Yasamin Fatemian

Projects slow down when everyone agrees on a solution but not on the problem they are trying to solve.

• The first step, they suggest, is to ask what business risk is being reduced, who is affected, and how success will be measured six months later.
• Clarity—not the newest platform or feature—is what moves projects forward.

Drawing on cybersecurity consulting and enterprise sales experience, the post says the best conversations start with those three questions. It closes on the idea that the most valuable thing someone can bring to a meeting is often the right question, not the answer.

Read original

If AI helps teams prioritize what matters most and make better decisions faster, that is where the real value lies. The field is still early, they write, and they invite readers to describe how their organizations are approaching AI.

In a #ThreatTalkThursday post, they note that every conversation lately includes AI, then focus on the ServiceNow ecosystem, SecOps, and risk management. They ask whether organizations are already seeing real value or are still figuring out where AI fits.

Read original

The examples are concrete: a weak password that never got updated, a critical patch that kept being postponed, access that was never removed, and an alert everyone assumed someone else would handle. The strongest security programs do not just chase the latest threats; they build a culture where getting the basics right becomes second nature.

Using the Britney Spears lyric "Oops!...I Did It Again" as the hook, the post lists recurring failures and asks readers which cybersecurity mistake they still see organizations repeating.

Read original

The strongest security programs, they say, are not the ones with the most tools but the ones with the clearest view of risk, assets, and activity across the organization.

• Visibility drives better decisions, and better decisions reduce risk.
• A clear view of the environment matters more than tool count as a measure of maturity.

Opening with The Police lyric "Every breath you take, every move you make," the post turns a love song into a security reminder and asks what visibility gap organizations are still overlooking.

Read original

They can include changing customer behavior, emerging technology, new competitors, or waiting too long to adapt. In this view, risk management is not only about preventing bad things from happening; it is about preparing for change before everyone else sees it.

Using Blockbuster as a cautionary example, the post asks readers to remember when everyone thought the company was untouchable, then reframes risk management around operational resilience and business strategy.

Read original

Themes include #WisdomWednesday, #ThreatTalkThursday, #FlashbackFriday, and #MicDropMonday.

• The tags consistently pair cybersecurity, risk, ServiceNow, IRM, SecOps, and GRC language with the Serity name.
• The format helps communicate the ideas rather than serving as a separate topic.

Yasamin Fatemian uses Britney Spears, The Police, and Blockbuster as familiar hooks for arguments about repeated mistakes, visibility, and business change.

Read original · Original 2 · Original 3 · Original 4 · Original 5

Newcomers can start here to get a feel for the practical, question-led voice that runs through the other posts.

Yasamin Fatemian argues that cybersecurity and enterprise projects often stall because teams agree on a solution but not the problem.

• The post offers three starting questions: What business risk are we trying to reduce?
• Who is actually affected?
• How will we know the project succeeded six months from now?
• The lesson: clarity, not the newest platform, moves projects forward.

For brands planning a campaign

A thought leadership collaboration on AI integration in security operations can build on an alignment-first message: start with a shared business problem, name the affected teams, and define success measures. The angle suits an audience interested in AI but wary of technology-led projects.

Readers interested in the topic can see the specific opportunity they emphasize: using AI to sort through data and support faster prioritization, rather than treating it as a generic trend.

Yasamin Fatemian says AI comes up in nearly every conversation lately, but the key question is how it helps security and risk teams.

• The post lists the steady flow of vulnerabilities, incidents, third-party risk, and compliance work, then argues that AI’s real value lies in helping teams prioritize what matters most and make better decisions faster.
• Fatemian says the field is still early and no one has all the answers, then asks how organizations are approaching AI.

For brands planning a campaign

This is a direct starting point for a campaign about AI integration in security operations.

• Build on the prioritization angle, invite audience responses about AI’s real value, and avoid claiming proven outcomes: the post says the field is in its early stages.
• The ServiceNow ecosystem mention also offers a natural bridge to enterprise workflow and risk audiences.

Newcomers can see their signature teaching format—a pop-culture hook, plain examples, and a practical question—and the belief that fundamentals outlast tool changes.

Using the Britney Spears lyric “Oops!…I Did It Again,” Yasamin Fatemian argues that most cybersecurity incidents stem from repeated old mistakes, not brand-new ones.

• The examples are concrete: a weak password that never got updated, a critical patch that kept getting postponed, access that was never removed, and an alert everyone assumed someone else would handle.
• Strong security programs, the post concludes, build a culture where getting the basics right becomes second nature.

For brands planning a campaign

A campaign can use cultural references and familiar mistakes to make security fundamentals memorable, then frame AI as a way to reduce repeated misses in patching, access review, and alert ownership. The post shows how to discuss AI without losing the fundamentals message, keeping the content credible for experienced security audiences.

Start here to see why their risk commentary extends beyond attacks and controls.

Yasamin Fatemian uses Blockbuster as a cautionary example, arguing that the biggest risks are not always cyberattacks.

• They also include changing customer behavior, emerging technology, new competitors, and waiting too long to adapt.
• The post defines risk management as preparing for change before everyone else sees it—not only preventing bad things from happening.

For brands planning a campaign

This post offers a broader executive-level angle for AI integration: frame adoption as part of adapting to emerging technology and changing business conditions, not just as a security operations tool. The operational-resilience framing can reach risk and business strategy readers who may tune out narrow cybersecurity messaging.

Newcomers can see how they turn a familiar cultural line into a practical security argument.

Yasamin Fatemian quotes The Police’s “Every breath you take, every move you make” and turns the love song into a security reminder: you cannot protect what you cannot see.

• The post argues that the strongest security programs are not the ones with the most tools, but those with the clearest view of risk, assets, and activity across the organization.
• Visibility leads to better decisions, and better decisions reduce risk.

For brands planning a campaign

A campaign on AI in security operations can present visibility as a prerequisite for automation.

• AI needs reliable data on assets, risk, and activity to be useful, so position it as an amplifier of good visibility, not a substitute.
• This fits enterprise audiences already considering ServiceNow-style risk and asset views.

The post treats AI as early-stage and open-ended, then asks readers how their organizations are approaching it, including inside the ServiceNow ecosystem.

Starts with the volume of security data, narrows to a practical question about where AI adds value, and invites readers to share their experience.

The post raises questions about AI in security operations but makes no product claims.

For brands planning a campaign

A natural fit for a campaign about AI integration in security operations: Yasamin's framing — AI as a way to triage an existing data-heavy process, set in ServiceNow/SecOps and IRM language — gives a vendor a usable hook. Because the post stays at the question level, a collaboration would need concrete deployment detail and results rather than reuse the post's framing alone.

Examples: Source 1

The post lists three questions to ask first — what business risk are we reducing, who is affected, and how will we know the project succeeded six months out — and concludes that the most valuable thing in a meeting can be the right question rather than the answer.

A lesson drawn from a pattern observed across projects, distilled into three reusable questions and a closing line.

The consulting and enterprise sales background is described in general terms. Ask for a named employer, client, or engagement before using that experience as a campaign credential.

For brands planning a campaign

Well suited to a vendor that wants to speak about discovery, problem definition, and buying decisions rather than features. A campaign could build on the three questions as a practical checklist for teams evaluating a security or risk platform, with the vendor adding the technical detail Yasamin leaves out.

Examples: Source 1

The post says the strongest programs do not just chase the latest threats; they build a culture where getting the basics right becomes second nature. It asks readers which mistake they still see organizations repeat.

A pop-culture hook, a list of recurring failures, a shift from tooling to culture, and a closing question for the audience.

No specific incident, breach, or supporting data is cited; the examples are presented as familiar patterns.

For brands planning a campaign

Works for security education, patch and vulnerability management, or identity and access vendors, where the message is about discipline rather than novelty. The culture framing argues against a purely product-led pitch; pairing the post's list of repeated mistakes with a practical remediation process would fit the tone.

Examples: Source 1

The strongest security programs, the post argues, are not the ones with the most tools but the ones with the clearest view of risk, assets, and activity across the organization: visibility drives better decisions, and better decisions reduce risk. It ends by asking which visibility gap organizations still overlook.

A song-lyric hook, a short causal chain (visibility to decisions to reduced risk), and an audience question.

The post argues against tool count as a measure of maturity, a framing that could clash with a vendor's broad product portfolio.

For brands planning a campaign

Relevant for asset management, attack surface, or IT and security visibility vendors.

• The explicit "not the most tools" line means a campaign should lead with a narrow, demonstrable visibility outcome rather than a platform-breadth story.
• The closing question could prompt discussion in co-created content.

Examples: Source 1

In this framing, risk management is not only about preventing bad things from happening but also about preparing for change before everyone else sees it.

A well-known business failure as a shared reference point, followed by a reframe of what risk management covers.

This post moves from cybersecurity into general business strategy and operational resilience.

For brands planning a campaign

An opening for vendors selling resilience, governance, or strategic risk products to buyers above the practitioner level. Yasamin moves between technical security topics and business-outcome language, useful for campaigns that need executive-facing copy rather than a product-demo narrative.

Examples: Source 1

The tags consistently pair cybersecurity, risk, ServiceNow, IRM, SecOps, and GRC terms with the Serity brand name.

A consistent structure: hook, one clear argument, invitation to respond. Theme names make the cadence predictable and the format easy for a partner to write into.

For brands planning a campaign

Gives a partner a defined slot and an established template: a co-created post can follow the hook-plus-question pattern without disrupting the existing series. Posts carry a recurring brand tag, so ask whether the existing arrangement leaves co-branding space open.

Examples: Source 1 · Source 2 · Source 3 · Source 4 · Source 5

The posts do not say whether Yasamin owns, works for, or partners with Serity. Ask them to clarify the relationship.

View example

Yasamin describes interest in how AI will help security and risk teams working with the ServiceNow ecosystem, and uses ServiceNow tags alongside IRM and SecOps topics.

• The posts show familiarity with the platform and its audience but do not state a vendor relationship, sponsorship, or client engagement.
• Ask whether any such relationship exists.

View example

Both treat the largest exposure as an awareness or decision gap rather than a technology gap: Yasamin Fatemian's misalignment post and Eduard Meelhuysen's NIS2 posts start from a common assumption and show what holding it costs.

Eduard Meelhuysen's posts focus on regulation and scope — who NIS2 covers, what the fines look like, and whether a company is in scope — then offer readers a self-assessment. Yasamin Fatemian ranges more widely across fundamentals, visibility, AI, and general business change, without walking readers through a specific regulation or offering a check-your-status tool.

Read original · Original 2

Anne Bisagno's posts on device trust and bring-your-own-device programs argue that security is a resilience issue, and that policy, identity, and oversight matter as much as tooling. That aligns with Yasamin Fatemian's argument that alignment and a clear view of risk come before platform features.

Anne Bisagno's posts introduce a longer article and point to a specific approach — BYOD policy and device trust as a phased route into Zero Trust.

• Yasamin Fatemian's posts are self-contained arguments that end with an audience question rather than a link to more reading.
• Bisagno's examples come from regulated-industry practice; Fatemian's come from consulting and enterprise sales conversations.

Read original · Original 2

Robert Horne's medieval-castle comparison argues that defenders over-invest in the perimeter and under-invest in what happens after it fails.

• Yasamin Fatemian uses song lyrics and an old business failure to argue that teams repeat basic mistakes and try to protect what they cannot see.
• Both end with a direct question to readers.

Robert Horne's posts delve into technical detail — Kubernetes breach paths, credential theft, lateral movement, and runtime visibility — and read as practitioner security writing. Yasamin Fatemian focuses on decisions and framing, using ServiceNow and risk-management vocabulary rather than exploit mechanics.

Read original · Original 2

His two posts make the reader's decision explicit: they argue that assuming "we're probably not affected" by NIS2 is the real risk, set out scope in usable terms (essential and important entities across energy, healthcare, logistics, manufacturing, and digital infrastructure; typically 50+ employees or €10M+ turnover or balance sheet total; plus critical suppliers and service providers in the value chain), and put penalties in the same breath, up to €10 million or 2% of global annual turnover, with a deliberate GDPR parallel.

• He also offers a free self-assessment linked under the post, giving vendors seeking qualified in-scope leads an existing conversion mechanic to build on.
• If a campaign about AI in security operations can be reframed as a compliance-deadline problem, he is the stronger choice of the three.

None of Yasamin Fatemian's posts touch AI in security operations, so the vendor would have to supply the argument about the technology, the triage workflow, and deployment claims.

• The content also ages with regulation and enforcement news: an evergreen AI piece can be reused for years, while a NIS2 launch is tied to a date.
• The register is assertive ("could be one of the most dangerous sentences in 2026", "I proved many people wrong"), and each post carries a promotional link.
• A vendor seeking measured, evidence-led copy should agree on that tone in advance.
• Ask whether they accept co-created or sponsored work.

Examples: Source 1 · Source 2

Her posts frame BYOD as a governance question, not just an IT one: every personal device accessing company resources creates risk, while Device Trust validates both the user's identity and the security posture of the device they are using.

• She describes cybersecurity as a business-resilience issue rather than an IT concern, and outlines a phased Zero Trust path that does not require a large infrastructure rebuild.
• Both posts point to a named long-form article, giving vendors an existing asset to reference and language that can hold up in a leadership meeting.
• Her posts are also the most recent of the three.

They do not discuss AI in security operations, so the vendor would have to supply the AI argument and operational detail.

• Their article-led format summarises a problem and points readers to a longer piece, rather than using the campaign's hook, single argument, and audience-question pattern.
• Buyers seeking analyst-level reasoning in the post itself will not find it.
• Ask for audience data and confirmation of partnership terms.

Examples: Source 1 · Source 2

The castle post argues that layered security has been oversimplified, the perimeter will eventually be breached, and the industry over-invests in the moat relative to what slows an attacker once inside.

• The Kubernetes post makes the point concrete: attackers are not trying to hack Kubernetes but to reach the data, identities, and cloud resources it can access.
• Container compromise becomes credential theft, then cloud access, then lateral movement; the question that matters is how quickly the behaviour that follows would be recognised.
• He closes with a direct debate prompt, which suits a campaign seeking comment volume and practitioner argument.

His posts explain how attacks progress, not where AI helps analysts decide.

• They offer no compliance, governance, or business-risk framing, so a vendor selling AI-assisted triage to risk, compliance, or executive buyers would have to steer the conversation from SOC and runtime engineering.
• He also links to third-party technical work, making his posts the argument layer rather than a full demonstration.
• Vendors seeking practitioner-level detail in the collaboration would need to supply it.
• Ask for audience data and confirmation of partnership terms.

Examples: Source 1 · Source 2