Who is Unai Rubio?

‍

‍

Unai Rubio: The blue-team builder who turns theory into tools

‍

Unai Rubio makes cybersecurity feel practical. He writes in plain Spanish, ships real resources, and invites people to test, break, and improve them. His posts read like a playbook you can run today. That is why SecOps leaders, students, and makers show up.

‍

1. Who he is

‍

Unai is a cybersecurity expert and entrepreneur based in Spain. He is known for deep blue-team know-how across SIEM, SOC operations, MITRE ATT&CK, and defensive engineering. His background includes ethical hacking and founding SOCNODE, which shaped his hands-on, tool-first style. He publishes frameworks, open resources, and ready-to-use rules that teams can adopt in a day. He teaches with live examples from real incidents and shares what works under pressure. That mix positions him as a trusted builder in the Spanish cyber community.

‍

2. A network of heavyweights

‍

Unai sits at the center of a technical map. You will see Microsoft, Google, AWS, IBM, Cisco, Elastic, Red Hat, Check Point, Deloitte, and MITRE in his orbit. He taps communities around Wazuh, Grafana, Snyk, OpenAI, and GitHub. The crowd in his comments includes SOC leads, incident responders, and researchers who trade configs and field notes. This network gives his content reach and fast peer review.

‍

‍

3. Why people listen

‍

‍

He explains security like an engineer who ships. Clear diagrams. Direct language. Step-by-step threads that end with a download or a repo. He favors evidence and repeatable steps over hot takes. People engage because they can try it, see results, and return with improvements.

‍

4. Authenticity that resonates

‍

‍

Favikon rates his presence at 97.5/100 for authenticity. The signals are clear. Dialogues show varied writing styles and real implementation questions. He posts niche how-tos, playbooks, and prompts that he tested himself. Comments debate techniques rather than trading generic praise, which keeps the signal high.

‍

5. Numbers that back it up

‍

‍

Unai’s audience grew from 16,348 to 26,531 followers in roughly 13 months, with steady organic gains. His Influence Score sits around 6,449 pts. Engagement quality is 87 and Post Content hits 94, which fits a technical niche that values depth over virality. He publishes frequently, and he also runs the Xocker Cybersecurity News newsletter with 1.9K followers.

‍

6. Collaborations that matter

‍

His feed is a rolling catalog of applied security. Examples include the popular list of open-source tools SOCs actually use, the Telefónica incident breakdown, and the “88 SIEM critical rules” guide. He shares defensive lab setups, blue-team prompts, and Wazuh plus Grafana recipes. These collaborations turn brand platforms and community tools into working defenses for real teams.

‍

7. Why brands should partner with Unai Rubio

‍

Working with Unai gives brands practical credibility in front of buyers who build and defend.

‍

• Co-create a field guide or playbook that ships with rules, dashboards, and test data.

• Host a live incident teardown that maps detections to ATT&CK and ends with a paste-ready config.

• Lead hands-on workshops for SOC analysts using your product in a full blue-team lab.

• Publish a joint benchmark or rules pack that improves detection coverage for common threats.

‍

8. What causes he defends

‍

‍

Unai promotes Cybersecurity Awareness, Tech for Good, and Education for Everyone. He turns those values into action by open-sourcing detections, writing clear Spanish guides for new analysts, and sharing classroom-ready exercises. He highlights accessible tools that small teams can run without big budgets. He builds learning ramps for students and mid-career switchers. Add the screenshot of causes like the one attached.

‍

9. Why Unai Rubio is relevant in 2026

‍

Security teams are automating detection and response with AI while attackers do the same. The winners will be the builders who pair models with solid telemetry, rules, and procedure. Unai already lives there. He bridges AI prompts and classic blue-team craft, then packages everything into usable playbooks. As budgets shift to outcomes, his tool-driven approach fits how security will be evaluated.

‍

Conclusion: Shipping Security, Not Hype

‍

Unai turns complex cyber problems into steps people can run today. He earns attention by teaching, testing, and releasing resources that survive real incidents. Brands gain trust when they build with him because the work is concrete and measurable. If your goal is to prove security value, Unai Rubio is the partner who helps you ship it.

‍
VIEW THE AI-POWERED PROFILE