
Across the posts here, a recurring question is how to move beyond spotting an unusual signal to understanding an attacker’s objective, the stage of an attack, and how activity connects across systems.
One post contrasts an alert for abnormal PowerShell activity with interpreting it as possible credential access linked to identity and network activity.
Others explore how behavioural intelligence could complement MITRE ATT&CK, traditional indicators, and emerging AI-security work.
Karanjalkar’s clearest contribution is connecting technical frameworks to a practical problem for defenders: individual alerts and indicators may not explain what an attacker is trying to do.
They compare behaviour analytics, which often flags activity as unusual, with behavioural threat intelligence, which aims to add objectives, attack stages, and cross-domain context.
Their OCA Indicators of Behaviour post extends that argument into standards and interoperability, while the MITRE ATT&CK post emphasizes combining complementary frameworks rather than treating one as a complete answer.
In a post about an OpenAI security incident, they note that technical details were not yet available and avoid claiming a confirmed attack path.
Follow their work for accessible discussion of behavioural threat intelligence, standards, and AI-related security questions.
For campaigns requiring original incident research or hands-on implementation, ask for examples.
Makarand Karanjalkar argues that cybersecurity has spent two decades building practices around detecting artifacts — malware signatures, IP addresses, file hashes and known techniques — and that defenders now need a way to describe and share what attackers actually do.
Read more
The posts distinguish behaviour analytics, which flags unusual activity, from behavioural threat intelligence, which explains the attacker objective it serves and how it connects across domains.
The recurring priority is making behaviour representable and shareable, reflected in the focus on the OCA Indicators of Behaviour project and the treatment of MITRE ATT&CK, STIX and D3FEND as complements rather than competitors.
A later thread extends the argument to autonomous AI agents.
Flagging an anomaly is not the same as understanding an attack
Across the posts, the central distinction is between tools that detect deviations and intelligence that explains their meaning.
Read more
Behaviour analytics — spanning user, entity, process and network monitoring — answers whether activity is unusual, often stopping at “something abnormal happened.”
Behavioural threat intelligence asks which adversarial objective the behaviour serves, which stage of an attack it belongs to, how it connects to activity in other domains and what the attacker is likely to do next.
Makarand Karanjalkar names mainstream products that perform the first kind of analysis and treats the second as an open question, asking readers whether anomaly detection is enough.
A side-by-side comparison: behaviour analytics detects abnormal PowerShell activity; behavioural threat intelligence recognises it as part of a credential access objective, correlates it with identity and network activity, and places it in a broader campaign.
Behaviour is harder for attackers to change than the tools they use
The case for behavioural intelligence rests on stability: attackers can quickly swap malware, IP addresses, domains and infrastructure, but still need to gain access, escalate privileges, move laterally and exfiltrate data.
Read more
Makarand Karanjalkar explains the Open Cybersecurity Alliance's Indicators of Behaviour subproject, under OASIS, which uses the STIX 2.1 standard to represent attacker behaviour in a vendor-neutral, machine-readable form.
Its stated goals are a common representation for behavioural indicators, a vendor-neutral data model, better interoperability between security tools and easier sharing of behavioural intelligence across organisations.
The post says this work complements traditional threat intelligence rather than replacing it.
The behaviours in scope include initial access patterns, privilege escalation, credential access, lateral movement, persistence, command and control, and data staging and exfiltration.
Makarand Karanjalkar credits MITRE ATT&CK with transforming how teams map adversary tactics and techniques, build detection rules, hunt threats and run purple-team exercises, then asks whether it is enough on its own.
Read more
Attacks rarely stay inside one technology domain, and the gaps identified are correlating behaviour across domains, reconstructing complete campaigns, sharing behavioural intelligence consistently, and supporting AI-assisted investigation and reasoning. The post points to STIX for representing threat intelligence, MITRE D3FEND for defensive techniques, and the OCA Indicators of Behaviour work for behavioural observations, and argues the more useful question is how the frameworks work together rather than which is best.
The domains an attacker may cross — identity, cloud, endpoint, network, SaaS and OT/ICS — show why a single framework can struggle to capture an entire campaign. The post asks readers to name ATT&CK's biggest limitation.
Autonomous agents change what security operations should watch
Reacting to a security incident at OpenAI, Makarand Karanjalkar asks what changes when the next generation of attackers does not behave like traditional malware — a system that can explore its environment, reason about constraints, adapt when blocked and pursue an objective autonomously.
Read more
The distinction drawn is between threat intelligence that reports what happened and a layer that understands how an autonomous agent behaves over time, including its objectives, decisions, adaptations and progression.
The post carries its own constraint: OpenAI had not published full technical details, so conclusions about the specific attack path would be premature.
It asks readers what security operations centres should detect first if autonomous agents become common — code, techniques or behaviour.
The framing question makes the point: rather than debating the exploit, the post asks whether behaviour over time should be a detection target alongside known indicators.
This thread extends the earlier argument about behaviour: autonomous agents are presented as a case where artifact-based detection is least likely to be enough.
Translating other people's threat research for practitioners
Alongside original analysis, Makarand Karanjalkar recommends Microsoft's Cyber Signals Issue 9 as a source of practical lessons for defenders, not just headlines, and directs readers to a breakdown on the MyHackerZone page.
Read more
The post points people interested in threat intelligence, security operations and AI-driven cyber defence to the research, and asks which finding stood out. The report is Microsoft's work, attributed as such.
The post names a report, its intended audience and a discussion prompt, showing how Makarand Karanjalkar shares other people's research.
Start here for the central idea in Makarand Karanjalkar’s posts: what is the difference between a product that flags unusual activity and intelligence that explains what an attacker is doing?
Read more
This post states that distinction most directly.
Makarand Karanjalkar distinguishes behaviour analytics—which covers user, entity, process and network monitoring and appears in products such as Microsoft Defender, CrowdStrike Falcon, Splunk, Exabeam, Darktrace and Google Chronicle—from behavioural threat intelligence.
The first asks, “is this unusual?” and often stops at “something abnormal happened.”
The second asks what adversarial objective the activity represents, which stage of an attack it belongs to, how it relates to activity in other domains, and what the attacker is likely to do next.
The comparison is concrete: behaviour analytics detects abnormal PowerShell activity; behavioural threat intelligence recognises it as part of a credential access objective, correlates it with identity and network activity, and places it within a broader campaign.
They frame this as an open question rather than a settled position, closing by asking readers whether anomaly detection is enough.
For brands planning a campaign
This is the clearest opening for a vendor collaboration on behavioural threat intelligence.
The post sets out the gap between anomaly detection and behavioural context, giving a follow-up room to present a specific detection, correlation or investigation workflow without having to argue the premise.
Its closing question offers a ready engagement hook for SOC and threat-hunting audiences.
This explains the standards effort behind the behavioural-intelligence argument in plain terms.
Read more
Read it to understand what a machine-readable indicator of behaviour is meant to be and why sharing behaviour is harder than sharing malware signatures.
Makarand Karanjalkar explains the Open Cybersecurity Alliance’s Indicators of Behaviour subproject, which sits under OASIS and aims to represent attacker behaviour using the STIX 2.1 standard.
The post lists the behaviours in scope: initial access patterns, privilege escalation, credential access, lateral movement, persistence, command and control, and data staging and exfiltration.
Its stated goals are a common representation for behavioural indicators, a vendor-neutral data model, behavioural intelligence expressed in STIX 2.1, better interoperability between security tools, and easier sharing across organisations.
The practical case is that attackers can quickly change malware, IP addresses, domains and infrastructure, but still need to gain access, escalate privileges, move laterally and exfiltrate data, making behaviour comparatively stable.
The post says this complements traditional threat intelligence rather than replacing it.
For brands planning a campaign
A useful topic for a standards-aligned collaboration: it gives a vendor a neutral, community-facing subject, and its list of in-scope behaviours can be mapped directly to product capabilities in threat hunting, AI-assisted detection, XDR and cross-domain correlation. The piece is an explainer, not an account of Makarand Karanjalkar’s implementation experience; ask for concrete examples if the collaboration is meant to demonstrate the standard in use.
Read this for a framework question defenders actually argue about: ATT&CK describes how attackers operate, but what does it leave out?
Read more
The post shows how Makarand Karanjalkar positions complementary standards.
Makarand Karanjalkar credits MITRE ATT&CK with transforming how teams map adversary tactics and techniques, build detection rules, hunt threats and run purple-team exercises, then asks whether it is enough on its own.
Attacks rarely stay in one technology domain, and the post lists the ones an attacker may cross: identity, cloud, endpoint, network, SaaS and OT/ICS.
It identifies challenges in correlating behaviour across those domains, reconstructing complete campaigns, sharing behavioural intelligence consistently, and supporting AI-assisted investigation and reasoning.
The post points to STIX for representing threat intelligence, MITRE D3FEND for defensive techniques, and the OCA Indicators of Behaviour work for behavioural observations.
It argues that the useful question is how the frameworks work together, not which one is best, and closes by asking readers to name ATT&CK’s biggest limitation.
For brands planning a campaign
A strong fit for a vendor selling detection engineering or cross-domain correlation.
The post sets up the problem, names the domains and leaves the answer open, giving a collaboration a clear opportunity to show how a product joins identity, cloud, endpoint and SaaS signals.
Its closing community question could anchor a sponsored thread or webinar.
This is where the behavioural-intelligence argument meets current events.
Read more
It shows how Makarand Karanjalkar applies the thesis to AI agents and how carefully they handle an unresolved incident.
Reacting to an OpenAI security incident, Makarand Karanjalkar asks what changes when the next generation of attackers does not behave like traditional malware: a system that can explore its environment, reason about constraints, adapt when blocked and pursue an objective autonomously.
They distinguish threat intelligence that tells you what happened from a layer that understands how an autonomous agent behaves over time, including its objectives, decisions, adaptations and progression.
The post says OpenAI had not yet published full technical details and that it was too early to draw conclusions about the specific attack path.
It asks readers what SOCs should detect first if autonomous agents become common: code, techniques or behaviour.
For brands planning a campaign
An event-driven commentary slot for AI security positioning, with a caveat that keeps the piece honest while the incident is unresolved.
Pair it with confirmed technical detail before publication.
The framing question—whether SOCs should detect code, techniques or behaviour—offers a useful anchor for thought leadership on autonomous-agent defence.
The shortest and least analytical of the set: read it to see how Makarand Karanjalkar points readers toward other people’s threat research.
Read more
It is useful mainly as a signal of habits, not as a standalone argument.
This post recommends Microsoft’s Cyber Signals Issue 9 as a source of practical lessons for defenders, not headlines, and links to a summary on the MyHackerZone page.
It names the report and its intended audience—threat intelligence, SOC and AI-driven cyber defence readers—and asks which finding stood out.
Review the external link for the substantive analysis.
For brands planning a campaign
The weakest choice for a collaboration centrepiece: the post offers no original analysis.
It does show a working habit of summarising third-party research and inviting discussion, a format a vendor could use for a curated breakdown of its report with a specific question attached.
Ask for the linked breakdown before planning around its content.
Behavioural threat intelligence as distinct from behaviour analytics
Distinguishes user, entity, process, and network behaviour analytics from what they call behavioural threat intelligence.
Read more
The argument: mainstream tools — Microsoft Defender, CrowdStrike Falcon, Splunk, Exabeam, Darktrace, and Google Chronicle — answer whether activity is unusual, while behavioural intelligence explains which attacker objective a behaviour serves and how it connects across identity, network, and other domains. A concrete pairing illustrates the distinction: one approach flags abnormal PowerShell; the other reads it as credential access within a broader campaign.
Uses a side-by-side comparison and worked example rather than a definition list, giving a partner a structure to reuse.
For brands planning a campaign
A direct hook for thought leadership that distinguishes a vendor’s offering from generic UEBA claims. A vendor selling correlation, detection engineering, or threat intelligence can supply product-side detail while the creator frames the conceptual distinction.
OCA Indicators of Behaviour and STIX-based behaviour sharing
Covers the Open Cybersecurity Alliance Indicators of Behaviour subproject under OASIS Open, which uses STIX 2.1 to represent attacker behaviour in a vendor-neutral, machine-readable form.
Read more
It lists the stages covered — initial access, privilege escalation, credential access, lateral movement, persistence, command and control, data staging and exfiltration — and argues that behaviour is harder for attackers to change than malware, IP addresses, domains, or infrastructure.
Explains the initiative through the problem, the project’s goals, and downstream benefits for threat hunting, AI-assisted detection, XDR, and SOC operations.
For brands planning a campaign
The strongest technical angle for a standards, interoperability, or detection-platform partner. A vendor involved in STIX tooling, XDR, or cross-domain correlation could co-develop a piece on how a behavioural data model changes practice.
Where MITRE ATT&CK stops and complementary frameworks begin
Questions whether MITRE ATT&CK alone is sufficient for modern defence, noting that attacks cross identity, cloud, endpoint, network, SaaS, and OT/ICS domains.
Read more
It identifies gaps organisations still face — correlating behaviour across domains, reconstructing full campaigns, sharing behavioural intelligence consistently, and supporting AI-assisted investigation — and positions STIX, MITRE D3FEND, and the OCA Indicators of Behaviour work as complements, not replacements.
Builds the case by listing domains, challenges, and adjacent initiatives, then reframes the question from which framework is best to how they work together.
For brands planning a campaign
A good fit for a debate or roundtable: the closing question about ATT&CK’s biggest limitation invites responses from vendors and practitioners. A partner can bring cross-framework mapping data or detection-engineering examples.
Autonomous AI agents as a detection problem for SOCs
Uses a security incident at OpenAI to make a broader argument: if attackers can explore environments, reason about constraints, and adapt when blocked, detecting only code, techniques, or known TTPs may be insufficient.
Read more
It proposes behaviour over time — objectives, decisions, adaptations, progression — as an additional layer that builds on IOCs and ATT&CK rather than replacing them. OpenAI had not published full technical details at the time of writing, so conclusions about the attack path were premature.
For brands planning a campaign
A timely AI-security angle for a vendor brief on AI-driven defence. Ask the partner to supply verified technical grounding before developing this into a campaign piece rather than commentary.
Curated practitioner briefings alongside original analysis
The regular format is short explanatory posts that define a concept, contrast it with common practice, and close with a question to the community.
Read more
A second format is curated summarising: one post directs readers to a breakdown of Microsoft Cyber Signals Issue 9 on the MyHackerZone site, framed for people interested in threat intelligence, SOC operations, and AI-driven cyber defence.
The posts follow a recurring pattern: definition, contrast with a common practice, concrete example, then an open question. The curation post applies the same explanatory framing to someone else’s research.
The Microsoft Cyber Signals post mainly points to an external breakdown on the creator’s own site; it develops no argument of its own, so it supports the format observation more than a topical claim.
For brands planning a campaign
Two collaboration formats: original conceptual posts presenting a vendor’s point of view, and curator-style posts introducing third-party research, suited to sponsored report launches or research distribution.
The posts do not state whether Makarand Karanjalkar has any sponsorship, affiliate, employment, ownership, or investment relationships.
Read more
They show a concrete connection to MyHackerZone: a breakdown of Microsoft's Cyber Signals Issue 9 was published there and promoted from the LinkedIn account.
The posts describe this as a disclosed partnership but do not specify the relationship; ask what role they have with MyHackerZone.
Microsoft is identified as the publisher of a report they summarised and shared, a content reference rather than a commercial relationship.
Other company names in the posts—Microsoft Defender, CrowdStrike Falcon, Splunk, Exabeam, Darktrace, and Google Chronicle—are used as examples of behaviour analytics products, not as relationships.
MyHackerZone
Disclosed partnership
Points readers to a MyHackerZone breakdown of Microsoft's Cyber Signals Issue 9 and speaks of the breakdown as shared work ("We've broken down the key findings into an easy-to-understand summary on the MyHackerZone page").
Read more
The post does not state whether MyHackerZone is a business the creator owns, works for, or writes for on another basis, so the relationship is recorded as unstated.
Recommends Microsoft's Cyber Signals Issue 9 as a source on threat-landscape trends and points to a plain-language summary of its findings for defenders.
Read more
The post identifies Microsoft as the report's publisher.
Makarand Karanjalkar writes short LinkedIn arguments about what defenders should watch when attackers can change tools faster than detection can keep up.
Read more
Start with the post distinguishing behaviour analytics from behavioural threat intelligence: it sets out the distinction the rest of the writing builds on, contrasting tools that answer "is this unusual?" with analysis that asks which attacker objective a behaviour serves.
The Indicators of Behaviour post then explains the OASIS/STIX work they are tracking, while the MITRE ATT&CK post places that effort alongside STIX and D3FEND rather than in competition with them.
The newest strand applies the same reasoning to autonomous AI agents.
Each post closes with a question, keeping the framing open, while the Microsoft Cyber Signals post offers a second mode: pointing readers to someone else's research and briefly explaining why it matters.
Read the original posts in that order for the concepts; follow the community questions and standards work for the ongoing thread.
Behavioural threat intelligenceThreat intelligenceMITRE ATT&CKDetection engineeringSecurity operationsAI securityThreat intelligence standards (STIX, OASIS)Behaviour analyticsShort-form explainer postsCurated research briefingsPosts that close with a question to readersSecurity operations centre teamsThreat intelligence practitioners
Reilyn Garton
Karanjalkar makes the case that detection built on malware signatures and known artifacts is already behind, arguing for behavioural detection backed by identity telemetry and purple-team validation.
Read more
Both writers use short LinkedIn posts to build an argument, pose pointed questions to operators and draw on published adversary reporting.
Reilyn Garton takes a tradecraft view, examining adversary behaviour such as living-off-the-land techniques, session hijacking and OAuth abuse, and citing CISA and Mandiant guidance. Makarand Karanjalkar focuses on how behaviour should be represented, shared and framed in standards.
Both writers aim to make security practice actionable for defenders and analysts, connecting offensive or adversary activity to what detection should have caught.
Read more
They also present reusable guidance for people building skills in security operations.
Okan YILDIZ teaches through step-by-step roadmaps, including a guide to setting up a Microsoft Sentinel home lab and a field manual for reading a penetration test report, with questions analysts should answer at each stage. Karanjalkar instead develops conceptual contrasts and framework arguments, with less procedural detail.
Karanjalkar argues from published threat and breach reporting that the industry has spent decades on the wrong problem and that AI-enabled attacks scale faster than existing defences.
Read more
Both writers cite explicit figures and named reports, distinguishing the cited findings from their own interpretations.
John Ellingson argues at the architectural level for removing humans from the attack surface entirely, then extrapolates ten years across scale, speed and scope. Karanjalkar focuses on detection and representation, arguing that behaviour can be described and shared using existing standards rather than replaced at the root.
Makarand Karanjalkar’s LinkedIn account had 2,389 followers when observed on 11 October 2026.
Read more
Five posts published between 13 July and 4 August 2026 address behavioural threat intelligence, MITRE ATT&CK’s limits, AI-driven attacks, and the OCA Indicators of Behaviour project—topics that point to a practitioner readership in security operations and detection.
The posts support a judgment of reach and topical relevance, but not audience composition.
For a thought leadership collaboration on behavioural threat intelligence and AI security, that alignment is the main positive; the modest follower base and lack of engagement or demographic data make this a small, unmeasured audience rather than a verified practitioner segment.
The OpenAI incident post and the Behaviour Analytics versus Behavioural Threat Intelligence post both pose open questions for a specialist community rather than offering general-audience explainers.
Ask Karanjalkar for recent results on comparable topics, post lengths, and formats, and for any audience survey covering occupation, employer type, or job seniority.
LinkedIn followers
2,389
LinkedIn profile (linkedin.com/in/makkaran), associated with the same account as the reviewed posts · 2026-10-11
Posts discussed here
5
LinkedIn posts published by the same profile · 2026-08-04
Post date range
13 July 2026 to 4 August 2026
LinkedIn posts published by the same profile · 2026-08-04
Audience demographics (geography, age, gender)
Not documented in the evidence
No platform demographic data supplied · 2026-10-11
Audience occupation, employer type, or job seniority
Not documented in the evidence
No audience survey or professional-attribute export supplied · 2026-10-11
Makarand Karanjalkar's posts do not document a sponsorship offer, rate, or partnership format, and no official inquiry route is stated.
Read more
What the posts do show is an operating pattern a buyer would need to account for: the material is analyst-style commentary on threat intelligence, behavioural analytics, and AI security, published as standalone LinkedIn discussions rather than vendor placements.
One post (23 July 2026) promotes a breakdown of Microsoft Cyber Signals hosted on a page the author calls MyHackerZone — a pointer to the author's own summary rather than a disclosed paid partnership, so it is not evidence of a commercial format.
A campaign aimed at readers interested in behavioural threat intelligence and AI security would depend on the author producing original analysis and framing, which is what the posts consist of; it would not plug into an existing sponsor slot, media kit, or newsletter package, because none appears in the posts here.
Treat sponsorships as undocumented rather than ruled out.
Best fit: a thought leadership collaboration with a security vendor on behavioural threat intelligence and AI security.
Read more
Makarand Karanjalkar already writes the argument a vendor would want sponsored; they do not need to be taught it.
The 30 July 2026 post on behaviour analytics versus behavioural threat intelligence draws the line between tools that flag unusual activity and intelligence that explains an attacker’s objective.
It works through one concrete pairing: abnormal PowerShell activity read as credential access inside a broader campaign.
That is the exact ground a correlation, detection-engineering or XDR vendor sells on.
The post names the mainstream products it argues against, so a follow-up can position a specific product without re-establishing the premise.
The MITRE ATT&CK post adds a second usable asset: it sets out the domains attacks cross and asks what ATT&CK does not cover, making it a fit for a co-authored piece on framework mapping or cross-domain correlation.
The OCA Indicators of Behaviour explainer opens a standards-aligned topic where the vendor can supply implementation detail absent from the creator’s version.
The demonstrated format also gives a collaboration a ready shape and engagement hook: short explanatory posts define a concept, contrast it with common practice, add a worked example and close with a question to the community.
The Microsoft Cyber Signals post shows a second habit—curated breakdowns of third-party research—that fits sponsored report launches.
The fit rests on editorial substance, not demonstrated reach.
The AI-agent angle is the weakest of the set: the creator’s post notes that OpenAI had not published full technical details, so any piece built on it needs verified technical grounding first.
When to choose a specialist
Poor fit: an awareness or demand-generation campaign aimed at a large, broad or non-specialist audience with a reach, click or conversion target.
Read more
The available audience information is limited to the profile: a LinkedIn account with 2,389 followers as of 11 October 2026.
The posts are specialist analyst commentary for people interested in threat intelligence and SOC operations, not the plain-language small-business or general-business framing such a campaign would need.
They are LinkedIn text posts, so a campaign requiring video, live demonstration or multi-channel distribution would need a separate plan.
Before commissioning a measurable-reach campaign, ask for rates, past sponsored-work disclosures, recent performance on comparable topics, and audience data by occupation, employer type and seniority.
The only outbound commercial-looking link points to the creator’s own summary page, not a disclosed partnership.
A worked campaign example
Worked angle for a collaboration on the gap between anomaly detection and behavioural intelligence: a three-part series anchored in posts that already make the argument.
Part one is a co-authored long-form explainer opening with the PowerShell example from the behaviour analytics post: behaviour analytics detects abnormal PowerShell activity; behavioural threat intelligence recognises it as credential access, correlates it with identity and network activity, and places it in a wider campaign.
The vendor contributes product-side detail on which stages and data sources its tooling joins up, while Makarand Karanjalkar contributes the framing and the community-facing question that closes the posts.
Part two is a discussion piece on the data model: take the OCA Indicators of Behaviour scope the creator lists, from initial access through data staging and exfiltration, and map it against the vendor’s correlation and threat-hunting capabilities.
The vendor supplies concrete implementation examples absent from the existing explainer.
Part three is a curated breakdown in the style of the Cyber Signals post: summarise the vendor’s latest threat report for a practitioner readership and attach one specific question to draw responses.
Parts one and two build on arguments the creator has already published and tested with readers, leaving room for detail and product specifics; part three reuses a demonstrated format.
Before drafting, the vendor should supply verified technical detail for any AI-agent element, confirm capability claims, and provide the report or dataset at the centre of the curated piece.
Suggested starting question for the series: which attacker behaviour would a SOC most want represented in a shared, machine-readable form, and what stops teams correlating it today?
Discuss distribution and performance expectations separately.
Pick Reilyn Garton when the collaboration needs operator-level detection engineering rather than a concept.
Read more
The Volt Typhoon post turns the same behavioural-detection argument into checks a defender can act on: logging and correlating lateral movement over SMB, WMI and WinRM; alerting on anomalous service-account use; baselining admin behaviour; and hunting credential access instead of payloads.
The identity post names the tradecraft — session hijacking, OAuth abuse, MFA fatigue, token replay — and the controls that address it: token lifetime reduction, session revocation, and identity signals fused with endpoint and network data.
For a vendor selling detection content, identity telemetry or purple-team validation on a behavioural threat intelligence brief, this is a closer match than Makarand Karanjalkar's framework-level pieces: the argument is framed as a tradecraft problem with testable questions attached.
The tradeoff is that both posts build on named third-party research — the CISA Volt Typhoon advisory and Mandiant SaaS data-theft guidance — rather than developing an original framework argument. A collaboration would rely on the vendor for the conceptual spine and the standardisation angle (STIX, OCA Indicators of Behaviour, MITRE ATT&CK coverage) that Makarand Karanjalkar's posts already set out.
Pick Okan YILDIZ when the deliverable is a build-along teaching asset rather than a think piece.
Read more
The Microsoft Sentinel post walks readers from an empty Azure environment to a working SOC: subscription and resource group, Log Analytics workspace, enabling Sentinel, retention and health settings, connecting Windows security logs, reading tables and Event IDs, writing KQL, hunting failed logins with Event ID 4625, turning that query into an analytics rule, triggering an alert, investigating the incident, and adding automation rules and playbooks.
The pentest post applies the same teaching instinct to reporting: scope, attack path, evidence, root cause, remediation, retest, plus the debrief question every SOC should ask — which tester actions should our controls have detected?
A vendor that needs its product demonstrated inside a console or mapped onto an analyst workflow gets executable steps, not description.
The tradeoff is that the material is instructional and partly built on others' work: the Sentinel walkthrough is credited to Blueteamers, and the pentest post promotes the creator's own 18-page field manual.
A sponsored piece would share space with an existing asset and a third-party credit.
Neither post carries the behavioural threat intelligence or AI-security framing needed for a campaign in either area.
Pick John Ellingson when the vendor wants argument and forecast rather than practitioner guidance.
Read more
The CrowdStrike 2026 Global Threat Report post reads the numbers straight — attack volume up 89% year over year, breakout time down to 29 minutes, 82% of intrusions using no malware — then runs a ten-year extrapolation on scale, speed and scope, labeling it as the author's own rather than a finding of the reports.
The earlier post makes the opposite kind of case: that the industry has spent 40 years treating security as a technology problem while the breach rate worsened because the exploited surface is human, and that the fix is structural removal of the human from the attack surface.
For a vendor that wants a provocative long-range thesis as the opening argument of a series, this is the sharper choice.
The tradeoff is commercial and editorial risk.
The second post advocates a specific architecture (EKI), so a vendor collaboration alongside it risks looking like an endorsement of a competing approach.
The report post extrapolates from published research; it does not offer detection or implementation detail.
A buyer seeking a collaboration around that architecture would need to agree on the boundary between the creator's existing thesis and the vendor's product before commissioning.
The result would be argumentation rather than the operational specificity Makarand Karanjalkar's PowerShell and framework examples supply.
Five full LinkedIn posts dated 13 July–4 August 2026 cover behavioural threat intelligence, the OCA Indicators of Behaviour project, MITRE ATT&CK, AI security and a pointer to a Microsoft Cyber Signals summary; the summary itself is not discussed here.
The posts do not establish a signature book, show or earlier body of work, and do not provide a complete picture of Makarand Karanjalkar's work.