# Ray Kelly

Ray Kelly works on cybersecurity research, with a focus on AI-assisted penetration testing and application security. Kelly describes using black-box fingerprinting to help AI testing agents target applications more efficiently, and argues that people with security expertise must review AI-generated code before it is shipped.

- Profile: https://b2binfluencer.marketing/creators/ray-kelly/
- LinkedIn: https://www.linkedin.com/in/ray-kelly-0b8647
- LinkedIn followers: 3,020
- Topics: artificial-intelligence, application-security
- Based on 11 dated posts, latest 2026-10-09

## Summary

Ray Kelly is useful for cybersecurity thought leadership on AI-assisted penetration testing and secure AI code review.

- Best for: Cybersecurity vendors wanting thought leadership on AI-assisted pentesting and secure AI code review.
- Not for: Consumer identity-theft protection brands wanting short-form video on personal password hygiene.
- Check first: Confirm commercial and employer checks, plus audience demographics and comparable content results.

### Takeaways

- Black-box fingerprinting can guide AI pentesting agents to prioritize SQL injection tests.
- AI-generated code still needs review by people who recognize security flaws.
- Kelly promotes XBOW’s agentic pentest platform and does cybersecurity mentoring for students.

## Main ideas

- **AI testing agents work better when you tell them what they are attacking**: Ray Kelly argues that an unconstrained AI pentesting agent might eventually find something deep and obscure, but the time required does not scale for enterprises assessing hundreds or thousands of applications. Their alternative is to first provide fingerprinting context from a purely black-box, dynamic perspective — identifying the technology stack and inferring likely backends — so the agent prioritises plausible attack paths and produces less noise and fewer false positives. They frame this as the difference between unguided AI and AI guided by real environmental evidence.
- **AI output still needs expert review, and in security the reviewer is often the attacker**: Ray Kelly's central accountability argument is that the problem with AI is not that models err, but that their output ships without review by people who understand the domain and can distinguish what is wrong from what merely looks right. In application security, teams do not get the second chance the legal system gave one firm: malicious actors will review unvetted AI-generated code for vulnerabilities, with breaches, financial loss, and fines as the potential cost. Kelly also criticises companies that cut experienced security teams in the name of AI efficiency, arguing that doing so does not eliminate the need for review — it hands that role to attackers.
- **Kelly promotes a named commercial agentic pentest platform**: Alongside their research, Ray Kelly publicly promotes a specific vendor's product, announcing new detection capability and an on-demand pentest offering described as delivering human-level offensive testing in hours with full exploit validation, complete coverage, and actionable results. They offer a discount code to anyone who reaches out. The product claims are vendor claims, not independently demonstrated findings; buyers should ask whether the promotion is paid or sponsored.
- **Community and early-career work is a standing priority**: Beyond research and product posts, Ray Kelly invests in hands-on student learning and conference community. Their mentoring and conference posts are less technical than their pentesting and review arguments, but recur as a priority and show them supporting early-career cybersecurity education.

## Work to read

- [How black-box fingerprinting guides an AI pentesting agent](https://www.linkedin.com/posts/ray-kelly-0b8647_ai-cybersecurity-activity-7450880787043971072-jk6B)
- [Why AI-generated code needs expert review before it ships](https://www.linkedin.com/posts/ray-kelly-0b8647_sullivan-cromwell-apologizes-to-judge-for-activity-7454544761157414912-k8uD)
- [XBOW’s ReactToShell detection and on-demand pentest offer](https://www.linkedin.com/posts/ray-kelly-0b8647_xbow-react2shell-cve-2025-55182-a-wake-up-activity-7403794536872845312-bNXN)
- [Black Hat meet-up and AI security conversations](https://www.linkedin.com/posts/ray-kelly-0b8647_blackhat-cybersecurity-ai-activity-7488612244843499522-rgDD)
- [Mentoring at the AIS GSU × Microsoft cybersecurity hackathon](https://www.linkedin.com/posts/ray-kelly-0b8647_cybersecurity-hola-activity-7514351637575041024-xvHq)

## Brand relationships

- **Microsoft** (employment)
- **XBOW** (disclosed_partnership)

## Partnerships

No published sponsorship policy, rate card, media kit, or partnership inquiry route appears in the posts here. The posts show a practitioner in a cybersecurity research role at Microsoft who amplifies a specific AI security vendor's product and takes part in community mentoring. Two things shape a buyer's plan. First, their Microsoft research role informs most of their commentary on AI-assisted pentesting and code review. Before pursuing a commercial arrangement with another security vendor, ask what Kelly's employer allows them to do publicly. Second, the only commercial integration described is a product post for XBOW, in which Kelly describes the vendor's agentic testing platform, announces an on-demand pentest offering, and offers to pass on a discount code to anyone who contacts them. The post demonstrates a promotion-and-referral format but states no fee, sponsorship, or contract terms; ask Kelly to confirm those terms.

## Alternatives

- Brendan Short: Choose Brendan Short when the campaign's central problem is the enterprise sales motion, not the technical AI security method. For thought leadership supporting a webinar or article series on carrying an AI security product through a multi-person buying committee, Short's posts on micro-pitches, sequential stakeholder pitches, and assets for each buyer role are a closer match. Their XBOW example also offers an AI-native revenue-org case: moving BDRs under RevOps and treating them as agent managers who QA AI outputs. That is useful when the audience is sales leaders, RevOps, GTM engineering, or founders who must get an AI security product through legal, security, RevOps, and front-line manager reviews.
- Ido Geffen: Choose Ido Geffen when the campaign calls for a CISO-level or platform-level argument about AI versus AI in security, rather than a practitioner workshop. Geffen's posts argue that more CISOs alone cannot fix the bug-pocalypse: AI writes more code faster with more vulnerabilities, and AI is getting better at finding and exploiting them. Geffen's Novee Security position is that defenders need the same step-change in capability, with AI agents that pentest continuously, at machine speed, and with human-quality reasoning. The Black Hat talk post adds a strong narrative about AI agents collaborating through shared memory, chaining exploits, and finding zero-days. That fits a vendor webinar or article series aimed at security leaders seeking a market thesis and urgency, especially a vendor selling continuous agentic pentesting or defensive AI.
- Okan YILDIZ: Choose Okan YILDIZ when the campaign targets SOC analysts, blue teams, detection engineers, or buyers who need to turn pentest results into action. YILDIZ's Microsoft Sentinel home lab post walks from an empty Azure environment through logs, KQL, detection, alert, incident, investigation, response, and automation. The pentest report field manual post argues that a report should show how compromise actually happens: scope, attack path, evidence, root cause, remediation, retest, and the debrief question of which tester actions security controls should have detected. That fits a vendor selling detection engineering, SIEM, managed detection, or purple-team services, or a campaign connecting offensive testing to defensive improvement.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/