# Michael McLaughlin

Michael McLaughlin is a cybersecurity attorney who writes and speaks about the legal and national-security consequences of cyber policy. Their work connects practical issues such as defense contractor compliance and incident reporting with broader questions about AI security and data supply chains.

- Profile: https://b2binfluencer.marketing/creators/michael-mclaughlin/
- LinkedIn: https://www.linkedin.com/in/michael-g-mclaughlin
- LinkedIn followers: 17,751
- Topics: artificial-intelligence, cybersecurity, defense-industrial-base
- Based on 17 dated posts, latest 2026-10-09

## Summary

Michael McLaughlin is most useful for cybersecurity compliance thought leadership aimed at defense contractors and their advisers.

- Best for: Cybersecurity compliance firms expanding a defense industrial base practice and campaigns aimed at contractors and advisers.
- Not for: Retail, e-commerce, marketing operations, demand generation, or customer-data platform campaigns; not product-led growth content.
- Check first: Ask for post analytics and follower demographics on comparable CMMC and incident-reporting posts.

### Takeaways

- CMMC suspension raises Administrative Procedure Act issues and may not survive courts or threat.
- MSPs with privileged access to contractor systems are high-leverage; only about 40 have CMMC Level 2.
- AI security depends on knowing training-data provenance; proposed control is a Training Data Bill of Materials.

## Main ideas

- **Security rules need verification, not just attestations**: McLaughlin argues that compliance requirements lose force when organizations can attest to controls without independent checks. They recognize that implementation costs burden small contractors and propose easing implementation without removing verification.
- **Cyber rules should account for who actually controls the systems**: McLaughlin focuses on gaps between formal responsibility and practical access. A contractor may be responsible for protecting sensitive information while a service provider holds privileged access to the systems that contain it.
- **Incident reporting should help defenders act sooner**: McLaughlin argues that organizations can be pulled into parallel processes during a cyber incident: containing the intrusion and meeting overlapping reporting duties. They favor coordination that preserves agencies’ legal authority while reducing avoidable operational friction.
- **AI security depends on knowing where the data came from**: McLaughlin treats training data as part of an AI system’s supply chain, not a neutral input. They warn that data with unclear provenance can affect model outputs in ways that are difficult to explain or defend, especially in high-stakes settings.
- **Treat the cause of cyber risk, not only its aftermath**: McLaughlin questions a security model built around breaches, investigations, insurance, and recovery while leaving vulnerable systems in place. They argue that architecture and data concentration can make a breach more damaging than a patching failure alone would suggest.
- **Private cyber capability needs coordination and clear limits**: McLaughlin distinguishes a company’s technical ability from its authority to act. When government and private organizations operate against overlapping infrastructure, poor coordination can cause operational, diplomatic, and legal harm.

## Work to read

- [The CMMC 'pause' isn't about national security](https://www.linkedin.com/posts/michael-g-mclaughlin_msp-collective-open-response-to-suspension-activity-7488292213693763585-QrVl)
- [Rulemaking by memo: why the CMMC suspension may not survive courts or the threat](https://www.linkedin.com/posts/michael-g-mclaughlin_rulemaking-by-memo-why-cmmc-suspension-deserves-activity-7503478780468871168-hOf6)
- [The Pentagon's cyber rules leave MSPs as a high-leverage attack vector](https://www.linkedin.com/posts/michael-g-mclaughlin_the-pentagons-cyber-rules-leave-msps-as-activity-7460434353551216640-lm0G)
- [Operationalizing cyber incident reporting: report once, use many times](https://www.linkedin.com/posts/michael-g-mclaughlin_mccrary-operationalizing-cyber-incident-activity-7501451155995017216-bkCg)
- [The supply chain for American AI runs through Beijing](https://www.linkedin.com/posts/michael-g-mclaughlin_the-supply-chain-for-american-ai-runs-through-activity-7460743576248000512-knVh)
- [New executive order on AI innovation and security: what it changes](https://www.linkedin.com/posts/michael-g-mclaughlin_new-executive-order-on-ai-innovation-and-activity-7468653651805413376-vn1s)
- [Digital sovereignty is about who owns and trains on the data](https://www.linkedin.com/posts/michael-g-mclaughlin_opinion-the-digital-sovereignty-debate-activity-7486931314223468544-7yTt)
- [Cybersecurity has become a self-licking ice cream cone](https://www.linkedin.com/posts/michael-g-mclaughlin_cybersecurity-has-become-a-self-licking-ice-activity-7509688566759768065-jwZV)
- [The U.S. government has a scale problem in cyberspace](https://www.linkedin.com/posts/michael-g-mclaughlin_the-us-government-has-a-scale-problem-in-activity-7501415621285310465-xtKf)
- [Securing the defense industrial base is not optional](https://www.linkedin.com/posts/michael-g-mclaughlin_where-cybersecurity-meets-legal-activity-7430000415406088192-tdcG)

## Brand relationships

- **McCrary Institute for Cyber & Critical Infrastructure Security** (disclosed_partnership)
- **U.S. Chamber of Commerce** (disclosed_partnership)
- **Buchanan Ingersoll & Rooney PC** (mention)
- **Nextgov/FCW** (mention)
- **Lawfare** (mention)

## Partnerships

The posts show McLaughlin working through editorial, institutional, and industry channels, but document no commercial sponsorship offer. They have published commentary in outlets such as Lawfare and Nextgov/FCW, served as a principal contributor to a McCrary Institute and U.S. Chamber of Commerce report on cyber incident reporting, discussed CMMC and defense-industrial security with Summit 7, and appeared on ABA and podcast programming. None shows a sponsored post, paid-placement disclosure, audience or content package, rate card, or terms a brand could buy. A cybersecurity compliance vendor planning defense-industrial thought leadership or client advisory work should ask directly whether they offer paid partnerships and, if so, what the package includes and costs.

## Alternatives

- Thomas Ward: Choose Ward over McLaughlin when the campaign needs someone who speaks straight to the contractor deciding what to do this quarter. In his July 2026 post he takes the CMMC Phase II pause and answers the questions it immediately raises — whether to stop preparing, cancel an assessment, or treat NIST SP 800-171 as obsolete — then tells organizations to keep maturing controls, close gaps, write policies that hold up in daily operations, and prepare for whatever assessment comes next. He pairs that guidance with an explicit offer set: gap assessments, SSP and POA&M development, fractional CISO or compliance advisory work, and a free one-hour strategy call. For a firm that wants content tied to a booked advisory intake rather than pure authority building, that directness is useful, and his more than 26 years in enterprise IT, cybersecurity, and compliance gives the pitch a practitioner grounding McLaughlin states less explicitly.
- Jason Sproesser: Choose Sproesser when the audience is the person implementing controls rather than the lawyer or executive approving the program. His posts separate NIST SP 800-171 revision 2 from revision 3 and lay out the practical bind: the CIO has called 800-171 implementation "table stakes," the FAR CUI rule is close to being live and points at r3, and if the current class deviation survives review then DFARS could require r2 while FAR requires r3, leaving some contractors bound to both at once. He delivers that through a recurring show, ending with plain subscribe and share asks, which hands a partner an episodic format with its own cadence instead of a single article to place.
- Darron Makrokanis: Choose Makrokanis when the goal is co-marketing with a company already inside the small-business CMMC market rather than a personal expert byline. His posts announce Summit 7's selection as one of eight companies in the U.S. Army's NCODE program, quote the CEO on why small contractors should not be shut out of the defense supply chain, and promote an AUSA-week supply chain readiness reception with a new low-cost offering for suppliers under 25 employees. For a compliance firm, that is program news and event access a campaign can attach to: a reason to be in the room with primes and small suppliers, and a concrete product aimed at the same cost barrier McLaughlin names.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/