# Motti Sorani

Motti Sorani is a cybersecurity entrepreneur focused on application security, software supply-chain risks, and helping teams fix vulnerabilities—not just detect them.

- Profile: https://b2binfluencer.marketing/creators/motti-sorani/
- LinkedIn: https://www.linkedin.com/in/motti-sorani
- LinkedIn followers: 2,664
- Topics: artificial-intelligence, supply-chain, cybersecurity, software-supply-chain-security, application-security
- Based on 16 dated posts, latest 2026-10-10

## Summary

Motti Sorani is useful for content focused on turning supply chain and application security concerns into repeatable fixes.

- Best for: A supply chain security or vulnerability remediation vendor focused on fixing issues in a build pipeline.
- Not for: Broad reach awareness campaigns arguing that more visibility or alerts will improve security.
- Check first: Ask for 90-day platform analytics and a follower breakdown by job function.

### Takeaways

- Finding a weakness is only the start of the security process.
- Automation is key to managing open-source risk at scale.
- Signed evidence proves remediation rather than just assuming it.

## Main ideas

- **Fixing vulnerabilities matters more than finding them**: Sorani's recurring argument is that security has over-invested in detection and visibility. Identifying a vulnerability is only step one; the hard, value-creating work is fixing it at scale without slowing development. Engineers do not need more alerts, in this view; they need efficient ways to fix issues. Solutions should reduce friction and fit into existing development workflows rather than sit alongside them. They borrow the telecom industry's “last mile” problem as an analogy: delivering connectivity is hardest at the final stretch, and security is similar—a finding that is never remediated creates no real value.
- **Software supply chains are the biggest open gap**: Sorani calls supply chain risk security's most serious unresolved problem: other areas of defense are improving much faster than supply chain protection, so the gap keeps widening. The specific challenge is knowing what is actually running in production. Software arrives in layers of code from many vendors, each depending on others, making its contents and hidden vulnerabilities hard to trace by the time it ships. Sorani also notes that application-level dependencies now fall under scrutiny from frameworks such as FedRAMP and PCI DSS. In the BSidesSF post, the assessment is the speaker's, not Sorani's: Ziyad Edher of BSidesSF 2025 says supply chain attacks are now the most effective way to infiltrate highly secured environments, and that everything else is improving faster than supply chain. Sorani recommends watching the talk and argues that automation is key to scaling open-source risk management.
- **Automation and defense inside the pipeline**: Sorani's answer to scale is automation. Managing open-source and third-party risk without losing flexibility requires it, and security tools should reduce friction by integrating into development workflows rather than running alongside them. As reasoning-driven attacks move instantly, defense must be automated and rely on secure-by-default components. The most concrete example is automated policy enforcement applied directly in CI/CD pipelines.
- **Prove remediation rather than assume it**: A separate thread focuses on evidence. Sorani argues that as supply chain security matures, detecting vulnerabilities is no longer enough: teams must be able to prove they were fixed, with a signed and verifiable record of what was fixed, when and by whom. That record should be immutable and audit-ready, support automated policy enforcement in pipelines and give every build a trusted security history. The summary phrase is a provable supply chain: security that is attested, not assumed. This is product positioning from a company announcement, not neutral commentary.
- **Learning security by taking systems apart**: Sorani's account of entering the field starts with offensive security: learning assembly language by reading computer viruses, becoming absorbed in how self-replicating code spreads and evolves, then writing a virus generator as an intellectual challenge. They later described it as a first step into offensive security, though they did not realize that at the time. That build-it-to-understand-it attitude toward security sits behind the later emphasis on hands-on remediation over passive detection.

## Work to read

- [Learning security by reading computer viruses](https://www.linkedin.com/posts/motti-sorani_back-then-it-wasnt-even-called-cybersecurity-activity-7308511797366394880-tlIB)
- [Detection is not the finish line: the 'last mile' argument](https://www.linkedin.com/posts/motti-sorani_in-cybersecurity-roi-needs-to-be-tangible-activity-7313548235174772736-8Sa3)
- [Announcing signed remediation evidence with JFrog](https://www.linkedin.com/posts/motti-sorani_resolved-security-and-jfrog-partner-to-bring-activity-7397252531778662400-SeLF)
- [Supply-chain risk in cars and medical devices](https://www.linkedin.com/posts/motti-sorani_securing-what-moves-us-how-do-you-manage-activity-7311032397100146690-1cvt)
- [Agentic AI attacks: is remediation fast enough?](https://www.linkedin.com/posts/motti-sorani_autonomous-agents-autonomous-attacks-the-activity-7396900514405437441-nfnB)
- [Amplifying a BSidesSF talk on third-party dependencies](https://www.linkedin.com/posts/motti-sorani_bsidessf-2025-scalably-securing-third-party-activity-7346886437759299584-gSNh)
- [Framing vulnerability management as a compliance problem](https://www.linkedin.com/posts/motti-sorani_the-compliance-era-of-vulnerability-management-activity-7368608713797971968-iTBO)

## Brand relationships

- **Resolved Security** (disclosed_partnership)
- **JFrog** (mention)
- **CyberMDX** (disclosed_partnership)
- **Philips** (mention)

## Partnerships

Sorani’s posts show company-level collaborations rather than a published sponsorship offer. Two patterns emerge: a joint product announcement, such as the Resolved Security integration with JFrog Evidence that carries signed proof of remediation state for each build; and a co-hosted educational event, such as the CyberMDX and Philips roundtable on medical-device attack vectors. A recurring founder-conversation format also runs through the posts, with Sorani and co-founder Gil Regev working through one technical problem on camera. Sorani’s posts contain no sponsorship policy, pricing, audience data, or partnership inquiry route. Ask for these before committing.

## Alternatives

- Darius Radford: Radford is the stronger choice when a collaboration needs a structured operating model at its core: named capability pillars, a maturity baseline, and a phased roadmap a buyer can work through, rather than one argument attached to a single integration. Radford’s Secure Software Factory posts define four, then five, pillars; frame the problem as missing integration, governance, and operating discipline rather than missing tooling; and lead to a whitepaper download or an assessment conversation. A supply chain and remediation vendor whose offer includes a maturity assessment or consultative discovery has an obvious next step: the framework describes the problem, the assessment is the entry point, and the remediation product sits inside pillar three.
- Ricardo Camacho: Camacho is the stronger choice when the subject is supply chain security in embedded, automotive, or medical-device software — long product lifecycles, constrained hardware, over-the-air update paths, and safety-critical verification — rather than the general AppSec dependency pipeline. Camacho writes about software-defined vehicles as networked systems built from many vendors’ code, ISO/SAE 21434 as a framework for engineering security into product development, and static analysis, structural coverage, fuzz testing, and AI-assisted verification as complementary controls. A vendor whose remediation story depends on shifting security left in safety-critical code, or proving a fix on devices that are hard to patch, finds more usable raw material here than in Sorani’s posts.
- Jim Manico: Manico is the stronger choice when a collaboration needs a position to argue — AI changing the economics of finding and fixing vulnerabilities, what happens to standalone scanners, or what standards like OWASP ASVS and AISVS should require — rather than a step-by-step account of how a fix is proven inside a build pipeline. Manico states a thesis, anticipates critics, and cites incident evidence, including a package-registry attack carried out by automated agents, then invites disagreement from practitioners with direct experience. A vendor that wants the campaign to make a claim and defend it against the prevailing view gets more from that than from a technical walkthrough. It also suits a standards-led message, since Manico treats ASVS and AISVS as the definition of what must be verified.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/