Motti Sorani is a cybersecurity entrepreneur focused on application security, software supply-chain risks, and helping teams fix vulnerabilities—not just detect them.
Motti Sorani is a cybersecurity entrepreneur whose posts focus on application security, software supply-chain risk, and vulnerability remediation.
The recurring point is that finding a weakness is only the start: teams also need practical ways to fix it at scale and show that it was fixed.
Their work is worth following for this emphasis on the path from security insight to action, alongside examples involving connected cars, medical devices, open-source dependencies, compliance, and emerging AI-driven attacks.
Sorani connects technical security problems to the work teams must do next.
In one post, a telecom “last mile” comparison explains why alerts and vulnerability discovery are not enough if engineers cannot remediate issues without slowing development.
In another, signed evidence attached to software builds makes remediation verifiable and usable in pipeline policy and compliance.
The feed also shares other practitioners’ work, including a post about managing open-source package risk across varied environments, while making clear that automation is key.
Together, these examples make their work most useful to readers interested in turning supply-chain and application-security concerns into repeatable fixes.
Motti Sorani's public writing returns to one complaint about the security industry: it is good at finding problems and bad at fixing them.
Read more
From there, the arguments turn to software supply chains, third-party and open-source dependencies, automation inside development pipelines, and a newer emphasis on proving a fix actually happened.
Sorani makes the case in short posts that usually link to a recorded conversation with co-founder Gil Regev, a conference talk or an article.
They often use concrete analogies—telecom's “last mile,” networked cars and medical devices—instead of proposing a new framework.
Fixing vulnerabilities matters more than finding them
Sorani's recurring argument is that security has over-invested in detection and visibility.
Read more
Identifying a vulnerability is only step one; the hard, value-creating work is fixing it at scale without slowing development.
Engineers do not need more alerts, in this view; they need efficient ways to fix issues.
Solutions should reduce friction and fit into existing development workflows rather than sit alongside them.
They borrow the telecom industry's “last mile” problem as an analogy: delivering connectivity is hardest at the final stretch, and security is similar—a finding that is never remediated creates no real value.
The post opening “In cybersecurity, ROI needs to be tangible” builds its case around the last-mile comparison: detection and visibility are step one, but the industry stops there; the fix is what actually reaches the customer. A companion clip features a conversation with co-founder Gil Regev on the same theme.
Later, the same gap becomes a speed problem.
If attackers use agentic AI to chain attacks, generate exploits and weaponize old vulnerabilities at machine speed, a standing vulnerability backlog becomes active risk and human remediation cycles are too slow.
Defense must shift toward automation and secure-by-default components.
Sorani calls supply chain risk security's most serious unresolved problem: other areas of defense are improving much faster than supply chain protection, so the gap keeps widening.
Read more
The specific challenge is knowing what is actually running in production.
Software arrives in layers of code from many vendors, each depending on others, making its contents and hidden vulnerabilities hard to trace by the time it ships.
Sorani also notes that application-level dependencies now fall under scrutiny from frameworks such as FedRAMP and PCI DSS.
In the BSidesSF post, the assessment is the speaker's, not Sorani's: Ziyad Edher of BSidesSF 2025 says supply chain attacks are now the most effective way to infiltrate highly secured environments, and that everything else is improving faster than supply chain.
Sorani recommends watching the talk and argues that automation is key to scaling open-source risk management.
Cars are described as networked systems assembled from vendor-provided code, so tangled that nobody can easily say what is running or which vulnerabilities are inside.
Sorani says this problem led to early work securing connected fleets, then naturally to medical device security, where the core question is identical.
The BSidesSF post highlights a talk on securing third-party dependencies in heterogeneous environments and a package admission-control system the speakers built to manage open-source risk at scale.
The focus shifts from device security—connected vehicle fleets and medical devices—to software dependency risk, but the underlying question stays the same: knowing what is inside a system and keeping it secure.
Managing open-source and third-party risk without losing flexibility requires it, and security tools should reduce friction by integrating into development workflows rather than running alongside them.
As reasoning-driven attacks move instantly, defense must be automated and rely on secure-by-default components.
The most concrete example is automated policy enforcement applied directly in CI/CD pipelines.
The BSidesSF post ends with Sorani's verdict: “IMHO, Automation is key.” The JFrog integration announcement lists automated policy enforcement in pipelines as the first of three intended uses.
Sorani argues that as supply chain security matures, detecting vulnerabilities is no longer enough: teams must be able to prove they were fixed, with a signed and verifiable record of what was fixed, when and by whom.
That record should be immutable and audit-ready, support automated policy enforcement in pipelines and give every build a trusted security history.
The summary phrase is a provable supply chain: security that is attested, not assumed.
This is product positioning from a company announcement, not neutral commentary.
The announced integration between Resolved Security and JFrog Evidence attaches signed proof of remediation state to every artifact built in a CI/CD pipeline.
It is presented as covering automated policy enforcement, audit-ready compliance evidence and a trusted record for each build.
A related post warns that application-level dependencies now face FedRAMP and PCI DSS expectations and asks whether teams are ready.
Sorani's account of entering the field starts with offensive security: learning assembly language by reading computer viruses, becoming absorbed in how self-replicating code spreads and evolves, then writing a virus generator as an intellectual challenge.
Read more
They later described it as a first step into offensive security, though they did not realize that at the time. That build-it-to-understand-it attitude toward security sits behind the later emphasis on hands-on remediation over passive detection.
The earliest post promotes a medical device security roundtable with CyberMDX and Philips, covering attack vectors against connected healthcare devices. It points to genuine roots in device security; a separate post's virus story offers an origin narrative through a clip with co-founder Gil Regev.
How did Sorani get into security, and what does that background explain about their later work?
Read more
Newcomers should start here: the remediation-focused, build-and-fix attitude that runs through everything else is rooted in this first step into offensive security.
Sorani traces their entry into security: learning assembly language by reading computer viruses, becoming absorbed in how self-replicating code spreads and evolves, then writing a virus generator purely as an intellectual challenge. The short first-person narrative is built around a clip of a conversation with co-founder Gil Regev, who appears across several of these posts.
For brands planning a campaign
A vendor selling AppSec or supply-chain tooling can use this origin story to open a joint piece on how hands-on attack knowledge shapes defensive product design. The post ends with a recorded conversation, a co-created format Sorani has used before.
What is Sorani's central argument about security spending?
Read more
Start here for the clearest statement of the thesis that returns in the supply-chain and integration posts.
Sorani compares security to the telecom industry's last-mile problem: finding vulnerabilities is only the beginning; the hard, value-creating work is fixing them at scale without slowing development. Engineers do not need more alerts, the post argues; they need remediation that fits into existing workflows.
For brands planning a campaign
This is the most direct match for a software-supply-chain and vulnerability-remediation brief. A remediation vendor could co-produce an expanded version of the last-mile argument, and the telecom metaphor works across formats without losing the point.
This post shows the current product direction and the partners already in their orbit.
Sorani announces an integration between Resolved Security and JFrog Evidence in which every artifact built in a CI/CD pipeline carries signed, verifiable proof of its remediation state, including what was fixed, when, and by whom. The post lists three intended uses: automated policy enforcement in pipelines, audit-ready evidence for compliance, and a trusted security record for each build.
For brands planning a campaign
This demonstrates that Sorani's channel already carries integration co-marketing aimed at DevSecOps buyers, and that a similarly shaped partner offer has a proven route into their feed. It is evidence of the format working, not evidence of payment or of any specific commercial arrangement.
How does Sorani explain the supply-chain problem to people outside security?
Read more
This post states it plainly and shows the industries they think about.
Sorani describes modern cars as networked systems assembled from layers of code from many vendors, so complex that by production time nobody can say what is actually running or what vulnerabilities are inside.
They say that problem led to early work securing connected fleets, then moved naturally into medical device security.
Both sectors share the same core challenge: knowing what is inside the system and keeping it secure.
For brands planning a campaign
Useful for reaching automotive, medical device, or operational-technology audiences. The 'know what is inside' framing maps neatly onto the audience a software bill of materials or dependency-scanning vendor wants to address, and the post shows Sorani moving comfortably between those sectors.
What does Sorani say about emerging threats, and where do they think the pressure will land?
Read more
This is a current-theme check rather than a historical one.
Sorani asks what happens to application security when attackers use agentic AI to chain attacks, generate exploits, and weaponize old vulnerabilities at machine speed.
The post lists three consequences: vulnerability backlogs become active risk, human remediation cycles are too slow, and defense has to shift toward automation and secure-by-default components.
It ends by pointing to a longer article.
For brands planning a campaign
A timely hook for AI-security angles. A vendor supplying underlying analysis or data could help expand an argument Sorani has already flagged to their audience.
How does Sorani use their feed when they are not promoting their own work?
Read more
This post shows their community role: surfacing other people's research and adding a view.
Sorani quotes a BSidesSF 2025 speaker arguing that supply chain attacks are now the most effective route into well-defended environments, summarizes a talk on securing third-party dependencies in mixed environments, and highlights a package admission-control system the speakers built. They close with their own opinion: automation is the key to scaling open-source risk management.
For brands planning a campaign
Sorani's feed is not only self-promotion; it also features other people's conference research, offering vendors with original findings or a speaking slot a plausible route in. Conference-adjacent content is something Sorani chooses to share.
Who does Sorani think is driving the supply-chain conversation?
Read more
This post names the external pressure and helps newcomers understand why the topic is urgent.
Sorani argues that vulnerability management has entered a compliance era, with frameworks including FedRAMP and PCI DSS bringing application-level dependencies under scrutiny.
They ask whether teams are ready.
The post points to a longer article and makes the case that regulation, not just attacker behavior, makes dependency management urgent.
For brands planning a campaign
A compliance-driven pitch can use this framing for buyers in regulated sectors. The post raises a question but offers no readiness data or checklist; ask a vendor to provide one.
Format: short written posts paired with recorded conversations5
Software supply chain and third-party dependencies as the headline risk4
Fixing vulnerabilities matters more than finding them3
Automation and pipeline-native defense3
Career arc: offensive-security origins, device security, then supply chain3
Compliance, attestation, and proof of remediation2
Fixing vulnerabilities matters more than finding them
Sorani's most repeated argument is that security has over-invested in detection and visibility and under-invested in remediation.
Read more
They compare the problem to telecom's "last mile": identifying a vulnerability is only step one, and the real challenge is fixing issues at scale without slowing development.
They add that engineers do not need more alerts; they need efficient ways to fix issues, and security work only creates value if it reaches the last mile.
In a later post, they frame the same gap as a timing problem: when attackers use agentic AI to chain attacks and weaponize old vulnerabilities at machine speed, a standing vulnerability backlog turns into active risk and human remediation cycles are too slow.
Sorani builds the argument with a single transferable analogy (the telecom last mile), then repeats it in different contexts rather than introducing new frameworks each time.
For brands planning a campaign
A vendor selling remediation workflow, automated patching, or developer-facing fix tooling is arguing Sorani's own thesis back to them. Collaboration content works best when it shows a concrete fix path — who fixes what, how fast, and with what developer friction — rather than another detection dashboard.
Software supply chain and third-party dependencies as the headline risk
Supply chain security runs through the posts.
Read more
Sorani quotes a BSidesSF 2025 speaker calling supply chain attacks the most effective way to infiltrate highly secured environments, and repeats the point that everything else is improving faster than supply chain protection.
They describe modern cars as networked systems assembled from code by layers of vendors, where nobody can easily tell what is actually running in production, and carry the same reasoning into medical devices.
On the compliance side, they note that application-level dependencies are now under scrutiny from frameworks such as FedRAMP and PCI DSS.
Their announced work on this problem is an integration between Resolved Security and JFrog Evidence that attaches signed, verifiable proof of remediation state to every artifact built in CI/CD.
The BSidesSF post largely amplifies another practitioner's talk, showing what Sorani chooses to signal rather than an argument they originated.
For brands planning a campaign
This is the closest match to a software-supply-chain-security brief. The strongest angle is third-party and open-source dependency risk in complex environments, with the practical question of how a team knows — and can prove — what is inside what it ships.
Responding to the third-party dependency talk, they state plainly that automation is key to managing open-source risk without sacrificing flexibility.
Elsewhere, they argue security solutions should reduce friction and live inside development workflows rather than beside them, and that as reasoning-driven attacks move instantly, defense has to shift toward automation and secure-by-default components.
The JFrog integration post continues the same line: automated policy enforcement directly in pipelines.
Sorani tends to state the principle first, then point to a specific mechanism or integration that implements it.
For brands planning a campaign
A collaboration framed around automating security controls in CI/CD, or around secure-by-default components, matches how Sorani already reasons about defense. Content that merely states "automation is important" adds nothing; the useful version shows a working pipeline control and its tradeoffs.
Sorani describes a "compliance era" of vulnerability management in which application-level dependencies fall under FedRAMP and PCI DSS expectations, and asks whether teams are ready.
In the product announcement, they draw the line explicitly: as supply chain security matures, it is not enough to detect vulnerabilities; you have to prove they are fixed.
They list what the Resolved Security–JFrog Evidence integration is meant to enable — automated policy enforcement in pipelines, immutable audit-ready evidence for compliance, and a trusted record of security for every build — and sum it up as a provable supply chain where security is attested, not assumed.
The JFrog post is a first-party product announcement from a company Sorani is part of; treat it as their own positioning, not neutral commentary.
For brands planning a campaign
For vendors in compliance, audit, or software bill of materials territory, the entry point is proof rather than prevention. Messaging that separates "we found it" from "we can show, with a signed record, that it was fixed and by whom" is the version Sorani already publishes.
Format: short written posts paired with recorded conversations
Sorani's recurring publishing format is a short text post that introduces a recorded conversation, usually with co-founder Gil Regev.
Read more
Three of the posts end that way, each on a different theme: how experimenting with computer viruses led into offensive security, why security must solve the last mile, and how to secure tangled software supply chains in cars and medical devices.
A second format is event and talk amplification — a BSidesSF 2025 session on securing third-party dependencies, and an earlier CyberMDX and Philips virtual roundtable on medical device attack vectors.
A third is product news, as with the JFrog Evidence integration.
The written post states the argument; the linked clip carries the supporting discussion, so the text stands on its own and the video offers optional depth.
For brands planning a campaign
A collaboration can reasonably include a recorded conversation or webinar clip plus a written post, since that is the shape Sorani already ships. Event-linked content also fits: they spotlight other practitioners' sessions, giving a brand a natural format for co-hosted or sponsored technical talks.
Career arc: offensive-security origins, device security, then supply chain
The earliest post promotes a medical device security roundtable with CyberMDX and Philips, covering attack vectors against connected healthcare devices.
Read more
A later post connects that work forward: one of the first solutions built to secure connected vehicle fleets at scale, then medical device security, with the same underlying question of knowing what is inside a system and keeping it secure. Sorani's own account of how they started is offensive rather than defensive — learning assembly language by reading computer viruses, then writing a virus generator purely as an intellectual challenge, which they now describe as the first step into offensive security without realizing it at the time.
The move from device security to software supply chain is visible across the posts and described in Sorani's own retrospective framing.
For brands planning a campaign
A brand working on connected devices, embedded software, or automotive and medical supply chains gets a creator whose stated roots are in that environment and who moved with the problem into software dependencies. The offensive-security origin story can frame technical security content credibly, provided it is presented as background rather than current offensive work.
Two commercial connections appear in the posts: Sorani announced a new integration between Resolved Security and JFrog Evidence, calling it “our new integration,” and promoted a CyberMDX and Philips virtual roundtable on medical device attack vectors.
Read more
Ask them to clarify their role at Resolved Security and their relationship with CyberMDX and Philips.
Several other posts are conversations with co-founder Gil Regev, but do not name the co-founded business; ask Sorani to identify it.
Remaining posts discuss compliance frameworks, automotive and medical-device supply chains, agentic AI attacks, and a BSidesSF talk.
Resolved Security
Disclosed partnership
Sorani announced an integration between Resolved Security and JFrog Evidence that lets every CI/CD build artifact carry signed proof of its remediation state: what was fixed, when, and by whom.
Read more
They call it “our new integration,” indicating a connection to Resolved Security. Ask them to clarify whether that connection is ownership, employment, or an advisory role.
Motti Sorani writes short LinkedIn posts about what happens after a vulnerability is found.
Read more
Follow the argument in sequence: start with the "last mile" post on why remediation, not detection, is where security earns its value; move to supply chain posts about third-party and open-source dependencies in cars, medical devices, and enterprise software; then read the compliance and proof posts on showing that a fix actually happened; and finish with more recent posts on automated defense against AI-driven attacks.
Most posts run a few paragraphs and introduce a recorded conversation with co-founder Gil Regev, a conference talk, or a product integration.
The written text carries the argument; the linked item adds depth.
The tags below group the material by subject, working specialty, format, and professional audience.
Similar creators offer adjacent perspectives on connected-device security, DevSecOps operating models, and how AI is changing application security.
Software supply chain securityVulnerability remediationApplication securityDevSecOpsCompliance and attestationMedical device securityConnected vehicle securityAI and cybersecurityOffensive securityAppSec and supply chain securityConnected device securityShort-form LinkedIn postsRecorded conversation clipsConference and webinar amplificationProduct announcementsSecurity engineersAppSec teamsCompliance and risk teamsDevice and embedded engineers
Darius Radford
Radford notes that organizations already own plenty of DevSecOps tooling—CI/CD platforms, static scanners, container security, and vulnerability management—yet still suffer breaches traced to unpatched dependencies, misconfigured pipelines, and poorly prioritized vulnerabilities.
Read more
He calls this a failure of integration, governance, and operating discipline, not tooling. His remedy resembles Sorani's: change the operating model through orchestrated delivery, developer-centred AppSec, artifact and supply chain governance, unified risk correlation, and post-deployment protection.
Radford's posts are long, white-paper-style pitches built around a named five-pillar model and a maturity assessment offer. Sorani makes a narrower, faster argument, anchored to a specific pipeline integration rather than a full framework.
Camacho writes about securing software in connected products, including automotive systems and embedded devices.
Read more
From the dependency side, Sorani reaches the same shift-left conclusion: find weaknesses before they become exploitable, keep issues out of production where possible, enforce secure coding and security gates in CI/CD, and keep validating security across a long product lifecycle. Both treat long-lived, hard-to-patch connected software as the hard case for security.
Camacho's guide-style, technique-led material covers ISO/SAE 21434 and three complementary approaches: static analysis, dynamic analysis with fuzz testing, and penetration testing. Sorani focuses instead on dependency risk, proof that a fix happened, and automated policy enforcement in the pipeline—not testing methods.
Manico argues that AI changes the economics of finding and fixing vulnerabilities, that attackers gain the same capabilities, and that competitive advantage shifts from how many vulnerabilities you find to how quickly and reliably you eliminate exploitable risk in live systems.
Read more
Sorani likewise argues that remediation matters more than detection. Both connect autonomous, agent-driven attacks to the need for continuous verification rather than more alerts.
Manico takes the prediction much further, expecting standalone scanners, SAST, DAST, IAST, and CVE tooling to give way to AI-native engineering verified against standards such as OWASP ASVS and AISVS. They write in an argumentative, debate-answering register; Sorani ties automation claims to concrete pipeline controls and signed evidence that a fix was applied.
Motti Sorani's LinkedIn profile looks better suited to a narrow, topic-specific placement than a reach buy.
Read more
The only measured audience figure available is 2,664 LinkedIn followers, recorded 9 October 2026.
That is a small base for cybersecurity outreach, so a partnership's value depends on how closely the subject matter matches a campaign aimed at AppSec and DevSecOps practitioners—and how engaged those followers are.
Sorani's posts cover software supply-chain risk, vulnerability remediation and proof-of-fix, medical-device and connected-vehicle security, and agentic-AI attacks.
Examples include a July 2025 post about the BSidesSF 2025 talk on securing third-party dependencies at scale, and a November 2025 announcement of a Resolved Security integration with JFrog Evidence that attaches signed, verifiable remediation records to every CI/CD build.
The topics align with an AppSec and DevSecOps campaign, but the posts do not establish who makes up the audience or how often they engage.
Before agreeing to a paid collaboration, ask Sorani for platform analytics for the last 90 days covering impressions, engagement rate, and follower growth; any audience survey or follower-demographic breakdown by job function, company size, industry, and country; and results for the two or three posts closest to software supply-chain remediation and vulnerability remediation.
These details will help determine whether a campaign reaches security engineers rather than other marketers.
Sorani’s posts show company-level collaborations rather than a published sponsorship offer.
Read more
Two patterns emerge: a joint product announcement, such as the Resolved Security integration with JFrog Evidence that carries signed proof of remediation state for each build; and a co-hosted educational event, such as the CyberMDX and Philips roundtable on medical-device attack vectors.
A recurring founder-conversation format also runs through the posts, with Sorani and co-founder Gil Regev working through one technical problem on camera.
Sorani’s posts contain no sponsorship policy, pricing, audience data, or partnership inquiry route.
Ask for these before committing.
Joint product or integration announcement
Buyer requirement
A concrete, verifiable update to announce—a shipped integration, a certification, or a joint capability—not a general mention.
The Resolved Security and JFrog Evidence post is the model: it names what was built (signed, audit-ready proof of what was fixed, when, and by whom), explains why it matters for policy enforcement and compliance, and links to further detail.
A vendor planning a launch-style post needs the technical substance ready before approaching.
Co-hosted webinar or roundtable
Buyer requirement
A named partner organisation and a scheduled educational session for the creator’s channel to promote.
The 2021 post promoting a CyberMDX and Philips virtual roundtable on medical-device attack vectors shows the format: the partners supply the expertise and event, while the post provides the invitation, date, and registration link.
The buyer brings the second party and agenda; a single-company product pitch does not fit.
Founder conversation or interview segment
Buyer requirement
A knowledgeable counterpart willing to appear alongside Motti Sorani, and a single technical topic with real operational detail.
The posts repeatedly reference conversations with co-founder Gil Regev about remediation at scale, supply-chain visibility in connected vehicles and medical devices, and how Sorani moved into offensive security.
A buyer’s subject-matter expert could fill the counterpart role.
Expect the discussion to focus on a problem and its tradeoffs rather than a product pitch.
Recommend the collaboration, provided it centres on a working fix path: how a dependency is found, fixed, and proven fixed inside a build pipeline, rather than on general thought leadership.
Read more
Brief
A supply-chain security and vulnerability-remediation vendor wants to collaborate with Motti Sorani on content about software supply-chain security and vulnerability remediation.
Reasons
The brief is Sorani’s own subject. They argue that supply-chain attacks are now the most efficient route into well-defended environments, quote another practitioner saying everything else is improving faster than supply-chain protection, and say plainly that automation is key to managing open-source risk at scale without losing flexibility.
Sorani already makes the argument a remediation vendor sells: finding a vulnerability is step one; the value lies in fixing it at scale without slowing development. Their comparison to telecom’s last mile — engineers don’t need more alerts; they need efficient ways to fix issues — is the clearest statement of that thesis in the posts and can be reused across formats.
The compliance half of the brief has a ready hook. Sorani has written about application-level dependencies falling under FedRAMP and PCI DSS expectations, and about proving a fix rather than assuming it, with signed, audit-ready evidence attached to each build.
The partnership formats fit the way Sorani already works. They post joint product and integration announcements, promote co-hosted educational events, and regularly publish short written posts introducing recorded conversations with co-founder Gil Regev. A vendor collaboration can use any of those three formats without asking them to adopt a new one.
Sorani’s channel is small enough that a technical vendor should expect a specialised placement, not reach: 2,664 LinkedIn followers, recorded 9 October 2026. Measure success by reaching niche AppSec and DevSecOps practitioners, not by volume.
Gaps to close
The posts provide no engagement, impression, follower-growth, or demographic data, so they don’t show how many followers work in security or what roles they hold. Ask for 90-day platform analytics and a follower breakdown by job function and industry before agreeing to a paid collaboration.
The articles, talk recordings, and event pages Sorani links to are not discussed here; the fit judgement rests on the posts themselves.
When to choose a specialist
Advise against the campaign or reframe it before proceeding.
Read more
Brief
A detection and visibility vendor, or any brand, wants a broad-reach awareness push across general IT and business buyers — a top-of-funnel campaign arguing that more visibility and more alerts will improve security.
Reasons
The campaign message contradicts Sorani’s published position. Their recurring argument is that the industry has over-invested in detection and visibility, identifying vulnerabilities is only the start, and engineers don’t need more alerts. A vendor selling visibility would be paying them to argue the opposite case.
The audience figures don’t support a reach buy. The only measured figure is 2,664 LinkedIn followers; the posts provide no data on geography, industry, employer, job function, seniority, engagement, impressions, or growth. A broad-awareness campaign would be judged against numbers nobody has produced.
Sorani’s formats are technical and conversational. The posts explain a single problem and its trade-offs, usually with a named technical counterpart or a conference talk attached.
A visibility vendor could still be a fit if it reframed the brief around remediation speed, using Sorani’s last-mile argument as the problem its product addresses. That’s a different brief from a reach campaign and should be written as one.
Gaps to close
No performance data for any format appears in the posts, so they do not say which posts travelled furthest or reached non-specialist readers.
A worked campaign example
Angle
Make remediation provable. Start with the problem Sorani already writes about: nobody can say what’s actually running inside a modern software product after it has passed through many vendor hands. Then demonstrate that a fix can be attested, not assumed, with a signed record of what was fixed, when, and by whom, attached to every build.
Brief
Supply-chain and remediation vendor: three-month collaboration, with one integration-announcement post, one recorded conversation, and one written post.
Format matches
A short written post introducing a recorded conversation, the format Sorani uses most often. Pair them with the vendor’s subject-matter expert in the counterpart role Gil Regev usually fills.
Joint product or integration announcement, following the format of the JFrog Evidence post: state what was built, list what it enables — policy enforcement in pipelines, audit-ready evidence, a trusted record per build — and link to details.
Conference-adjacent amplification: Sorani has spotlighted a BSidesSF talk on third-party dependencies in mixed environments and an earlier CyberMDX and Philips medical-device roundtable. A sponsored technical session or a talk they can share is already an established format.
Measurement
Because the posts include no audience data, agree on the vendor’s own success criteria — qualified AppSec and DevSecOps conversations, demo requests, or pipeline-control trials — rather than impressions.
Request Sorani’s 90-day impressions, engagement rate, follower growth, and a follower breakdown by job function and industry before the first paid deliverable, to establish a campaign baseline.
Ask for performance data on Sorani’s two or three closest posts — the JFrog announcement, the last-mile post, and the BSidesSF amplification — to set realistic expectations for the collaboration.
Proof points to use
Supply-chain attacks as the most effective route into hardened environments, and the widening gap between supply-chain protection and everything else.
The last-mile argument: detection is step one; the value is remediation at scale without slowing development.
Compliance pressure: application-level dependencies face scrutiny under FedRAMP and PCI DSS.
The distinction between detecting vulnerabilities and proving they’re fixed with signed, audit-ready evidence.
Sequence
Week 1-2: Agree on the exact technical claim the content will demonstrate. The vendor supplies the pipeline mechanism and any readiness or dependency data the post will cite. Sorani’s posts typically state a principle and point to a mechanism, making that mechanism the vendor’s deliverable.
Week 3-6: Record Sorani and the vendor’s expert discussing a problem with real operational detail: heterogeneous dependency environments or proving a fix survived the build.
Week 7-9: Run the announcement post alongside the recorded conversation, using the integration-post structure: what was built, the three things it enables, and one link to detail.
Week 10: Publish a written post that stands alone—the problem, the tradeoff, and the fix path—with video as optional depth, as Sorani’s existing posts do.
What to confirm with the creator
Confirm that Sorani is willing to put their name to the technical claim the vendor wants demonstrated.
Confirm that a recorded conversation with the vendor’s expert is available; the format needs that counterpart.
Ask about sponsorship terms, rates, and disclosure practices; none appear in Sorani’s posts.
Radford is the stronger choice when a collaboration needs a structured operating model at its core: named capability pillars, a maturity baseline, and a phased roadmap a buyer can work through, rather than one argument attached to a single integration.
Read more
Radford’s Secure Software Factory posts define four, then five, pillars; frame the problem as missing integration, governance, and operating discipline rather than missing tooling; and lead to a whitepaper download or an assessment conversation. A supply chain and remediation vendor whose offer includes a maturity assessment or consultative discovery has an obvious next step: the framework describes the problem, the assessment is the entry point, and the remediation product sits inside pillar three.
The tradeoff is voice and evidence.
Radford’s posts read as consultancy marketing: they state a framework, list claimed outcomes — reduced mean time to remediate, fewer production incidents, improved compliance readiness — and link to a whitepaper that requires registration.
Sorani’s posts take one problem and explain it in operational terms, often alongside a recorded conversation with a named technical counterpart.
Choosing Radford for a campaign about those outcomes means trading practitioner explanation for a branded method; the vendor should provide data behind the claims rather than assume the posts substantiate them.
The comparison rests on two posts.
Ask for audience and commercial-availability information before deciding.
Camacho is the stronger choice when the subject is supply chain security in embedded, automotive, or medical-device software — long product lifecycles, constrained hardware, over-the-air update paths, and safety-critical verification — rather than the general AppSec dependency pipeline.
Read more
Camacho writes about software-defined vehicles as networked systems built from many vendors’ code, ISO/SAE 21434 as a framework for engineering security into product development, and static analysis, structural coverage, fuzz testing, and AI-assisted verification as complementary controls. A vendor whose remediation story depends on shifting security left in safety-critical code, or proving a fix on devices that are hard to patch, finds more usable raw material here than in Sorani’s posts.
The tradeoff is scope and independence.
Camacho’s coverage is narrower — embedded, automotive, and verification tooling — and does not reach the broader AppSec and DevSecOps readership targeted by the campaign.
It also lacks the compliance hooks, such as FedRAMP and PCI DSS scrutiny of application-level dependencies, that make Sorani’s angle easy to frame.
Both posts read as vendor-authored educational marketing: one carries a tool vendor’s hashtag, and both link to a guide or blog.
A sponsor gets less of the personal, question-led voice that makes Sorani’s last-mile argument quotable across formats.
Keep this alternative for a campaign focused specifically on embedded or automotive.
Manico is the stronger choice when a collaboration needs a position to argue — AI changing the economics of finding and fixing vulnerabilities, what happens to standalone scanners, or what standards like OWASP ASVS and AISVS should require — rather than a step-by-step account of how a fix is proven inside a build pipeline.
Read more
Manico states a thesis, anticipates critics, and cites incident evidence, including a package-registry attack carried out by automated agents, then invites disagreement from practitioners with direct experience.
A vendor that wants the campaign to make a claim and defend it against the prevailing view gets more from that than from a technical walkthrough.
It also suits a standards-led message, since Manico treats ASVS and AISVS as the definition of what must be verified.
The tradeoff is that Manico’s published position cuts against part of what this campaign sells.
Manico argues that AI agents increasingly discover, exploit, patch, and verify software; routine security work will need far less human labor; and standalone scanners and traditional AppSec products will be replaced by AI-native capability.
A vendor selling scanning or vulnerability management would fund a message that argues its category away.
This fit works only if the campaign is genuinely about AI-native security engineering and verification.
The two posts offer argument and commentary, with less operational detail about supply chain mechanics — how a dependency is found, fixed, and attested — than Sorani’s posts.
Ask for audience and commercial-availability information before deciding.
This profile is built from the eight LinkedIn posts in full text, read end to end, together with the account snapshot observed on 9 October 2026.
Several posts introduce a recorded conversation, a conference talk, an article, or an event page; those linked items were not and were not read, so anything said about them rests on how Motti Sorani frames them in the post itself.
The post text carries no publication dates, and no engagement, impression, follower-growth, or audience-demographic data was available; the only measured figure is 2,664 LinkedIn followers.
Two posts name a company in a commercial context, and both leave Sorani's exact role unstated, so the relationship is described only as far as the post supports it.
No books, shows, or other earlier signature work appear in the material reviewed, which remains an open gap for anyone searching this name.
Statements are limited to what the posts show; employers and credentials were not verified beyond them.