# Brad Dowden

Brad Dowden shares practical perspectives for CIOs and technology leaders on IT strategy, cybersecurity, identity security, AI governance and the costs of managed IT services.

- Profile: https://b2binfluencer.marketing/creators/brad-dowden/
- LinkedIn: https://www.linkedin.com/in/braddowden
- LinkedIn followers: 14,290
- Topics: artificial-intelligence
- Based on 10 dated posts, latest 2026-10-08

## Summary

Most useful for explaining operational and commercial consequences of IT, security, and AI choices to technology leaders.

- Best for: A campaign for mid-market managed IT services providers wanting to be seen as strategic advisors.
- Not for: AI governance, cost-management, or data-readiness campaigns aimed at private-equity fund managers and regulated financial firms.
- Check first: Confirm audience location, job titles, buying influence, and recent post-level engagement before estimating campaign results.

### Takeaways

- Consolidating IT under one managed service provider tends to cost more than it saves.
- The era of MFA is enough is ending, with earlier deadline September 2026.
- UK cyber regulation targets IT suppliers, so mid-market clients absorb cost and risk.

## Main ideas

- **Consolidating IT under one managed service provider tends to cost more than it saves**: Dowden once believed that consolidating a technology landscape with a single managed service provider was the right move: it shifted day-to-day complexity to a third party, brought service-level agreements with teeth and gave the business “one throat to choke” when something broke. They no longer believe or recommend it. They list recurring failures across organisations of all sizes: overpaying for services; being sold products chosen to match the provider's supplier affiliations rather than the client's needs; lacking anyone internally with the expertise to challenge vendor advice or benchmark prices; and becoming so reliant on a provider that leaving is difficult or too expensive, allowing unnecessary costs to continue year after year. The case against consolidation is that it can stop buyers testing whether the spend is worth it—not that providers are uniformly bad.
- **The era of “MFA is enough” is ending, and the earlier deadline is September 2026**: Dowden argues that Microsoft's retirement of SMS and voice authentication in Entra ID is a reason to review an organisation's whole authentication strategy, not just another configuration change. SMS multi-factor authentication was a major improvement over passwords alone, but they say it remains vulnerable to phishing, SIM-swapping, social engineering and replay attacks. Passkeys, by contrast, are built to be phishing-resistant by default. The key is sequencing: waiting for vendor prompts to drive adoption puts the migration on the vendor's timetable rather than the organisation's assessment of its own identity risk. Dowden also treats registration experience, staff communication and account recovery as part of the security work.
- **UK cyber regulation targets IT suppliers, so mid-market clients absorb the cost and the risk**: Dowden argues that the Cyber Security and Resilience Bill matters even to businesses that will never be regulated by it. The Bill had reached Committee stage in the House of Lords and, for the first time, brings medium and large managed service providers and data centres into direct regulation. These are the same providers on which a large share of mid-market businesses rely for day-to-day IT. Reporting duties and fines fall on the supplier, but the consequences can reach clients: if a provider mishandles an incident or raises prices to cover the new compliance burden, clients feel the effects without having had a say in the compliance decision. Dowden frames this as a board-level question of supplier accountability and cost exposure, not a technical compliance problem.
- **Regulated firms cannot manage AI spend they never measured**: Dowden argues that firms cannot say what they spend on AI, and fewer still can say what they get back. Cost control, returns, governance, trust and security belong in one conversation for a regulated firm, alongside how AI changes roles and operating models. Treating AI as a technology experiment separate from cost and governance creates blind spots. Dowden makes this case around a panel: the specific observations belong to the panellists, while the framing and questions for readers are theirs.

## Work to read

- [The uncomfortable truth about MSP consolidation](https://www.linkedin.com/posts/braddowden_i-want-to-share-an-uncomfortable-truth-part-activity-7504163327900766208-sx0l)
- [SMS MFA has an expiry date: what CIOs should do before September 2026](https://www.linkedin.com/posts/braddowden_cybersecurity-cio-microsoftentra-activity-7492992538593869824-zQz6)
- [The true cost of AI: a reality check for fund managers](https://www.linkedin.com/posts/braddowden_theciocircle-ai-aigovernance-activity-7508562397029154817-KV4b)
- [A new proposed UK law won’t regulate most mid-market businesses directly](https://www.linkedin.com/posts/braddowden_theciocircle-cybersecurity-cyberresilience-activity-7502727840962879488-VdCk)

## Brand relationships

- **Lanware** (disclosed_partnership)
- **Microsoft** (mention)
- **The CIO Circle** (mention)

## Partnerships

Across four Brad Dowden LinkedIn posts, no sponsorship packages, media kits, published rates, advertising formats or partnership inquiry routes are described. The posts do show a different kind of collaboration: on 23 September 2026, they appeared on a vendor-hosted panel, “The True Cost of AI: A Reality Check for Fund Managers,” run by Lanware alongside Henry Duncombe and Dan O. of Lanware, Adrian Bolton of GHO Capital and Walid Al Saqqaf of Rebalance Earth. The panel covered AI cost control, return on investment, governance and security in regulated firms. Other posts carry the #TheCIOCircle tag, including the AI panel post and one about the UK Cyber Security and Resilience Bill reaching Committee stage in the House of Lords. For a managed IT services provider planning a content partnership, the posts offer no terms to plan against. Ask directly about available formats, lead times, editorial control and rates. The campaign topics align with subjects they already write about at length: managed service provider consolidation and overspend (11 September 2026), Microsoft Entra retiring SMS and voice authentication and the phishing-resistant shift to passkeys (11 August 2026), and the Cyber Security and Resilience Bill bringing mid-market managed service providers and data centres into direct regulation (7 September 2026).

## Alternatives

- Sebastain Gomes: Choose Sebastain Gomes when the partnership needs to teach identity and Microsoft security mechanics rather than argue market position. Gomes's posts offer a video-led explainer on Authentication Context in Entra ID — c1/c2 values, Conditional Access, step-up authentication, configuration and testing — and a channel milestone post promising Azure, Entra, Microsoft 365, cloud and security topics. For an MSP trying to make authentication migration concrete for technical readers, a co-created walkthrough or video series on passkeys, Conditional Access and step-up authentication would fit the campaign subject, with more implementation detail than Dowden's five-step planning post.
- Raymond Akpan: Choose Raymond Akpan when the campaign goal is cyber skills, career pathways or community reach rather than a buyer-facing advisory position. Both of Akpan's posts promote a free webinar on SOC, penetration testing, GRC and cloud-security careers, and describe Akpan as cybersecurity ecosystem lead for ELITE 247 TECH HUB. For an MSP that wants to build a local talent pipeline, sponsor entry-level training or reach career switchers, Akpan is a more direct match than Dowden, whose posts address technology leaders and business spend.
- Cole McMillan: Choose Cole McMillan when the campaign needs a first-person operating model rather than a market argument. McMillan's two posts describe moving a 150-user, multi-site Microsoft 365 environment to direct licensing; building identity attributes and dynamic groups in Entra ID; and deploying Intune, BitLocker, Defender, firewall, update rings, compliance policies, LAPS and Conditional Access in report-only mode before enforcement. The second post recounts explaining to VP- and director-level IT leaders how one person runs IT for 150 users with no MSP, using centralized intake and automation, with reported results of about 4x ticket volume, 90% faster initial response and 60% faster resolution. For a campaign about lean internal IT, Microsoft-stack standardization or the practical case for operating without an MSP, McMillan gives the same buyer a concrete build story that Dowden's consolidation critique does not.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/