FROM 0 TO 5K: BUILDING IN PUBLIC

Eighteen months ago this account had zero followers, zero budget, and exactly one thing to say: most breaches are human errors wearing a technical costume. There was no audience to agree, no algorithm boost, and no reason for a single stranger to care. Today, 5,000 people read that message every week, and more than 2,700 of them have joined the community it built.

This post is the honest ledger of how that happened. Not a highlight reel and not a growth-hacking thread. It is the version I wish someone had shown me when I was staring at a follower count of nothing, wondering whether teaching security in public was worth the effort. If you are early on your own build, this is the map I did not have.

The short version is simple and slightly disappointing: there was no trick. There was a niche, a habit, and a refusal to fake expertise I did not have. The long version is where the useful parts live.

Why build in public, in security of all fields

Security has a secrecy habit, and for good reasons. Real incidents are covered by non-disclosure agreements. War rooms stay private. Post-mortems get sanitized before anyone outside the company ever reads them. The result is a field where the most valuable lessons are locked away precisely because they were expensive to learn.

That secrecy creates a strange gap. Students learn from textbooks that are five years stale, then walk into interviews where the questions are about last month. The distance between what academia teaches and what the floor demands is not a small crack. It is a canyon, and almost nobody is building bridges across it in public.

So the bet was to bridge it out loud. Every post shared exactly one real practice. How a modern phishing email actually reads, word for word. How an approval scam drains a crypto wallet, transaction by transaction. How an analyst triages a screaming alert queue at the start of a shift. The kind of thing a syllabus skips and an employer silently expects you to already know.

People did not follow the account because it was clever. They followed it because it was useful. That distinction turned out to be the whole game.

Trust compounds faster than follower counts. Teach one real thing per post, be right often enough to be safe and wrong openly enough to be human, and the audience builds itself.

What actually grew the audience

I kept records, because measuring what works is the same instinct that makes a good analyst. When I look back at the posts that moved the needle versus the ones that vanished, four patterns repeat with almost boring consistency.

• →Specificity beat volume. One concrete walkthrough of a single technique outperformed ten posts of opinion, every single time. Vague advice like "use strong passwords" got ignored. A teardown of one real credential-stuffing attack got saved and shared.
• →Receipts beat claims. Screenshots of real red flags, sanitized incident timelines, before-and-after configurations. Anybody can claim expertise. Showing your working is what separates a teacher from a poster.
• →Consistency beat virality. Two posts a week for eighteen months, whether I felt like it or not. The algorithm forgets a viral spike within days. People remember a habit for years, and habits are what turn a reader into a member.
• →Answering messages beat broadcasting. Roughly half of the community core came from one-on-one conversations that started as a single comment or a two-line direct message. Broadcasting builds reach. Replying builds relationships, and relationships are what survive a platform change.

None of these are secrets. They are just unglamorous, and unglamorous work is exactly the kind that most people quit before it compounds. The posts that felt like a waste in month two are the reason month twelve worked.

The failures I do not usually mention

For honesty, the other side of the ledger. I chased trends that did not fit the niche and watched engagement crater. I wrote a few posts that were technically wrong, got corrected in the comments, and had to eat it in public. That stung, but it also taught the audience something more valuable than any single fact: that this account would rather be corrected than be confidently wrong.

I also spent a full month trying to be a personality instead of a teacher, leaning into hot takes and controversy because that is what the growth advice promised. The numbers went up briefly and the quality of the audience went down sharply. People who arrive for outrage do not stay for education. I deleted that experiment and went back to teaching.

The give-back chapter

A following is a liability if it only feeds itself. Five thousand people reading your posts is meaningless if the only thing it produces is more posts. At some point the audience has to become infrastructure for something bigger than one person talking.

That is what 2026 turned into: the giving-back year. CyArt Studio is the open home where those 2,700 potential talents trade the practices academia never taught them, without a paywall and without gatekeeping. Free sessions, honest keynotes, real labs. The account that started as one person teaching became a room where members teach each other, which is the only version of this that scales past me.

The thesis has not changed since post number one. Reduce human error from cyber security infrastructure. The only difference is that it is now a community project instead of a personal broadcast, and communities are far harder to fool and far better at catching what one person misses.

What you can take from this

If you are sitting at zero right now, here is the compressed version of eighteen months. Pick a niche narrow enough that you can be genuinely useful in it. Teach one real thing at a time. Show your working. Post on a schedule you can actually keep, not a heroic one you will abandon. Answer the people who reply. Be correctable. Refuse to trade your audience quality for a temporary bump in reach.

The next 5,000 will not come from posting harder. They will come from members teaching members, in public, with receipts. That is a machine that runs without me, and building that machine is the actual goal.

So here is the question worth sitting with. What do you know from experience that a student cannot find in any textbook? Whatever that is, it is your first post, and someone out there is waiting for exactly it.