Muli Motola

One post says IAM resilience “isn't just about preventing attacks”: organisations also need to detect, respond and recover when something goes wrong. The breach posts make the same point: if strong controls can be bypassed, the key question is what the business can still do afterwards.

The Apollo Global Management post says attackers targeted people rather than systems and held unauthorised cloud access for five days. Motola argues that strong security controls can be bypassed when humans are the target, so resilience must include detection, response and recovery.

Read original · Original 2 · Original 3

During an identity incident, teams have to tell attacker changes apart from legitimate ones, choose a recovery state they can trust, keep containment actions in place and verify access afterwards. Recovery testing should rehearse those judgements; speed of restore is not the same as restoring the right thing.

The post presents a recovery test through a sequence of decisions: distinguish attacker changes, choose a trusted recovery state, preserve containment and verify access.

Read original

Williams describes the IAM challenge as a duality: rigorously keep unauthorised users away from sensitive data while enabling authorised teams to run investigations and meet legal obligations.

A GDPR fine triggered by access alone, with no exfiltration, turns an identity control gap into a compliance event.

Read original

The argument: routine identity loopholes can become catastrophic incidents.

Revoked access that remains active and legacy systems nobody remembered to review are among the misconfigurations described as causes of serious breaches.

Read original

Reporting that over 500 critical infrastructure organisations were targeted by the Medusa group, the post asks whether an IAM architecture can withstand a threat that weaponises newly disclosed flaws within 24 hours and targets Active Directory for lateral movement. It focuses on the pace of attacks and the role of directory infrastructure in helping attackers spread.

Medusa weaponised a fresh flaw within a day and used Active Directory to move laterally across a victim's environment.

Read original

It explains what teams should test during an identity incident and why a fast restore can still be the wrong outcome.

Motola separates a successful restore from a successful recovery.

• The post says teams must distinguish attacker changes from legitimate ones, choose a recovery state they can trust, preserve containment actions, and verify access afterward.
• The takeaway: recovery testing should rehearse the decision, not just measure restore speed.

For brands planning a campaign

A co-authored recovery-testing piece could build on this distinction: use a decision-tree or tabletop exercise to test trusted recovery state, separation of attacker changes from legitimate ones, preservation of containment actions, and post-recovery access verification.

A newcomer gets a named CISO’s framing of the risk in one short post.

Motola promotes an Identity Nightmares interview with Kayla Williams, CISO at Devo.

• The post argues that unauthorized data access is itself a reportable incident, even when data is not exfiltrated; it can trigger major GDPR fines and create a dual challenge: block unauthorized users while keeping authorized teams able to investigate and meet legal obligations.
• It defines IAM resilience as responding to, recovering from, and limiting identity incidents—not just preventing them.

For brands planning a campaign

For a campaign about unauthorized access, this supports a co-authored piece that uses unauthorized access as the incident trigger and connects it to GDPR reporting, investigation access, and recovery.

It’s a useful starting point for readers seeking concrete failure modes rather than abstract risk.

Motola introduces Identity Nightmares with Barry Gordon, who describes real-world vulnerabilities: unauthorized privileged access, overlooked legacy systems, and identity misconfigurations that escalate into major breaches. The post frames routine identity loopholes as catastrophic incidents and points to their business impact.

For brands planning a campaign

Use this as evidence for an enterprise campaign on privileged access review and legacy system decommissioning as IAM resilience measures.

It’s useful for readers asking what IAM resilience means against fast-moving ransomware.

Motola reports that over 500 critical infrastructure organizations have been targeted by the Medusa ransomware group.

• The post asks whether IAM architecture can withstand a threat that weaponizes newly discovered flaws within 24 hours and aggressively targets Active Directory for lateral movement.
• It puts Active Directory and speed at the center of IAM defence.

For brands planning a campaign

A timely campaign hook: pair recovery testing with Active Directory hardening and rapid-exploit scenarios.

It offers a clear example for a general reader.

Motola uses the Apollo Global Management breach to illustrate social engineering risk: attackers targeted people to gain unauthorized cloud access for five days. The post argues that even strong security controls can be bypassed when humans are the target, so IAM resilience needs detection, response, and recovery—not only prevention.

For brands planning a campaign

Supports a campaign on social engineering tabletop exercises that test detection and recovery, not just phishing prevention.

Muli Motola repeatedly pushes the idea that identity and access management resilience means being able to detect an identity incident, respond to it, and recover with confidence.

• One post states plainly that IAM resilience "isn't just about preventing attacks" and that organizations must also be prepared to detect, respond, and recover when something goes wrong.
• Another argues that recovery testing should rehearse the decision, not just the restore: teams need to tell attacker changes from legitimate ones, pick a recovery state they can trust, keep containment actions intact, and verify access afterwards.

Argument-first short posts that state a reframe ("a successful restore isn't necessarily a successful recovery") and then unpack it in a few short paragraphs before linking to fuller Acsense content.

For brands planning a campaign

A vendor selling IAM or identity resilience can use this framing as the spine of a campaign. It supports messaging that moves the buyer from "breach prevention" to "incident readiness," and it gives a natural co-authored angle on recovery testing.

Examples: Source 1 · Source 2 · Source 3

It lays out the judgments teams face during an identity incident: distinguishing attacker changes from legitimate ones, choosing a recovery state they can trust, preserving containment actions, and verifying access afterwards. Its conclusion: recovery testing should rehearse those decisions rather than measure raw restore speed.

A single-idea post built around a sequence of concrete decisions teams must make, ending with a link to a longer article.

For brands planning a campaign

This topic is directly usable in a campaign brief on recovery testing and IAM incident response. It offers a concrete, defensible thesis—test the decision, not just the restore—and a checklist a co-authored piece could expand and pressure-test.

Examples: Source 1

It also describes the IAM challenge as a duality: rigorously block unauthorized users from sensitive data while allowing authorized teams to conduct investigations and meet legal obligations.

For brands planning a campaign

Useful for campaigns aimed at risk, compliance, and legal stakeholders as well as security teams. It connects identity controls to regulatory exposure, not just technical hygiene.

Examples: Source 1

One covers the Apollo Global Management breach, where attackers targeted people to reach cloud systems for five days, and argues that strong controls can be bypassed when humans are the target. Another opens with the Medusa ransomware group targeting over 500 critical infrastructure organizations, weaponizing newly disclosed flaws within 24 hours, and going after Active Directory for lateral movement.

Incident-led commentary: open with a striking breach statistic or event, pose a question to readers, then link to a longer newsletter item.

Because these posts draw on others’ incidents rather than the creator’s original research or data, ask how the commentary will reframe the event.

For brands planning a campaign

Shows a repeatable format for a brand: take a current breach, draw out the identity lesson, and turn it into a short post plus a longer breakdown. Suited to newsjacking and alert-style campaign content rather than evergreen thought leadership.

Examples: Source 1 · Source 2

Its framing: routine identity gaps can become catastrophic incidents rather than staying contained.

For brands planning a campaign

Gives a vendor a ready-made taxonomy of failure modes for content: each can become its own asset or a section in a longer guide, and each maps to a distinct product capability.

Examples: Source 1

Interview subjects include Kayla Williams, CISO at Devo, and Barry Gordon. The LinkedIn posts act as entry points, linking to the full discussion, article, or newsletter issue.

Promotional posts tease a series or issue, summarize it in a few takeaways, invite reader comments, and link to the full item.

For brands planning a campaign

A brand considering co-marketing can expect an interview-and-newsletter model rather than one-off posts. That suits a campaign built around named practitioners and recurring episodes, with the vendor’s contribution likely feeding an existing series format.

Examples: Source 1 · Source 2 · Source 3

They use the #Acsense tag and first-person plural ("we take a closer look"). The posts don't state the nature or terms of the relationship; ask Motola to clarify the affiliation and its terms.

Original disclosure

#Acsense

View example

Richards discusses a Fortinet VPN vulnerability exploited by ransomware groups and an Active Directory attack that never dropped malware, arguing that the fastest recoveries come from disciplined patching and operational accountability, not the biggest security budget. Motola makes the same move when discussing the Apollo breach or the Medusa campaign: start with a real event, then reframe the reader's priority.

Richards writes about customer success and vulnerability management, focusing on why known gaps stay unpatched, and points to the Tech Decanter discussion with Aida Keehner. Motola stays within identity and access management; the post points to an interview series or newsletter rather than a vendor-side operational checklist.

Read original · Original 2

Edwards's account of the MGM incident argues that a help desk password reset is a privileged access channel, and that the person on the phone, the questions they ask and the exceptions they allow under pressure matter more than the firewall.

• Motola similarly argues that identity loopholes in everyday settings, such as privileged access and legacy systems, can lead to catastrophic incidents.
• Both teach by walking through what actually happened.

Edwards writes longer, narrative educational pieces and promotes study material for security-operations certification, aimed at analysts building hands-on judgement. Motola's posts are shorter, usually promoting an interview or newsletter issue, and focus on enterprise identity programmes rather than exam preparation for individual practitioners.

Read original · Original 2

Jurga writes that paying a ransom is an illusion of recovery because restoration is unreliable and repeat attacks are common, then lists immutable backups, isolated storage and tested automated recovery as the answer.

• Motola makes the same shift from prevention to recovery in the IAM context.
• Both frame the cost as a board-level risk question rather than a technical one.

Jurga focuses on the software supply chain and DevOps data resilience, covering repositories, CI/CD pipelines and build environments rather than identities and access. Motola uses practitioner interviews as a teaching device; Jurga builds a C-suite argument around statistics and a vendor brief, and labels the posts with a GitProtect hashtag.

Read original · Original 2

Muli Motola’s posts argue from a customer-success position inside a security provider, returning to known, unpatched vulnerabilities and privileged accounts as the openings ransomware groups actually use.

• One post examines a Fortinet VPN case and asks how long a known flaw would remain in a given environment before someone fixed it; another looks at a ransomware group that used compromised domain credentials and Group Policy, asking how much damage a trusted admin account could do before anyone noticed.
• Vendors in vulnerability management, patch prioritisation or privileged access protection will find a closer match here than in a recovery-testing thesis: the posts name the operational failures those products claim to fix.
• The format is ready to use: pick a reported case, add the practitioner view and end with a pointed question for readers.

The posts react to a third-party discussion series and someone else’s reporting, leaving less of the author’s own method to build a co-authored asset around than the recovery-versus-restore distinction.

• Recovery appears only in a closing thought—that resilience matters as much as prevention—so the vendor would need to supply the substance of a recovery piece.
• There’s also a fit question: for a managed security provider or managed identity vendor, this voice sits close to a competing offer.
• Ask how they would distinguish the campaign from their own services.

Examples: Source 1 · Source 2

Muli Motola’s posts include a long, structured account of the MGM incident, tracing how a service desk became a privileged access channel: attackers reportedly used public employee information, called support, impersonated staff and talked their way into a password reset.

• A second post lays out a study path for a cybersecurity operations certification, spanning an audio course, a printed and ebook guide, and a flash-card set.
• For a course module, study guide or analyst-skills material built around the recovery idea—or a social-engineering and help-desk-process angle instead of the recovery-state angle—this is the stronger choice.
• The detailed case narrative also offers a better starting point for a long-form draft than the short-post format the campaign would otherwise inherit.

The two posts take opposite approaches to teaching: one is a historical case study, the other promotes someone else’s certification study products.

• Neither shows a recovery-testing method, so the four recovery decisions would need to be drafted from scratch.
• The certification post also puts the vendor in someone else’s frame rather than establishing it as the author of the method.
• For a training brief, ask for evidence of curriculum-design experience; a single study-path post isn’t enough to assess it.

Examples: Source 1 · Source 2

Muli Motola’s posts examine a package-poisoning campaign that reached a build pipeline—more than 400 infected packages—and argue that hardened perimeters are irrelevant when attackers use a trusted delivery pipeline.

• Another analyses whether to pay ransomware, for a C-suite audience.
• Both reach the same practical ground as the identity-side argument: immutable backups, air-gapped storage and tested automated recovery, alongside the warning that cloud providers guarantee platform uptime, not data recovery.
• Vendors selling pipeline security, repository protection, or backup and recovery for engineering organisations will find the framing closer to their buyers.
• The executive-brief format also offers a precedent for a longer asset aimed at senior audiences.

This isn’t an identity-resilience body of work.

• The access-control decisions at the heart of the recovery argument—distinguishing attacker changes from legitimate ones, choosing a recovery state the team can trust, maintaining containment and verifying access afterwards—don’t appear.
• A recovery-testing piece built on those decisions would need the original framing or a full rewrite from the supply-chain angle.
• The posts also direct readers to named product executive briefs, so a campaign here would join an existing content programme rather than establish a fresh author position.

Examples: Source 1 · Source 2