Luke Matthews

Co-Founder | Lifestyle Blogger |  Content Marketer | Storyteller 

I teach you how to write with AI (and win LinkedIn)

Building in public on LinkedIn™ is risky for you. 

You aren't a 20-something Instagram model or a 33-year-old drop shipping bro bragging about 6 figures from Bali. 

You have a real business and a real reputation to uphold. 

You want to take advantage of more opportunities through visibility on social media, but you know there are privacy risks that come with that.... 

Most AI models take your data and sell it. 
Most social media platforms take your data and sell it.
Most marketers don't understand this, which can expose your company.

That's where I come in. 

I've been marketing for over 10 years on social media, built over 250k followers across all platforms, and I've ghostwritten for some of the biggest personal brands in the world. 

But beyond that, I value privacy and staying hidden. 

It takes skill to build a personal brand that not only generates revenue for your company but also remains secure and private. 

I help you build on social media and maintain your privacy using secure AI systems and world-class ghostwriting. 

Sound interesting?

Don't message here on LinkedIn.

Email me instead and use subject "𝗜 𝘄𝗮𝗻𝘁 𝘁𝗼 𝗯𝘂𝗶𝗹𝗱 𝘀𝗲𝗰𝘂𝗿𝗲𝗹𝘆"

luke@wizardofoddmarketing.com

--

Want to learn how to use AI safely?

Follow me and subscribe to my email list to learn how to use AI tools safely and securely without exposing your data and private life to the world. You can subscribe by clicking any link in my profile as they all go to my newsletter on Substack.

Founder - Lead Wizard & Ghostwriter

Linkedin & Twitter Ghostwriting Services for CEOs, Influencers, and Tech companies. 
Reach your audience with a sprinkle of magic, the power of explosive copywriting, and let the WIZARD OF odd MARKETING help make your biz a LOT  less boring.

I have been banned over 10x on LinkedIn. 

The brutal truth is the system ain’t fair…

In business and in life those willing to cater to the system (and exploit you) end up profiting from it. 

Social media has made this reality worse. 

It’s not about how skilled you are.
It’s about how skilled you can talk. 

(& it’s about who u know aka how good you are at kissing up to leaders and using errr befriending them on your climb to a seat at the table)

I decided this rat race wasn’t for me. 

So I’m playing a different game now. 

Rebuilding in the shadows. 
Learning new skills. 
Making new friends…

Friends that are hackers, rebels and the anonymous geniuses defending digital freedom…

Because look, complaining about broken systems accomplished nothing…

Action wins. 

PS Hi LinkedIn. Who’s still here?

2 posts in a week whoa 🤓

Luke M

I used to spend 8 hours a day engaging on LinkedIn. 

In 2025 I spent less than 30 minutes a day... 

So why change?

Well for starters I shut down a lot of things this year. I ghosted the platform for months, I shut down my old businesses and went into the shadows to consider a rebuild. 

But last year a lot changed on the platform.

Commenting alone is now far less effective for growth.

There are too many AI comments.
There are too many thought leader ads.
There are too many virtual assistants focused on ROI.

The odds of your comment alone being seen, considered and replied to simply went down a lot. 

So here's what I have been doing in Q4:

I comment for 15 minutes a day.
I make sure each comment is interesting.
I follow up the comment with a simple DM. 

(oh and yes I remove all my comments, posts and footprint 30-60 days after with a pretty cool AI tool.... DM if your curious why I do this!) 

No you wont get a ton of reach or follower growth this way!

But you will start conversations....

PS Have you changed your strategy in 2025?

It's easy to get 1000 likes a post (like I used too)

Here's how to be a LinkedIn influencer: 

1. Talk about LinkedIn. 
2. Be good looking and post pictures.
3. Write short, broad content. 
4. Spend all day commenting. 
5. Do this for 90 days. 

OR 

69. Pay a team to do it all for you. 

But here's the truth about this blueprint. 

You missed the window when this was possible for anyone. It's too late now on LinkedIn to do this organically. The market has changed, agencies don't work as well, organic is dying and this actually isn't the best strategy unless you want to pretend the old system still works. 

The better way? 

Cut the dopamine. Pick a niche. Speak to that niche. 
Accept less reach. Accept slower growth. 

But reach a very targetd audience. 

In summary...

You need a real skill and a real niche to focus on.

The generic LinkedIn growth expert is playing an old game to take your hard earned money by fooling you with cheap dopamine. 

You will never become them. 

You don't need a personal brand.

You just need to be an expert with a real skill and a specific niche.

PS Who bought cool AI tools for Black Friday?

I now separate work and my personal life.

But not for balance... I do it for privacy.

If you wanna work 16 hours a day and find joy in that then I see no reason at all to say that's unhealthy. 

So this post isn't about encouraging balance.

I mean, I'm the guy who posted 3x a day and spent 8 hours+ a day commenting and connecting on LinkedIn for years who now has a cartoon profile pic, posts 1x a week and barely comments...

I enjoy the unhinged and unbalanced life.

More fun. More purpose. More stories.

And yet I've worked hard to seperate personal and business in 2025.

That's meant shutting down a lot of social media accounts, AI tools, services, clients and ways that I show up on the internet. 

I use Linux for personal stuff.
But Windows for work. 

I use a rebuilt android OS for personal stuff.
And only use an IPhone hardened for work.

I still post on LinkedIn for work. 
But I removed all pics and stories connected to my life.

I could go on and on...

But for me, seperating work and my personal life hasn't been about balance. It's been about privacy and being more intentional with my time, my words and my efforts... 

I believe the internet is no longer a place for authenticity. 

It's simply a place to do commerce. 

So look, do you but if your password is the same for your bank and your LinkedIn account....

Maybe it's time for an audit of yourself eh peasant? 

🧙‍♂️

I only log in to LinkedIn on Windows. 

I use Linux for my personal data and files...

Running more than one operating system on your computer is called multi-booting. 

This summer as I began to purge myself of big tech I realized that I couldn't full exit the system yet... 

Even though I concluded that:

Using Google search is a privacy risk.

Using ChatGPT is a privacy risk.

Using Cloud AI is a risk...

Publishing content connected to your full name, actual face, phone number and home IP address is also a privacy risk…

I also realized I couldn't cut the last 1% of these data stealing big tech tools and programs...

This is where taking back your privacy requires effort.

So I decided to learn how to sandbox my work/private life online environments.

Sandboxing is when you run apps/programs in a secure, isolated framework to restrict those tools access to the rest of your systems files and resources.

Basically I wanted to figure out how to isolate tools like LinkedIn so they don't have access to my other files and life.

This takes some skill, but deleting 100% of everything just wasn't possible for me yet. 

It's a constant game of learning but I think it's worth learning how to shield your personal data and sandbox your work life, personal life and daily life environments from each other.

Otherwise you are at the mercy of data leaks, hackers, corrupt big tech and government policies…

Personally I think it’s worth the effort to learn and seperate tools, systems and resources.

What about u?

PS Yes I know Windows is getting worse... But Mac? EW

Do you share your live location with social media apps? 

I do not. Here's a quick why/why not list... 

✅ Positives to location sharing:

It's convenient (easy to meet up & connect)
It's social proof (events, hotspots, clout)
It gives you steak recommendations. 

✖️ Negatives to location sharing: 

It creates movement patterns for 1000s to study.
It allows your data to be harvested more easily.
It establishes a physical digital footprint.

I have always been careful to not share my live location.

I analyze every photo or post written and consider what kind of footprint I'm leaving behind. 

Am I paranoid? 

Perhaps... But this elder-millennial is gonna keep walking the line between using tech and disappearing into the shadows..

PS Sharing any photos adds to your risk. 

This photo has clues in it. 

Where do you think this photo was taken?

The gatekeepers are losing their grip.

For years, "world-class" meant big budgets, big teams, and exclusive tools. You had to be part of the club.

That era is over.

AI has kicked the door down. A new report from Artlist, based on insights from 6,500 creators, calls this "The third wave of democratization."

What does that mean?

It means anyone with a laptop can now produce studio-quality work. It means a couple of skilled individuals can take on companies in the hundreds. It means the playing field is wide open for anyone willing to learn.

Of course, when anyone can make anything look perfect, the game changes.

It's no longer just about technical skill. It's about taste. Vision. Strategic thinking.

As the report says, direction now matters more than ever. AI handles the production, but only you can choose the ideas that move people. Your choices are what set you apart.

This is why I find AI so appealing. It's not about replacing humans; it's about empowering the ones that choose to accept the new game. It is the great redistributing. An opportunity for anyone willing to learn, not just those with deep pockets.

The little guy has a chance. The rebel. The creator with a dream. The expert with a real skill.....

I think that's pretty cool.

PS if you want to read more about the state of AI check out the AI Trend Report 2026 from Artlist (who sponsored this post).

https://lnkd.in/gf7e8aXE

Brand partnership • Scale your business privately with AI.

How to pay $0 with 9 private AI tools.

(I replaced my tech stack with these brands)

This summer I quit using most AI tools that required overpriced monthly subscriptions/credits and stored my data in their clouds. 

So I had to replace 99% of my tools. 

From $500 to less than $25 a month.

Here's my list:

Notion >Crypt(.)ee for note taking and ideas.
Airtable > AppFlowy for content management.
G-Suite > Proton for secure email and file hosting.
ChatGPT > Okara for private open source AI. 
Loom > Cap so I can record my screen with video.
Perplexity > DeepSeek with Ollama for research.
Canva > Penpot for self hosting creative assets.
Manus > Venice for AI research purposes.
Slack > Signal cz I don't need all the fluff.

So yeah this list is a lot longer.

But I know your attention span is short.

I'm still getting used to some of these new tools.

(and I paid for Proton Premium too btw)

The truth is, it's inconvenient. 
I was used to my tool stack. 

Learning new software and setups is a challenge.

But avoiding subscriptions the best I can and maintaining max control of my data is my decision maker.

PS Yes I left out the self-hosting tools and process...

(I gotta make you follow for more somehow right?)

Lester Chng

Cyber CEOs Brand Strategist. I build your brand as you build your business. | Senior Cybersecurity Advisor | Author | Naval Officer | CISSP | 🇨🇦🇸🇬 |

You head a leading cybersecurity firm.
But your online presence doesn't reflect it.

In fact, being invisible is damaging. 

You understand the power of thought leadership.
You know LinkedIn shapes deal flow and adds credibility in the industry.
You just don’t have the cycles (or the copy) to share your expertise and experience.

You have stories worth telling.

The insights from being in the trenches.
The deep conversations with your ace teams.
The hard discussions with your clients. 

Don’t let this wisdom go to waste.

That’s where I come in.

--------------------------------------------------------------------------------------------

How we work together.

Profile & Positioning
=> Rebuild your LinkedIn profile so visitors see industry authority, not “another vendor.”

Content engine
=> Ghostwritten posts that leverage your insights and expertise into engaging LinkedIn posts. 

Outreach campaign
=> Targeted DM campaigns and audience-building strategies that build your authority and land you on podcasts and conference stages.

--------------------------------------------------------------------------------------------

You focus on growing your firm and protecting your clients.
And we will ensure the industry, clients, prospects, and investors can’t ignore it.

Let’s build the personal brand that commands the cybersecurity conversation and drives business.


Worked with global client portfolio 
- MSPs
- MSSPs
- Agentic AI SOC
- AI-powered GRC 
- Operational Resilience 

Senior Advisor, Financial Crimes Unit Exercises. BMO Fusion Centre

Execution of Financial Crimes Unit Exercise and Drill Program
• Design and execution of exercises and drills to operationalize the Financial Crimes Unit Fusion Centre
• Scenario creation and exercise execution for Information Security, Enterprise Fraud Management, Physical Security, and Global Crisis and Continuity Management teams 
• Providing effective challenge of incident response readiness through exercise observation
• Execution of enterprise-wide Purple Team Exercise


Cybersecurity Exercises: Purple Team, Ransomware, DDoS, Malware, Data Corruption, Data Breach, 3rd Party Incidents
Fraud Exercises: ATOs, Attack on Payment systems, Business Email Compromise, PII Breach
Physical Security Exercise: Active Assailant, Civil Unrest, Bomb Threats
Crisis Exercises: Disaster Recovery, Business Continuity, Operational Resilience, Fire Incidents, Natural Disasters, Utilities Disruption

We landed in Canada 8 years ago. 
Today I still get this question. 
Why did you move from Singapore?

I always answer with this as if one of the reason. 

“We were very comfortable and had stable jobs. In fact, I know almost exactly how many career will pan out”

And we wanted to try something diff. 

This is what it wld have looked like:
- stayed on in the Navy
- promotions to LTC or SLTC
- 300k salary (don’t quote me)
- waiting on a ~500k bonus in 2026
- complete command of 2-3 warships

This is the last 8 years instead:
- ~50% pay cut for first role
- took 3 role changes to gain parity 
- only to be laid off after a few years
- and living through a dead economy

If we take a snapshot view here, it is a disastrous decision. 

But of course it’s never that linear. 

Here are other things that I gained:
- explored 2 career paths. PM + cyber
- grew professional network from 0
- gained experience in enterprises
- sold digital products & services
- found mission driven role + team
- resilience and independence
 
The questions will always be asked. 

And the journey is still being written. 

P.S what questions do u always get when you tell your story?
How do u answer them?

JSESSIONID

li_at

Talks about #linkedin, #resilience, #cybersecurity, #crisismanagement, and #personalbranding

The Brand Strategist for Cyber CEOs. I build your brand as you build your business. | Senior Cybersecurity Advisor | Author | Naval Officer | CISSP | 🇨🇦🇸🇬 |

Rogers Cybersecure Catalyst, Toronto Metropolitan University is hiring.
We continue to grow and if our vision of "Cybersecurity for all" resonates with you. Check out and apply for these roles.

Director of Strategic Partnerships
https://lnkd.in/gaTXKaBz

Director, Public Sector and Small Businessess
https://lnkd.in/gFGDsGvG

Program Lead
https://lnkd.in/gSajF8eK

Cyber Clinic Program Lead
https://lnkd.in/gcFhZFkP

Operations Coordinator

Check out this job at Toronto Metropolitan University:  https://lnkd.in/g2S-fNFa


Applications close soon and start the new year in a role and organization that is shaping the future of Cybersecurity in Canada and beyond.

Rogers Cybersecure Catalyst, Toronto Metropolitan University

You are all busy. I don't expect you to read my history, so here is a little about me.

𝗕𝗼𝗿𝗻 𝗮𝗻𝗱 𝗿𝗮𝗶𝘀𝗲𝗱 𝗶𝗻 𝗦𝗶𝗻𝗴𝗮𝗽𝗼𝗿𝗲.

Never the model student.
Made a career choice at 19.
To serve in the Navy and see the world.

𝗖𝗮𝗿𝗲𝗲𝗿 𝗶𝗻 𝘁𝗵𝗲 𝗡𝗮𝘃𝘆

Daily lessons of leadership, critical thinking.
Ran the wargaming and simulation centre.
Left in 2017 after rejecting a promotion and the opportunity to command a ship.

𝗢'𝗖𝗮𝗻𝗮𝗱𝗮

Moved to Canada w no corporate exp
Struggled for years to climb a ladder
Fortunate to move into cybersecurity

𝗖𝘆𝗯𝗲𝗿𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆

Currently in my 3rd role in cyber.
1. Project Management
2. Senior advisor - security exercises
3. Senior advisor - security exercises

𝗖𝘂𝗿𝗿𝗲𝗻𝘁 𝗲𝗻𝗱𝗲𝗮𝘃𝗼𝗿𝘀

Full-time at Rogers Cybersecure Catalyst, Toronto Metropolitan University. 
Best place I have worked in Canada.

Need cybersecurity tabletop exercises, cyber range training, cyber advisory services?

Give me a shout.

𝗖𝗼𝗻𝗰𝘂𝗿𝗿𝗲𝗻𝘁 𝗮𝗰𝘁𝗶𝘃𝗶𝘁𝗶𝗲𝘀

Book author
The Essential Cybersecurity Ex Playbook.
I still refer to it when I design exercises. 
Get it if you are tasked to run exercises.

Ghostwriter for Cyber CEOs and Founders
Your LinkedIn Account is a goldmine.
Build your thought leadership and authority.
I write your LinkedIn posts for you.

P.S What did you not know abt me?

I work in a cybersecurity organization that drives diversity in cybersecurity. Yet we still see all male panels and leadership teams.

Yes, things are changing and Rogers Cybersecure Catalyst, Toronto Metropolitan University is driving that forward in partnership with the Mastercard Emerging Leaders Cyber Initiative (ELCI). This program is in its 5th cohort in 2026 and empowers women and non‑binary professionals with the skills, confidence, and leadership capabilities needed to thrive in this rapidly evolving field.

Lina is an alumni of that program and I interviewed her to learn about her experience in law enforcement, cybercrime, cybersecurity, leadership, and being an inspiration for the next generation.

𝗪𝗼𝗺𝗲𝗻 𝗶𝗻 𝗖𝘆𝗯𝗲𝗿 & 𝗟𝗲𝗮𝗱𝗲𝗿𝘀𝗵𝗶𝗽 𝗟𝗲𝗴𝗮𝗰𝘆

What still needs to change to help more women move into cyber leadership roles?

STEM was historically a predominantly male domain and while there has been a shift, we need to encourage girls early on towards cybersecurity as a future career. From a leadership perspective, encourage authentic inclusive environments (not a checkbox!) where all voices at the table are valued and heard. Mentorship and allyship are key to building confidence.

What advice would you give to women thinking about shifting into cybersecurity?

One of my favourite things about cybersecurity is that it is a field where diversity of thought is welcome and there are so many opportunities for different specializations. Don’t be afraid to step out of your comfort zone and take on the challenge of finding your passion. 

If you enjoyed this interview series, please follow Lina. She is a passionate defender in the cybersecurity space and an inspirational leader.

P.S. What is your company doing to promote diversity?

Mastercard

Executive Director, office of the CISO Optiv Canada RCMP Cybercrime (ret’d)

Cybersecurity professionals struggle in OT organizations.

Especially if they don’t take the time to understand operations.

I interviewed my friend Osman Saleem, the Managing Director of Actimeta, who helps his clients secure their OT and IoT infrastructure.

What Makes OT/IoT Security Complex

Q3: What makes protecting operational environments fundamentally different from traditional IT cybersecurity?

OT environments have physical processes, so organizations prioritize safety, reliability, and availability of OT systems. Confidentiality of data takes a back seat. Additionally, OT systems have a much longer life cycle. As a result, these systems operate 24/7 on legacy equipment and networks making patching and rebooting a challenge. Security changes can directly impact physical processes, which means risk management must balance cyber controls with operational continuity.

Q4: Can you share an example of how operational and security priorities sometimes conflict — and how organizations can bridge that gap?

Security teams may recommend immediate patching or network changes, while operations teams push back due to downtime risks or safety concerns. Capital upgrades of legacy equipment are also cited as reasons for avoiding immediate patches. Bridging that gap comes from joint risk assessments, staged mitigation plans, or designing controls that reduce risk without disrupting critical operations
_____________________________

If you enjoyed this interview series, please follow Osman. He is a security infrastructure expert and has helped organizations build IoT and OT security programs.


P.S. What’s the biggest challenge in OT security?

OT & IoT Cybersecurity | Smart Building Technology | Smart Cities

Culture change is crucial for security transformations.

How does one influence change in critical infrastructure?

I interviewed my friend Osman Saleem, the Managing Director of Actimeta, who helps his clients secure their OT and IoT infrastructure.

Leadership, Culture & Collaboration

Q7: You’ve worked across consulting, engineering, and executive leadership — what have you learned about leading teams through complex technical change?

Real progress happens when leaders listen to their teams, and more importantly, remove obstacles instead of issuing directives. Operational teams adopt change when they feel respected, supported, and protected from unnecessary risk — not when security is pushed onto them as “another policy to follow.”

Q8: In your view, what’s the biggest cultural or mindset shift organizations need to make to strengthen their cyber and operational resilience?

Organizations must stop treating security as something they “enforce” on operations and start treating it as something they build with them. When frontline technicians and engineers are empowered as partners rather than problems to manage, security becomes practical, sustainable, and actually effective.
_____________________________

If you enjoyed this interview series, please follow Osman. He is a security infrastructure expert and has helped organizations build IoT and OT security programs.


P.S. Which sector needs the most security attention?

“I’ll take a break from writing/posting”. 

That’s what I told myself as I returned from my vacation. 

“It will be easy to get back into it”. 

Just like my exercise routine, my writing and networking rhythm were severly derailed. 

Even though my systems and tools were in place, I need to reconvince myself of the intend of being active on this platform. 

And it really does fall back to the why. 

Once that is reaffirmed, then the other pieces of the how kicks back in. 

Here’s back to sharing:
- how organizations should use cyber exercises to improve their readiness and resilience 
- how cyber CEOs should use LinkedIn to drive brand awareness 

P.S who thinks the LinkedIn feed is darn boring these days. Let’s start sharpening our storytelling skills.

Cyber CEOs are missing one of the biggest opportunities on LinkedIn.

Your founder story.

Not the pitch.
Not the product.
The reason you started.

Here is why it matters.

1. It builds trust faster than yr website.

People want to know the conviction behind your company. Your story answers the core question every buyer has: why should I trust you.

2. It humanizes your brand.

Cybersecurity is technical and crowded. Your story cuts through the noise and shows the person behind the mission.

3. It creates instant differentiation.

Competitors can copy language, pricing, and positioning. They cannot copy your journey.

4. It strengthens every future conversation.

When people understand your why, your product demonstrations, sales calls, and partnerships become warmer and easier.

Your founder story is not optional.
It is a strategic asset.

If you do not tell it, your audience will never hear it. And don’t wait for permission to share too. 

No one is gonna give you that.

Career pivots are always challenging.

But you never start from zero.

Lina has made some interesting moves in her career. 

Do you know she started in the army? 
Legend has it she asked for the hardest role and they sent her to the infantry. 

She then joined the RCMP where she embarked on a 30 year career with her last role as the Unit Commander of RCMP Cybercrime Investigative Team. 

I interviewed Lina to learn about her experience in law enforcement, cybercrime, cybersecurity, leadership, and being an inspiration for the next generation.

𝗖𝗮𝗿𝗲𝗲𝗿 𝗙𝗼𝘂𝗻𝗱𝗮𝘁𝗶𝗼𝗻𝘀 & 𝗧𝗿𝗮𝗻𝘀𝗶𝘁𝗶𝗼𝗻

You led several RCMP units before moving into cyber. What lessons from policing still guide how you lead in cybersecurity?

My approach to leadership, regardless of the unit or program line, has always been about helping my teams be the best version of themselves and ensure they had what they needed to execute their roles effectively; be it tools, training, mentoring or support.  

When you took on the cybercrime team, what was the biggest mindset shift you had to make?

The cybercrime team is somewhat unique in policing, especially when considering the diversity of specialties within the cyber team itself. I found myself in the unfamiliar position of not being the most experienced person on the team. But it also meant that I had the opportunity to learn from my team. And it was amazing. Like drinking from a firehose, but so amazing.

If you enjoyed this interview series, please follow Lina. She is a passionate defender in the cybersecurity space and an inspirational leader.

P.S. What was your career before cyber?

Waiting for someone to interview you?

Stop waiting. Interview yourself. 

Many cyber CEOs are waiting for conferences to reach out for speaking opportunities, for organizations to invite them for expert panelists, or for a intimate podcast session. 

Some wait and nothing ever arrives. 

Use this platform, interview yourself and share your insights immediately. 

Here are 7 questions to answer:

1.	Who does your product help (role, industry, company size), and what does a “bad day” look like for them?

2.	What trigger pushed your client from “we should address this” to “we need a solution now” (audit, incident, board pressure, customer requirement, insurance renewal)?

3.	How has your clients describe the problem in plain language, without cybersecurity jargon?

4.	Where does the pain show up in your client’s day-to-day work (broken handoffs, constant exceptions, unclear ownership, reporting gaps)?

5.	What have your clients already tried, and why did it fail or stall (tool sprawl, consultants, spreadsheets, policies that didn’t stick)?

6.	What happens if nothing changes in the next 6–12 months?
How does that impact your client? (business impact, personal accountability, reputational and compliance exposure)?

7.	What proof did your client need before they’ll trust and buy (success criteria, non-negotiables, deal killers), and what niche-specific insight made them say “this person gets our world”?


You do realize no one is going to ask you those questions in an interview. 

Yet these are the questions you need to answer to position yourself and your solution as the go-to in the market. 

Now stop waiting and start answering.

Take a second to count your personal connected devices.

Now, estimate that number for an enterprise set-up.

Enterprises struggle to keep up with the inventory, tracking, management, and governance of their IT systems. Industries and companies that rely heavily on physical systems, such as monitoring devices, automated systems, and highly integrated systems, add layers of complexity and associated risks to maintaining operational efficiency and security.

I interviewed my friend Osman Saleem, the Managing Director of Actimeta, who helps his clients secure their OT and IoT infrastructure.

The OT/IoT Security Landscape 

Q1: How has the growing interconnection between physical systems and digital networks changed the way organizations think about cybersecurity?

Organizations that run physical systems and OT are more aware now of the risks that come with connecting them to digital networks. Asset owners are increasingly focused on securing these environments—marketing hype can amplify the fear, but the concern is justified. More connectivity expands the attack surface and links cyber incidents to real-world impacts on safety, reliability, and finances. As a result, there is a shift to treat cybersecurity as an operational responsibility, not just an IT issue.

Q2: From your experience, what are the biggest misconceptions business leaders still have about securing operational or connected environments?

Many business leaders place more emphasis on tooling and technology. Their main focus should be prioritized towards embedding cybersecurity practices and controls in their business workflows, organizational processes and ensuring their governance is not just documented, but functional. 
_____________________________

If you enjoyed this interview series, please follow Osman. He is a security infrastructure expert and has helped organizations build IoT and OT security programs.


P.S. What are some IoT/OT security assumptions that many have?

If growing your LinkedIn presence as a cyber CEO is not part of your 2026 plan, it is a huge marketing miss. 

The others parts are shaping up:
- website copy
- marketing swag
- cold email blasts
- conference booth
- CISO wine and dine 😃

All that is important and probably takes up the bulk of your budget. 

And then when your prospects land on your LinkedIn page, it blands (yes bland) in with the rest of the corporate copy. 

“We are on brand.”
“Our product speaks for itself.”

What could have been a differentiator from your competitors and a vibrant platform to build a community and awareness for your company. 

Instead, it just fades to the background. Like many of the other passive accounts. 

Is your LinkedIn account working your you, your company, and your vision?

Or will 2026 be another missed opportunity? 

Your platform. 
Your choice.

LinkedIn

Addressing security issues in an OT heavy organization is an uphill battle.

Especially if we blindly apply IT security principles.

Where should one start? Or is it an impossible task?

I interviewed my friend Osman Saleem, the Managing Director of Actimeta, who helps his clients secure their OT and IoT infrastructure.

Building Secure and Resilient Systems

Q5: When you work with clients on OT/IoT cybersecurity, what guiding principles or frameworks do you find most effective?

Common sense, to start with. We also rely heavily on frameworks like NIST SP 800-82 and ISA/IEC 62443, focusing on asset visibility, segmentation, and defense-in-depth. These frameworks take a risk-based approach. There are industry-specific regulations that may also apply. Effective cybersecurity programs align cybersecurity controls directly to safety, reliability, and regulatory objectives rather than treating security as a standalone effort.

Q6: How can organizations take practical first steps toward improving their OT or IoT resilience without massive overhauls?

Work on foundational knowledge first. Document your environment and how OT intersects with and affects other organizational departments. Start with visibility - and I don’t mean deploying a tool. Understand what assets are connected, where data flows, and who owns them. Understand your existing staff's skill set. Establish your risk tolerance thresholds. Document everything. Then implement basic segmentation, access control, and incident response planning — small changes that dramatically reduce risk without major system interruptions.
_____________________________

If you enjoyed this interview series, please follow Osman. He is a security infrastructure expert and has helped organizations build IoT and OT security programs.


P.S. What are some key differences between IT and OT security?

Here’s one signal to know yr cyber exercise is highly effective. 
And most TTXs never trigger this. 

We recently executed a cyber range simulation exercise that put an IT team through a stressful scenario. 

The team was actively analyzing the IOCs and raise many relevant points for decision making. The leadership team weighed the risks and make a decision for containment. 

This decision was communicated to the technical teams and it spark a behavior which I didn’t expect but was glad it happened. 

The IT team responded to seek clarification on the decision. The instructions from the leadership team was clear on intent but the IT teams wanted to ensure that the leadership team understood the risks and nuances of the decision. 

And the discussion got pretty heated. 

This is termed as “Challenge and Response” and is something that we used while we manage the navigation team to ensure the safety of the ship. 

Team members would challenge the instructions (not the authority) if they were unclear or they had information that may impact the decision. The officer of the watch will have to respond to confirm or clarify the order. 

The purpose of this mechanism was to ensure that there was an avenue for clarification of an order without the risk of insubordination. 


So to my surprise, I saw this playing out as we ran our exercise. 

This is a healthy sign that the team had the right culture and understood the intent of the team’s actions. 

How did the heated discussion end?

I had to intervene, acknowledge the perspectives of both parties, and park the issue aside to continue w the exercise. 

This learning point would not occur in a benign tabletop exercise. It took a realistic high pressure scenario to tease out the practical considerations of incident response. 

P.S can u guess what the discussion was about? 
I’ll give a prize if anyone guessed it!

I consult with many Cyber CEOs. 

These 4 questions come up in every strategy call I run with founders.

⸻

1/ What should I post without oversharing or sounding salesy

They worry about balancing:
- Oversharing insights 
- Being authoritative vs promotional

But the real issue?

This isn’t a writing problem.
It’s a positioning + content strategy problem.

Once you define your POV and boundaries, posting becomes easy.

⸻

2/ Will this really generate business, or is it just vanity?

They’re skeptical because:
- Impressions ≠ pipeline
- “Likes” don’t close deals
- Decision-makers feel invisible on LI

Behind this question is a deeper fear:

“Will my effort pay off?”

LinkedIn is a trust engine, not a slot machine. It compounds if you show up consistently.

⸻

3/ How do I stand out when every cyber CEO sounds the same?

Their feed is full of:
- News reposts
- Corporate announcements 
- Zero Trust / AI buzzwords

Their real question is:

“What is MY unique point of view?”

The answer is always the same. 
Stand out by being specific, not louder.

Your niche, your observations, your client stories, your lessons.

Those are the differentiators.

⸻

4/ How much time does this take each week?

They assume LinkedIn is:
- Daily posting
- Daily commenting
- Constant DMing
- Full time social media diva

But what they actually want is simple:
A strategy that is intentional. 
A plan that drives results. 

You don’t need to post daily.
You need clarity, consistency, and relevance.

⸻

If you’ve have all these questions too, the good news is they’re all solvable.

Cyber CEOs don’t need more content.
They need a clearer strategy, stronger positioning, and a repeatable system.

P.S what other qns do u have?

Cyber CEOs have endless stories. 

Here are some ideas if u r stuck.

1. The moment you realized the cybersecurity problem you’re solving was real (A client incident, a failure you witnessed, or a blind spot in the market.)

2. Why you decided to start the company instead of joining another one (Your conviction, frustration, or spark.)

3. The first obstacle you faced as a founder and what it taught you
 (Funding, product clarity, hiring, credibility.)

4. The early version of your solution and how different it was from today
 (Show evolution and persistence.)

5. A hard lesson you learned that shaped how you lead now
 (Trust, communication, resilience, decision speed.)

6. The turning point when you knew the company would work
 (First client, first renewal, first big validation.)

7. A belief you hold about cybersecurity that most people overlook
 (Your “why” behind your mission.)

8. How your background shaped the way you approach security problems
 (Past industries, roles, failures, or personal experiences.)

9. The sacrifice most people don’t see
 (Time, stability, opportunity cost, personal growth.)

10. Your vision for the industry and why you’re committed to it
(Where things are going and why you care.)

P.S Expand on each point in a few different angles and your content is set for months. 

Any other story ideas?

LinkedIn has never worked for me. 

Many Cyber CEOs tell me that. 

“What have you tried?”

- had 1 video call w a new contact
- create 2 posts every quarter 
- msg 3 CISOs every week
- like 4 posts every day 
- read 5 cringey posts

Bruh, what were you expecting. 

If you execute prod dev like a hawk,
raise funds like the fed, why do you neglect your professional presence?

You may be causing more damage missing more opportunities than u thk. 

Is 2026 going to the same for u?

Here are 4 silly TTX lessons that you never plan for but do happen. 

You have gone through the rigor. 

Study the IRPs and escalation flows. 
Deep dive into sector intel and risks. 
Create the most compelling scenario. 

You executed the exercise w precision. 

Then realize this is what they gained. 

1. Some participants have never met. 

Whether it is high turnover or there never as reason to meet, don’t be surprised if some members have never met before and the exercise served its purpose of building relations. 

Silly but happens more often than u thk

2. Some plans have never been read. 

Or in some cases, no one knew it existed or didn’t event realize annex C-7 had a whole section dedicated to the responsibilities of said department. 

Better late than never to realize you have a role to play in an incident. 

3. Some words have diff meaning. 

You used industry defined nomenclature as you peppered the response plans with actionable and detailed terminology. Only to realize no one cares about your glossary on page 54. 

Fav terms. Isolate. Asset. Segregate. Sanitize. Take offline. Clean up. 

Record the lesson learned. 
Create an action item to synch. 

4.  Some roles and ppl r gone. 

This always happens but don’t let u derail the exercise. Plans are never perfect. They are there to serve as a kick off point and reference, not a step by step instruction booklet. 

Don’t be so rigid. 

P.S what other interesting TTX encounters have you experienced?

Most cyber CEOs make the same LinkedIn mistake.

They publish generic cyber opinions.

Humans are the weakest link.
Zero Trust is hard but important. 
AI is risky but is changing the world. 

It feels safe. 
It feels like thought leadership.

But it is a losing strategy.

Cut the noise and focus on:
- industry constraints
- operational challenges
- tech stack experiences

When you post generic cyber content, you create three problems:

1. You blend in.
If 50 other CEOs could have written it, the market will not remember you.
	
2. You attract the wrong attention.
Likes from practitioners and vendors, not conversations with decision-makers.

3. You confuse prospects of yr niche.  

Instead, pick a niche and own it.

Not “ransomware.” 
Ransomware for school boards, manufacturers, or healthcare suppliers.

Not “incident response.” IR for mid-market teams, OT-heavy environments, or critical infra orgs.

It is much more efficient to build in a specific niche than to spam. 

P.S: If I read your last 10 posts, would I know exactly who you’re writing to?

How to instantly instill confidence during an incident response call?

One of the key features in every incident response plan is the incident response call or CSIRT (cybersecurity incident response team) call. 

Yet, it is hardly ever practised and you can confuse everyone if it is a mess. 

There is no clear lead, the agenda is sketchy, and the conversation goes all over the place. Even worse, it drags on with no end in sight. 

A simple way to fix this. 

Meetig structure + Practice

Here is a sample meeting structure:

1. State the objective and summary
2. Facts so far (what we know, what we think, what we don’t know)
3. Impact and scope 
4. Top 3 priorities and risks
5. Decisions needed now
6. Action item review
7. Comms and notifications
8. Recap key next steps
9. Open for questions 
10. Timing of next call 


You need to practise these calls. 
And run it with military disciple. 

P.S what agenda item wld u add?

taplio

The Battle

Luke Matthews

Lester Chng

Followers

Posts

Engagements

Likes

Performance ScoreLuke Matthews's LinkedIn Performance

Performance ScoreLester Chng's LinkedIn Performance

Ready to grow your LinkedIn presence?

taplio

The Battle

Luke Matthews

Lester Chng

Followers

Posts

Engagements

Likes

Performance Score.css-goub6s{font-size:var(--chakra-fontSizes-md);font-weight:500;color:var(--chakra-colors-gray-600);display:block;margin-top:var(--chakra-space-1);}Luke Matthews's LinkedIn Performance

Performance ScoreLester Chng's LinkedIn Performance

Ready to grow your LinkedIn presence?

Performance ScoreLuke Matthews's LinkedIn Performance