# Patrick Keating

Patrick Keating shares cybersecurity advice for business leaders, with a focus on board-level cyber risk, security governance, and practical protection for small businesses and financial institutions. The posts connect technical threats—such as email fraud and ransomware—to business risks including financial loss, operational disruption, and customer trust.

- Profile: https://b2binfluencer.marketing/creators/patrick-keating/
- LinkedIn: https://www.linkedin.com/in/patrickwkeating
- Topics: artificial-intelligence, leadership, cybersecurity, ai-security, risk-management, identity-security
- Based on 13 dated posts, latest 2026-07-20

## Summary

Patrick Keating is most useful for translating cybersecurity threats into board-level business risk and practical leadership actions.

- Best for: A cybersecurity advisory firm planning thought leadership on board-level cyber risk and governance.
- Not for: Mass-market consumer launches or paid posts judged mainly on follower count and retail sign-ups.
- Check first: Confirm audience data for geography, age, gender, and documented follower roles and seniority.

### Takeaways

- Cloud hosting does not prevent account takeover; credentials, app permissions, and forwarding rules can expose payments.
- Faster payments shrink fraud-detection windows; link fraud and cybersecurity teams and plan joint response.
- CISO independence, executive access, and board engagement can shape whether security influences business decisions.

## Main ideas

- **Cyber risk is a board-level business decision**: Patrick Keating frames security events in terms boards care about: whether money moves incorrectly and customer trust holds. The business outcome matters more than the technical root cause, so leadership should own the response. In a Microsoft 365 post, they trace a chain from email takeover to payment fraud, reputational damage and executive distraction. Email is now a financial system, they argue, because invoices, ACH changes, vendor onboarding and payroll approvals move through it. In a ransomware post, they call cyber risk a business risk, not an IT checkbox, and recommend elevating patch management to a board-level KPI.
- **The CISO’s reporting line shapes security outcomes**: Patrick Keating summarizes peer-reviewed research on CISO reporting and argues that impact depends less on title than on structural position. Three patterns recur: independence from IT when the CISO does not report to the CIO; direct access to the CEO or top management team, making security an enterprise risk decision; and regular CISO-to-board interaction for faster incident response and governance alignment. They connect these findings to Keysec Advisors’ work on fractional CISO models, governance restructuring and board-level cyber risk reporting.
- **Cloud-hosted is not risk-free, and MFA is not a strategy**: Patrick Keating challenges the assumption that Microsoft 365 removes email risk. In Microsoft 365 environments, attackers do not need a server exploit; they can use compromised credentials, malicious OAuth app consent, MFA fatigue and session hijacking, or hidden inbox rules and forwarding. The business impact stays the same, but the route differs. “We have MFA” is not a strategy, they conclude; resilience matters more than assumptions.
- **Faster payments require merging fraud and cyber defenses**: Patrick Keating examines how Zelle, Cash App, PayPal and FedNow compress settlement times and shrink fraud-detection windows. Customers benefit, while banks face greater vulnerability and nation-states and organized crime exploit the platforms through AI-driven fraud, SIM swaps and device takeovers. For boards and risk committees, they recommend aligning fraud prevention with cybersecurity, applying cooling-off periods for profile changes and holds on high-value transactions, using risk-based authentication and behavioral analytics, and building integrated fraud-cyber incident response plans. In a separate post on community banking, they say attackers keep exploiting the same basic weaknesses, and that culture, accountability and execution matter more than tools.
- **AI has lowered the barrier to entry and exposed a governance gap**: Patrick Keating highlights research analyzing more than 1,000 academic papers and says 100% of those studies confirm that nation-states and criminal actors are weaponizing AI. The barrier to entry has collapsed: criminal syndicates and smaller groups can now access open-source models and cloud platforms once reserved for sophisticated state-linked attackers. Beyond deepfakes, they list hyper-targeted phishing that bypasses MFA, adaptive malware, autonomous drone attacks and coordinated influence operations. They point to fragmented legal frameworks, difficult attribution and slow international cooperation, framing the challenge as one of governance and security architecture, not technology.
- **2026 planning should turn controls into operational resilience**: Several posts explicitly frame their advice as preparation for 2026. Patrick Keating urges SMB leaders to treat email as a Tier-0 business asset, elevate patch management to a board-level KPI, stress-test ransomware resilience with validated backups and isolated critical systems, define emergency authorization processes before an incident, and treat insider knowledge as a threat vector. Attackers are maturing their tactics and using trusted access and legacy infrastructure to disrupt operations, damage reputations and exert financial pressure. They frame these steps as preparation, not fear.
- **Recurring method: incident, consequence, short action list, executive question**: Across the posts, Patrick Keating follows a consistent structure: start with a current incident or study, translate it into a business consequence, give three or four prioritized actions, and close with a direct question to an executive reader. The approach keeps the focus on decisions leaders can make rather than technical detail. They call it Business-First Security and return to the idea that cyber risk is business risk.

## Work to read

- [Where should the CISO report?](https://www.linkedin.com/posts/patrickwkeating_cybersecurity-ciso-governance-activity-7422277370876686337-rc5H)
- [If you’re a CEO managing Microsoft 365, it’s crucial to differentiate between “cloud-hosted” and “risk-free”](https://www.linkedin.com/posts/patrickwkeating_threat-actor-dev-0322-exploiting-zoho-manageengine-activity-7416514425320349696-i_gI)
- [Instant Payments, Instant Risks](https://www.linkedin.com/posts/patrickwkeating_cybersecurity-riskmanagement-boardleadership-activity-7371946842126958592-fw-J)
- [Cybersecurity in banking: still the fundamentals, still the hardest part](https://www.linkedin.com/posts/patrickwkeating_cyber-risk-management-for-banks-insights-activity-7424810121446199296-xPK4)
- [The AI Arms Race is Here, And It’s Not What You Think](https://www.linkedin.com/posts/patrickwkeating_cybersecurity-artificialintelligence-threatintelligence-activity-7430250788490424321-acMJ)
- [Leadership in 2026 means recognizing that cyber risk is business risk — not just an IT checkbox](https://www.linkedin.com/posts/patrickwkeating_this-smartermail-vulnerability-allows-remote-activity-7413962543339048960-LZde)

## Brand relationships

- **Keysec Advisors** (disclosed_partnership)
- **Banking+** (mention)

## Partnerships

Across six LinkedIn posts dated September 2025 to February 2026, Patrick Keating writes in a professional advisory voice and closes several posts with invitations to connect: a “CEO-to-CEO conversation,” a direct message, or a booked call, framed around the advisory work of Keysec Advisors. These are invitations to discuss cybersecurity and risk, not disclosed sponsorship or paid-content arrangements. The posts contain no media kit, rate card, audience package, or labeled partner content. For a paid collaboration, ask directly whether sponsorship formats are available; the visible route is a direct message or introductory call.

## Alternatives

- Andy Elizaire, MIS, GCED, GEVA: Choose Andy Elizaire when the collaboration should lead with how AI is changing security operations, not only how boards should govern cyber risk. Elizaire's posts argue that AI is a force multiplier that will not replace analysts because it cannot judge business context, risk tolerance, or which server can be taken offline. One post adds that AI is making ransomware faster at reconnaissance and social engineering, so defenders need detection and response that keeps pace. The work is anchored to a named platform, Sophos, and to MDR and AI-assisted security operations; it also draws on a panel appearance and audience questions. Elizaire is a better choice if the advisory firm wants a practitioner-facing or vendor-adjacent piece about human-plus-AI security operations, threat detection, or managed detection and response, or a speaker who already frames AI adoption as a leadership question. It also suits a campaign that benefits from event, panel, and conference framing rather than a written governance framework.
- Salman Hussain: Choose Salman Hussain when the campaign needs a specific region, a specific consumer-technology controversy, or a compact list of verification actions. One post covers the rise in executive impersonation and CEO fraud across the Gulf, describing attackers who use AI, deepfake voice and video, social engineering, and public business information to imitate senior executives. It then lists five controls: verify financial requests through an independent channel, use dual approvals and segregation of duties, train staff on impersonation, assess executives' public exposure, and run business email compromise simulations. Another post reviews reports that Google Chrome quietly downloads a large on-device AI model, raising questions about consent, privacy, local AI processing, supply chain trust, and governance of AI features. Hussain is the better pick if the advisory firm wants Gulf or Middle East market relevance, executive-impersonation and deepfake fraud as the spine of the piece, or an AI privacy and transparency angle aimed at organizations concerned about what software installs on their devices. The posts are short, scannable, and easy to co-sign as a regional briefing or a top-five controls list.
- Reilyn Garton: Choose Reilyn Garton when the audience is security operations and detection teams rather than boards and executive committees. One post works through the CISA advisory on Volt Typhoon, where valid accounts and living-off-the-land techniques let an intruder persist without traditional malware. It asks operators whether they log and correlate lateral movement over SMB, WMI, and WinRM; alert on anomalous service-account use; baseline administrator behavior; and hunt credential access instead of payloads. Another argues that attackers are signing in rather than breaking in, citing session hijacking, OAuth abuse, MFA fatigue, and token replay, and calls for shorter token lifetimes, session revocation, and identity signals fused with endpoint and network data. Garton is the better fit for a technical detection-engineering or identity-security piece, a purple-team exercise, or a practitioner session where the deliverable is tradecraft questions and telemetry requirements. The posts are direct, assumption-challenging, and specific about defensive controls, which is useful when the buyer wants credibility with hands-on defenders.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/