# Patrick Garrity

Patrick Garrity works in cybersecurity threat intelligence at VulnCheck, sharing evidence of vulnerability exploitation and practical guidance on exposure, patching, and detection. Garrity also discusses VulnCheck’s exploit research and community releases and takes part in security panels and podcasts.

- Profile: https://b2binfluencer.marketing/creators/patrick-garrity/
- LinkedIn: https://www.linkedin.com/in/patrickmgarrity
- LinkedIn followers: 40,464
- Median of last 8 posts: 35 reactions, 3 comments (checked 2026-11-02)
- Topics: artificial-intelligence, supply-chain, cybersecurity, vulnerability-management, threat-intelligence
- Based on 11 dated posts, latest 2026-10-09

## Summary

Patrick Garrity is most useful for concise vulnerability exploitation updates with practical exposure, patching, and detection guidance.

- Best for: A threat intelligence vendor co-branded webinar or panel on exploitation and detection.
- Not for: Gated scripted executive keynotes on cyber risk management for CISOs and boards.
- Check first: Ask for comparable session results and audience data on role, industry, and seniority.

### Takeaways

- A Node-RED canary caught exploitation three days after public detection.
- Two Rejetto HFS code bases were under attack, with vendor warning quoted.
- A compromised AI coding extension had an explicit list of affected and unaffected versions.

## Main ideas

- **Exploitation in the wild is the signal that matters**: Garrity's posts move past disclosure to evidence that someone is actually attacking. He tracks canary hits, notes when a flaw enters VulnCheck's known-exploited catalog and whether CISA's has caught up, and points readers to a free alert signup for new exploitation evidence. He also keeps confirmed activity separate from rumor: one post reporting a batch of remediation work mentions, as unconfirmed chatter, possible additional Citrix NetScaler zero-days.
- **A CVE record is a jumping-off point, not the answer**: The argument is that an enterprise cannot judge exposure from the database entry alone. Garrity describes the aim as a more complete view of a vulnerability covering prioritization, mitigation, detection and testing, plus exploitation activity and internet exposure, and VulnCheck's releases pair each exploit with detection artifacts rather than a bare proof of concept.
- **Patching is an operating habit, not a one-off event**: Garrity relays vendor guidance as changes to routine: turn on automatic patching where possible, set maintenance windows frequent enough to absorb out-of-band critical fixes, design workloads so restarts are routine, and keep an inventory of the open-source components in your software. The stated reason is that organizations which know what they run patch fastest.
- **Give defenders working artifacts, in public and on a schedule**: A stated priority is open, reusable output rather than advice. VulnCheck's Initial Access Intelligence Community is described as a free, open collection of VulnCheck-authored exploits and detection artifacts published on GitHub and available through the VulnCheck API, with new items every Monday. Cadence is part of the argument: a predictable release rhythm is something a security team can build a routine around.
- **AI and developer tooling are part of the attack surface**: Garrity covers compromises in tools developers install, not only network software. His posts separate what is affected from what is not, and credit the researcher who surfaced the finding rather than presenting it as his own.
- **Bring the people doing the work into the conversation**: Alongside written updates, Garrity appears in and hosts recorded discussions, and the posts show him comfortable sharing a format with other technical voices. A guest's views are the guest's, not his; these posts establish who took part and what a session was about, not what was argued in it.

## Work to read

- [A Node-RED canary caught exploitation three days after detection went public](https://www.linkedin.com/posts/patrickmgarrity_cybersecurity-infosecurity-otsecurity-activity-7523026268460761088-22DI)
- [Two Rejetto HFS code bases under attack, with the vendor's own warning quoted back](https://www.linkedin.com/posts/patrickmgarrity_cybersecurity-infosecurity-threatintel-activity-7512165608004829184-RwL6)
- [A compromised AI coding extension, with an explicit list of what is and is not affected](https://www.linkedin.com/posts/patrickmgarrity_cybersecurity-infosecurity-aisecurity-activity-7521891020570066944-sZ11)
- [Patch at speed: the operational advice behind a week of emergency fixes](https://www.linkedin.com/posts/patrickmgarrity_infosecurity-cybersecurity-threatintel-activity-7522067750224109568-xIE7)
- [A CVE record is a jumping-off point, not the answer](https://www.linkedin.com/posts/patrickmgarrity_cybersecurity-infosecurity-riskmanagement-activity-7521285344420589568-elUm)
- [Free exploits and detection artifacts, published every Monday](https://www.linkedin.com/posts/patrickmgarrity_cybersecurity-infosecurity-threatintel-activity-7521621162817314817-Vm2I)
- [On camera: developing an exploit for PHP2Shell](https://www.linkedin.com/posts/patrickmgarrity_cybersecurity-infosecurity-threatintel-activity-7521943133778128896-wWKU)
- [Moderating a coordinated vulnerability disclosure panel](https://www.linkedin.com/posts/patrickmgarrity_cybersecurity-infosecurity-cvd-activity-7513627972415893505-Yofn)

## Brand relationships

- **VulnCheck** (employment)

## Partnerships

The reviewed posts show Garrity taking part in two collaborative formats: recorded technical discussions about specific exploit research, and live conference panels. The closest precedent for a vulnerability-exploitation webinar is the recorded PHP2Shell exploit discussion Garrity joined alongside VulnCheck's director of exploit development and a co-host, published to YouTube. No reviewed post sets out a sponsorship policy, rate card, deliverable list, or partnership inquiry route, so a vendor should treat these as observed practice rather than a packaged offer and confirm scope, recording rights, and promotion directly.

## Alternatives

- Eric Taylor: Choose Eric Taylor instead when the campaign needs a written, attacker-centric deep dive rather than a live technical conversation — a co-branded ransomware threat report, or a research-led session built around one crew. Both reviewed posts are long-form synthesis: one pulls Microsoft, Check Point, Group-IB, Huntress and Trend Micro reporting into a single profile of a ransomware operation, covering how an intrusion unfolds, six known-exploited CVEs to patch first, a MITRE ATT&CK mapping, IOCs and hunting guidance; the other reverses a sold ransomware sample and pairs the technical finding with seven fixes. If the vendor's asset is a gated report, or a session where the case study is a named crew rather than a single vulnerability, this material is closer to the deliverable than Patrick Garrity's shorter exploitation alerts.
- Omar Ahmed: Consider Omar Ahmed when the campaign is a single-vulnerability explainer with a built-in call to action. One reviewed post is a complete walkthrough of a Telegram Desktop flaw — severity and CVSS score, affected versions, the inter-process communication mechanism, the relevant CWE, the conditions required for the chain to work, the fix commit and release version, and a numbered list of actions for defenders — structured so a reader can act without leaving the post. A second covers an FBI disruption operation and moves from the headline numbers to what defenders are not given. For a sponsored one-flaw session or a detection-focused co-branded post, that teach-then-act shape travels well.
- Tab Dayani: Reach for Tab Dayani only if the brief itself moves, not the creator. Both reviewed posts are climate and sustainability work from 2022 — an Accenture COP27 event series covering net-zero finance, Scope 3 supply chains and decarbonisation, and a GEP thought-leadership piece on the ocean freight sector's path to lower emissions. The brief that fits is a sustainability or supply-chain audience, not a vulnerability webinar.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/