Andy James

If attackers study the specific organisation, they argue, testing should too.

• Much security testing is designed around the testing company's delivery model rather than the customer's reality.
• Templates, standard scopes and pre-defined playbooks can produce a report without meaningful insight.
• The argument is not that testing is unnecessary, but that the same test cannot fit organisations with different infrastructure, people, risks and threat landscapes.
• Engagements should be scoped to the risks that matter to the client.

"Too much security testing today is built around the testing company's model, not the customer's reality.

• Templates.
• Standard scopes.
• Pre-defined playbooks.
• That may produce a report.
• It doesn't always produce meaningful insight."
• They contrast this with C360RED engagements designed around the organisation, its environment and its risks.

Read original

They make three related claims: every organisation must know exactly where its data lives, resilience inside a single hyperscaler is an illusion, and the default cloud-first mindset should be challenged rather than assumed.

• The reasoning ties concentration risk to business continuity: if resilience is not genuinely distributed, the next outage takes down more than systems.
• They frame the position as deliberately contentious and invite disagreement rather than presenting it as settled.

"Cloud-first has become cloud-fragile, and after the recent AWS & Azure outages, we need to talk about it." They add: "If we do not rethink resilience now, the next outage will not just take systems down, it will take businesses with it," and describe the argument this way: "This one will divide opinion… and it should."

Read original

The pattern they describe is top-down deployment to save money before anyone has defined data ownership, governance or risk tolerance.

• Their reasoning contrasts most technology, engineered from the ground up with security built in and controls understood, with AI, which is often deployed before the governance questions are answered.
• The unanswered questions they list are where data goes, who owns it once inside these systems, and what exposure has been accepted.
• Their conclusion: innovation matters, but discipline matters more.

"Where is the data going?

• Who owns it once it's inside these systems?
• What exposure have we just accepted?"
• They also write: "We are trading known human limitations for unknown technology weaknesses — and in many cases, we don't fully understand how these systems behave under pressure."
• The post closes with a self-deprecating aside about a dated headshot in the published interview, keeping the register conversational rather than corporate.

Read original

The answer depends on specifics the default ignores: which risks matter, where the data physically lives, and who owns it.

• This is one working habit applied across three topics, giving the arguments the shape of positions rather than general commentary.
• The anti-template case comes from the CEO of C360RED, a company that sells bespoke engagements, so the position and the commercial offer point the same way.
• They do not hide the commercial framing, and on cloud resilience they explicitly expect the argument to be contested.

Compare the three setups: "Every serious attacker starts the same way… With reconnaissance" against the vendor template; "resilience inside a single hyperscaler is an illusion" against the cloud-first default; "Security is built in… With AI, it's often: deploy first, ask questions later" against fear-driven AI rollouts. In each case, the question is what the organisation's own situation requires.

Read original · Original 2 · Original 3

Start here for the clearest statement of method, purpose and commercial positioning across the posts.

Andy James, CEO of C360RED, opens with a direct account of how serious attackers work: “Every serious attacker starts the same way.

• Not with malware.
• Not with exploits.
• With reconnaissance.”
• The post argues that attackers study people, technology, suppliers and processes before moving, while too much security testing follows the testing company's model rather than the customer's environment.
• They describe the pattern as “Templates.
• Standard scopes.
• Pre-defined playbooks.” and contrast it with C360RED engagements designed around the organisation, its infrastructure, its people and the risks that matter to it.

For brands planning a campaign

A strong hook for a thought-leadership collaboration or advisory engagement on red teaming. Tailor the angle to assessment design: why reconnaissance and client-specific risk should shape a security test, and how that changes what buyers learn from the exercise.

It is a useful starting point for readers interested in Andy James's contrarian case on digital sovereignty, data location and business continuity.

Andy James responds to recent AWS and Azure outages with the claim that “Cloud-first has become cloud-fragile.”

• The post announces a new article on digital sovereignty and argues that every organisation must know where its data lives.
• They call resilience inside a single hyperscaler “an illusion” and challenge the default cloud-first mindset.
• The post explicitly expects disagreement: “This one will divide opinion… and it should.”

For brands planning a campaign

A campaign can position Andy James as a debate-ready voice on cloud resilience and digital sovereignty. Possible formats include a contrarian keynote, a moderated debate or a practical advisory piece on where data lives and how much outage exposure a business can tolerate.

It is the best starting point for readers focused on responsible AI adoption rather than only technical security testing.

Andy James argues that AI adoption is moving too fast because fear is driving decisions.

• The post criticises organisations that deploy AI top-down to “save money” before defining data ownership, governance or risk tolerance.
• They contrast most technology, engineered from the ground up with security built in, with AI deployments that ask questions later: “Where is the data going?
• Who owns it once it's inside these systems?
• What exposure have we just accepted?”
• A plain-spoken aside about a dated headshot gives the piece a more human, less corporate tone.

For brands planning a campaign

Useful for a thought-leadership or advisory collaboration on responsible AI adoption. The content can connect AI governance to cybersecurity risk, with Andy James addressing what enterprises should define before deploying AI and how to avoid trading known human limits for unknown technology weaknesses.

The post opens by describing how attackers begin—with reconnaissance, studying an organisation’s people, technology, suppliers and processes for weak signals and small gaps—and uses that to argue that testing should be designed around the risks that matter to the client.

Uses the attacker’s own entry point—reconnaissance—to justify a bespoke engagement, then contrasts it with packaged scopes.

For brands planning a campaign

Good fit for thought leadership built on a contrarian position: sponsored pieces, webinars or advisory content questioning standard-scope penetration testing and explaining reconnaissance-led red teaming. The claim is specifically about how engagements are scoped, so a brand should pair Andy James with a format that lets them walk through a scoping decision rather than deliver a generic security-awareness message.

Examples: Source 1

They frame security as normally engineered from the ground up, with controls understood and exposure known, and contrast that with AI, where questions about where data goes, who owns it once it is inside the systems, and what exposure has been accepted are often answered after the fact. They note that innovation matters, but discipline matters more.

Uses a before-and-after contrast—how security is normally built versus how AI is adopted—and a short list of unanswered governance questions to make the case.

For brands planning a campaign

Suited to AI governance, data-risk and compliance vendors looking for a cautionary rather than promotional voice.

• The natural collaboration is a pre-deployment governance checklist or risk-assessment discussion framed around data ownership and exposure, not an AI-capability showcase.
• The post closes with a self-deprecating aside about their own headshot, signalling a conversational, non-corporate register that sponsors should expect.

Examples: Source 1

The post promotes a new article on digital sovereignty and makes three claims: every organisation must know exactly where its data lives, resilience inside a single hyperscaler is an illusion, and the default cloud-first mindset should be challenged. They expect the position to divide opinion and invite responses.

The argument is deliberately contentious, so it could attract disagreement as readily as agreement in a comment thread.

For brands planning a campaign

Fits cloud security, business continuity, and multi-cloud or sovereignty-focused vendors willing to sponsor a debate-positioned argument, including comment-section discussion. Because the piece is anchored to named public outages, timing matters more than for the other topics: the angle is strongest while outage resilience is current.

Examples: Source 1

The posts carry the main claim in the feed and place the link in the comments.

For brands planning a campaign

A brand can expect a campaign to produce an in-feed argument plus a longer asset, with the click-through link in the comments. That limits direct in-feed referral value but gives sponsors two usable formats and an established pattern for pairing a post with an article or interview—useful when negotiating deliverables.

Examples: Source 1 · Source 2 · Source 3

Original disclosure

as CEO of C360RED

View example

Ask whether James has a role, ownership stake or commercial relationship with the company.

View example

Ask whether the post reflects a sponsorship, affiliate or client relationship.

View example

James starts with what an attacker sees during reconnaissance; LaMantia starts with external DNS records, subdomains and third-party dependencies that remain visible and ungoverned, arguing that the real problem is the ownership gap, not a single misconfiguration. Both use short LinkedIn posts to flag patterns seen across many enterprises and point readers to a newsletter or article.

LaMantia's material stays within one technical domain: DNS and external attack surface management, including the case for a controlled brand top-level domain. James focuses on engagement design and business decisions: how to scope a red-team test, whether resilience depends on one hyperscaler, and whether AI can be deployed before data ownership is settled.

Read original · Original 2

Bisagno makes the case that BYOD is a governance initiative balancing productivity, security, compliance and employee experience, and that device trust can be adopted in phases rather than through a full infrastructure rebuild.

• James applies the same instinct when arguing that testing should be scoped to the client's risks rather than a standard package.
• Both publish advisory LinkedIn posts that link to longer articles.

Bisagno offers practical best-practice guidance for hybrid-work device decisions, with a steady, constructive tone and a phased roadmap.

• James takes positions rather than offering guidance, building arguments on named incidents such as the AWS and Azure outages and saying directly that they will divide opinion.
• Readers looking for implementation steps will get more from Bisagno; those looking for a contested point of view will get more from James.

Read original · Original 2

Both argue that resilience matters alongside prevention: Richards on recovery readiness and disciplined vulnerability management, James on rethinking resilience before the next outage takes systems down. Both work for security providers and say so in their posts.

Richards writes from a customer-success and managed-services angle at Atruent, focusing on operational habits such as patch management, privileged account protection and remediation discipline.

• They often respond to someone else's reported findings.
• James writes from the offensive side as chief executive of a red-teaming firm, questioning how tests are scoped and challenging defaults rather than describing operational controls.

Read original · Original 2

The posts show close work on external DNS exposure: legacy records, third-party dependencies with unclear ownership, incomplete SPF/DMARC coverage, and externally visible assets outside governance.

• A vendor selling an EASM, DNS security, or digital-risk product can use that material to build a governance-led campaign — the argument is not just “find misconfigurations” but “fix the ownership gap for every domain, subdomain, DNS record, and externally exposed asset.”
• That’s a sharper fit than Andy James when the buyer wants one technical control area explored in depth rather than a broad resilience or red-team scoping argument.

The tradeoff is scope.

• Andy James's posts focus on DNS, external exposure, and namespace governance; they do not develop red-team engagement design, AI deployment governance, or cloud concentration risk to the same depth.
• A buyer who needs a multi-topic advisory voice or a red-teaming conversation will get less from this alternative.
• Only two posts were available, dated May and June 2026.
• Ask for audience data and partnership terms to assess reach and commercial availability.

Examples: Source 1 · Source 2

The posts treat BYOD as a governance initiative rather than an IT decision — policies, employee education, identity security, ongoing oversight — and frame device trust as a way to validate both user identity and device security posture.

• That suits a vendor selling endpoint, identity, or Microsoft 365-related controls to regulated or hybrid-work-heavy organisations, especially if the desired collaboration is a practical “how to start without a massive infrastructure transformation” piece.
• It is a more natural fit than Andy James when the buyer needs an endpoint-and-access decision framework rather than red-team scoping, AI governance, or cloud resilience.

The tradeoff is that the posts stay close to endpoint and access security.

• They do not cover offensive reconnaissance, red-team engagement design, AI data ownership, or cloud concentration risk, so a buyer whose campaign centres on those topics loses the direct argument.
• The available posts are two posts from September 2026.
• A campaign that needs a contested public debate is also less supported here than by Andy James’s explicit invitation to disagree on cloud strategy.
• Ask for audience data, commercial terms, and post-level performance to assess reach and paid availability.

Examples: Source 1 · Source 2

The posts analyse how ransomware groups exploit known Fortinet VPN vulnerabilities, why MFA alone is not enough, and how compromised domain credentials and Active Directory Group Policy can disable controls without malware.

• The posts also bring a customer-success angle: the organisations that recover fastest tend to have disciplined vulnerability management, operational accountability, and proactive remediation, not the biggest budgets.
• That fits a vendor or MSSP selling resilience, patch management, identity protection, or recovery readiness, especially if the campaign should be grounded in operational process and customer outcomes.
• It is a better match than Andy James when the buyer wants ransomware and identity-risk specifics rather than a red-team scoping, AI governance, or cloud-sovereignty argument.

The tradeoff is that the posts are event-led and vendor-adjacent.

• They respond to specific incidents and a TechDecanter discussion, and they foreground Atruent’s customer-success perspective; a buyer wanting a neutral, category-level advisory voice or a broad thought-leadership position may find them narrower.
• They do not develop red-team engagement design, AI deployment governance, or cloud concentration risk.
• Only two posts from August and September 2026 were available.
• Ask for audience data, rates, and sponsorship formats to assess reach and commercial availability.

Examples: Source 1 · Source 2