Ray Kelly works on cybersecurity research, with a focus on AI-assisted penetration testing and application security. Kelly describes using black-box fingerprinting to help AI testing agents target applications more efficiently, and argues that people with security expertise must review AI-generated code before it is shipped.
Ray Kelly is useful for cybersecurity thought leadership on AI-assisted penetration testing and secure AI code review.
Best for
Cybersecurity vendors wanting thought leadership on AI-assisted pentesting and secure AI code review.
Not for
Consumer identity-theft protection brands wanting short-form video on personal password hygiene.
Key takeaways
Black-box fingerprinting can guide AI pentesting agents to prioritize SQL injection tests.
AI-generated code still needs review by people who recognize security flaws.
Kelly promotes XBOW’s agentic pentest platform and does cybersecurity mentoring for students.
Check first: Confirm commercial and employer checks, plus audience demographics and comparable content results.
Main ideas
AI testing agents work better when you tell them what they are attacking · AI output still needs expert review, and in security the reviewer is often the attacker · Kelly promotes a named commercial agentic pentest platform
Ray Kelly writes about cybersecurity, especially how AI can assist penetration testing without replacing security expertise.
In a detailed example, they describe fingerprinting an application from its live behavior, then using those clues to guide an AI agent toward more plausible SQL-injection tests.
Their other posts make the complementary point: AI-generated code still needs review by people who can recognize security flaws.
Together, these posts show how to make automated testing more targeted while keeping people accountable for what gets shipped.
Other posts show a broader mix of activity, including a product announcement, a Black Hat invitation, and cybersecurity mentoring for students.
Kelly makes AI security easier to evaluate by connecting a technical method to its practical tradeoffs.
The fingerprinting example shows how clues such as Apache and PHP can help an agent prioritize tests, adapt when an initial hypothesis fails, and avoid wasted probing.
The code-review post adds an important counterweight: faster AI output is not safer unless qualified people check it before release.
Together, the posts show how to focus automation without handing off accountability.
Other posts cover XBOW’s pentesting offer, a conference, and student mentoring.
They show commercial and community contexts but offer less depth than the fingerprinting example.
Across the posts, Ray Kelly argues that AI is useful but not trustworthy on its own: it needs grounding before it acts and expert human review after it produces something.
Read more
In penetration testing, they give an AI agent black-box fingerprinting context up front so it targets likely weaknesses instead of firing payloads blindly.
In application security, their priority is accountability: AI-generated code pushed without internal review still gets reviewed, just by attackers.
Kelly also promotes an agentic pentest platform commercially and invests time in community and early-career mentoring.
AI testing agents work better when you tell them what they are attacking
Ray Kelly argues that an unconstrained AI pentesting agent might eventually find something deep and obscure, but the time required does not scale for enterprises assessing hundreds or thousands of applications.
Read more
Their alternative is to first provide fingerprinting context from a purely black-box, dynamic perspective — identifying the technology stack and inferring likely backends — so the agent prioritises plausible attack paths and produces less noise and fewer false positives. They frame this as the difference between unguided AI and AI guided by real environmental evidence.
The agent was tasked with finding SQL injection.
Rather than fire random payloads blindly, it received AI-generated fingerprinting context, identified Apache and PHP, inferred likely database backends, and prioritised the most plausible SQL injection strategies.
When its first hypothesis failed, it adapted to the live response and pivoted to a probe that exposed a MySQL-specific error, confirming the issue with far less noise.
AI output still needs expert review, and in security the reviewer is often the attacker
Ray Kelly's central accountability argument is that the problem with AI is not that models err, but that their output ships without review by people who understand the domain and can distinguish what is wrong from what merely looks right.
Read more
In application security, teams do not get the second chance the legal system gave one firm: malicious actors will review unvetted AI-generated code for vulnerabilities, with breaches, financial loss, and fines as the potential cost. Kelly also criticises companies that cut experienced security teams in the name of AI efficiency, arguing that doing so does not eliminate the need for review — it hands that role to attackers.
A law firm's court filing contained AI-generated fake citations and incorrect references. Kelly notes that opposing counsel and the court caught the errors after filing, calling it an embarrassing and potentially costly failure that should have been caught internally.
Kelly promotes a named commercial agentic pentest platform
Alongside their research, Ray Kelly publicly promotes a specific vendor's product, announcing new detection capability and an on-demand pentest offering described as delivering human-level offensive testing in hours with full exploit validation, complete coverage, and actionable results.
Read more
They offer a discount code to anyone who reaches out. The product claims are vendor claims, not independently demonstrated findings; buyers should ask whether the promotion is paid or sponsored.
Kelly announced that XBOW had added React2Shell zero-day detection to its agentic AI testing platform and introduced XBOW Lightspeed, then offered readers who made contact a discount code for the assessment.
This is the most transactional post, showing a practical, vendor-facing side alongside the research and accountability arguments in the others.
Community and early-career work is a standing priority
Beyond research and product posts, Ray Kelly invests in hands-on student learning and conference community.
Read more
Their mentoring and conference posts are less technical than their pentesting and review arguments, but recur as a priority and show them supporting early-career cybersecurity education.
Kelly mentored the cybersecurity track at the AIS GSU × Microsoft Mini Hackathon, thanking HOLA Atlanta, Microsoft, and the Association for Information Systems at Georgia State University. They also said they would be at Black Hat the following week and invited people to connect, talk about AI and security, or compare notes on how much grayer they had gotten since the early Black Hat days.
Start here: Ray Kelly offers a concrete method, a step-by-step SQL injection example, and a clear reason fingerprinting can reduce wasted effort and false positives.
Ray Kelly describes starting a new research role at Microsoft and weighing speed against accuracy in AI-driven pentesting.
An unconstrained agent might eventually uncover something deep and obscure, but that takes too much time for enterprises assessing hundreds or thousands of applications.
Their alternative is to provide fingerprinting context from a purely black-box, dynamic perspective, so the AI understands its target up front.
In the example, the agent was tasked with finding SQL injection.
Rather than firing random payloads blindly, it received AI-generated fingerprinting context, identified Apache and PHP, inferred likely database backends, and prioritized the most plausible SQL injection strategies.
When its first hypothesis failed, it adapted to the live response and pivoted to a probe that exposed a MySQL-specific error, confirming the issue with less noise.
Kelly calls this the difference between unguided AI and guided AI grounded in real environmental evidence.
For brands planning a campaign
An article or webinar on AI-assisted pentesting can build a segment around “fingerprint first, payload second.” The SQL injection walkthrough offers a practical demo or case study for vendor thought leadership, supporting a message about guided agents over autonomous scanning.
Start here for Ray Kelly’s accountability argument and its connection between a familiar AI hallucination story and application security consequences.
Ray Kelly uses a legal matter—a court filing with AI-generated fake citations and incorrect references—to argue that the key failure was not that AI made mistakes, but that no one properly reviewed the output before submission.
AI is fast and useful, they note, but still needs review by people who understand the domain and can spot what is wrong, not just what looks right.
In the legal case, opposing counsel and the court reviewed the filing after the fact.
In software development and application security, Kelly argues, there are no second chances: malicious actors will review unvetted AI-generated code for vulnerabilities, with costs that can include breaches, financial loss, and fines.
They also criticize companies that reduce experienced security teams in the name of AI efficiency, arguing that this does not eliminate the need for review—it hands that role to attackers.
For brands planning a campaign
Secure AI code review content can open with the legal hallucination as a hook, then pivot to application security. The “reviewed by attackers” line is a strong framing for an article or webinar, while the distinction between internal review and review after the fact supports a practical checklist for review ownership.
What commercial AI pentesting product appears in this material?
Read more
Start here for current product positioning around agentic testing and on-demand pentests.
This promotional post announces that XBOW has added ReactToShell zero-day detection to its agentic AI testing platform and introduced XBOW Lightspeed.
Kelly describes Lightspeed as an on-demand pentest that delivers human-level offensive testing in hours, with full exploit validation, complete coverage, and actionable results.
They also offer a discount code for the assessment.
For brands planning a campaign
A vendor producing thought leadership should treat this as product-claim context, not an independent case study. The post offers angles on how agentic testing is packaged, what “human-level” and “full exploit validation” mean, and how fingerprinting or review accountability could help interrogate those claims.
Where can readers encounter Ray Kelly in person or in the security community?
Read more
Start here for conference context and an informal sense of their connection to Black Hat culture.
Ray Kelly says they will be at Black Hat the next week and invites people to connect, talk about AI and security, or compare notes on how much grayer they have gotten since the early Black Hat days.
For brands planning a campaign
An event-based campaign could use Black Hat as a timely hook for an interview, live recording, or meetup. The “early Black Hat days” line adds a light personal-history angle.
What does Ray Kelly do beyond research and product posts?
Read more
Start here to see their community and early-career education role, relevant to readers considering a mentoring or campus-facing collaboration.
Ray Kelly says they are excited to serve as a mentor for the cybersecurity track at the AIS GSU × Microsoft Mini Hackathon and thanks HOLA Atlanta, Microsoft, and the Association for Information Systems at Georgia State University for creating a hands-on learning and mentorship opportunity for students.
For brands planning a campaign
A cybersecurity vendor could pair a technical webinar with a student hackathon or mentorship component.
The post shows Ray Kelly lending their name to hands-on student learning, supporting campus, diversity-in-tech, or early-career pipeline campaigns.
Ask for details about the curriculum and Kelly’s session.
Kelly describes supplying an AI testing agent with black-box, dynamic fingerprinting context before it attacks: identifying Apache and PHP, inferring likely database backends, then prioritizing the most plausible SQL injection strategies instead of firing payloads blindly.
Read more
When the first hypothesis failed, the agent adapted to the live response and pivoted to a probe that exposed a MySQL-specific error. Kelly frames this as the difference between unguided and guided AI: grounding the model in real environmental evidence keeps it focused and produces less noise and fewer false positives across hundreds or thousands of enterprise applications.
AI-generated fingerprinting context is given to the agent up front; it tests each hypothesis against live responses and pivots when a probe fails rather than continuing blind.
For brands planning a campaign
The corpus’s strongest technical anchor for a vendor selling AI-assisted penetration testing or application security. A webinar or article series could centre on a guided-versus-unguided demonstration, with Kelly walking through the SQL injection example and the enterprise-scale argument as the hook.
Human review is the control that AI does not remove
Using a law firm's filing that contained AI-generated fake citations, Kelly argues that the notable failure was not that the model erred, but that people who understood the domain submitted its output without review.
Read more
In application security, teams do not get the same second chance: AI-generated code pushed without internal review will still be reviewed by attackers looking for vulnerabilities, and the cost lands as breaches, financial loss, and fines. Kelly also criticises companies that cut experienced security teams in the name of AI efficiency, arguing that this does not remove the need for review — it hands the reviewer role to attackers.
For brands planning a campaign
Good material for thought leadership on secure AI code review and human-in-the-loop development workflows.
A vendor could pair Kelly with a customer story about review gates and accountability.
Their line that unreviewed code will be reviewed anyway — just by malicious actors — is a usable headline quote.
Kelly announced that XBOW added React2Shell zero-day detection to its agentic AI testing platform and introduced XBOW Lightspeed, an on-demand pentest offering they describe as delivering human-level offensive testing in hours with full exploit validation, complete coverage, and actionable results.
Read more
They offered to give a discount code for the assessment to anyone who reaches out.
The post does not state whether the promotion is paid or sponsored. Ask Kelly to confirm the relationship terms before planning a campaign.
For brands planning a campaign
Kelly publicly promotes a named commercial platform in this category, making a conflict check essential before a competing vendor plans a campaign.
For XBOW or a similar buyer, they are a plausible amplifier with a demonstrated audience-facing offer mechanic.
Other buyers should confirm exclusivity and existing commitments first.
Kelly mentored the cybersecurity track at the AIS GSU × Microsoft Mini Hackathon, thanking HOLA Atlanta, Microsoft, and the Association for Information Systems at Georgia State University for connecting students with technology professionals through hands-on learning.
Read more
In a separate post, they said they would be at Black Hat and invited people to connect, talk about AI and security, or compare notes on how long they have been attending.
For brands planning a campaign
Supports event activation, university and hackathon sponsorship, and recruiting-adjacent campaigns, with a low-friction way to open a conversation around conference cycles such as Black Hat. These posts carry less technical depth, making them better suited to awareness and talent-pipeline messaging than product-led content.
Ray Kelly's posts mention two brand relationships.
Read more
They state that they hold a research role at Microsoft, where their work covers balancing speed and accuracy in AI-driven penetration testing.
In a post about XBOW's agentic AI testing platform and XBOW Lightspeed, they write in the first person about the company and offer a discount code for an assessment.
Ask them to clarify their role with XBOW.
The posts contain no investment, affiliate, or sponsorship disclosures.
Microsoft
Employment
Ray Kelly states that they are in a new research role at Microsoft, focused on balancing speed and accuracy in AI-driven pentesting, including work on black-box fingerprinting to help AI testing agents target applications more efficiently.
Read more
They give a worked example of an agent finding a SQL injection using AI-generated fingerprinting context and contrast this guided approach with letting a model run unconstrained. They also mention serving as a mentor for the cybersecurity track at a Microsoft-partnered hackathon.
Ray Kelly announces that XBOW has added ReactToShell zero-day detection to its agentic AI testing platform and introduced XBOW Lightspeed, an on-demand pentest offering.
Read more
Writing in the first person about the company's releases and offering to supply a discount code for the assessment, they show a clear association with XBOW. Ask them to clarify their role with the company.
Start with Kelly’s two most substantive posts: a walkthrough of giving an AI penetration-testing agent black-box fingerprinting context before it attacks, and an argument that people who understand the domain must review AI-generated output because, in application security, the next reviewer is an attacker.
Read more
A product announcement for an agentic pentest platform shows the commercial side of the same field, including a discount offer for anyone who makes contact.
The mentoring and Black Hat posts are less technically detailed but show where they spend time beyond the work itself.
For a method to try, start with the fingerprinting post; for a look at how AI could change security staffing, start with the review-accountability post.
Ido Geffen writes about the same shift as Ray Kelly: AI finding and exploiting vulnerabilities faster than human teams can review code, and the case for defenders to match that change in capability rather than add headcount.
Read more
Geffen’s Black Hat write-up on AI agents collaborating through a shared memory system to chain exploits sits alongside Kelly’s fingerprint-first agent testing as another angle on what autonomous security tooling can do.
Geffen makes the industry case for continuous AI pentesting, pointing readers to news coverage and conference talks.
Kelly shows what happens in a single test: how fingerprinting context narrowed an SQL injection run and how the agent pivoted when its first probe failed.
They also give more attention to human accountability for reviewing AI output, while Geffen focuses on defenders’ need for machine-speed tools.
Okan YILDIZ teaches cybersecurity by walking readers through the work in numbered steps and checklists: building a Microsoft Sentinel home lab from an empty cloud environment through detection, alerting, investigation and automation, and a field manual on what a pentest report should show.
Read more
That focus on handing over a usable method rather than an opinion also underpins Kelly’s account of grounding an AI agent in real environmental evidence before it probes.
YILDIZ teaches defenders and analysts hands-on blue-team and reporting practices, linking to downloadable guides and making heavy use of hashtags and calls to repost.
Kelly’s teaching is narrower and more focused on current technology: how to steer an AI testing agent, and why review discipline still determines whether AI-assisted work is safe to ship.
YILDIZ offers practical training; Kelly offers a method and a critique of how organisations use AI.
Brendan Short analyses how AI-native companies operate, in the same close-reading style Kelly brings to security tooling.
Read more
Short’s post on XBOW moving its BDR team under revenue operations and describing the role as agent managers covers ground close to Kelly’s own XBOW post: both examine what changes when an agent does the first pass of the work and a person supervises it.
Short writes for revenue and go-to-market readers, using examples about pitches to buying committees and sales assets.
Kelly writes for security readers, with examples about attack paths and code review, and discloses a sponsorship relationship where one exists.
Their one clear commercial post does not say whether the promotion is paid; ask for that detail before evaluating it.
They cover different audiences and subjects, but both examine how far agent output can be trusted.
For a cybersecurity vendor planning thought leadership on AI-assisted pentesting and secure AI code review, Ray Kelly is a topically aligned LinkedIn voice with modest reach.
Read more
They had 3,020 LinkedIn followers on October 23, 2026.
Their posts focus on AI security testing, including black-box fingerprinting to guide pentesting agents, application-security review of AI-generated code, XBOW’s agentic testing platform, Black Hat, and a student hackathon mentorship.
The topics suggest an audience interested in security engineering and AI risk.
Before placing a webinar or article series, ask for recent LinkedIn follower demographics and results from comparable AI-security or pentest content, such as impressions, engagement, registrations, or attendee roles, to assess whether the audience includes the security practitioners and buyers the campaign needs.
No published sponsorship policy, rate card, media kit, or partnership inquiry route appears in the posts here.
Read more
The posts show a practitioner in a cybersecurity research role at Microsoft who amplifies a specific AI security vendor's product and takes part in community mentoring.
Two things shape a buyer's plan.
First, their Microsoft research role informs most of their commentary on AI-assisted pentesting and code review.
Before pursuing a commercial arrangement with another security vendor, ask what Kelly's employer allows them to do publicly.
Second, the only commercial integration described is a product post for XBOW, in which Kelly describes the vendor's agentic testing platform, announces an on-demand pentest offering, and offers to pass on a discount code to anyone who contacts them.
The post demonstrates a promotion-and-referral format but states no fee, sponsorship, or contract terms; ask Kelly to confirm those terms.
Vendor product amplification with a personal referral route
Buyer requirement
The documented example is a post promoting XBOW's agentic AI testing platform, its React2Shell zero-day detection, and a new on-demand pentest offering.
It ends with Kelly offering a discount code to anyone who reaches out.
A vendor seeking a similar post needs to supply current product details, a concrete offer (an assessment, a trial, or a discount), and a defined way for Kelly to direct interested readers.
The post states no fee or sponsorship terms; ask Kelly to confirm payment, exclusivity, and disclosure requirements.
Community mentorship and co-hosted student programs
Buyer requirement
Kelly served as a mentor for the cybersecurity track at a hackathon run by AIS GSU and Microsoft, with HOLA Atlanta also credited.
A vendor pursuing this format needs a partner organization that already runs a student or early-career program, a commitment of the mentor's time, and hands-on technical content rather than a speaking slot alone.
The post does not establish paid sponsorship or brand placement; ask the partner how sponsorship would be funded and displayed.
A cybersecurity vendor wants thought-leadership content on AI-assisted penetration testing and secure AI code review, including a webinar or article series that draws on Ray Kelly's fingerprinting method and review-accountability argument.
Read more
Verdict: strong fit on substance, conditional on commercial and employer checks.
Kelly's posts give the buyer original, specific material rather than general commentary.
The fingerprinting post describes a working method: supply an AI pentesting agent with black-box, dynamic fingerprinting context before it attacks; identify Apache and PHP; infer likely database backends; prioritize SQL injection strategies instead of firing payloads blindly; and, when the first hypothesis fails, adapt from the live response and pivot to a probe that exposes a MySQL-specific error.
That is a usable webinar or article centrepiece because it shows guided AI versus unguided AI and ties the method to the enterprise-scale problem of hundreds or thousands of applications to assess.
The review-accountability post gives a second strong theme.
They use a law firm filing with AI-generated fake citations to argue that the real failure was not that AI made mistakes but that the output was not reviewed by people who understood the domain.
In application security, they say unreviewed AI-generated code will still be reviewed, just by malicious actors, with costs showing up in breaches, financial loss, and fines.
That line is a strong headline quote for secure AI code review content and supports a practical discussion of review ownership and human-in-the-loop development.
The constraints are material.
Kelly has 3,020 LinkedIn followers, but the posts do not identify follower job titles, seniority, industries, geography, or decision-making authority.
There is no post-performance data, webinar registration history, or comparable content-results record.
Their research role at Microsoft is the context for most of the AI pentesting and code review commentary, so a vendor should confirm what they are permitted to do publicly for another security vendor.
The only documented commercial integration is the XBOW post, which promotes XBOW's agentic testing platform and an on-demand pentest offering and includes an offer to pass on a discount code.
The post does not state a fee, sponsorship, or exclusivity term; the buyer should confirm commercial terms and check for competing commitments.
The best format is a technical webinar or article series aimed at application security and security engineering audiences, not a broad awareness campaign.
When to choose a specialist
A consumer identity-theft protection brand wants a high-reach short-form video series about personal password hygiene, aimed at non-technical households and mainstream US adults.
Read more
Verdict: poor fit based on the posts here.
All five posts sit in a technical, business-to-business security context: AI-assisted penetration testing, application security review of AI-generated code, an agentic pentest platform announcement, a Black Hat meet-up, and mentoring at a university-linked cybersecurity hackathon.
None address personal password hygiene, household identity theft, consumer scams, or non-technical security habits.
The posts also show no short-form video, consumer-facing explainer, or mainstream audience.
The only audience measurement is 3,020 LinkedIn followers, with no demographic, survey, or engagement data showing reach among non-technical consumers.
They could be a credible technical expert on authentication and password security in an enterprise setting, but this brief calls for consumer reach and consumer-friendly formats.
Ask for audience and format evidence from comparable consumer work before reconsidering; technical credibility alone does not establish a match.
A worked campaign example
A worked campaign angle for the strong-fit brief: a three-part article and webinar series called “Guided agents and review gates: making AI security work at enterprise scale.”
The buyer is a cybersecurity vendor selling AI-assisted testing or secure code review.
The audience is application security leads, security engineers, and engineering leaders evaluating AI tools.
Part one: “Fingerprint first, payload second.”
Use Ray Kelly's SQL injection example as the spine.
The agent receives black-box fingerprinting context, identifies Apache and PHP, infers likely database backends, prioritizes SQL injection strategies, and when the first hypothesis fails, pivots from the live response to a MySQL-specific error.
Frame the contrast as unguided agents wandering through low-probability paths versus guided agents grounded in environmental evidence.
The practical takeaway for the audience is a pre-assessment fingerprinting step that reduces wasted effort and noise at enterprise scale.
Part two: “Review is the control AI does not remove.”
Open with the law firm filing that contained AI-generated fake citations.
Ray Kelly's argument is that the important failure was submission without review by people who understand the domain.
Move to application security: unreviewed AI-generated code will still be reviewed, but by attackers looking for vulnerabilities, with costs in breaches, financial loss, and fines.
Use Ray Kelly's line that reducing experienced security teams in the name of AI efficiency does not eliminate review; it hands the reviewer role to attackers.
The practical takeaway is a review-gate model: who validates AI-generated code, what evidence they check, and how the team stands behind what ships.
Part three: “What to ask an agentic pentest vendor.”
Use the XBOW post as product-claim context, not as an independent case study.
The post says XBOW added ReactToShell zero-day detection to its agentic testing platform and introduced XBOW Lightspeed, an on-demand pentest described as delivering human-level offensive testing in hours with full exploit validation, complete coverage, and actionable results.
Turn those phrases into buyer questions: What counts as human-level?
How is coverage measured?
What does exploit validation include?
This part can be a moderated customer panel, with the vendor's own product claims clearly separated from Ray Kelly's method discussion.
Supporting asset: a short review-gate checklist that a buyer can use after the webinar: does the AI agent receive target context before testing; who owns review of AI-generated code; what happens when the first hypothesis fails; and what evidence is required before shipping. The series call to action can be a technical workshop or assessment, not a generic newsletter sign-up.
Before booking, the buyer should confirm three things: Ray Kelly's employer permissions for public work with another security vendor; any exclusivity or conflicting commitments connected to the XBOW promotion; and audience performance data from comparable AI-security content, such as impressions, registrations, attendee roles, and engagement. Those checks protect the campaign from an avoidable conflict and from over-reading a 3,020-follower LinkedIn snapshot.
Choose Brendan Short when the campaign's central problem is the enterprise sales motion, not the technical AI security method.
Read more
For thought leadership supporting a webinar or article series on carrying an AI security product through a multi-person buying committee, Short's posts on micro-pitches, sequential stakeholder pitches, and assets for each buyer role are a closer match.
Their XBOW example also offers an AI-native revenue-org case: moving BDRs under RevOps and treating them as agent managers who QA AI outputs.
That is useful when the audience is sales leaders, RevOps, GTM engineering, or founders who must get an AI security product through legal, security, RevOps, and front-line manager reviews.
Short does not cover the hands-on pentesting method or secure-code review argument Kelly's campaign needs.
The campaign would get buyer-committee messaging and sales-process content, but not fingerprinting an AI agent, SQL injection prioritisation, or the review-accountability chain from AI-generated code to breaches and fines.
A vendor seeking technical credibility with application security leads should treat Short as a distribution or sales-enablement alternative, not a substitute for the technical centrepiece.
Short's posts also include a newsletter sponsorship disclosure and a commercial product launch, so check for sponsorship conflicts.
Choose Ido Geffen when the campaign calls for a CISO-level or platform-level argument about AI versus AI in security, rather than a practitioner workshop.
Read more
Geffen's posts argue that more CISOs alone cannot fix the bug-pocalypse: AI writes more code faster with more vulnerabilities, and AI is getting better at finding and exploiting them.
Geffen's Novee Security position is that defenders need the same step-change in capability, with AI agents that pentest continuously, at machine speed, and with human-quality reasoning.
The Black Hat talk post adds a strong narrative about AI agents collaborating through shared memory, chaining exploits, and finding zero-days.
That fits a vendor webinar or article series aimed at security leaders seeking a market thesis and urgency, especially a vendor selling continuous agentic pentesting or defensive AI.
Geffen's posts focus less on a repeatable technical method a buyer can copy.
They offer a platform thesis and a Novee product position, so a series about how to fingerprint and guide an agent would shift toward why defenders need autonomous security systems.
The tradeoff is practitioner specificity for executive urgency.
There is also a direct commercial risk: Geffen is associated with Novee Security, an AI pentesting vendor, so a competing security vendor should treat this as a potential conflict, not a neutral expert booking.
Choose Okan YILDIZ when the campaign targets SOC analysts, blue teams, detection engineers, or buyers who need to turn pentest results into action.
Read more
YILDIZ's Microsoft Sentinel home lab post walks from an empty Azure environment through logs, KQL, detection, alert, incident, investigation, response, and automation.
The pentest report field manual post argues that a report should show how compromise actually happens: scope, attack path, evidence, root cause, remediation, retest, and the debrief question of which tester actions security controls should have detected.
That fits a vendor selling detection engineering, SIEM, managed detection, or purple-team services, or a campaign connecting offensive testing to defensive improvement.
YILDIZ does not focus on AI-assisted pentesting or review accountability for AI-generated code.
For content specifically about guided AI agents and secure AI code review, YILDIZ is a better fit for the downstream defensive workflow: what to do with findings and how to test whether fixes hold.
The tradeoff is AI-specific technical depth for operational SOC and report-quality depth.
YILDIZ's posts use educational frameworks and include calls to save, repost, and follow.
Ask for audience-performance data and confirmation of any independent endorsement before booking.
Ray Kelly's five LinkedIn posts cover AI-assisted penetration testing with black-box fingerprinting, accountability for reviewing AI-generated code, a product announcement for an agentic pentest platform, a Black Hat meet-up, and mentoring at a university-linked cybersecurity hackathon.
No publication dates appear in the posts here, so they are presented as a map of positions rather than a chronology, and no change in emphasis over time could be established.
Comparisons with similar creators rest on the full text of two posts each from three other accounts.
No talks, interviews, longer written work, video, transcripts, follower demographics, post-performance data, media kit, rate card, or sponsorship policy were available.
Those gaps leave audience composition, reach, and the commercial terms of the one promotional post unmeasured.
The posts here do not document a sponsorship format, which is not a claim about what Ray Kelly does or does not accept.
