Dan Haagman works on cybersecurity resilience, bringing together CISO experience, industry practice, and academic research. Haagman is a Research Fellow at the University of Warwick and contributes to the CISO Global Study.
Dan Haagman is most useful for thought leadership on cyber resilience and questioning security priorities.
Best for
A cybersecurity consultancy wanting thought leadership on cyber resilience for senior security audiences.
Not for
A security-tooling vendor campaign needing product-led webinars, benchmarks, interface demos and free-trial sign-ups.
Key takeaways
The Zero-Budget Test asks what a CISO would do first if cyber budget became zero.
Dan Haagman is a Research Fellow at the University of Warwick.
They propose removing unnecessary privilege, dependencies and exceptions that make attacks more damaging.
Check first: Confirm commercial terms, disclosure, deliverables, and recent LinkedIn analytics before contacting them.
Main ideas
Ask what should no longer be true, not what to buy next · Build the resilience evidence with the CISO community, not about it · Keep the ideas open to challenge: unscripted conversation as a working method
Dan Haagman writes and speaks about cybersecurity resilience, connecting CISO experience with industry practice and academic research.
Their posts describe work on the CISO Global Study and a Research Fellow appointment at the University of Warwick.
They focus on how security teams can do more than add controls: they can also remove unnecessary privilege, dependencies and exceptions that make attacks more damaging.
Haagman turns resilience into practical questions.
In a conversation with Kai Feng Thia, they propose asking what a CISO would do first if the cyber budget became zero.
That constraint shifts attention from buying tools to examining the conditions the organization keeps defending.
They also frame the work as collaborative, describing how practitioners learn from one another and how the CISO Global Study connects CISO experience, academic research and industry evidence.
The posts offer marketers a memorable way to question security priorities and a view of how shared research might inform practice.
Dan Haagman’s recurring argument is that cyber resilience is a thinking and design problem before it is a buying problem.
Read more
Two priorities run through the posts: reduce the conditions that make attacks consequential instead of adding controls, and build the case for that approach with practitioners rather than for them. A third, quieter priority is the method: Haagman treats unscripted conversation and challenge from peers as ways to sharpen the ideas.
Ask what should no longer be true, not what to buy next
In an unscripted fireside conversation with Kai Feng Thia at CISO Singapore, Haagman asked what a CISO would do first if the cyber budget became zero tomorrow.
Read more
The point was not to argue for less investment in cybersecurity, but to separate investment from thinking.
Without the option of buying another control, the underlying system comes into view: the conditions organisations keep paying to defend, temporary exceptions that have become permanent architecture, and cases where detection and response compensate for complexity, access or dependencies that could be removed.
Haagman calls cybersecurity an increasingly additive discipline — more controls, more telemetry, more capability — and argues that resilience can also come from subtraction.
Detection, response and recovery remain essential, but getting better at fighting fires is different from designing an environment where fewer fires take hold.
The post’s memorable reframe is the question a CISO might ask: not “What should we buy next?” but “What should no longer be true?” Haagman makes the direction concrete: remove unnecessary privilege, eliminate dependencies, challenge exceptions and simplify operating models.
Build the resilience evidence with the CISO community, not about it
Haagman’s second recurring argument is about how the work gets done.
Read more
They argue that the scale and pace of change across cybersecurity and AI demand deeper thinking about the field’s enduring problems, and that addressing them requires bringing together industry experience, the CISO community and academic research.
Their post about becoming a Research Fellow at the University of Warwick, working with Prof.
Carsten Maple and colleagues to expand the CISO Global Study into a wider global research programme, gives this argument an institutional footing.
The ambition is applied: develop and test ideas against real-world experience, build evidence over time and return that learning to the CISO community that helped create it.
A separate post places the programme within months of academic research and in-field exploration, with the CISO Global Study due to be formally announced.
Haagman points to a prior collaboration with Carsten Maple on the original UK Breaches Survey and frames their reconnection around a shared focus they call Resilience in Practice. Their larger aim is an applied industry research consortium, reflecting Haagman’s view of research as an ongoing exchange with practitioners, not a one-off report delivered to them.
Keep the ideas open to challenge: unscripted conversation as a working method
A third, more procedural priority runs through the posts: Haagman treats dialogue as a way to test arguments, not broadcast conclusions.
Read more
They deliberately left the CISO Singapore fireside unscripted, setting a direction and difficult questions before letting the conversation and audience shape what followed.
They also credit others with changing their thinking: the research has brought challenge and refinement in both directions, producing a level of shared learning they say they have not experienced before.
The Melbourne post takes a similar approach: Haagman writes about being in the eye of a storm while facing an opportunity to change course and do meaningful work together.
The clearest illustration is the fireside itself, built around a deliberately uncomfortable proposition and left unscripted.
In the Melbourne post, Haagman agrees with Sunil Rane’s view that the field does not yet grasp what is coming or what is quietly building in the background, from geopolitics to organised crime, all fuelled by AI.
Haagman endorses this as a guest’s argument, not as a finding of their own.
For a clear example of how Dan Haagman thinks about resilience rather than tooling, open this piece.
Read more
It puts the guidance to a test with a single practical exercise.
Dan Haagman describes an unscripted fireside conversation with Kai Feng Thia at CISO Singapore, built around one deliberately uncomfortable question: if the cyber budget became zero tomorrow, what would you still do first?
The answer is not a shopping list.
They separate investment from thinking: without the option of buying another control, you are forced to examine the system underneath.
The post walks through the questions that follow: what conditions are we continually paying to defend, which temporary exceptions have quietly become permanent architecture, and where are detection and response compensating for complexity, access, or dependencies that could be removed?
The argument is that cybersecurity has become an additive discipline—more controls, more telemetry, more capability—while resilience can also come from subtraction: removing unnecessary privilege, eliminating dependencies, challenging exceptions, and simplifying operating models.
Detection, response, and recovery stay essential, but they draw a sharp line between getting better at fighting fires and designing an environment where fewer fires take hold.
The closing reframe is the memorable part: the more powerful CISO question may be not what to buy next, but what should no longer be true.
For brands planning a campaign
A thought-leadership collaboration on cyber resilience can build directly on the Zero-Budget Test as a repeatable format: a recorded or written conversation in which a named practitioner answers the same question in the context of their own environment. It gives the partner firm a concrete, quotable device rather than a general call for better security.
This piece explains the institutional side of the work: who Dan Haagman builds with and what the research programme aims to produce.
Read more
It shows how the resilience message is backed by a study, not just opinion.
Dan Haagman writes about being invited to become a Research Fellow at the University of Warwick, working with Prof.
Carsten Maple and colleagues to expand the CISO Global Study into a wider global research programme.
The stated motivation is that the scale and pace of change across cybersecurity and AI demand deeper thinking about enduring problems, bringing together industry experience, the CISO community, and academic research.
They note that they first worked together years earlier through the original UK Breaches Survey, and frame the reconnection around a shared focus on Resilience in Practice.
The post places this within a larger effort to build an applied industry research consortium: developing and testing ideas against real-world experience, building evidence over time, and returning that learning to the CISO community that helps create it.
For brands planning a campaign
For a consulting firm, this supports a research-led collaboration rather than a commentary-only one: a co-produced study, survey, or practitioner working group could become a credible joint asset. It also signals whom to target: CISOs and security leaders who would contribute to and use the findings.
Open this to see Dan Haagman in conversation rather than in essay form, with a fuller account of the resilience work: what is changing and what practitioners should watch.
Read more
This post introduces the second part of a discussion between Dan Haagman and Sunil Rane, recorded live in Melbourne.
Haagman describes being deeply immersed since then in the cybersecurity challenge of resilience, and notes that the CISO Global Study will soon be formally announced after months split between academic research and in-field exploration.
They credit exceptionally bright minds with challenging and refining the thinking, and describe a level of shared learning they had not experienced before.
In the conversation, they agree with Sunil Rane's point that the field does not yet grasp what is coming, or what is quietly building in the background, from geopolitics to organised crime, all fuelled by AI.
The post closes on the idea of being in the eye of a storm while also facing one of the greatest opportunities to shift approach and do meaningful work together.
For brands planning a campaign
This is a natural entry point for a conversational format—a podcast, live panel, or recorded dialogue—that explores resilience with a second practitioner rather than presenting a single-voice argument. A partner could sponsor or host the dialogue and use the 'eye of the storm' framing to introduce it.
Dan Haagman argues that resilience is not only about adding security controls.
Read more
Their “Zero-Budget Test” asks what a CISO would do first without new spending, directing attention to unnecessary privilege, dependencies, permanent exceptions and complexity that make attacks more consequential.
Uses a challenging opening question and an unscripted fireside conversation to draw out the argument.
For brands planning a campaign
A thought-leadership collaboration could turn the test into a practical exercise for security leaders: identify a costly or risky condition to remove, then explain how that change affects resilience. The post presents this as a complement to detection, response and recovery, not a replacement.
Haagman describes bringing together CISO experience, industry practice and academic research through the CISO Global Study and a wider research programme at the University of Warwick.
Read more
They emphasize testing ideas against real-world experience and returning learning to the CISO community.
Frames research as an ongoing exchange between practitioners and academics, with learning built over time.
For brands planning a campaign
A research-led collaboration could suit a firm able to contribute practical cases or help translate evidence into usable guidance for CISOs. Ask for the study’s findings and methods before developing the collaboration.
Cybersecurity change, uncertainty and collaboration
In a discussion recorded live in Melbourne, Haagman connects cybersecurity resilience with a changing threat environment, including geopolitics, organized crime and AI.
Read more
They present uncertainty as both a challenge and an opportunity for shared work, and say research conversations have challenged and refined their thinking.
Uses a recorded conversation and personal reflection to introduce the topic.
For brands planning a campaign
A discussion or interview could explore how security leaders make decisions amid change, grounded in specific evidence or experience. Ask for examples to anchor the conversation.
Dan Haagman's posts show a research fellowship at the University of Warwick and a fireside conversation at CISO Singapore.
University of Warwick
Employment
Invited to become a Research Fellow at the University of Warwick, working with Prof.
Read more
Carsten Maple and colleagues to expand the CISO Global Study into a wider global research programme.
Original disclosure
I was invited to become a Research Fellow at the University of Warwick, working with Prof. Carsten Maple and colleagues to expand the CISO Global Study into a wider global research programme.
Start with the CISO Singapore conversation, where Haagman introduces the “Zero-Budget Test”: what would a security leader still do first if the cyber budget became zero tomorrow?
Read more
They make the case for resilience through subtraction: remove unnecessary privilege, eliminate dependencies and challenge exceptions that have become permanent architecture.
Next, read the University of Warwick research fellowship post, which explains how they want to test these ideas by bringing CISO experience, industry practice and academic work together in the CISO Global Study and a wider applied research programme that returns its findings to the practitioner community.
The Melbourne discussion post adds the wider backdrop—geopolitics, organised crime and AI—and shows them using unscripted conversation as a working method rather than a broadcast format.
Follow for cyber resilience, security strategy and research built with security leaders rather than delivered to them.
Thangaraju and Haagman make the same core argument: security outcomes depend on system design, not on adding controls or blaming users.
Read more
In “Your people aren't the weakest link.
Your system design is,” Thangaraju advocates phishing-resistant MFA, password managers and just-in-time access over awareness quizzes and standing privilege—the same subtraction logic Haagman applies in the Zero-Budget Test.
Both posts open by challenging a familiar security framing and replace it with something readers can act on.
Thangaraju writes mainly for security founders and product teams about buying behaviour and go-to-market, using Gartner research and the divide between practitioners and decision-makers to make the case. Haagman writes for security leaders in the CISO community, placing the same design argument within a shared research programme, without a sales pitch.
Bohler and Haagman both work in cybersecurity, conduct research through formal institutions and invite the security community to take part.
Read more
Bohler's posts recruit cybersecurity professionals for a Walsh College doctoral dissertation on mindfulness and motivation, and the burnout and turnover it is meant to address.
Haagman's Warwick post describes expanding the CISO Global Study with academic colleagues.
Both incorporate practitioner experience into their work.
Bohler focuses on workforce wellbeing—the motivation and burnout of individual security staff—and uses survey invitations with eligibility criteria and participation links. Haagman focuses on organisational resilience, using reflective essays to explain an argument rather than request data.
Harvey and Haagman both examine how rapid technological change affects professional judgement, and argue against letting the tools make the decisions.
Read more
Harvey's post on Google's move from Gems to Skills insists that teachers and students retain agency over why, when and how AI supports learning, warning against quietly transferring those decisions to platforms. Haagman's Zero-Budget Test poses a similar question to security leaders, shifting attention from what to buy next to which conditions should no longer be true.
Harvey focuses on education: AI in classrooms, teacher and student agency, pedagogy and the Google Innovator programme, where the posts describe project work and a graduate community. Haagman focuses on enterprise cybersecurity for security leaders, with a research programme rather than classroom practice.
For a cybersecurity consulting firm weighing a thought-leadership collaboration on cyber resilience, the audience information points to a focused LinkedIn placement among senior security practitioners rather than a broad-reach campaign.
Read more
Dan Haagman's LinkedIn audience measured 4,432 followers on 8 October 2026, a specialist-sized following suited to a senior, topic-led voice.
The posts show the intended reader, not who actually reads them: a written recap of an unscripted fireside with Kai Feng Thia proposing a "Zero-Budget Test" (what a CISO would still do first if the cyber budget became zero); an announcement of a Research Fellow appointment at the University of Warwick and expansion of the CISO Global Study; and a conversation with Sunil Rane about geopolitics, organised crime and AI.
The conversational, reflective formats avoid product or vendor content and point toward CISOs, security leaders, and academic or policy researchers.
Before committing budget or a delivery target, ask for recent LinkedIn analytics, including impressions, engagement rate, follower seniority, job function, geography, and industry, plus video performance data and results from comparable long-form thought-leadership posts on resilience topics.
If reaching a specific professional segment is central to the campaign, ask whether any audience survey or documented reader data exists.
Dan Haagman's posts do not mention a sponsorship programme, media kit, rate card or partnership inquiry route.
Read more
They describe collaborative formats rather than commercial ones: a deliberately unscripted fireside with Kai Feng Thia at CISO Singapore, framed around a "Zero-Budget Test" question; a recorded discussion with Sunil Rane made in Melbourne; and a Research Fellow appointment at the University of Warwick alongside Prof.
Carsten Maple, covering the CISO Global Study and work towards an applied industry research consortium.
The Warwick role is an academic research position, not a brand placement, and the recorded conversations are not presented as paid partnerships.
Buyers planning a thought-leadership collaboration should ask about available formats, disclosure expectations and terms.
Cybersecurity consultancy collaboration: a cybersecurity consultancy wants thought leadership on cyber resilience.
Read more
Decision: strong fit on topic, format, and audience, with commercial terms unproven.
Dan Haagman brings a named, repeatable device rather than a generic security message: the Zero-Budget Test asks what a CISO would still do first if the cyber budget became zero, turning resilience into questions about unnecessary privilege, permanent exceptions, and complexity that detection is compensating for.
That question is already packaged for conversation, and the published fireside with Kai Feng Thia shows it working in front of senior practitioners.
The institutional side is equally concrete: a Research Fellow appointment at the University of Warwick with Prof.
Carsten Maple, expanding the CISO Global Study into a wider research programme and working toward an applied industry research consortium.
A consultancy collaboration can be anchored to that programme rather than resting on opinion.
The conversational format also has precedent in the Sunil Rane discussion recorded in Melbourne, giving a partner a second proven shape for the collaboration.
Audience details point in the same direction: 4,432 LinkedIn followers observed on 8 October 2026, and content written for CISOs, security leaders, and academic or policy audiences.
Before committing, confirm commercial terms, disclosure, and deliverables; the posts provide no sponsorship formats, media kit, rate card, or inquiry route.
The fit rests on topic, format experience, and audience alignment, not documented performance.
When to choose a specialist
Security-tooling vendor campaign: a security-tooling vendor wants a product-led webinar and comparison series that benchmarks a defensive product against named alternatives, demonstrates the interface, and drives sign-ups to a free trial for IT administrators who manage endpoint controls.
Read more
Decision: poor fit based on the posts.
None of the three shows product evaluation, benchmark testing, hands-on tooling demonstrations, vendor-neutral comparison, or instructional content for administrators.
The material is argument-led and senior: a fireside argument about subtraction, a research fellowship announcement, and a reflective discussion about geopolitics, organised crime, and AI.
The only audience measure is a follower count observed on 8 October 2026; the writing targets CISOs, security leaders, and academic or policy audiences rather than a measured IT-administrator segment.
No commercial format is documented, so a product-comparison webinar would be an untested change in both subject and format.
This does not mean Dan Haagman would refuse such work; it means the posts do not demonstrate the ability, audience access, or delivery format a buyer would be commissioning.
A worked campaign example
For the cybersecurity consultancy collaboration, run a six-to-eight week programme built around the Zero-Budget Test.
Phase one: a recorded, unscripted fireside between Dan Haagman and a CISO named by the client, opening with one question: what would a CISO still do first if the cyber budget became zero tomorrow?
The client keeps the raw recording and receives a written recap modelled on the published Kai Feng Thia post, plus two short vertical clips for LinkedIn.
Phase two: publish a follow-up article or hold a second session applying the subtraction questions to one anonymised client environment: which temporary exceptions have become permanent architecture, and where do detection and response compensate for removable complexity or privilege?
End with a practical checklist a security leader can use internally.
Phase three: connect the output to the CISO Global Study by inviting the client's practitioner contacts to contribute to the research, with permission and disclosure confirmed in advance.
The angle works because the Zero-Budget Test is already a quotable, repeatable format; the Warwick fellowship and CISO Global Study provide a research anchor beyond commentary; and the Kai Feng Thia and Sunil Rane posts show precedent for the conversational format.
Before committing, confirm whether Dan Haagman will front client-branded content, what disclosure is required, whether study findings or participation can be referenced, who owns the recordings, and the rate and deliverables.
If the client needs measured seniority, geography, or engagement data, ask for the relevant analytics.
Choose Anand Thangaraju when the collaboration centers on security buying behavior, product validation versus purchase approval, or retiring the idea that people are the weakest link.
Read more
The posts are sharper than Dan Haagman’s on how security teams and vendors misread the buyer, and on replacing awareness training with system-design fixes such as phishing-resistant MFA, password managers, and just-in-time access. Thangaraju is the better choice for LinkedIn-native, myth-busting content aimed at security founders, vendors, or security leaders who must defend a purchase or programme internally.
The tradeoff is scope and institutional proof.
Anand Thangaraju’s posts here are two standalone arguments.
They show no research programme, study, convening format, or documented collaboration vehicle comparable to Dan Haagman’s connection to the CISO Global Study and the University of Warwick research fellowship.
Haagman’s posts show a repeatable conversation format and a research anchor; Thangaraju’s show sharp written positions but not a broad resilience programme.
Before choosing, ask for evidence of audience, engagement, and commercial availability; the posts don’t establish those.
Choose William Bohler when the campaign goal is cybersecurity workforce well-being, burnout, retention, or practitioner research participation rather than resilience architecture.
Read more
The posts are direct calls for a dissertation survey on mindfulness and motivation among cybersecurity professionals, with specific eligibility criteria and a defined audience of employed practitioners, mostly in the Eastern U.S. time zone and with ten years or fewer in the field. That makes Bohler a better choice for a study-recruitment partnership, an employee well-being initiative, or content that asks practitioners to contribute their own experience.
The tradeoff is narrowness.
The two posts repeat the same survey request and eligibility list.
They show no thought leadership on cyber resilience, system design, or CISO strategy, and no fireside, article, or multi-format publishing practice.
Against Dan Haagman’s Zero-Budget Test and research-programme connection, William Bohler offers a specific workforce-research call to action but not a broad editorial platform for a campaign focused on cyber resilience.
Ask for evidence of audience size, engagement, and willingness to front commercial content; the posts don’t establish those.
Choose Dr Michael Harvey only if the buyer’s task shifts from cybersecurity resilience to AI in education.
Read more
The posts argue about teacher and student agency as AI moves from Gems to Skills, and about the Google Innovator Programme as a responsibility to keep asking better questions.
That’s a strong fit for an AI-in-education thought-leadership campaign, especially one aimed at teachers, school leaders, and edtech product teams.
For the current cybersecurity consulting campaign, Harvey is not the better choice on topic.
The tradeoff is domain mismatch.
The posts are education-focused: pedagogy, student agency, teacher agency, and AI product changes for learning.
They show no cybersecurity, resilience, CISO, or security-buying content.
Compared with Dan Haagman, Dr Michael Harvey would require the client to change the subject and audience, not just the format.
Before choosing, ask for evidence of audience, engagement, and commercial-format experience; the posts don’t establish those.
Dan Haagman's LinkedIn posts here include a fireside conversation with Kai Feng Thia at CISO Singapore introducing the Zero-Budget Test; an announcement of a Research Fellow appointment at the University of Warwick and work expanding the CISO Global Study; and an introduction to part two of a Melbourne discussion with Sunil Rane.
A LinkedIn follower count was observed on 8 October 2026.
The posts do not show publication dates, and no transcripts, video, study findings, additional posts, engagement metrics, audience composition data, media kit, rate card, or partnership terms are published here.
Similar-creator comparisons use posts from the named creators.
Dan Haagman's posts here do not identify a signature book, show, or business; that does not mean none exists.
