# Okan YILDIZ

Okan YILDIZ creates practical cybersecurity learning content focused on SOC operations, penetration testing, phishing investigations, and detection engineering. Their examples connect hands-on exercises—such as building a Microsoft Sentinel lab—to the investigation and response work security teams perform.

- Profile: https://b2binfluencer.marketing/creators/okan-yildiz/
- LinkedIn: https://www.linkedin.com/in/yildizokan
- LinkedIn followers: 105,861
- Based on 9 dated posts, latest 2026-10-07

## Summary

They are most useful for providing practical, hands-on technical workflows for cybersecurity training and education.

- Best for: Cybersecurity training companies looking to build SOC analyst labs or detection engineering courses.
- Not for: General consumer brands or campaigns requiring short-form video demonstrations for broad audiences.
- Check first: Request account and recent post analytics, including follower demographics and engagement data.

### Takeaways

- They publish practical content on SOC operations, penetration testing, and phishing investigations.
- Their posts connect technical steps to decisions security teams must support.
- They have 105,861 LinkedIn followers, but no demographic data is provided.

## Main ideas

- **Build the environment, don’t memorise the SIEM, to learn security operations**: Okan argues that knowing where the buttons are in a security platform is not the same as understanding security operations. The learning comes from creating the telemetry, writing the query, turning it into a detection, then explaining an alert you generated yourself. The value lies in the connected chain — data source, logs, KQL, detection, alert, incident, investigation, response, automation — rather than in any single feature.
- **A vulnerability rating describes a finding; an attack chain describes the risk**: In a post describing an 18-page field manual, “Pentest: Inside the Report”, Okan argues that listing weaknesses is not the same as showing how a compromise happens. Individually manageable issues can connect into a route to privileged access or sensitive data; a report that never assembles that path leaves readers unable to judge the risk. A security team needs a report it can act on: one that shows where the attacker started, what enabled the path, and what exactly breaks it.
- **Authentication proves something about the sending infrastructure, not that a message is trustworthy**: Okan argues that phishing analysis should not begin with whether a message passed authentication: a passing result does not establish trust. An attacker-controlled domain can authenticate correctly, a convincing lookalike can pass SPF, DKIM and DMARC, and business email compromise may carry no malicious attachment or link. The method follows from this: preserve the original evidence, then parse, inspect and correlate before drawing a conclusion.
- **A fixed sequence and closing questions push every investigation forward**: The three posts share a working method: correct a common assumption, give an ordered pipeline, then list the questions a practitioner must answer. Those questions turn one completed exercise into the next task — a validation into a detection, a finding into a debrief, a confirmed email into an environment-wide hunt. Two posts also point to a named, self-published working document, suggesting a priority on reusable artifacts rather than one-off explanations.

## Work to read

- [Microsoft Sentinel Home Lab: a zero-to-SOC roadmap](https://www.linkedin.com/posts/yildizokan_microsoftsentinel-soc-socanalyst-activity-7513539502871777280-lxxK)
- [Pentest: Inside the Report field manual](https://www.linkedin.com/posts/yildizokan_penetrationtesting-pentest-cybersecurity-activity-7513241104885014528-Ql7Z)
- [Phishing Email Analysis Field Notebook](https://www.linkedin.com/posts/yildizokan_cybersecurity-phishing-emailsecurity-activity-7513602971633336320-aiUp)

## Brand relationships

- **Microsoft** (mention)
- **Blueteamers** (mention)

## Partnerships

Okan YILDIZ's three LinkedIn posts do not describe partnership formats. They are self-published educational guides — a Microsoft Sentinel home-lab roadmap, an "Inside the Report" penetration-testing field manual, and a phishing-analysis field notebook — each ending with a save/repost/follow call to action rather than a sponsorship offer, rate card, media kit, or brand contact route. One post credits the material to "Blueteamers," showing shared or republished content but not establishing a commercial relationship. For buyers, there is no published way to scope, price, or book a collaboration based on these posts. Any partnership would need to be negotiated directly and confirmed in writing before being planned into a campaign.

## Alternatives

- Reilyn Garton: Choose Reilyn Garton when the course needs to teach detection strategy for state-sponsored and identity-based tradecraft rather than lab build-out. Their posts cover Volt Typhoon's living-off-the-land persistence inside critical infrastructure and turn it into operator questions a course can score: are you logging and correlating lateral movement over SMB, WMI and WinRM; alerting on anomalous service-account use; baselining admin behaviour and flagging deviations; and hunting credential access and token abuse instead of payloads? A second post covers the identity shift—session hijacking, OAuth abuse, MFA fatigue and token replay—and argues that defenders who keep pace focus on token lifetime reduction and session revocation, MFA-abuse telemetry rather than checkbox MFA, and identity signals fused with endpoint and network data. For a module on behavioural detection, identity telemetry or purple-team validation of adversary tactics, this framing offers a sharper threat picture and more advanced operator questions than the Sentinel lab sequence, which starts lower down the stack.
- Makarand Karanjalkar: Choose Makarand Karanjalkar when the course is about how behavioural intelligence is represented, shared and interpreted, not about running a SOC lab. The OCA Indicators of Behaviour post explains a vendor-neutral way to describe attacker behaviour using STIX 2.1—initial access, privilege escalation, credential access, lateral movement, persistence, command and control, staging and exfiltration—and argues that behaviour is far harder for attackers to change than infrastructure or tooling. The follow-up distinguishes behaviour analytics, which answers only whether activity is unusual, from behavioural threat intelligence, which places activity within an attack objective and wider campaign. It names Microsoft Defender, CrowdStrike Falcon, Splunk, Exabeam, Darktrace and Google Chronicle as platforms doing the former. That gives a standards, CTI-sharing, XDR-interoperability or AI-assisted-detection module a usable spine and a vendor landscape buyers will ask about.
- Steve Faruque: Choose Steve Faruque when the course is an AI-security or LLM-security module rather than SOC fundamentals. The posts examine AI-native attacks through a named case—the ForcedLeak vulnerability in Salesforce Agentforce, where indirect prompt injection turned an autonomous agent into a CRM data-leak path—and break down the agent attack surface (knowledge bases, executable tools, memory and autonomous workflows) and why it produces no malware, privilege escalation or suspicious network traffic to alert on. The second post adds attack economics and a concrete controls stack: delimiter spotlighting to isolate inputs; a security-code-review checklist for every AI feature pull request; basic request logging with three anomaly alerts on free-tier tooling; open-source guardrails including Guardrails AI, Llama Guard and NeMo; and a growth path of Lakera Guard or Azure Prompt Shields, behavioural anomaly detection, output filters and monthly automated red teaming against the OWASP LLM Top 10 with Garak. A live attack case and that level of named tooling give a module on securing AI features practical detail.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/