Mickey Davis

In a post about a joint FBI, CISA, and MS-ISAC advisory on Medusa ransomware, they list measures most organizations already know—updates, multifactor authentication, backups, training, and a response plan—and ask why those measures remain undone.

• The post describes Medusa as a franchise: developers build the ransomware, affiliates deploy it, and both split the profits.
• The gap, Davis argues, is governance and follow-through, not tooling.
• Mature programs treat security requirements as guardrails rather than obstacles.

The post gives leadership teams three questions: Is the organization actually complying or just saying so?

• What security measures has it deferred?
• And what decision would it most regret if breached tomorrow?
• It cites average ransomware payments above $1 million and recovery costs five to ten times higher.

Read original

The framing, "Not a standard approach.

• But we're committed," signals a deliberate choice to start early rather than wait for the deadline.
• The same logic appears in a K-12 hiring post, which describes an Ohio HB 96 compliance deadline as creating built-in need.

The CMMC post's two-number format is the clearest example: it gives a date and a duration rather than a general warning. The K-12 post applies that urgency to a specific role, saying the deadline creates demand for someone who already knows Ohio school districts.

Read original · Original 2

Invited to host at Partnership Leaders' Catalyst Summit Austin, they chose people over the obvious technology topics of AI and automation.

• Their proposed Power Circle, "Partner Whispering: Reverse-Engineering the Relationships that Work," would collect what has worked, dissect it, and identify what is repeatable.
• A shorter post about a military-engineering event makes the same point: the relationship matters because the companies have worked together over years and the person "says nice things."

The Catalyst Summit post opens with a test question: "Who's a partner that would pick up your call right now?

• (even if you haven't worked together in years?)" It then names the variables that make partnerships hold.
• Davis quotes their CEO, Tim Martin, describing the event's spirit as "breathe the same air."

Read original · Original 2

Combining perspectives and backgrounds, they argue, gives partnerships more depth and reach. Davis quotes "A house divided against itself cannot stand" to explain why a one-sided view is weaker.

The post shows photos sent to Davis's CEO after a day of partner meetings and credits Rep.

• Ty Mathews and Jason Clark for access and candor.
• It offers a concrete account of relationship-building across competing firms rather than a general statement about partnership.

Read original

After touring the John Olson Advanced Manufacturing Center at the University of New Hampshire, they explain the venue logic: real manufacturing, real problems, and local partner organizations such as NH APEX Accelerator and EMDC's Maine APEX Accelerator, which help bring the community together. Events work better, they argue, when held where the work matters and with partners who understand local value.

The post describes a Portland, Maine session the next day and says the John Olson location was worth the wait.

• It closes with "Great events happen when you hold them in places where the work matters."
• John Roth is credited as the tour guide.

Read original

The Medusa post warns executives against explaining weeks of downtime and ties the argument to payment and recovery costs. A separate post applies the same logic to K-12: schools have high-value data, open networks, tight budgets, and rising targeting, so the pitch is mission-driven and compliance-driven rather than a typical tech sale.

The K-12 post spells out what makes the opportunity concrete: education-sector experience, relationships with superintendents and IT directors, an HB 96 compliance deadline, and a mission described as "We help schools stay open, compliant, and operational." The role is for someone who genuinely cares about protecting Ohio schools.

Read original · Original 2

The post contrasts "firewalls and MFA during the work day" with "stories about culture and belonging during lunch breaks," presenting them as complementary rather than conflicting. The theme is balance: a regular day job alongside passion projects.

Davis describes meeting Elizabeth H., owner of Bookery Manchester, at the NH Business Review NH200 event. Elizabeth invited them to give Little Lao its first reading on June 12; the post notes that the book reached local TV and that story time is for ages two to ten.

Read original

It answers \"how does Davis actually frame risk for a non-specialist audience?\" and shows the move from government advisory to decision framework that runs through most of their writing.

Mickey Davis reframes the FBI/CISA/MS-ISAC joint advisory on Medusa ransomware as an accountability problem, not a technology problem.

• The post notes that 300-plus organizations across healthcare, education, legal, and manufacturing have been compromised since 2021; lists familiar measures—updates, MFA, backups, training, and a response plan—and asks why they remain undone.
• It offers three questions for leadership teams, explains Medusa’s franchise model, in which developers build the ransomware and affiliates deploy it while splitting profits, and cites average payments above $1 million, with recovery costs five to ten times higher.
• It closes by contrasting the hope of avoiding an attack with treating security requirements as guardrails.

For brands planning a campaign

A ready-made structure for a threat-modeling or business-resilience talk: the \"accountability, not tooling\" angle plus the three leadership questions can be lifted directly into a session outline or audience worksheet.

Davis reduces the regulation to the two numbers that change a decision.

A short post that compresses a compliance timeline into two facts: CMMC 2.0 Phase 2 hits November 10, 2026, and C3PAO assessments take 6–12 months to complete. The framing \"not a standard approach / but we're committed\" signals a deliberate choice to start assessments ahead of the wave rather than wait.

For brands planning a campaign

Evidence that Davis can deliver timely, specific compliance guidance in compact form—useful for a webinar or speaking slot pegged to a regulatory deadline.

Davis describes being invited by Partnership Leaders to host at Catalyst Summit Austin and deliberately passing over the obvious technology topics — AI, automation — to talk about people.

• The post opens with a test question ("who's a partner that would pick up your call right now, even if you haven't worked together in years?") and then names the variables that make partnerships hold: a partner's priorities (growth, cost savings, quick wins, long-term success), their communication style, and whether they want to be brought into a deal or passed the baton.
• The planned Power Circle would share what has worked, dissect it, and find what is repeatable.

For brands planning a campaign

A practical outline for a partnership or resilience session. The list of variables—priorities, communication style, and deal involvement—translates readily into a facilitated discussion exercise.

Davis shares the photos sent to their CEO after a day of partner meetings, describing the goal as meeting potential partners across the MSP/MSSP space — including what they call \"collab-petition,\" collaboration plus competition — and people on both sides of the table.

• The post quotes \"a house divided against itself cannot stand\" and credits Rep.
• Ty Mathews and Jason Clark for access and candor.

For brands planning a campaign

Concrete evidence of channel or regional market-development work, relevant to a session or brief on partnership-led growth in a defined geography.

Davis describes a team tour of the John Olson Advanced Manufacturing Center at UNH, led by John Roth, and explains the workshop-venue logic behind it: real manufacturing problems being solved there, and local partners such as NH APEX Accelerator and EMDC's Maine APEX Accelerator who help bring the community together.

• A Portland, Maine session the next day is mentioned, with the John Olson location framed as worth the wait.
• The closing line — \"great events happen when you hold them in places where the work matters.\"

For brands planning a campaign

A concrete example of community-anchored events, useful for a sponsor or partner weighing co-located workshops over a generic conference slot.

Davis describes meeting Elizabeth H., owner of Bookery Manchester, at the NH Business Review NH200 event and connecting over side projects: Elizabeth’s include Manchester Distillery and The Factory On Willow; Davis’s is a children’s book about growing up with different cultures. The post recounts being invited to give Little Lao its first reading at the bookstore on June 12, notes the book reached local TV, and contrasts workday firewalls and MFA with lunch-break stories about culture and belonging.

For brands planning a campaign

Relevant to audience-fit and brand-safety questions: account for this culture- and community-facing work alongside the cybersecurity profile when considering a partnership or appearance.

Davis posts a profile for an Ohio K-12-focused business development rep, seeking education-sector experience, existing relationships with superintendents, IT directors, and school boards, and comfort with outbound outreach and in-person events.

• The post lists the appeal: a mission (\"we help schools stay open, compliant, and operational\"), legal urgency from an HB 96 compliance deadline, performance-based pay, a low learning curve, and the chance to work with them directly.
• The role is not typical tech sales; it’s for someone who genuinely cares about protecting Ohio schools and can help them navigate new cybersecurity requirements.

For brands planning a campaign

A compact example of how Davis frames an education-sector market opportunity, useful for audiences or sponsors interested in K-12 or public-sector partnerships.

Posts promote in-person workshops — a Portland, Maine, session and a planned event at the John Olson Advanced Manufacturing Center at the University of New Hampshire — and credit local partners such as NH APEX Accelerator and EMDC's Maine APEX Accelerator. The argument: events work best "in places where the work matters," with real manufacturing and real problems rather than conference rooms.

Recurring workshop model: tour or host at a manufacturing or industry site, involve regional partner organizations, then schedule the session there.

For brands planning a campaign

For a speaking brief on threat modeling or compliance, Davis can deliver a practical, venue-anchored talk built around workshops and local partner networks rather than abstract policy.

Examples: Source 1 · Source 2

One post states that CMMC 2.0 Phase 2 takes effect November 10, 2026, and that C3PAO assessments run six to twelve months. Another frames an Ohio K-12 cybersecurity role around the HB 96 compliance deadline as "built-in need."

For brands planning a campaign

Opening material can lead with a date and a requirement, a fit for audience segments — executives, school districts, small manufacturers — that act when a deadline is near.

Examples: Source 1 · Source 2

One post contrasts the temptation to speak about AI and automation at a conference with the chosen topic, "Partner Whispering: Reverse-Engineering the Relationships that Work," hosted at Partnership Leaders' Catalyst Summit Austin. A shorter post about a military-engineering event makes the same point in miniature: the companies have worked together, and the person "says nice things."

Facilitated "power circle" format: convene a group, collect what has worked, and dissect what is repeatable.

For brands planning a campaign

For partner-ecosystem or co-marketing events, Davis offers a people-first, discussion-driven format rather than a product pitch, useful for channel and alliance audiences.

Examples: Source 1 · Source 2

The strategy combines perspectives and backgrounds for deeper reach.

Ask for results from this approach; the post describes it in progress.

For brands planning a campaign

Davis suits panels or discussions that need both vendor and reseller perspectives, rather than a single-vendor viewpoint.

Examples: Source 1

The question is whether they are complying or deferring decisions they will regret. The post treats ransomware as a franchise model run by developers and affiliates, and argues that successful programs treat security requirements as guardrails rather than obstacles.

For brands planning a campaign

For campaigns aimed at board or executive audiences, Davis's accountability framing can move messaging beyond tools to governance and decision-making.

Examples: Source 1

A separate post applies the same logic to schools: high-value data, open networks, tight budgets, and rising targeting.

For brands planning a campaign

The content translates into executive-level business language for briefings aimed at decision-makers who fund or defer security work.

Examples: Source 1 · Source 2

The post contrasts "firewalls and MFA during the work day" with "stories about culture and belonging during lunch breaks," and says the book received local television coverage.

The book is a personal creative project. Ask whether Davis is open to a commercial sponsorship or brand tie.

For brands planning a campaign

This personal thread may suit community, education, or culture-focused partners. For a cybersecurity campaign, ask how the topic would support its goals.

Examples: Source 1

The post is about hosting a partnership session and names NuView as their workplace.

View example

The post names Partnership Leaders as the organizer. Ask about the commercial terms.

View example

The post credits John Olson with helping make community connections happen.

View example

View example

View example

View example

The post thanks the bookstore for the opportunity.

View example

Masman's nine-year agency post and a CESMII advanced-manufacturing roadshow post make the case that you cannot help organizations grow without learning the industries they serve, matching Davis's insistence that CMMC sessions belong where the work happens.

Masman's lane is marketing, communications, and talent recruitment for industrial and workforce clients, not cybersecurity readiness. Readers looking for threat, compliance, or partner-ecosystem content will find it there; readers looking for storytelling and brand work should turn to Davis's profile.

Read original · Original 2

The Identity Nightmares series works like Davis's Medusa post: it interviews a CISO on unauthorized data access and GDPR exposure, then another practitioner on privileged access and legacy-system gaps, turning one incident class into a short list of consequences and takeaways.

Motola's format is a recurring interview and video series built around identity and access management with named guests, and the posts serve as promotional entry points to those episodes. Davis's format is a hosted in-person workshop plus short field notes, covering CMMC and ransomware rather than IAM specifically.

Read original · Original 2

Both writers resist the tooling answer, argue that disciplined process and accountability separate organizations that recover from those that do not, and close with a question aimed at the reader's own environment.

Richards writes from a customer-success role at an MSSP and builds posts around a newsletter's discussion, giving them an operational, vendor-adjacent frame. Davis writes from partnership and market development, framing the buyer's board-level decision and the local workshop, with compliance deadlines as the trigger.

Read original · Original 2

For a sponsored session for small and mid-size defense suppliers in Ohio and New England before the November 10, 2026 phase-in, Masman is the closer match if the deliverable is campaign strategy, audience building and manufacturing-sector storytelling.

• Masman's posts describe a nine-year agency serving manufacturing, workforce development, education, economic development and public-sector clients, following earlier work as a lobbyist and media director representing manufacturers, farmers and ranchers.
• They also show Masman in Ohio advanced-manufacturing rooms, including taking the microphone at a CESMII roadshow workforce breakout to argue that top-of-funnel marketing puts advanced manufacturing in front of people as a career.
• Masman reaches the manufacturer-heavy audience this sponsored session targets through marketing craft rather than a security credential.

Mickey Davis's posts do not discuss cybersecurity, CMMC or compliance, so the sponsoring brand would need to supply the deadline hook and defense-supplier framing.

• Masman brings room-building and manufacturing context, not subject-matter urgency.
• As an agency-side, marketing-led partner, Masman does not replace the practitioner credibility Davis brings to questions about deferred controls and accountability; the workshop would need a second technical voice alongside the host.

Examples: Source 1 · Source 2

The posts center on an interview series that puts CISOs and security leaders on record about identity and access management failures.

• One installment has Kayla Williams, CISO at Devo, naming unauthorized data access—not malware—as the scariest scenario and explaining that unauthorized access can be reportable even when nothing is exfiltrated, with GDPR exposure attached.
• A second installment uses Barry Gordon to walk through privileged-access gaps and overlooked legacy systems.
• For the same sponsored session, choose Motola if the brand wants to convince the room that identity risk is a business problem and the audience is security practitioners rather than defense-manufacturing owners.

Mickey Davis's posts do not show an Ohio or New England footprint or say that they host in-person sessions, so the local-partner and venue logistics for a session in those regions would need to be built from scratch.

• The implied readership is a security audience, which risks filling seats with practitioners instead of the owners, quality leads and IT leads the session needs to reach.
• Ask who will deliver the CMMC timing argument.

Examples: Source 1 · Source 2

Richards publishes incident dissections from a customer-success seat at a security provider, using a recurring newsletter series to push operations leaders past tooling and into process.

• One post argues that MFA alone is not enough while ransomware groups exploit publicly known Fortinet VPN flaws; another covers an attack that used compromised domain credentials and Active Directory Group Policy to disable security controls without dropping malware.
• Both end with questions a plant or IT manager can act on: would a known vulnerability in their environment be found, prioritized and remediated before an attacker got there?
• For a brand that wants its name attached to that recurring argument over months, this is a better use of budget than one workshop date.

Mickey Davis's posts do not show event delivery, a manufacturing or defense-industrial-base focus, or an Ohio or New England presence, so a co-hosted workshop would lose its main advantage.

• The strength here is written amplification to a security readership: the brand would be buying content reach and credibility rather than a room full of DIB suppliers.
• Ask who will deliver the CMMC deadline framing.

Examples: Source 1 · Source 2