# Reilyn Garton

Reilyn Garton shares practical cybersecurity analysis on threat detection, identity-based attacks, and exposure management, with an emphasis on connecting security operations to business risk.

- Profile: https://b2binfluencer.marketing/creators/reilyn-garton/
- LinkedIn: https://www.linkedin.com/in/reilyngarton
- Topics: artificial-intelligence, cybersecurity, identity-security, threat-intelligence
- Based on 11 dated posts, latest 2026-10-07

## Summary

Reilyn Garton is useful for practical cybersecurity analysis on identity attacks, exposure management, and checking AI security outputs.

- Best for: Cybersecurity vendors selling identity detection, behavioral detection, or exposure prioritization that want a practitioner voice.
- Not for: Mass-market AI-productivity vendors running reach campaigns built on unqualified AI optimism.
- Check first: Confirm audience demographics, engagement, and partnership terms before contacting them.

### Takeaways

- Attackers use valid accounts, session hijacking, and token replay instead of malware.
- Volt Typhoon post asks if teams log SMB, WMI, and WinRM lateral movement.
- Exposure data needs business context, exploitability, ownership, and remediation priorities.

## Main ideas

- **Look for behavior, not just malware**: Garton argues that malware-signature-based detection can miss intrusions using valid accounts and ordinary administrative tools. Teams should add behavioral detection and identity telemetry, and test defenses with both red and blue teams.
- **Treat identity activity as a likely attack path**: Garton’s point: attackers can enter through sign-ins and sessions, not just by deploying malware. Defenders should monitor identity signals and connect them to endpoint and network data, rather than treating multifactor authentication as a box to check.
- **Keep checking AI security recommendations**: Garton warns that confident automated explanations can create false assurance when teams stop verifying results. The risk is not just that a system can be wrong: relying on it unchecked can weaken a team’s habit of challenging its conclusions.
- **Prioritize exposures by context and ownership**: Garton argues that more security data does not automatically help teams decide what to fix. Exposure information needs business context, exploitability, ownership, and a path into remediation work.

## Work to read

- [Volt Typhoon and living-off-the-land detection](https://www.linkedin.com/posts/reilyngarton_threathunting-redteam-blueteam-activity-7427454945140015104-BTj-)
- [Identity attacks that begin with a sign-in](https://www.linkedin.com/posts/reilyngarton_cybersecurity-identitysecurity-threatintelligence-activity-7426691763681087488-lyU7)
- [The risk of trusting AI security outputs without checks](https://www.linkedin.com/posts/reilyngarton_cybersecurity-ai-securityoperations-activity-7461142818489655297-F0Ae)
- [Unified exposure management needs context and prioritization](https://www.linkedin.com/posts/reilyngarton_gartnersrm-cybersecurity-exposuremanagement-activity-7458226850486566912-Q1tu)
- [RSAC 2026: conversations at the event](https://www.linkedin.com/posts/reilyngarton_rsac2026-activity-7441857136906842112-NkSI)

## Brand relationships

- **Nucleus** (disclosed_partnership)
- **Gartner** (mention)
- **Mandiant** (mention)

## Partnerships

The posts document no partnership program, sponsor policy, media kit, rate card, or brand-collaboration inquiry route. The clearest commercial-context signal across the five posts is a May 2026 post in which Reilyn Garton says they will be at Gartner Security & Risk Management Summit 2026 with Nucleus and invites people to Booth #248. It establishes a vendor-facing appearance tied to exposure management, but does not specify a sponsorship format or terms. The other posts cover threat hunting, identity-based attacks, AI in security operations, and exposure management, with no sponsor mentions or disclosed brand work. Vendors considering a co-marketing or speaking collaboration should ask about available formats, terms, and the right contact; there is no published package or official inquiry channel.

## Alternatives

- Makarand Karanjalkar: A stronger choice when the vendor's pitch is behavioural threat intelligence rather than identity telemetry specifically, or when the campaign needs someone to argue about standards, data models and interoperability. The posted work is built on the Open Cybersecurity Alliance Indicators of Behaviour subproject under OASIS, using STIX 2.1 to represent attacker behaviour such as initial access, privilege escalation, credential access, lateral movement, persistence, command and control, and exfiltration in a machine-readable, vendor-neutral form. A second post sharpens the buyer decision, separating behaviour analytics, which answer 'is this unusual', from behavioural threat intelligence, which answers which attack stage an observation belongs to, what objective it represents and how it relates across domains. It names Defender, Falcon, Splunk, Exabeam, Darktrace and Chronicle as platforms that already claim the analytics label. For a vendor selling cross-domain correlation, XDR, SOC workflow or a detection data model, that framing gives a session or co-authored piece a real argument instead of a product tour.
- John Ellingson: A stronger choice when the vendor wants a keynote-level or executive-level argument about where cybersecurity is going, and the product can be framed as removing a structural problem rather than improving an existing control. The posts supply that thesis directly. One reads CrowdStrike's 2026 Global Threat Report and develops a ten-year extrapolation across three curves—attack volume up 89% year over year, breakout time down to 29 minutes, and 82% of intrusions using no malware—concluding that defenders cannot close the gap on the current architecture. The other argues that the industry has spent 40 years treating cybersecurity as a technology problem while 68–82% of breaches involve a human element, and that the right response is structural removal of humans from the authentication loop, no persistent credentials and no reliance on secrecy as a control. For a vendor selling credential elimination, identity architecture change or a category-defining platform, this is the closest match among the alternatives: the posts already make the case that better detection and more training are the wrong spending.
- Okan YILDIZ: A stronger choice when the vendor needs teaching rather than commentary, and the campaign asset is something the audience performs rather than reads. The posts show two concrete instructional products. One is a Zero-to-SOC home lab path for Microsoft Sentinel that moves from an empty Azure environment through a Log Analytics workspace, Sentinel enablement, Windows security log ingestion, KQL, a failed-login hunt on Event ID 4625, an analytics rule, a triggered alert, incident investigation, and automation rules and playbooks. Its explicit point is that the skill lies in explaining why an alert matters and what happens next. The other is an 18-page pentest field manual that turns findings into an attack path—scope, attack path, evidence, root cause, remediation, retest—and closes by asking which tester actions the SOC should have detected, converting a pentest debrief into detection engineering. For a vendor selling SIEM, detection engineering, purple-team validation or a pentest-adjacent product, this alternative can carry a hands-on lab, guided workshop or co-authored practical guide.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/