Michele Cerreta shares work on cybersecurity research, including automated penetration testing, vulnerability disclosure, AI and cyber threats, and blockchain-based criminal investigations.
Michele Cerreta is most useful for technical cybersecurity research, speaking, and coordinated vulnerability disclosure work.
Best for
A cybersecurity lab or security vendor seeking a technical speaker, workshop contributor, or research collaborator.
Not for
A consumer brand or general-audience product launch seeking broad reach and high-volume sponsored content.
Key takeaways
Presented Automating Penetration Testing with MeTeOr at OSVS Workshop at Euro S&P 2024.
Reported an exposed API vulnerability to TIM Group, which confirmed the flaw and shipped a fix.
Presented on AI prejudices and blockchain-based criminal investigations at ITASEC24.
Check first: Ask for recent LinkedIn analytics, audience survey, and attendance for comparable talks or workshops.
Main ideas
Vulnerability disclosure works best as a cooperative, timed process · Security research should be presented publicly and revised on expert feedback · AI bias is itself an attack surface
Michele Cerreta shares cybersecurity research and practical security work, including automated penetration testing, responsible vulnerability disclosure, AI-related threats and blockchain-based criminal investigations.
The posts reviewed show research presented at Euro S&P 2024 and ITASEC24, alongside a concrete account of reporting an exposed API vulnerability to a TIM Group service and receiving confirmation of a fix.
These examples make their work relevant to readers interested in how security research connects with real-world testing, disclosure and emerging technical questions.
The strongest thread is the link between technical research and applied security practice.
Cerreta describes a named research project, “Automating Penetration Testing with MeTeOr,” presented at the OSVS Workshop at Euro S&P 2024, and a disclosure process that runs from technical analysis and a proof of concept to a company correction.
Other posts broaden the picture: at ITASEC24, they describe presenting on AI prejudices and their exploitation and sharing research on blockchain-based criminal investigations.
A summer-school post adds learning across post-quantum cryptography, operational technology security, malware detection and cybersecurity governance.
Together, these posts offer a view of several connected areas of cybersecurity.
Michele Cerreta writes about cybersecurity as a cooperative, applied discipline.
Read more
Their posts argue that vulnerability disclosure should be private and timed, ending in a fix; that research earns its keep when presented publicly and revised in response to expert feedback; that attackers can exploit AI’s own biases; that formal methods can address practical investigative problems such as blockchain forensics; and that serious security work spans cryptography, operations, law and geopolitics.
The examples include an API vulnerability reported to a TIM Group service, a penetration-testing automation paper presented at Euro S&P 2024, a study on AI prejudices presented at ITASEC24 on behalf of Prof.
Gabriele Costa, and a blockchain forensics paper co-authored with colleagues at the IMT School.
Vulnerability disclosure works best as a cooperative, timed process
Cerreta treats responsible disclosure as a procedure, not a gesture: a researcher finds a potential flaw, reports it privately to the affected company through its dedicated channel, and allows time for a fix before publication.
Read more
The reasoning is practical: the process shortens the window of exposure, brings security researchers and company teams together, and helps prevent attacks exploiting the same weakness. Cerreta argues that companies with disclosure or bug bounty policies demonstrate security maturity by accepting that no system is invulnerable and that transparency and cooperation are the better ways to improve it.
Cerreta describes applying the process to an exposed API belonging to a TIM Group service: conducting a technical analysis, assessing the potential impact, contacting the team through its dedicated channels with a proof of concept and reproduction details, then receiving a quick response confirming the vulnerability and shipping a fix. The reported outcome: a risk removed before a third party could exploit it.
Security research should be presented publicly and revised on expert feedback
For Cerreta, publishing and presenting are part of the research, not an afterthought.
Read more
They describe presenting to expert audiences, gathering feedback and incorporating new perspectives, and frame conferences as places to exchange ideas, not just announce them. The same emphasis on collaboration and knowledge-sharing runs through the write-ups of academic workshops, industry sessions and the summer school.
At Euro S&P 2024 in Vienna, Cerreta presented the paper "Automating Penetration Testing with MeTeOr" at the OSVS Workshop, calling it a significant milestone and saying the feedback would inform the research. The post also notes the programme’s breadth, from emerging threats and defence mechanisms to privacy-preserving technologies.
In the ITASEC24 write-up, Cerreta argues that prejudices or biases in AI systems can be exploited in ways their designers did not anticipate, a concern in the context of advanced persistent threats.
Read more
The argument connects two subjects often discussed separately — how AI models behave and how attackers operate — and treats the former as a route into the latter.
Cerreta presented a study on AI prejudices and their unforeseen exploitations on behalf of Prof.
Gabriele Costa at the AI-APT workshop on artificial intelligence and advanced persistent threats at ITASEC24.
Prof.
Costa is credited with the study and its framing; Cerreta’s role was to present it.
Formal methods can be pointed at concrete investigative problems
The ITASEC24 material also shows how abstract techniques such as temporal logic can address operational needs.
Read more
Here, the challenge is criminal investigation: reasoning about events and their order on a blockchain, where transactions are public but the actors behind them are not. Cerreta names the colleagues who collaborated on the work.
At ITASEC24, Cerreta also co-presented the paper "Supporting Criminal Investigations on the Blockchain: A Temporal Logic-based Approach" with Hamza Sajjad, Davide Di Monda, and Matteo Fabbri of the IMT School. The paper applies a temporal logic-based approach to supporting criminal investigations on the blockchain.
Security is a cross-sector discipline, from cryptography to governance
The summer school write-up shows the breadth of training Cerreta values: technical topics such as post-quantum cryptography, OT security and malware detection, as well as geopolitics and the legal and governance dimensions of cybersecurity.
Read more
The week brought together universities, an agency headquarters, a police organisation, a NATO body and a consultancy project, reflecting a view of security as a field practised across sectors and borders.
Cerreta was selected for the International Cyber Security Summer School in The Hague.
The programme included lessons at Leiden University and the Security Delta headquarters, visits to Europol and the NATO Communications and Information Agency, a collaborative project with Accenture, and a serious cybersecurity game in which Cerreta’s group placed second.
They credit the organisers, Demi Oomen and Julian B., by name.
Answers “what is Cerreta's own research, and where has it been presented?”
Read more
Newcomers looking for a concrete example of named work should start here.
Cerreta writes about attending Euro S&P 2024 in Vienna and presenting “Automating Penetration Testing with MeTeOr” at the OSVS Workshop.
They describe the presentation as a milestone and say feedback from experts and researchers would inform the research.
The conference covered emerging threats, defence mechanisms and privacy-preserving technologies.
This is the clearest statement of a named research output presented at a peer-reviewed venue.
For brands planning a campaign
For a security vendor or research lab considering Cerreta as a speaker or collaborator, the natural anchor is an automated penetration-testing method presented at an academic workshop. An outreach message can reference the MeTeOr work and propose a talk, joint paper or technical session.
Answers “does Cerreta do hands-on vulnerability work, and how do they handle it?”
Read more
This is the clearest end-to-end example of finding, reporting and closing a real flaw.
Written in Italian, the post explains responsible disclosure: reporting a vulnerability to the affected company and allowing time to fix it before publication.
Cerreta argues that this shortens the exposure window and prevents real attacks, then describes identifying a vulnerability in an exposed API belonging to a service of the TIM Group, conducting a technical analysis and checking the potential impact.
They contacted the team through its dedicated channel with a proof of concept and reproduction details.
The company responded quickly, confirmed the flaw and shipped a fix.
The post links to further detail.
For brands planning a campaign
This is evidence of a complete disclosure cycle, from finding to fix, with a large telecom group as the counterparty.
A lab or vendor assessing Cerreta for collaborative security work can treat it as a demonstration of method and communication discipline.
It also supports a talk or workshop on disclosure policy and bug-bounty practice.
Cerreta worked across AI security and blockchain forensics at the same conference.
Cerreta describes three days at ITASEC24, contributing to an AI-APT workshop on artificial intelligence and advanced persistent threats.
They presented a study on AI prejudices and their unforeseen exploitations, representing Prof.
Gabriele Costa, and shared “Supporting Criminal Investigations on the Blockchain: A Temporal Logic-based Approach” with colleagues from the IMT School.
The post names the co-authors and calls the experience enriching.
For brands planning a campaign
Two research threads—adversarial use of AI bias and logic-based blockchain forensics—broaden the topics a partner could book.
A programme organiser could place Cerreta on an AI-threat panel or digital-forensics session, or ask for a joint talk with the named co-authors.
The AI-APT workshop framing is the closest match for a vendor audience.
Answers “who has Cerreta trained and worked alongside?”
Read more
This offers useful context on their professional network and training.
Cerreta writes about being selected for the International Cyber Security Summer School in The Hague.
They describe lessons at Leiden University and the Security Delta headquarters on geopolitics, post-quantum cryptography, OT security, malware detection, and the legal and governance sides of cybersecurity.
The week included visits to Europol and the NATO Communications and Information Agency, a collaborative project with Accenture, and a serious security game in which their group placed second.
Cerreta thanks the organisers by name.
For brands planning a campaign
This is training and network context rather than a signature output, so it should not lead. It does show an institutional circle—Leiden, HSD, Europol, NCI Agency and Accenture—that a partner could draw on to shape a joint event or co-hosted session on post-quantum, OT or governance topics.
Research communication through conference and workshop talks3
Responsible disclosure and coordinated vulnerability reporting1
Automated penetration testing with MeTeOr1
AI security and advanced persistent threats1
Blockchain and criminal investigations1
Cybersecurity education, summer schools, and cross-sector convening1
Responsible disclosure and coordinated vulnerability reporting
Cerreta describes finding an exposed API vulnerability in a service from the TIM Group, carrying out a technical analysis and impact check, contacting the company through its dedicated channels with a proof of concept, and seeing it confirm and fix the issue.
Read more
The post explains how responsible disclosure can reduce the exposure window, encourage collaboration between researchers and security teams, and prevent real attacks. It also says companies with disclosure or bug bounty policies show security maturity.
Technical analysis, impact validation, proof of concept, private notification through dedicated channels, and a public write-up after the fix.
For brands planning a campaign
A security lab or vendor can evaluate Cerreta for a talk or collaboration on vulnerability disclosure, bug bounty operations, or vendor coordination. Ask for a technical walkthrough of the disclosure process and its policy context.
Cerreta presented the paper "Automating Penetration Testing with MeTeOr" at the OSVS Workshop at Euro S&P 2024 in Vienna.
Read more
The post describes presenting the work to experts and researchers and receiving feedback to incorporate into the research. This is a specific research presentation on automating penetration testing.
Conference workshop paper and presentation, with feedback used for further research.
For brands planning a campaign
Cerreta is relevant for a penetration testing automation session, academic workshop, or research collaboration. Ask for a demo or talk explaining what the tool automates, what it does not, and what evidence supports it.
At the ITASEC24 AI-APT workshop, Cerreta presented a study on AI prejudices and their unforeseen exploitations, representing Prof.
Read more
Gabriele Costa. The topic connects AI bias or prejudice with attack paths in the context of advanced persistent threats.
Workshop presentation on AI prejudices and their unforeseen exploitations.
For brands planning a campaign
A vendor or lab working on AI security, threat research, or APT defense can consider Cerreta for a technical talk or panel. Ask for a non-confidential explanation of the exploitation paths and mitigations discussed.
Cerreta co-presented the paper "Supporting Criminal Investigations on the Blockchain: A Temporal Logic-based Approach" with colleagues at IMT School: Hamza sajjad, Davide Di Monda, and Matteo Fabbri.
Read more
The work applies a temporal logic-based approach to supporting criminal investigations on the blockchain.
Temporal logic-based approach for blockchain investigation support.
For brands planning a campaign
This is relevant for digital forensics, blockchain analytics, and law-enforcement-adjacent security research. Ask for a technical briefing on the method and its limits.
Cybersecurity education, summer schools, and cross-sector convening
Cerreta was selected for the International Cyber Security Summer School in The Hague.
Read more
The post describes lessons at Leiden University and the Security Delta headquarters on geopolitics, post-quantum cryptography, OT security, malware detection, and legal and governance aspects of cybersecurity; visits to Europol and the NATO Communications and Information Agency; a collaborative project with Accenture; and a serious cybersecurity game with Booz Allen Hamilton. Their team placed second in the game.
Summer school format with university lessons, agency visits, a collaborative project, and a serious game.
For brands planning a campaign
A training provider, university, or community program can evaluate Cerreta for education, convening, or early-career researcher events. The practical angle is a structured learning format combining university lessons, agency visits, a collaborative project, and a serious game.
Research communication through conference and workshop talks
Across the provided posts, Cerreta presents at academic and industry workshops (ITASEC24 AI-APT, Euro S&P 2024 OSVS) and attends a selective summer school (ICSSS).
Read more
The posts offer first-person technical and research reporting on what was presented, what feedback was received, and what was learned.
Workshop presentations, conference attendance, and collaborative project work.
For brands planning a campaign
A lab or vendor can evaluate Cerreta for workshop talks, panel participation, or research collaboration. Ask for a talk abstract and intended audience level.
Michele Cerreta's posts document a responsible-disclosure report to Gruppo TIM, a collaborative project with Accenture, a cybersecurity game with Booz Allen Hamilton during an international summer school, visits to Europol and the NATO Communications and Information Agency, lessons hosted by Leiden University and Security Delta (HSD), and a co-presented conference paper with colleagues from the IMT School for Advanced Studies Lucca.
Read more
Ask about any ongoing contracts, fees, or commercial terms.
Gruppo TIM
Mention
Cerreta identified an exposed API vulnerability in a Gruppo TIM service and reported it through the company's responsible-disclosure channels, providing a proof of concept and reproduction details.
Read more
The company confirmed the vulnerability and shipped a fix. This was a researcher-to-company disclosure, not a commercial engagement.
Cerreta joined a behind-the-scenes visit to Europol during ICSSS Summer School, part of the programme's look at work to keep Europe safe and resilient.
NATO Communications and Information Agency (NCI Agency)
Mention
Cerreta visited the NATO Communications and Information Agency during ICSSS Summer School week in The Hague as part of the programme's institutional visits.
Cerreta attended in-depth lessons at Leiden University as part of ICSSS Summer School, covering geopolitics, post-quantum cryptography, OT security, malware detection, and legal and governance aspects of cybersecurity.
Cerreta presented the paper "Supporting Criminal Investigations on the Blockchain: A Temporal Logic-based Approach" at the ITASEC24 AI-APT workshop with colleagues from the IMT School for Advanced Studies Lucca.
Read more
Ask whether Cerreta is employed by or formally affiliated with the school.
Start with Cerreta's named work rather than a topic list.
Read more
Their responsible-disclosure write-up follows a vulnerability reported to a TIM Group service from technical analysis to fix, and explains why timed, private reporting matters.
The conference posts branch into two directions: applied offensive security, with the "Automating Penetration Testing with MeTeOr" paper presented at the OSVS Workshop at Euro S&P 2024; and the overlap between AI behaviour and attack technique, with a study on AI prejudices and their unforeseen exploitations presented at the ITASEC24 AI-APT workshop on behalf of Prof.
Gabriele Costa, plus a blockchain forensics paper co-authored with IMT School colleagues.
The summer school post offers a different angle on relevant training, spanning post-quantum cryptography, OT security, malware detection, geopolitics and the legal side of security.
The output consists of first-person reports on presented research and disclosed vulnerabilities, rather than how-to guides or commentary on industry news.
For comparable voices, Antonio Ieranò covers adjacent ground from the governance and compliance side, while Ivan Canovese and Giorgio Gnoli share the Italian-language, first-person, walk-through-the-work format on entirely different subjects.
Ieranò writes about AI governance and cybersecurity compliance, including the AI Act as a practical filter for assessing AI-enabled products and the compliance problem created by employees using unauthorised AI tools.
That overlaps with Cerreta's focus on AI behaviour as a security concern and the legal and governance sessions covered in their summer school post.
Both write in Italian and English for a professional security and compliance readership, and use LinkedIn posts to summarise longer technical articles and point to practical checklists.
Ieranò works the legal and regulatory angle — GDPR, DPIA, the Italian workers' statute and vendor assessment questions — framing problems as governance decisions.
Cerreta works from the offensive and research side: finding and reporting vulnerabilities, and presenting penetration-testing and AI-attack research at academic workshops.
Follow Ieranò for compliance reasoning and Cerreta for hands-on security research.
Gnoli's posts take one concrete build — a CRM data model for an automotive dealer or an outreach system for an agency — and walk through it step by step with the actual numbers, then extract a lesson.
Cerreta's disclosure post does the same in security: one specific vulnerability, the process followed and the outcome.
Both write in Italian, in the first person, about work they have personally done.
Gnoli's territory is commercial CRM, Salesforce configuration, data reconciliation and agency sales pipelines.
Cerreta's is vulnerability research and security conference work.
The problems they solve do not overlap; the reason to read both is their shared teaching approach, not shared expertise.
Writes in Italian as a practising adviser, using first-person accounts of client work — a promotion earned after crossing project and revenue thresholds, and an economic-uncertainty conversation with managers — to make a broader point about working with companies.
Read more
Readers who follow Cerreta for evidence-based, first-person professional reporting rather than opinion content will find a similar register here.
Canovese's subject is cost management, procurement, energy sourcing and supply-chain negotiation, including a detailed reading of the Bab el-Mandeb shipping risk. Their work does not overlap with security research, disclosure or academic work; the connection is language, format and professional audience.
For a cybersecurity lab or vendor considering Michele Cerreta as a speaker or collaborator, their LinkedIn following of 2,157 as of October 9, 2026, and posts aimed at cybersecurity research and professional event audiences support a limited placement decision.
Read more
Their posts cover penetration testing, vulnerability disclosure, AI threats, and blockchain-based criminal investigations. Ask for recent LinkedIn analytics or an audience survey covering geography, industry, job function, and seniority, plus attendance or audience size for comparable talks or workshops.
LinkedIn followers
2157
Attached LinkedIn profile snapshot for linkedin.com/in/mcerreta · 2026-10-09
Michele Cerreta's posts do not offer sponsorships or paid partnerships.
Read more
They show a working profile built on technical research, conference presentations, and one completed vulnerability disclosure—relevant context for a lab or security vendor considering a speaking slot, joint research project, or disclosure collaboration rather than an advertising buy.
The ITASEC24 post describes presenting a study on AI prejudices and their exploitations at the AI-APT workshop on behalf of a professor, plus co-authored work on blockchain criminal investigations.
The Euro S&P 2024 post describes presenting the paper "Automating Penetration Testing with MeTeOr" at the OSVS workshop.
Both are academic and industry conference contexts; any commercial arrangement would need to be negotiated directly and scheduled around research commitments.
The Responsible Disclosure post describes finding an exposed API vulnerability in a TIM Group service, reporting it through the company's dedicated channel with a proof of concept, and having the company confirm and fix it.
The posts publish no sponsorship formats, rate structures, media kit, or audience-deliverable specifications.
Buyers should ask about terms, availability, and any employer or institutional constraints.
A cybersecurity lab or security vendor seeking a technical speaker, workshop contributor, or research collaborator on penetration-testing automation and coordinated vulnerability disclosure.
Read more
The strongest reasons come from named work.
Cerreta presented “Automating Penetration Testing with MeTeOr” at the OSVS Workshop at Euro S&P 2024 in Vienna, the clearest research output in the posts and a direct fit for a testing-focused vendor.
A second reason is their disclosure work: they identified an exposed API vulnerability in a service from the TIM Group, analysed its impact, contacted the company through its dedicated channel with a proof of concept and reproduction details, and reported that the company confirmed the flaw and shipped a fix.
For a vendor selling testing, disclosure, or bug-bounty tools, this demonstrates method and communication discipline.
At ITASEC24, Cerreta also presented a study on AI prejudices and their unforeseen exploitations at the AI-APT workshop, representing Prof.
Gabriele Costa, and co-presented “Supporting Criminal Investigations on the Blockchain: A Temporal Logic-based Approach” with colleagues from the IMT School.
These provide two further booking angles — AI threat research and blockchain forensics — beyond penetration testing.
The International Cyber Security Summer School in The Hague adds training context and an institutional circle that includes Leiden University, the Security Delta headquarters, Europol, the NATO Communications and Information Agency, Accenture, and Booz Allen Hamilton, useful for a co-hosted or joint-institution session.
This is a specialist booking or collaboration, not a reach play: the posts mention a LinkedIn following of 2,157 as of 9 October 2026.
Before outreach, ask for their current role and affiliation, availability around a research schedule, any employer or institutional approval needed for public speaking, and whether they can discuss the MeTeOr work or TIM Group disclosure in non-confidential technical detail.
When to choose a specialist
A consumer brand or general-audience product launch seeking broad reach and high-volume sponsored content.
Read more
The posts do not document a sponsorship offer, rate card, media kit, or audience-deliverable specification, so there is no purchasable format to plan around.
They mention a LinkedIn following of 2,157 as of 9 October 2026, but provide no measured demographics, geography, job function, or seniority data; a buyer cannot forecast impressions or target a consumer segment from this information.
The content is technical and event-driven: a responsible-disclosure write-up partly in Italian, a conference paper presentation, two research presentations, and a summer school report.
It shows no product promotion, consumer-facing content, or track record of sponsored posts; instead, it reads as first-person research and event reporting.
A campaign seeking a lifestyle audience, a fast mass-reach boost, or a creative format outside technical security would be a poor match.
So would a campaign requiring Cerreta to act as an independent commercial spokesperson without first confirming employer or institutional constraints.
The posts do not state their current employer or job title, or whether speaking or commercial work is permitted alongside research and academic commitments.
Check those constraints before planning a campaign; otherwise, look at other creators in the directory rather than force Cerreta into a format the posts do not show.
A worked campaign example
Worked campaign angle: a coordinated-disclosure clinic for a security vendor or testing platform.
A vendor selling penetration-testing or disclosure tools wants a technical session that earns credibility with security teams and generates a shortlist of qualified conversations, not a mass-awareness push.
Cerreta is a plausible fit for a 40-to-45-minute technical session plus a short written companion resource on coordinated disclosure in practice.
The angle rests on two examples in the posts.
The MeTeOr paper presented at the OSVS Workshop at Euro S&P 2024 gives the session a named research anchor: what automating penetration testing covers, what it does not, and what feedback from the workshop changed.
The TIM Group disclosure provides a concrete, non-confidential walkthrough: identifying an exposed API vulnerability, analysing its impact, reporting through the company’s dedicated channel with a proof of concept and reproduction details, and seeing the flaw confirmed and fixed.
The session can connect the two: automated testing finds candidates, and a disciplined disclosure process closes them.
A one-page companion checklist could cover scope, reporting channel, proof of concept, reproduction steps, and fix confirmation.
Suggested outreach message: “We are planning a 45-minute technical session for security teams on how automated penetration testing feeds into coordinated vulnerability disclosure.
We saw the MeTeOr paper from the OSVS Workshop at Euro S&P 2024 and the write-up of the TIM Group API disclosure, and we would like to build the session around both — what the automation covers, and how the reporting and fix-confirmation process works in practice.
Would you be available for a call to scope the session, confirm which technical details can be shared publicly, and discuss a written companion checklist for attendees?”
Before committing, confirm their current role and any employer or institutional approval needed, availability around a research schedule, whether the MeTeOr work and TIM Group disclosure can both be discussed in non-confidential detail, and the intended audience level: the posts are aimed at researchers and security professionals rather than a general audience.
Do not promise reach or engagement based on the 2,157-follower LinkedIn audience, present an undocumented sponsorship package, or treat the Accenture or Booz Allen Hamilton summer school connections as existing commercial partnerships; the posts describe them as training and event context, not paid relationships.
Choose Canovese when the session is commercial rather than technical: a vendor or lab wants the buyer-side view of cost, procurement and supply-chain resilience, or the audience is CFOs, procurement directors and operations managers rather than security engineers.
Read more
Their material suits that room.
One post marks their promotion to Senior Partner at ERA Group EMEA after passing project and revenue thresholds, and makes the case for a method: listen before proposing, ask why something has always been done a certain way, build tailored cost paths, and treat a returning client as the real result rather than the title.
The other applies the same lens to a live risk — the Bab el-Mandeb strait, roughly 12% of seaborne oil and over 20% of international containers, and the effect of a full blockage on European cost structures — and argues for selective, better-informed spending rather than paralysis, with energy sourcing as the decision point.
If the goal is to help an audience make sharper supply and cost decisions under uncertainty, they approach the task through a different discipline.
The tradeoff is losing the technical anchor.
Neither post covers penetration testing, vulnerability research, disclosure processes or bug bounties, so a session built on Canovese cannot credibly demonstrate how to run an automated test or close out a vulnerability report.
You would be buying advisory judgment and negotiation discipline instead of hands-on security evidence.
A security-team audience may see a procurement-led talk as adjacent to its problem, not directly about it.
The campaign also shifts from research credibility to commercial advisory, changing who in the buyer's organisation must approve the booking.
Choose Gnoli for a build-and-show-numbers session aimed at go-to-market or revenue-operations teams, covering CRM architecture, data quality at scale and replicable demand generation.
Read more
The CRM post is unusually concrete: a Salesforce-based customer 360 for an automotive dealer; 105,169 records reconciled to 98,146 unique customers using matching rules (same tax code, same VAT number, or email or phone combined with name); lead-to-account conversion rules; a 60-day deal cut-off with a “sale beyond cut-off” tag; lifetime value and whole-vehicle spend; 953 body-type models and 1,877 parts families classified; and 682 mapped fields with configurable placement.
The second post applies the same instinct to pipeline: when an agency has no fallback in a negotiation, it takes any client, so build pipeline through cold outreach and a sharp offer.
The worked example uses roughly €15 of setup, one domain, a small sending script, an A/B tracker and a CRM, and gets 13 positive replies in a week.
If the vendor wants a practitioner who shows the machine and the numbers behind it, Gnoli is the stronger booking.
The tradeoff is topic displacement and a positioning risk.
Neither post covers penetration-testing automation, vulnerability disclosure or security research, so the disclosure-clinic angle gives way to revenue systems and CRM data.
The outbound tactics shown — scraping from prospect-data tools and bulk cold email — can sit awkwardly with a security-vendor brand and an audience focused on data protection and abuse controls.
The buyer should be comfortable with that framing or keep the session tightly scoped to CRM and data-quality work.
The CRM post ends with a save-and-follow prompt, and the pipeline post with a “comment AI Agency” call to action: both are lead-generation tactics, not neutral instruction.
Choose Ieranò for governance and compliance rather than testing: an AI vendor assessment, a GDPR-aligned deployment of AI tooling, or the legal limits of monitoring employees' AI use.
Read more
The first post argues that the AI Act has become the practical filter for evaluating every AI-embedded product — copilots, agents, LLMs, DLP and data-protection tools, cloud and SaaS — and replaces “does it use AI?” with procurement questions: what AI, with which data, processed where, how autonomous, what outputs, which subprocessors, and who is accountable.
It flags that AI-enabled solutions may run outside the EU, process personal data, logs, metadata or embeddings, be embedded in critical systems, or act operationally.
It points to GDPR, Schrems II, SCCs, transfer impact assessments, DPAs and supplementary measures, with a vendor-assessment checklist and a named set of internal functions to involve, from CISO and DPO through to procurement and senior leadership.
The second post addresses shadow AI directly: DLP, CASB or browser controls on unauthorised AI apps run into Article 4 of the Italian workers' statute without a union agreement or labour-inspector authorisation, require a DPIA under GDPR Article 35, and produce logs that are unusable in disciplinary or judicial proceedings without proper notice.
It then sets out a five-step compliance roadmap.
For a lab or vendor selling governance advisory to CISOs, DPOs and legal teams, this is directly usable material.
The tradeoff is that the posts offer written analysis, not demonstrated testing.
Both promote articles with checklists and legal reasoning; neither shows a penetration test being run, a vulnerability found or a disclosure managed through to a fix.
If the campaign's credibility anchor is “we have done this and can show how,” Ieranò shifts the promise to “we can tell you what the rules require” — a different proposition for a compliance and legal sign-off audience rather than engineering practitioners.
The material is also in Italian, so an English-language session would need adaptation.
Hashtag stacks and comment prompts frame the substance as promotion.
Four LinkedIn posts published by Michele Cerreta's account cover a responsible-disclosure write-up describing an exposed API vulnerability in a service from the TIM Group, reported with a proof of concept and confirmed fixed; a post on presenting “Automating Penetration Testing with MeTeOr” at the OSVS Workshop at Euro S&P 2024; a post on ITASEC24 presentations covering AI prejudices and their exploitation, and a co-presented paper on blockchain-based criminal investigation; and a post on the International Cyber Security Summer School in The Hague.
The conferences and summer school named in those posts point to 2024; the posts here carry no publication dates, so none are given.
Cerreta's posts do not say what the current role or employer is, so no claims are made about seniority, affiliation or institutional position.
The posts here do not include papers, slide decks or transcripts, and do not state a sponsorship policy, rate card or audience demographics.
A profile snapshot shows 2,157 LinkedIn followers as of 9 October 2026.
Posts by Antonio Ieranò, Giorgio Gnoli and Ivan Canovese provide the basis for statements about those creators.
