# Roy Zur

Roy Zur is a cybersecurity and fraud-prevention entrepreneur building AI tools at Charm Security to help teams detect and respond to scams and social engineering.

- Profile: https://b2binfluencer.marketing/creators/roy-zur/
- LinkedIn: https://www.linkedin.com/in/royzur
- LinkedIn followers: 22,178
- Topics: artificial-intelligence, cybersecurity, ai-agents, social-engineering
- Based on 11 dated posts, latest 2026-09-23

## Summary

Roy Zur is most useful for explaining human-centered fraud prevention and AI agents that engage scammers.

- Best for: A fraud-prevention technology company seeking an advisor or speaker on human-centric fraud prevention.
- Not for: A consumer brand-awareness campaign seeking sponsored content, fixed deliverables, rate card, or verified audience composition.
- Check first: Confirm audience demographics and comparable results from fraud-prevention talks or campaigns before contacting them.

### Takeaways

- HVE framework classifies and assesses human vulnerabilities scammers exploit, while supporting human judgment.
- HoneyBot AI agent engaged a scammer, gathered identifying information and patterns, and shared them.
- Charm Security was selected for FinTech Innovation Lab and RSAC 2026 Innovation Sandbox.

## Main ideas

- **Fraud starts with a human vulnerability, so it needs its own classification standard**: Roy Zur argues that most fraud, scams, and cybercrime begin when attackers exploit human traits such as urgency, fear, trust, authority, shame, confusion, loneliness, greed, and pressure through repeatable social engineering. Software flaws have CVE, CVSS, and CWE to classify and score them, but social engineering has no equivalent. Zur and a team of AI, behavioral science, fraud, criminology, and cybersecurity researchers built the Human Vulnerabilities & Exploits framework (HVE) to identify, classify, score, and mitigate the human vulnerabilities exploited in fraud and cybercrime. The goal is not to replace human judgment but to give fraud, security, and frontline teams faster answers: whether a person is being manipulated or doing the manipulating, which tactic is in play, which vulnerability is being exploited, and which intervention is most likely to work.
- **Detection alone is not enough; prevention means acting in the moments that matter**: Roy Zur argues that identifying fraud is insufficient. The goal is to understand the human exploit and act in the moments that matter, moving teams from reactive alerts to prevention, intervention, and resolution. Zur frames fraud, cybercrime, and financial crime as human-centric from the first signal and says defenses need to evolve as scams and social engineering do.
- **AI agents should engage scammers, not just flag them**: Charm Security's HoneyBot is an AI agent that takes on the role of a victim, sustains a conversation, observes, and quietly collects intelligence while the attacker believes the target is a real person. Roy Zur presents it as a shift from reactive alerts to proactive defense by an agentic fraud workforce.
- **Industry recognition and conference work are part of the fraud-prevention argument**: Roy Zur treats selection by industry programs and in-person events as validation for the work and a way to build the ecosystem around human-centric fraud prevention. The posts publicize Charm Security's selection for the RSAC 2026 Innovation Sandbox and the FinTech Innovation Lab 2026, and list a multi-city conference schedule. The invitation is to connect in person with AI, fraud, cybersecurity, and fintech leaders, using the phrase "break the scam spell" as a shared slogan with partners and organizers.

## Work to read

- [Human Vulnerabilities & Exploits: a classification system for social-engineering risk](https://www.linkedin.com/posts/royzur_can-ai-tell-if-someone-is-lying-manipulated-activity-7477373057779675136-jMSq)
- [HoneyBot: an AI agent that engaged a scammer in conversation](https://www.linkedin.com/posts/royzur_ai-charm-honeybot-activity-7425146079148634112-zfmr)
- [RSAC 2026 Innovation Sandbox recognition](https://www.linkedin.com/posts/royzur_cybersecurity-rsac-activity-7426987193463848960-y4Oq)
- [FinTech Innovation Lab 2026 and the financial-services ecosystem](https://www.linkedin.com/posts/royzur_excited-to-share-that-charm-security-has-activity-7442943218025091072-jsEL)
- [Conference circuit across fraud, fintech and cybersecurity](https://www.linkedin.com/posts/royzur_fintechabrsecurity-ai-fraud-activity-7440416943054032896-DqBw)

## Brand relationships

- **Charm Security** (owned_business)
- **Crosspoint Capital Partners** (investment)
- **Team8** (disclosed_partnership)
- **FinTech Innovation Lab** (disclosed_partnership)

## Partnerships

The posts document partnerships held by Charm Security, the company Roy Zur is building, rather than a personal sponsorship or creator-partnership program. Charm Security is working with Team8 and Crosspoint Capital Partners, was selected for the Accenture and Partnership Fund for New York City FinTech Innovation Lab 2026, and was named to the RSAC 2026 Innovation Sandbox. None of these is described as paid media or as an offer they make to brands. The posts show them on an active conference circuit—RSAC in San Francisco, Fintech Meetup in Las Vegas, HumanX in San Francisco, Fraud Fight Club in Charlotte, NACUSO ReImagine2026 in Orlando and the Fintech Security Summit in New York City—and using direct-response distribution, offering the Human Vulnerabilities & Exploits research paper to anyone who comments the keyword. The posts list no terms, deliverables, rates or booking route. Buyers interested in an advisory or speaking engagement should contact them directly through LinkedIn and ask about scope.

## Alternatives

- Salman Hussain: Choose Salman Hussain when the buyer sells into enterprise security leadership, especially in the Gulf and wider Middle East, and wants an advisor or speaker focused on defending the executive layer. Their posts treat executive and CEO impersonation as a business-process and trust-verification problem, not an email-filter problem. They name the actions a security organisation needs to take: establish independent callback channels for financial requests, require dual approvals and segregation of duties, train employees on executive impersonation and AI-enabled fraud, assess executives' public digital exposure, and run BEC simulations. A second post extends the discussion to governance of AI features deployed on user devices, covering consent and transparency, local AI processing, supply-chain trust, resource consumption and endpoint visibility. For a session with security leaders responsible for implementing controls, that checklist framing is more directly usable than a classification framework: it ends in decisions the audience can act on the following week.
- Swati Gupta: Choose Swati Gupta when the buyer's product targets small and medium businesses and the campaign or session needs to reach owners rather than security teams. Their posts argue that identity is the new front door for SMBs, cite the prevalence of compromised credentials in small-business systems, and reframe ransomware as a volume-based business-pressure attack: automated campaigns scan and exploit 30- to 50-person companies for smaller ransoms. They close with a concrete pre-incident list: offline tested backups, strong identity controls, phishing-resistant authentication, incident response planning and executive crisis playbooks. The delivery is deliberately plain and numbered, written for an owner with no security team. It suits an SMB-facing webinar or workshop where the audience needs a short action list rather than adversary detail.
- Landon Winkelvoss: Choose Landon Winkelvoss when the campaign is consumer-facing or runs through managed service providers, and the buyer wants a speaker who can discuss building anti-impersonation products as well as the scam problem. Their posts tell impersonation stories in human terms, including a man accused of posing as a San Francisco 49ers player, with an accomplice posing as the man's financial adviser, to defraud more than two dozen women of roughly $1.3 million; and a victim who lost $1M over seven months to a caller claiming to be a federal investigator. Each post ends with a rule an ordinary person can apply, such as hanging up, looking up the agency's real number and calling back. The posts also explain that Backgrounder and Ask Carmen were built to close the gap between people holding profiles across many services and companies detecting impersonation only after the fact. They name MSP channel exposure explicitly, useful for buyers reaching small businesses through partners.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/