LinkedIn Content Strategy for Identity Security Consultants | Netwarm
LinkedIn playbook · Case study
LinkedIn content strategy for identity security consultants: how a Raleigh identity architect reached 56 security and IT leaders in 5 weeks
We read every reaction on 30 posts from a Raleigh identity security architect who runs non-human identity assessments. 2,098 people, 56 security and IT leaders. Here is what brings buyers, what brings peers, and the 5 posts we'd publish next.
Max Sawyer · Netwarm··12 min read
The creator in this case studyA Raleigh identity security architect
Followers47,789
Posts~5–6 a week (30 posts in 5 weeks)
These numbers are from 4 November. Your audience has already moved.
New security and IT leaders turn Hot every week and others go quiet. Run your free scan to see today’s version, with the names.
SellsFixed-scope non-human identity assessments for Microsoft Entra ID: service principals, app registrations, managed identities and AI agent identities, inventoried, scored and prioritised in ten working days
PeriodSep 28 – Nov 4
Ideal client: CISOs, heads of security and IT, IT directors and identity leads at companies running Microsoft Entra ID, in regulated sectors like healthcare and banking.The challenge: The architect writes about the brain science of work: stress on video calls, approval fatigue, why alerts get tuned out. Those posts travel far, mostly among coaches, consultants and engineers. The people who buy an identity assessment are security and IT leaders, and they are 2.7% of the audience. Which posts reach them?
Key takeaways
56 security and IT leaders reacted in 5 weeks.CISOs, heads of security and IT, IT directors and CTOs: 2.7% of the 2,098 people who reacted. Coaches, consultants and advisors were 556.
Identity posts bring 2x more of them.Identity and AI agent security: 3.8% security and IT leaders. Viral work-video breakdowns: 1.7%. AI and your career: 1.8%.
No buyer is Hot yet.5 security and IT leaders came back for a second post. None reached 3. The pool is real, but nobody is being pulled back yet.
01
Who actually reads you, and what the LinkedIn algorithm changed
The architect posted 30 times between 28 September and 4 November: identity and AI agent security, AI and careers, breakdowns of viral work videos, leading teams, and how the brain behaves under pressure. Almost every post ties a workplace moment to a study.
The LinkedIn algorithm shows a post to the people who reacted to the last ones, then to people like them. The video breakdowns reach thousands, so the next posts go to that crowd first: coaches, consultants, engineers. They push reach. They don't buy assessments. We looked at every person who reacted and sorted them by role.
30posts in 5 weeks
2,098people reacted
56security & IT leaders
0came back 3+ times
Audience by roleThe 2,098 people who reacted, by roleFree
Security and IT leaders (CISO, head of security or IT, IT director, CTO)56 · 2.7%
Coaches, consultants, advisors and authors556 · 26.5%
Engineers, analysts, students and everyone else1,486 · 70.8%
More than a quarter of the audience sells advice: leadership coaches, career coaches, keynote speakers. They react to the brain science, and they rarely run an Entra tenant.
The largest group is everyone else, many of them engineers and security analysts. They read the identity posts, but the budget for an assessment sits one or two levels above them. The 56 security and IT leaders are the smallest group, and the one to grow.
SeniorityAll people who reactedFree
Founder, owner, C-level11.8%
Director, VP4.3%
Manager14.1%
Independent6.6%
Other63.3%
IndustriesSecurity and IT leaders onlyNetwarm
Banking & financial services16.1%
Hidden in preview00%
Hidden in preview00%
Hidden in preview00%
See all industries and company sizes in your free scan.
Core audience0 security and IT leaders engaged 3+ times · 0 engaged 5+ timesNetwarm
5 security and IT leaders came back for a second post in 5 weeks. None came back a third time yet.See your regulars
Engager company sizeEveryone who reacted, by company sizeNetwarm
Hidden in preview00%
Hidden in preview00%
Hidden in preview00%
Hidden in preview00%
Hidden in preview00%
See which company sizes your security and IT leaders work at.See company sizes
02
What to post on LinkedIn to reach security and IT leaders
Reach is not the goal for an identity consultant. A post with 5,000 reactions from coaches brings fewer buyers than one with 100 reactions from CISOs.
We tagged each of the 30 posts by topic, then measured the share of security and IT leaders among the people who reacted.
Your topicsWhat your 30 posts were aboutFree
30posts
Identity and AI agent security9
AI and your career7
Viral work-video breakdowns7
Leading and mentoring teams4
Brain habits under pressure3
Topics that attract security and IT leadersShare of each topic’s reactions from security and IT leadersNetwarm
Identity and AI agent security3.8%
Leading and mentoring teams2.5%
AI and your career1.8%
Viral work-video breakdowns1.7%
Brain habits under pressure0.7%
One topic brings 5x more security and IT leaders than another. See which.See which topics
Identity and AI agent security posts bring 2x more security and IT leaders per reaction than viral work-video breakdowns (3.8% vs 1.7%), and 5x more than posts on brain habits (0.7%).
Posts that brought the most security and IT leadersShare of security and IT leaders in each post’s reactions1 of 5 open
#1You were already underwater: the zero-day, the audit and the agents12.1%
#2Refusal is not access control8.1%
#3You meant to teach them, then the deadline hit7.1%
#4The AI isn't the only one guessing4%
#5The password question got the recipe, not the password3.3%
For comparison, the post about two men standing up on a video call had 5,773 reactions on LinkedIn, the most of the 30, but only 2% security and IT leaders.
6 rules for LinkedIn engagement from security and IT leaders
These rules come from what worked on the architect's own profile, and from the best-performing posts by identity, Entra and security educators on LinkedIn over the last 3 months.
1
Put the brain science inside a security leader's week. The study lands harder on a CISO when the stressor is theirs: the zero-day, the audit, the agents nobody approved. The same study on a video call reaches coaches.On this profile: identity and AI agent security posts brought 3.8% security and IT leaders, viral work-video breakdowns 1.7%.
End with what to take out of the agent's hand. Security leaders save a post they can forward to their team. A short list of controls (keys out of the context, scoped tokens, an owner per identity) is that post.On this profile: the approval fatigue post closing on a list of controls brought 8.1% security and IT leaders, the second best of the 30.
Give one thing to check in their own tenant. One setting, one query, the path to it in the admin center. An IT director can check it before the next meeting, and remembers who told them.Across the niche: a four-step post on one Entra setting drew 1,437 likes and 44 comments.
Hook on this week's identity news. An acquisition, a default that changes, a breach disclosure. Then say what it changes for the person who owns identity risk.Across the niche: a post on one identity vendor acquisition drew 444 likes and 27 comments on a 5.6k-follower account.
Name the leaked credential, then the bill. A non-human identity is abstract until it costs money. One key, one date, one dollar figure makes the risk real for the person who signs the budget.Across the niche: a post on one leaked cloud key and its $88,982 bill drew 541 likes and 75 comments.
Keep viral video breakdowns for reach. They grow the follower count, and they bring coaches and engineers. Post them, but don't count on them to bring a CISO.On this profile: the shorts-on-a-call post had 5,773 reactions on LinkedIn and 2% security and IT leaders.
When security and IT leaders read: the best time to post on LinkedIn for identity security consultants
We compared the share of security and IT leaders by the day each post was published (Eastern time). All 30 posts went out between 8 and 10 a.m., so we can't compare hours. Thursday had 3 posts and no post went out on a Saturday, so read those days with care.
Share of security and IT leaders by posting dayAmong the people who reacted to each postFree
1.8%
Mon
2.3%
Tue
2.5%
Wed
3.8%
Thu
2.5%
Fri
1.3%
Sun
Thursday brought the highest share, 3.8% across 3 posts. Wednesday and Friday followed at 2.5%. Sunday was the lowest, 1.3%: security leaders read on workdays.
Put the identity posts on Wednesday and Thursday mornings, and keep the video breakdowns for Sunday and Monday, when the goal is reach.
05
5 posts ready to publish to target security and IT leaders
Each post follows the rules above, in the architect's voice. Swap in your own details before posting: the real tenant findings and the real numbers are what make them land.
1Ready to postFinding + brain science
73% ownership coverage. One owner.Rule 1 and rule 5: one concrete finding, the psychology behind it, then what to do. Modelled on the "already underwater" post, the best on the profile for security and IT leaders.
Hook
The directory said 73% of app registrations had an owner.The metric was accurate.Then we resolved the owner records.All 151 pointed to a single principal.
An external guest account.One identity outside the organisation's control.
Accountable for everything.———That finding is from a lab tenant I built to calibrate my assessment. Synthetic data.I'd still bet your tenant has a version of it.———The biology:When a number looks healthy, the brain stops checking it.
A green dashboard is a safety cue. It gets less scrutiny, not more.And when many people could own something, each one assumes someone else does. Psychology calls it diffusion of responsibility.Neither is a character flaw.
Both are the brain doing its job inside a system that wasn't designed around it.———What to do this quarter:→ Resolve every owner record. Count the people, not the records.
→ Flag owners who are guests, disabled, or gone.
→ Give each app registration a named team, not just a named person.
→ Re-check when someone leaves, not once a year.You don't need a better ownership metric.You need to know who is behind the number.
Visual · Simple chartTwo bars: "73% ownership coverage" and "1 actual owner", on a plain background.Check before postingThe 73% and 151 figures come from the lab tenant on your website: keep "synthetic data" in the post, or swap in a real, anonymised client finding.
One line of PowerShell, one uncomfortable numberRule 3: one check an IT director can run before the next meeting. Modelled on a Microsoft MVP's four-step Entra setting post (1,437 likes).
Hook
Run this before your next security review.With Application.Read.All, it returns the number of app registrations holding a secret valid for more than a year:Get-MgApplication -All | Where { $_.PasswordCredentials.EndDateTime -gt (Get-Date).AddYears(1) } | Measure-ObjectOne line. Read-only.———Why it matters:Those secrets were created in pull requests and deployment scripts.
Outside any approval workflow.
Usually with no named owner.Joiner-mover-leaver fires on employees.
Not on the apps they created.So when the owner leaves, the app keeps its permissions and its secret.Nothing breaks, so nobody looks.———If the number is higher than you expected:→ Sort by permission, not by age. A long-lived secret with Directory.ReadWrite.All comes first.
→ Check the owner on each one. Is that person still here?
→ Move what you can to certificates or managed identities.What number did you get?
Visual · Code screenshotThe one-line command in a dark terminal, with a made-up result count blurred out.Check before postingRun the command on a test tenant before posting to check the syntax, and keep it exactly as it is on your website.
Your users can now create agent identitiesRule 4: hook on this week's identity news, then say what it changes for the person who owns the risk. Modelled on an IAM educator's post on an identity vendor acquisition.
Hook
Since November 4, any user in your Entra tenant can register an agent identity blueprint.Unless an admin turned it off.No built-in role needed.
No custom role needed.———That's not a bug. It's a default.And defaults are where non-human identities come from.The service account someone needed that week.
The app registration in a deployment script.
The OAuth grant someone clicked "Allow" on.Now add agents built by whoever had an afternoon.———What to check this week:→ Entra ID > Users > User settings: is "Users can register agent identity blueprints" set to No?
→ If it was on, list the blueprints created since November 4.
→ Give each one an owner. A team, not just a person.The question isn't whether your people will build agents.It's whether you'll know they did.
Visual · ScreenshotThe User settings screen in the Entra admin center, with the agent blueprint setting highlighted.Check before postingCheck the setting's exact name and the November 4 date in Microsoft's documentation before posting.
The 10-minute non-human identity checkRules 2 and 3: a short list of checks a security team can run, offered for free. Modelled on an OT security educator's free project list (648 likes) and a security guide sent to everyone who commented (543 comments).
Hook
I turned my non-human identity assessment into a 10-minute self-check.The full assessment runs 44 checks across seven dimensions.The self-check is the 10 I'd run first in any Entra tenant:→ Inventory: how many service principals, app registrations, managed identities and agent identities do you have?
→ Ownership: how many owners are guests, disabled, or gone?
→ Credentials: how many secrets are valid for more than a year?
→ Permissions: how many apps hold tenant-wide write access?
→ Agents: who can create one today?Each check comes with the read-only query and what a good answer looks like.———A CISO told me on First Principles that most of the information already exists.
What's missing is whether the controls behind it actually work.This is the fastest way I know to find out.It's free. Comment "NHI" and I'll send it to you.
Visual · Document previewThe first page of the self-check as a clean PDF, the first three checks readable.Check before postingBuild the 10-check PDF from your assessment before posting, with one read-only query per check. Answer every comment.
The key was in the agent's contextRule 2 and rule 5: one leaked credential, the habituation science, then what to take out of the agent's hand. Modelled on the "Refusal is not access control" post (8.1% security and IT leaders).
Hook
The agent didn't steal the key.It was handed the key.It sat in a .env file the agent could read. So the agent used it.———By Anthropic's own count, Claude Code users approve 93% of permission prompts.Not careless. Habituated.When a signal repeats without consequence, the response to it drops. That's habituation, one of the most basic forms of learning.The first prompt gets read.
The twentieth gets approved.———So stop asking the human to be the control.What to do this quarter:→ Keep keys and tokens out of the agent's context. If it can read a secret, assume it will use it.
→ Give each agent its own identity. Not yours, not a shared service account.
→ Scope it to the task, and let it expire.
→ Name an owner for every agent identity. A team, not just a person.You don't need more vigilant people.You need agents that can't reach what they were never meant to touch.
Visual · Text onlyNo image: the post works on its first two lines.Check before postingIf you add a real incident, use a public one with its source (date, company, cost) in the comments.
Free forever: unlimited scheduling through LinkedIn’s official API, with images, video and PDF carousels.
06
LinkedIn lead generation: lead magnets that work to target security and IT leaders
Reactions show interest. A download shows intent. An IT director who asks for a self-check for their tenant is telling you the question is open.
In identity and security, these formats get the most requests:
Format 1The free hands-on listA numbered list of checks or projects people can run on their own, each with the tool or environment to do it.
Format 2The comment-for-the-guideA complete guide on handling sensitive data, sent to everyone who comments a keyword. The comments push the post further.
Format 3The live demoA webinar showing a real attack path and its mitigation. Every registration is a name and a company.
Our pick for you: “The 10-minute non-human identity check”Built from the 44-check assessment the architect already runs and the read-only query already on the website: the 10 checks to run first in any Entra tenant, each with its query. Offer it in post 4, and invite the people who download it to a 20-minute call.With a Reveal link, every person who downloads it is shown by name, with their role and how warm they are. Your first Reveal link is free.Create your free Reveal link
07
From reactions to clients
Content brings security and IT leaders to the profile. It doesn't say when to reach out. Most never comment, so they stay invisible, and a CISO reading the identity posts this month may book another assessor next quarter.
On LinkedIn, the right moment to start a conversation is when someone keeps coming back. We call that Hot: 5 or more points over 90 days, where a reaction counts 1, a repost 2, a download or a reply 4.
Hot right now0 security and IT leaders · not contacted yetNetwarm
0 security and IT leaders are Hot. See who to message first.See who’s Hot
First messageAn opener for each Hot person, based on the posts they readNetwarm
Hi Brian, you reacted to my post on approval fatigue. Is anyone on your team looking at agent identities yet?Hi Priya, I saw you read the post on the zero-day and the audit. Do you know how many app registrations in your tenant still have an owner?
A first line for each of them, ready to send.See the openers
Netwarm sends nothing for you. It tells you who and when, and you write the message. It also works inside Claude and ChatGPT: ask "Who's Hot today?" and get the list.
08
FAQ
Posts that sit inside a security leader's week: a finding from a real tenant, one check to run, what this week's identity news changes. Here, identity and AI agent security posts brought 3.8% security and IT leaders, viral video breakdowns 1.7%.
For this architect, Thursday brought the highest share of security and IT leaders (3.8%, on 3 posts), then Wednesday and Friday (2.5%). Sunday was the lowest (1.3%). All posts went out between 8 and 10 a.m. Eastern.
This architect posted 30 times in 5 weeks. That volume builds reach. For buyers, two identity posts a week written for security leaders matter more than daily posts on other topics.
Look at who reacts, not how many. Group reactions by role, measure the share of your ideal clients per post, and follow the people who keep coming back. A free Netwarm scan does this for you.
Yes. Netwarm only reads public reactions to your own posts. It never logs in as you, never asks for your password, and never messages anyone for you.
How we made this playbook
We read the public reactions on 30 posts published between 28 September and 4 November 2026 (up to the first 100 reactors per post) and sorted the 2,098 people by role. Comments were not counted, so engagement figures are a floor.
Niche rules come from top posts by identity, Entra and security educators over the last 3 months. Role groups are approximate: a headline says CISO or head of IT, not whether the company runs Entra ID. A Netwarm scan matches people to your own ideal client.
