# Muli Motola

Muli Motola shares and promotes practical coverage of identity and access management (IAM) security, including identity incidents, ransomware, social engineering, and recovery testing. The posts also point readers to Acsense’s Identity Nightmares interviews and Five Nines newsletter.

- Profile: https://b2binfluencer.marketing/creators/muli-motola/
- LinkedIn: https://www.linkedin.com/in/motolamuli
- LinkedIn followers: 8,504
- Topics: social-engineering, ransomware
- Based on 12 dated posts, latest 2026-10-08

## Summary

Most useful for incident-focused IAM resilience content that explains detection, response, and recovery decisions.

- Best for: Brands wanting co-authored, opinionated IAM resilience material rather than paid reach campaigns.
- Not for: Campaigns needing guaranteed distribution to a defined buyer segment with fixed terms.
- Check first: Confirm audience breakdown and commercial terms before planning any paid placement.

### Takeaways

- Recovery testing should rehearse the decision, not just measure restore speed.
- Unauthorized data access is a reportable incident even without exfiltration.
- Apollo Global Management breach shows controls can be bypassed when people are targeted.

## Main ideas

- **IAM resilience means detect, respond and recover — not just prevent**: Motola argues that identity security must go beyond prevention. One post says IAM resilience “isn't just about preventing attacks”: organisations also need to detect, respond and recover when something goes wrong. The breach posts make the same point: if strong controls can be bypassed, the key question is what the business can still do afterwards.
- **Recovery testing should rehearse the decision, not the restore**: Motola distinguishes a successful restore from a successful recovery. During an identity incident, teams have to tell attacker changes apart from legitimate ones, choose a recovery state they can trust, keep containment actions in place and verify access afterwards. Recovery testing should rehearse those judgements; speed of restore is not the same as restoring the right thing.
- **Unauthorised access is itself a reportable incident**: In a post based on an Identity Nightmares interview, Motola relays Devo CISO Kayla Williams' view: even when data is not actively exfiltrated, unauthorised access is a reportable incident that can trigger major GDPR fines. Williams describes the IAM challenge as a duality: rigorously keep unauthorised users away from sensitive data while enabling authorised teams to run investigations and meet legal obligations.
- **Identity failures start in ordinary places**: Introducing Identity Nightmares, Motola summarises Barry Gordon's account of real-world vulnerabilities: unauthorised privileged access, overlooked legacy systems and simple misconfigurations that escalate into major breaches. The argument: routine identity loopholes can become catastrophic incidents.
- **Fast-moving ransomware puts identity architecture under time pressure**: Motola ties ransomware tradecraft to identity architecture. Reporting that over 500 critical infrastructure organisations were targeted by the Medusa group, the post asks whether an IAM architecture can withstand a threat that weaponises newly disclosed flaws within 24 hours and targets Active Directory for lateral movement. It focuses on the pace of attacks and the role of directory infrastructure in helping attackers spread.

## Work to read

- [Recovery testing is a decision test, not a restore test](https://www.linkedin.com/posts/motolamuli_acsense-iam-identityresilience-activity-7513334909546024960-lsG9)
- [Unauthorized data access as a reportable identity incident](https://www.linkedin.com/posts/motolamuli_iam-cybersecurity-gdpr-activity-7511564793439219713-U3ac)
- [Identity Nightmares: privileged access and legacy systems](https://www.linkedin.com/posts/motolamuli_acsense-iam-cybersecurity-activity-7512562348763602945-kJHo)
- [Medusa ransomware and Active Directory lateral movement](https://www.linkedin.com/posts/motolamuli_five-nines-vol-45-activity-7512886956897456128-SQZr)
- [Apollo breach: social engineering and IAM resilience](https://www.linkedin.com/posts/motolamuli_five-nines-vol-45-activity-7513646967646920704-LXCl)

## Brand relationships

- **Acsense** (disclosed_partnership)

## Partnerships

The five posts in this profile are promotional in form: each points readers to Acsense material, including the Identity Nightmares interview series and the Five Nines newsletter. They show a working content relationship with Acsense, but disclose no sponsorship programme, rate card, or booking terms. The recurring pattern is co-marketing around IAM resilience topics rather than an openly sold advertising product. Before planning a paid placement, ask Muli Motola directly for the deliverables, cost, and booking terms; the Acsense hashtags alone do not prove a commercial agreement.

## Alternatives

- Bradley Richards: When the focus is buyers’ day-to-day operations rather than the recovery decision itself. Muli Motola’s posts argue from a customer-success position inside a security provider, returning to known, unpatched vulnerabilities and privileged accounts as the openings ransomware groups actually use. One post examines a Fortinet VPN case and asks how long a known flaw would remain in a given environment before someone fixed it; another looks at a ransomware group that used compromised domain credentials and Group Policy, asking how much damage a trusted admin account could do before anyone noticed. Vendors in vulnerability management, patch prioritisation or privileged access protection will find a closer match here than in a recovery-testing thesis: the posts name the operational failures those products claim to fix. The format is ready to use: pick a reported case, add the practitioner view and end with a pointed question for readers.
- Jason Edwards: When the deliverable is a teaching asset rather than an opinion piece. Muli Motola’s posts include a long, structured account of the MGM incident, tracing how a service desk became a privileged access channel: attackers reportedly used public employee information, called support, impersonated staff and talked their way into a password reset. A second post lays out a study path for a cybersecurity operations certification, spanning an audio course, a printed and ebook guide, and a flash-card set. For a course module, study guide or analyst-skills material built around the recovery idea—or a social-engineering and help-desk-process angle instead of the recovery-state angle—this is the stronger choice. The detailed case narrative also offers a better starting point for a long-form draft than the short-post format the campaign would otherwise inherit.
- Bartosz Jurga: When the campaign targets DevOps teams and executives, and the resilience question concerns the software supply chain rather than identity incidents. Muli Motola’s posts examine a package-poisoning campaign that reached a build pipeline—more than 400 infected packages—and argue that hardened perimeters are irrelevant when attackers use a trusted delivery pipeline. Another analyses whether to pay ransomware, for a C-suite audience. Both reach the same practical ground as the identity-side argument: immutable backups, air-gapped storage and tested automated recovery, alongside the warning that cloud providers guarantee platform uptime, not data recovery. Vendors selling pipeline security, repository protection, or backup and recovery for engineering organisations will find the framing closer to their buyers. The executive-brief format also offers a precedent for a longer asset aimed at senior audiences.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/