Nir Sofer

The old example was an unsanctioned file-sharing tool; today, it is an AI assistant someone connected to a Microsoft 365 tenant through a delegated OAuth grant with read access to mail and files.

• The application sits inside the identity provider, so a firewall never sees it, off-boarding never revokes it, and it appears in no inventory because nobody bought it.
• Sofer cites SysAid's State of Service Management 2026 survey of 718 IT professionals, which found that only 9.9% of organizations have full visibility into their software ecosystem, with nearly half flagging poor software visibility as a security risk.

Sofer offers a three-list exercise that requires no budget: pull the application list from the identity provider, OAuth grants from the tenant sorted by scope, and twelve months of card spend filtered for SaaS. The difference between the lists reveals the shadow estate, which they say ends up bigger than expected.

Sofer adds a deliberate constraint: do not aim for 100% visibility, because that pursuit stalls the program. The goal is a known, bounded unknown: measured coverage, a tracked gap, and a named owner for the remainder.

Read original

Every unauthorized tool is a potential compliance gap.

• Frameworks such as SOC 2 and ISO 27001 require an asset inventory and a vendor-risk process—neither can cover tools nobody knows exist.
• Sofer cites the same 9.9% visibility figure from the SysAid survey and argues that a vendor audit, rather than a breach, often provides the impetus to act.

Sofer recommends getting ahead of the problem before an audit forces the issue, turning the visibility exercise into preparation for a commercial and compliance event, not just a technical one.

Read original

The piece they share frames digital transformation as a convergence of AI, cybersecurity, and financial integrity, and describes leadership silos as a strategic liability.

• It sets out a CEO, CFO, and CISO triad in which strategy, value, and protection operate together.
• Identity and access management is presented as a foundational business control affecting revenue assurance and audit readiness, while AI governance is necessary because AI can accelerate errors and regulatory breaches as quickly as it accelerates insight.

The shared analysis proposes aligning security controls with financial cycles such as order-to-cash, so digital and AI investment delivers measurable outcomes without unacceptable risk. Sofer contributes the framing; the three named takeaways come from the outside article.

Read original

Across the posts, the pattern is consistent: open with a familiar line or a counterintuitive number, explain the mechanism in plain terms, then offer a few specific steps. The writing is first-person and argumentative rather than promotional, with longer blog or press pieces linked as supporting material rather than serving as the main event.

One post moves from the inverted maxim that you cannot secure what you cannot see to the 9.9% visibility figure, an explanation of why OAuth-connected tools evade all three detection methods, and three data pulls a team can run immediately.

Read original · Original 2 · Original 3

Announcing the move to SysAid as Chief Information Security Officer after nearly four years at Align Technology protecting global innovation, they describe the service desk as the heart of every company and SysAid as transforming IT service management through AI-driven orchestration. Their stated mission is to ensure that innovation is built on trust and world-class security, securing AI-powered service management as the executive responsible for it.

The two software-visibility posts cite SysAid's own 2026 survey and link to a SysAid blog post for the IT team playbook, tying the public themes to the employer's research agenda.

Read original

Read this first to see how Sofer frames software visibility as the control everything else rests on.

Sofer opens with a statistic from SysAid's State of Service Management 2026 survey of 718 IT professionals: only 9.9% of organizations report full visibility into their software ecosystem.

• Then they show how the shadow IT problem has changed shape: the old example was an unsanctioned file-sharing tool; the current one is an AI assistant connected to a Microsoft 365 tenant through a delegated OAuth grant with read access to mail and files.
• Because that tool sits inside the identity provider, the firewall never sees it, off-boarding never revokes it, and no purchasing record exists.
• Sofer then gives three concrete steps that require no budget: pull the application list from the identity provider, pull OAuth grants sorted by scope, and pull twelve months of card spend filtered for SaaS.
• The gap between those three lists, they write, is the shadow estate.
• The post closes with a deliberate restraint: aim for a tracked, bounded unknown rather than 100% coverage, because chasing completeness stalls the program.

For brands planning a campaign

This is the strongest single artifact for a fractional CISO brief.

• It shows a repeatable discovery method a buyer can hand to an internal team in week one, plus a judgment call about scope that separates a program-builder from a tool-pusher.
• It also doubles as thought-leadership raw material: the OAuth-grant framing is specific enough to anchor a byline or webinar, unlike generic “shadow IT is a risk” content.

Read this second to see the commercial framing layered onto the same visibility gap.

Sofer takes the familiar shadow IT warning and adds a consequence most security commentary skips: license compliance.

• Every unapproved tool is a potential compliance gap.
• They cite the same SysAid 2026 figure — 9.9% of organizations with full visibility — to argue that frameworks such as SOC 2 and ISO 27001 require an asset inventory and vendor-risk process that cannot be produced for tools nobody knows exist.
• The central framing is that shadow IT and license compliance are one problem viewed from two directions, and the forcing function is often a vendor audit rather than a breach.
• Sofer refers readers to a longer SysAid blog post for the IT team playbook.

For brands planning a campaign

Useful for a brief where security has to win budget from finance or a compliance owner.

• It shows Sofer can translate a technical gap into audit-readiness and cost language, often essential in a fractional CISO engagement's first executive conversation.
• The post also demonstrates comfort publishing under an employer's research banner, relevant if the engagement includes co-authored thought leadership.

Read this to judge whether they can hold a boardroom conversation, not just a practitioner one.

Sofer shares and endorses a Philippine Daily Inquirer piece arguing that digital transformation has become a convergence of AI, cybersecurity, and financial integrity, and that leadership silos are now a strategic liability.

• It lays out three takeaways: identity is the new perimeter, meaning identity and access management is a business control affecting revenue assurance and audit readiness rather than a technical project; the CISO and CFO should align security controls with financial cycles such as order-to-cash so AI investment produces measurable outcomes; and AI governance matters because AI accelerates errors and regulatory breaches as quickly as it accelerates insight.
• Sofer's contribution is the framing: security as the backbone of business trust and scalability rather than a technical department.
• This is a share of outside analysis with commentary, not original reporting.

For brands planning a campaign

This is the executive-alignment sample.

• For a campaign aimed at building executive alignment on identity as the new perimeter, it shows the vocabulary Sofer uses with CFOs and CEOs: financial cycles, audit readiness, measurable outcomes.
• It is commentary on a third-party article, so it shows how they frame executive conversations rather than a full original argument.

Read this first for context on the role and remit before judging the security writing.

Sofer announces joining SysAid as Chief Information Security Officer after nearly four years at Align Technology, where the stated work was protecting global innovation.

• They explain the choice: the service desk sits at the heart of every company, and SysAid is positioning its IT service management platform around AI-driven orchestration.
• Sofer describes the remit as making sure that innovation is built on security and trust — securing AI-powered service management from the inside, as the executive responsible for it, rather than advising from outside.

For brands planning a campaign

Establishes the day job and its scope: a sitting CISO at an ITSM vendor, hired to secure an AI-driven product line.

• That experience supports a fractional engagement focused on securing AI features in a B2B SaaS product.
• Because Sofer is a sitting executive rather than a full-time independent consultant, account for their availability in any 30-day plan.

Where it once meant an unsanctioned file-sharing tool, it now means an AI assistant someone connected to a Microsoft 365 tenant, holding a delegated OAuth grant with read access to mail and files.

• Because the app lives inside the identity provider rather than outside the perimeter, a firewall never sees it, off-boarding never revokes it, and it appears in no inventory because nobody bought it.
• Sofer anchors the argument in SysAid's State of Service Management 2026 survey of 718 IT professionals, citing a finding that only 9.9% of organizations have full visibility into their software ecosystem while nearly half flagged poor software visibility as a security risk.

The post lays out a concrete three-step exercise any team can run without a budget: pull the application list from the identity provider, pull the OAuth grants from the tenant sorted by scope, then pull twelve months of card spend filtered for SaaS. The delta between the three lists is the shadow estate.

Sofer pushes back on chasing 100% coverage, warning that the pursuit stalls the program. The goal, they say, is a known, bounded unknown: a measured gap with a named owner for the remainder.

For brands planning a campaign

The OAuth grant audit is a repeatable, demonstrable artifact. A security vendor or fractional-CISO engagement can build a workshop, assessment offer, or content series around the three-list exercise, with the 9.9% figure as a headline number.

Examples: Source 1

Every unauthorized tool is a potential compliance gap.

• They point out that frameworks such as SOC 2 and ISO 27001 require an asset inventory and a vendor-risk process—neither of which an organization can produce for tools it does not know exist.
• The practical argument is to get ahead of the issue before a vendor audit forces the hand, using the same 9.9% visibility figure from the SysAid survey.

For brands planning a campaign

This gives a GRC, license-management, or vendor-risk partner a ready-made bridge from technical discovery to audit and certification outcomes, making it a fit for content aimed at compliance and finance-adjacent buyers as well as security teams.

Examples: Source 1

Identity is the new perimeter: IAM is not a technical project but a foundational business control that affects revenue assurance and audit readiness.

• They describe a CISO-CFO alliance that ties security controls to financial cycles such as Order-to-Cash, so digital and AI investment delivers measurable outcomes without unacceptable risk.
• They also treat AI governance as necessary because AI amplifies regulatory exposure as readily as it amplifies insight.

For brands planning a campaign

Sofer can carry an executive-audience message that a purely technical creator cannot. Suitable uses include C-suite roundtables, board-level explainer content, and webinars that bring a security voice into a finance or strategy conversation.

Examples: Source 1

Sofer opens with a familiar line or a counterintuitive figure, explains the mechanism behind it in plain terms, and closes with a short list of named actions or takeaways.

• Posts appear as LinkedIn text with bolded lines, short bulleted lists, an external link to a longer piece on a company blog or in the press, and a hashtag set spanning ITSM, software management, cybersecurity, and CISO topics.
• The style is first-person and argumentative rather than promotional.

Lead with a number or an accepted adage, invert it, explain why the old model no longer holds, then give readers three things they can do this week.

The corpus is undated, so this pattern cannot be tracked as a developing trend over time; it is documented as the current format only.

For brands planning a campaign

A partner does not need to commission long-form work to match Sofer's register. A single counterintuitive finding plus a short action list is the native unit; longer blog or press placements serve as supporting links rather than the main event.

Examples: Source 1 · Source 2 · Source 3

Their career-announcement post states that they joined SysAid as Chief Information Security Officer after nearly four years at Align Technology protecting global innovation.

• It sets out the mission in terms used elsewhere: making sure AI-driven service management is built on trust and world-class security.
• Other content references SysAid's own research and blog, linking the platform closely to the employer's thought-leadership programme.

For brands planning a campaign

Partners should expect Sofer's public themes and the vendor's research agenda to move together, and plan for the possibility that topics are chosen to support a current employer's market position. The fit is strongest for vendors whose positioning overlaps with ITSM, identity, and AI governance.

Examples: Source 1

Later posts discuss SysAid’s State of Service Management 2026 survey and a SysAid blog on shadow IT and license compliance.

View example

View example

Where Sofer says to pull three lists, Hathaway says to start with an honest benchmark against the NIST AI Risk Management Framework or the CRI financial-services framework, then build policies, a repeatable AI risk assessment, AI items in vendor reviews, and AI incident playbooks. Both answer the reader's real question — where do I start? — with a named first move rather than a principle, and both write short LinkedIn posts that close on a concrete next step.

Hathaway focuses on AI risk in vendor and risk-assessment processes: whether a vendor's model, training data, and human oversight were reviewed, and how to get notice before a new AI feature goes live.

• Sofer focuses on the identity estate — unsanctioned OAuth grants, shadow applications, and software the organization cannot see.
• Hathaway also draws on an advisory practice running free NIST AI RMF sessions, while Sofer writes from an in-house CISO role tied to one vendor's research.

Read original · Original 2

Both explain frameworks in plain, structured prose and end with what the reader should do or understand next. Biswas walks through the NIST Cybersecurity Framework functions and argues that resilience is measured by sustaining trust during disruption — the same move Sofer makes when framing identity as a business control rather than a technical project.

Biswas focuses on framework interpretation, governance principles, and practitioner education, and has published a certification guide on ITIL 5.

• Their posts offer conceptual explanation more than operational checklists.
• Sofer is narrower and more concrete, pointing to specific artifacts a team can collect this week; their subject is identity exposure rather than service-management practice.

Read original · Original 2

The posts answer the question teams ask first — where to start — with a sequence: benchmark against the NIST AI Risk Management Framework or the financial-services framework from CRI, then build four things.

• First, written AI policies matched to how the team actually works, not copied from a template.
• Second, an AI risk assessment integrated into the company's existing risk process.
• Third, vendor security reviews extended with AI questions, examining a model, its data handling and its documentation alongside the vendor's SOC 2.
• Fourth, incident-response playbooks for a model acting on its own or reaching a customer with a confidently wrong answer.
• The vendor side is unusually practical: ask two triage questions per vendor — does it touch customer data, and does it make or influence a decision about a person?
• Then send a one-paragraph discovery email to critical and high vendors to build a review queue, and add a renewal clause requiring notice before a new AI feature is switched on.
• The dated record of what was asked, what the vendor said and what was decided is the artifact an examiner looks for.
• For a B2B SaaS security company whose board is asking for AI risk oversight, or whose own product ships AI features its customers must review, this maps more directly to an AI governance program than identity-perimeter work.
• The working session ends with a written benchmark and roadmap, a concrete week-one artifact.

For an OAuth and shadow-estate assessment, the posts do not show the core working method: pulling the application list from the identity provider, sorting OAuth grants by scope, and comparing the gap with twelve months of SaaS card spend to identify a shadow estate.

• They also offer no blast-radius triage for delegated grants with read access to mail and files, no revocation procedure, and no first-person account of running product security inside a software vendor.
• The reference points are NIST's AI framework and a financial-services framework, which may require adaptation for clients outside regulated financial services.
• There are two posts; the second quotes a risk leader from a panel and describes a checklist built in response, rather than the author's own engagement.
• Before hiring, ask for a sample month-one plan covering OAuth discovery, grant triage and revocation.
• Used alone, Hathaway covers the AI governance half of an AI governance program, leaving the OAuth and shadow-estate work to someone else.

Examples: Source 1 · Source 2

The writing works through the NIST Cybersecurity Framework functions — govern, identify, protect, detect, respond, recover — and argues that resilience is measured by how well an organization sustains trust during disruption, not by whether it prevents every incident.

• It describes stakeholders as expecting transparency in response, resilience in recovery, accountability in learning, and continued delivery of value.
• For a board-level story about governance, recovery and accountability, or a mapping of the client's controls onto NIST CSF, this is the register the creator works in.
• Biswas also announced a certification guide for ITIL Version 5, named a technical reviewer, and wrote about service management expanding to cover digital products, ecosystems, AI and automation, governance, risk and sustainability.
• The argument is that certification supplies knowledge, while value comes when it changes how people decide and collaborate.
• A client that sells service-management or ITSM software, or needs framework and certification education for its own practitioners and customers, gets an authored teaching credential on the framework side rather than another set of opinion posts.

For a first month focused on OAuth and shadow-estate work, the tradeoff is specificity.

• The published material is framework exposition and a trust narrative; it does not show a repeatable exercise a client team can run in days one to five, or cover OAuth grants, identity-provider inventories, software-spend reconciliation or vendor-review question sets.
• Where Sofer's material gives readers three lists to pull that week, this material gives them six functions to consider.
• The second tradeoff is market concentration: an engagement built on service-management frameworks looks much like the surrounding product category.
• A B2B SaaS security client should confirm in writing that the framework teaching stays general and does not also promote adjacent service-management vendors.
• The certification guide appears only in the author's own announcement; ask to review its contents before treating it as a teaching outcome rather than a stated authorship and subject.

Examples: Source 1 · Source 2