# Michael Brooks

Michael Brooks is a cybersecurity professional whose work focuses on assessing whether security controls protect sensitive information, including in defense-related organizations.

- Profile: https://b2binfluencer.marketing/creators/michael-brooks/
- LinkedIn: https://www.linkedin.com/in/mdb-michael-brooks
- LinkedIn followers: 6,166
- YouTube: https://www.youtube.com/channel/UCh2UY1hxlMr4_7Az_iQ82HQ
- Topics: cybersecurity
- Based on 10 dated posts, latest 2026-10-09

## Summary

Most useful for explaining how to assess whether security controls actually protect sensitive information.

- Best for: A cybersecurity consulting firm running thought-leadership webinars for defense contractors on resilience and assessment.
- Not for: A consumer identity-protection brand seeking high-reach household awareness, paid social video, or influencer-style personal stories.
- Check first: Confirm their audience includes people who can influence or approve a defense-contractor security program.

### Takeaways

- They distinguish restoring a system from restoring confidentiality of information already exposed.
- Assessment can use four tests: control exists, implemented correctly, effective, and effectiveness can be demonstrated.
- A breach review asks who owned risk, which safeguards failed, and how fixes are verified.

## Main ideas

- **An assessment's job is to prove controls work**: Michael Brooks defines a security assessment by what it produces: evidence. The test is not whether a control was documented or a report filed, but whether anyone can show that the control exists, is configured correctly, works in practice, and can be proven to do so. An assessment completed with the least possible disruption has missed its purpose: to find weaknesses before an adversary does. The same standard applies at the organizational level. Preventive and detective controls should prevent disclosure, detect activity, and limit exposure. When they do not, the question is why.
- **Resilience claims have to survive the loss of confidentiality**: Michael Brooks accepts "from static checklists to continuous cyber resilience" as a worthy ambition but asks whether the change delivers the protection people and the mission require. The reasoning turns on an asymmetry: a system can be restored, but exposed information cannot be made secret again. That makes confidentiality loss the case a resilience program has to answer for. Continuous resilience means continuous evidence that protections work, plus accountability when they do not.
- **A breach should be reviewed through accountability questions**: Rather than treating a breach as a technical incident to close, Michael Brooks uses it as a case for reform and lists what that reform should answer: who owned the risk, which safeguards failed, who authorized the system to operate and on what basis, what evidence supported confidence in those safeguards, and how corrections will be verified. Reducing bureaucratic drag is useful only if it strengthens the ability to answer those questions; otherwise, the same failure can recur without anyone showing what changed.
- **Regulatory uncertainty is not a reason to stop**: Michael Brooks reports hearing the same concern from defense contractors: they want to do the right thing but are no longer sure what that is. The pressures named are the Pentagon breach, continued uncertainty around CMMC, contract and system scoping challenges, and ongoing CUI ambiguity. The response is not a promise of clarity but a short list of what stays constant regardless — understand your obligations, protect sensitive information, make informed decisions, keep moving forward. The phrase "the mission continues" closes more than one post and carries the same idea. The quoted line comes from contractor conversations Michael Brooks reports having, not from a named individual; the partners at RADICL are named as session collaborators.
- **The people behind the data are the reason the work matters**: Michael Brooks writes about breaches as harm to people, not just records. The exposed files belonged to people who serve, served, and support the country. A veteran potentially affected and a cybersecurity professional who has evaluated whether controls are implemented and effective, they put the stakes plainly and reject assessments reduced to paperwork: the information and the people behind it matter.

## Work to read

- [From static checklists to continuous cyber resilience](https://www.linkedin.com/posts/mdb-michael-brooks_from-static-checklists-to-continuous-cyber-activity-7511407685330923520-L_-E)
- [A veteran's reaction to the Pentagon data breach](https://www.linkedin.com/posts/mdb-michael-brooks_pentagon-breach-exposed-sensitive-data-on-activity-7510488673491132416-lF9y)
- [Cutting through CMMC and CUI confusion for defense contractors](https://www.linkedin.com/posts/mdb-michael-brooks_cybersecurity-cui-defenseindustrialbase-activity-7511085279303168000-aKPs)

## Brand relationships

- **RADICL** (disclosed_partnership)
- **A-LIGN** (mention)

## Partnerships

The posts do not list a sponsorship package, rate card, media kit, or published inquiry route for Michael Brooks. They show participation in and promotion of live educational sessions with defense-industry partners. One post invites the Defense Industrial Base community to a session run with the partners at RADICL, covering what remains relevant under CMMC uncertainty, contract and system scoping challenges, and controlled unclassified information (CUI) ambiguity. The other two posts are commentary from Brooks on security assessment and the Pentagon personnel data breach, with no commercial offer. For a buyer planning a thought leadership webinar series on continuous cyber resilience and security assessment, session-based collaboration is the only format shown. No terms, deliverables, or booking process are published; ask Brooks directly about these before pursuing an arrangement.

## Alternatives

- Darron Makrokanis: Choose Makrokanis when the series needs to reach small and mid-sized defense suppliers held back by the cost of CMMC and NIST SP 800-171 compliance. The posts are written from inside Summit 7's CMMC work. Summit 7 was one of eight companies picked for the U.S. Army's NCODE program, described in the post as the Army's answer to the price barrier CMMC poses to businesses with 2 to 10 employees. A second post pitches a supply-chain readiness session at AUSA for primes and their small subcontractors, aimed at companies under 25 employees, and promises visibility into subcontractor compliance and a lower-cost path for smalls. If the webinar needs a co-host who can speak directly to getting small suppliers compliant and giving primes visibility into their status, Makrokanis is the closer match for the task.
- Muli Motola: Choose Motola when the series should center on identity and access management and the regulatory cost of unauthorized access, rather than control assessment for defense contractors. The two posts promote an 'Identity Nightmares' interview series. One features Kayla Williams, CISO at Devo, arguing that unauthorized access is itself a reportable incident that can trigger large GDPR fines, and that IAM has to block intruders while keeping authorized investigation and legal teams working. The other features Barry Gordon on privileged access, overlooked legacy systems, and misconfigurations that escalate into breaches. For a series with named practitioner guests and a GDPR and enterprise angle, the interview format is ready to reuse.
- Rebecca Human AI Trust Leader: Choose this creator when the need shifts toward AI trust, autonomous-agent risk, insider threat, or consumer digital identity instead of defense-contractor control assessment. The two posts cover an autonomous AI hack of three companies that Anthropic disclosed after the fact, framed around oversight, accountability, and the limits of machine 'understanding,' and the arrival of U.S. passport digital ID in Apple Wallet, framed around privacy, data access, and personal autonomy. For a broader AI-and-privacy angle or a session on insider and AI-driven threats, this material opens that conversation.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/