John Pryor

They make the priority argument in their own words: the law tells companies to treat customer data as the number one concern, while securing a firm's operations and competitive edge matters more.

• Pryor attributes the mismatch to three factors: GDPR fines push compliance to the top of the agenda; security teams protect systems and personal data rather than business-critical knowledge; and many firms do not know which intangible assets they hold.
• What disappears quietly, in their account, includes trade secrets, data-derived insights such as segmentation and pricing models, AI and machine-learning models with their training data, strategic plans and acquisition targets, and supplier and partner intelligence.

The post opens with Martin's comparison: losing customer data is like a burglar photocopying your bank statements while you are out; losing operational capability is like being punched in the face and having your legs broken. Pryor uses the contrast to frame the JLR breach as a competitive loss, not a privacy incident.

Read original

Because the assets are never written down or classified, the business cannot prove they exist—and proving their existence is the first step in defending them.

• They note the uncomfortable consequence: these secrets are lost, leaked or copied through neglect, not malice.
• Pryor also identifies a gap in the advice market: intellectual property law firms concentrate on patents and trademarks, cybersecurity firms on breaches, and internal teams are busy keeping the business running.
• That leaves nobody covering the day-to-day management of intangible assets.
• Their proposed fix is strategic rather than legal or technical: identify what is truly valuable and vulnerable, structure knowledge so it is usable and protectable, build incentives and processes that reduce leakage, and add resilience without bureaucracy.

The post names the assets plainly: a pricing algorithm fine-tuned over years, customer insights buried in a CRM, supplier relationships that create an edge, undocumented know-how the team uses daily, data no one else has collected, and the way the business does things. It calls these trade secrets and says most owners cannot defend them legally, operationally or strategically.

Read original

Email addresses and phone numbers are generally available, so they cannot be trade secrets.

• Non-public insight can qualify: customer preferences, buying behaviour, pricing history, internal notes, strategic relationship information and churn risk.
• They apply the three conditions information must meet under UK and international trade-secret law — it is not generally known or readily accessible, it has commercial value because it is secret, and reasonable steps have been taken to keep it confidential — then turn each into a question readers can answer about their own operations.

The post ends with four diagnostic questions: How many people across the business have access to the CRM?

• Has the information been classified?
• Have CRM users been trained on trade secrets?
• Do they have confidentiality agreements or contracts in place?

Read original

Trust and expertise are personal, so client relationships very likely follow the individuals; that is much of what such a move is about.

• Confidential material is different: lawyers retain a continuing duty of loyalty and confidentiality after leaving a firm, including not using or disclosing trade secrets learned in earlier work.
• The risk of inadvertent disclosure in new engagements is real.
• They apply the same test as elsewhere — CRM information is a trade secret only if it is not widely known, gives a competitive edge and has been protected by reasonable measures — and conclude that copying or transferring client records, notes or internal strategy documents in that situation would likely amount to misappropriation.
• The post also asks what sits in people's heads rather than on systems.

Pryor names Samsung, Apple and Collision Communications as clients when noting that client relationships would very likely move with the lawyers, then contrasts that with the duty that continues to bind them when dealing with former clients.

Read original

They identify the missing support as strategic guidance on managing intangible assets in the real world—not legal advice or tech solutions—and typically list actions in short numbered or flagged points before closing with questions aimed at readers' own businesses.

• There is a tension in how they use the law: they criticise compliance-led thinking for crowding out competitive protection, yet rely on the statutory trade-secret test to decide what counts as protectable.
• They also argue that protection should not come at the cost of how the business works: confidentiality measures should not kill collaboration or agility.

The structure repeats: a blunt problem statement in the reader's own words, a stack of concrete examples, a turn that reframes the issue, then four or five short items or questions readers can act on. Pryor's remedies include classifying information, training staff, and setting up incentives and processes rather than relying on NDAs and firewalls alone.

Read original · Original 2 · Original 3 · Original 4

It names the assets in everyday language before any legal test and states the problem Pryor returns to: businesses hold valuable knowledge they cannot prove or protect.

The post lists what small and mid-sized businesses own without calling it a trade secret: a pricing algorithm refined over years, customer insights in a CRM, supplier relationships that create an edge, undocumented know-how the team uses daily, proprietary collected data, and the way the business does things.

• It states the uncomfortable part plainly: these are trade secrets, and most owners cannot defend them legally, operationally or strategically.
• NDAs and firewalls are not enough; defence depends on knowing what you have, why it matters and how to protect it without killing collaboration.
• Pryor points to a gap rather than a villain: IP lawyers concentrate on patents and trademarks, cybersecurity firms on breaches, while internal teams are busy running the business.
• Without specificity, you cannot prove a secret exists, so secrets are lost through neglect rather than malice, the post argues.
• The proposed fix is deliberately non-technical: identify what is valuable and vulnerable, structure knowledge so it is usable and protectable, build incentives and processes that reduce leakage, and add resilience without bureaucracy.

For brands planning a campaign

A knowledge inventory — “name the five things your business would struggle to replace” — fits this creator’s framing better than a legal-compliance angle. A campaign could take the form of a self-assessment or audit worksheet, moving readers from vague worry to a written list of assets that later content on CRM classification, access controls and exit procedures can build on.

Newcomers get a three-part legal test and a four-question self-audit in one short read, making it a companion to the broader trade-secrets post rather than an alternative.

This post separates two categories of CRM data that are often lumped together.

• Email addresses and phone numbers are generally available and so cannot be trade secrets.
• Non-public insights can be: customer preferences, buying behaviour, pricing history, internal notes, strategic relationship information and churn risk.
• Pryor sets out the three conditions information must meet to qualify as a trade secret under UK and international law: it is not generally known or readily accessible, it has commercial value because it is secret, and reasonable steps have been taken to keep it confidential.
• The post closes with four diagnostic questions readers can apply immediately: how many people across the business can reach the CRM, has the information been classified, have users been trained on trade secrets, and do users have confidentiality agreements in place.

For brands planning a campaign

This is the most directly usable piece for a data-heavy audience because it turns an abstract principle into an audit.

• A campaign can borrow the structure — distinguish what is public, apply the three-part test, then run the four questions — and use the audit questions as a lead-capture checklist or workshop agenda.
• It also makes a case for discussing internal access and training rather than perimeter security, suiting vendors selling governance, knowledge management or CRM hygiene rather than breach prevention.

This is the strongest statement of Pryor’s central argument and the piece to lead with when readers need a case for reframing the problem, not the mechanics of fixing it.

Pryor builds the argument around a quoted comparison from Ciaran Martin, the former head of the National Cyber Security Centre, about the Jaguar Land Rover data loss: losing customer information is like someone photocopying your bank statements while they are out, whereas losing operational capability is like being punched in the face and having your legs broken.

• The post argues that the law pushes companies to treat personal data as the top priority, while securing operations and competitive edge matters more.
• It names three reasons for the misalignment: regulatory pressure under GDPR, security teams that focus on systems and personal data rather than business-critical knowledge, and firms that do not know which intangible assets they hold.
• It then lists what insiders, competitors or careless collaboration can take quietly: trade secrets such as formulas, processes and designs; data-derived insights like segmentation and pricing models; AI and machine learning models with their training data; strategic plans and acquisition targets; and supplier and partner intelligence.
• The post ends with a one-line claim about a codebase being worth billions, attributed in the text to a named figure as “Elon”.

For brands planning a campaign

Use this as the provocation piece for an executive audience, paired with a practical inventory so the argument does not stop at alarm.

• The post leans on a third-party quote and an unattributed-enough reference to a well-known technology figure; a campaign should paraphrase the underlying point rather than repeat the borrowed lines, and avoid implying Jaguar Land Rover or the quoted official endorse anything.
• The five asset categories listed here provide a ready-made structure for a content series, one per category.

It applies the abstract principle to a real, named situation, helping readers see how the rules work before applying them to their own hiring or departure process.

The post uses the move of twenty-one intellectual property lawyers from one firm to another as a test case, asking what goes and what stays.

• Pryor separates personal trust and expertise from confidential material: client relationships very likely follow the individuals, which is much of what the move is about, and the post names Samsung, Apple and Collision Communications as clients in view.
• It then states the constraint: lawyers retain a continuing duty of loyalty and confidentiality after leaving, including not using or disclosing trade secrets learned in earlier work, and cannot simply resume old conversations with former clients.
• The risk of inadvertent disclosure in new engagements is real.
• On CRM records, the post repeats the qualifying test: information is a trade secret only if it is not widely known, gives a competitive edge and has been protected by reasonable measures.
• Copying or transferring client records, notes or internal strategy documents would, in Pryor’s reading, likely amount to misappropriation.
• The post closes with a prompt about containing value loss and a shortened link.

For brands planning a campaign

A campaign on employee mobility — offboarding checklists, onboarding rules about prior employers’ confidential material, and the difference between relationships and records — can use this as its opening scenario. The piece is anchored to a specific firm move and names client organisations, so a brand campaign should use the underlying question about what travels with people rather than reproduce the news framing or client names.

Because these assets are never named, the business cannot prove they exist—and proving their existence is the first step in defending them. They point to a gap in the market: IP law firms work on patents and trademarks, cybersecurity firms work on breaches, and internal teams are busy running the business, leaving nobody to manage everyday intangible assets.

Uses everyday examples, states the uncomfortable counterpoint bluntly, then offers a short numbered remedy list instead of a technical framework.

For brands planning a campaign

A campaign built around helping businesses inventory and protect their knowledge fits this framing.

• The hook: you cannot protect what you have not named.
• Content that takes readers from vague unease to a written list of their valuable assets would land with the audience Pryor writes for.

Examples: Source 1

They list three reasons companies get this wrong: GDPR fines push compliance to the top of the agenda, security teams protect systems and personal data rather than business knowledge, and most firms do not know which intangible assets they hold. Assets that can disappear quietly include trade secrets, data-derived insights such as pricing models, AI and machine-learning models with their training data, strategic plans and M&A targets, and supplier and partner intelligence.

Opens with an outside expert quote, names the causes of the problem in a short list, then lists the asset types at risk.

The claim is made forcefully but is an argument about priorities, not a measured finding about any single breach.

For brands planning a campaign

Lead with this argument when addressing senior leadership rather than a security team: it shifts the conversation from compliance to competitive resilience and makes asset visibility the practical next step. Pryor cites named external authorities, so a brand partnering with them should supply experts or primary sources rather than generic commentary.

Examples: Source 1

Email addresses and phone numbers are generally available, so they cannot be trade secrets.

• Non-public insights can be: customer preferences, buying behaviour, pricing history, internal notes, strategic relationship information, and churn risk.
• They then apply the three-part test—the information is not generally known or readily accessible, has commercial value because it is secret, and has been kept confidential through reasonable steps—and ask four operational questions: how many people have CRM access, has the information been classified, have users been trained on trade secrets, and do they have confidentiality agreements?

Starts with a definitional test, moves to a self-check list, then invites comments.

For brands planning a campaign

This is the most directly actionable material in the corpus. A self-audit—a short structured assessment readers can run against their own CRM—is a natural campaign asset and conversion step for a wider programme on protecting business knowledge.

Examples: Source 1

Trust and expertise are personal, so client relationships will very likely move with them; duties of loyalty and confidentiality continue after leaving a firm.

• They note that CRM information counts as a trade secret only if it meets the test and has been protected as a secret, so copying client records, notes, or internal strategy documents in that situation would likely be misappropriation.
• The post also raises the awkward question of what sits in people's heads rather than on systems.

A news hook leads into practical legal questions and a short synthesis.

The LinkedIn post is commentary that points to a longer piece by the author; only the commentary text appears here.

For brands planning a campaign

Partner moves, senior hires, and departures are live risk moments. Content for legal, HR, and leadership audiences on onboarding and offboarding—what may and may not move with a person—is a distinct entry point to the same subject.

Examples: Source 1

A blunt headline states a problem in the reader's own words, short flagged lines pile up concrete examples, an uncomfortable turn reframes the issue, and the post closes with a short numbered list or questions aimed at the reader's own operation. The writing avoids legal jargon, uses everyday analogies such as a burglary for a data breach, and often ends by inviting comments.

For brands planning a campaign

Formats that match this style include short diagnostic checklists, self-assessment questions, and example-led explainers rather than formal legal guides. Asking readers to examine their own business and answer four questions is closer to Pryor's register than a long technical whitepaper.

Examples: Source 1 · Source 2 · Source 3 · Source 4

Both start from the claim that companies misunderstand their own exposure and that the real problem is awareness rather than rules: Meelhuysen says the most dangerous sentence in 2026 is "we're probably not affected by NIS2", and argues most firms do not have a compliance problem, they have an awareness problem. Both use a blunt diagnosis, a short list of what readers overlook and a direct question back to the reader, and both anchor the argument in a specific piece of law.

Meelhuysen writes about scope and readiness under one EU cyber-regulation regime, framing the issue through turnover thresholds, fine ceilings and penalty exposure, and points readers to a self-assessment to decide whether they are in scope.

• Pryor addresses a different question: which internal assets are valuable enough to protect at all.
• They reach for the trade-secret test rather than a regulatory threshold.
• Meelhuysen also links the topic to a named software product; Pryor’s posts focus on management arguments and self-check questions.

Read original · Original 2

Both writers assume readers are responsible for protecting something valuable and need to know what to do about it on Monday morning, and both end with mitigation steps rather than analysis.

Abtar writes inventory-style surveys — ten numbered threats with a mitigation paragraph each, for pharmaceuticals and for financial services — offering breadth and ready-made classification of a sector’s risks.

• Pryor focuses on one asset class, trade secrets and business knowledge, and argues that companies have aimed their effort at the wrong target; the legal test for what qualifies serves as a filter, not a checklist of threats.
• Abtar’s posts also carry a company hashtag, while Pryor’s read as independent arguments.

Read original · Original 2

The 398-day certificate lifetime dropping to 47 days is a practical wake-up call, much as Pryor turns a breach or a law firm move into a prompt to rethink what a business holds and how it protects it. Both write short, plainly structured posts that end with a clear next step for the reader.

Trawick’s posts are tied to a vendor’s certificate-management and post-quantum offerings, name the company, and point to a webinar and product links; the argument centers on technical infrastructure and lifecycle automation.

• Pryor’s posts focus on strategic questions of management, incentives and classification.
• Trawick names specific industry timelines — 47-day certificates by 2029, quantum-safe migration by 2030 — while Pryor works from a legal definition of what counts as protected.

Read original · Original 2

The two posts reviewed do exactly that for NIS2: they set out who is covered (essential and important entities across energy, healthcare, logistics, manufacturing and digital infrastructure), the size thresholds of 50 or more employees or €10M+ turnover or balance sheet total, and the extension of scope to critical suppliers and service providers in the value chain.

• They argue that the real risk is assuming you are out of scope, and that most companies have an awareness problem rather than a compliance problem.
• Each post closes with a self-assessment route, giving a legal, insurance or advisory sponsor whose offer is a readiness check or evidence pack a working tool to put in front of readers from the first post.

The material covers regime scope, fines and readiness, not the individual assets inside a business.

• It does not name what specifically has to be protected — no pricing algorithm, CRM insight, supplier relationship or undocumented know-how — or address what happens when someone holding that knowledge leaves.
• A sponsor whose message is “name the five things your business could not replace” would have to supply the inventory framework, classification test and departure angle, losing the concrete asset examples that make the posts liftable as written.
• The posts also point to Meelhuysen’s own self-assessment offer, so a sponsor should agree how its tool relates to that offer rather than assume the content stands alone.

Examples: Source 1 · Source 2

Abtar’s posts enumerate threats in detail.

• For pharmaceuticals: intellectual property theft of formulations and research data, ransomware, clinical trial data breaches, supply chain vulnerabilities, IoT and medical device risk, data-integrity compromise, employee training gaps, state-sponsored attacks and biomedical espionage.
• For financial services: advanced persistent threats, cryptocurrency risk, distributed denial of service, insider exploitation, mobile banking weaknesses, regulatory compliance, cloud risk, identity theft, misuse of machine learning, and supply chain attacks.
• Each entry pairs a threat with mitigations — access controls, encryption, audits, backups, vendor assessments and training — making the posts suited to an awareness campaign, training module or sector-risk explainer where breadth across named threats is the point.

These are survey lists.

• They describe threats and standard controls but do not prompt readers to assess their own operations.
• They offer no definition of a trade secret, classification test or self-check.
• A campaign aiming to get executives to name and protect specific assets would gain breadth but lose the instrument.
• Both the pharmaceutical and financial-services posts are dated April 2024; ask for current material and confirmation that the framing still holds.
• Before discussing budget, ask for audience size, reach and whether Abtar takes sponsor work.

Examples: Source 1 · Source 2

The posts announce a dated industry change — the CAB Forum approving a reduction in the maximum lifespan of publicly trusted SSL/TLS certificates from 398 days to 47 days by 2029 — connect it to the move toward post-quantum cryptography by 2030, and draw the operational consequence: certificate discovery, inventory and lifecycle management have to be automated.

• The second post carries the same argument into an event, promoting a webinar on cryptographic visibility and control alongside an acquisition and an expanded product stack.
• For a certificate-management or PKI sponsor, that is the right shape: a regulatory change with a date, a practical consequence for the reader’s operations, and a path to a product conversation.
• It also shows how to carry a supply-side story into event promotion.

Both posts promote a named security company and link to its own calls to action.

• A sponsor would be buying into someone else’s product narrative or negotiating around it, rather than commissioning neutral content about its own offer.
• The implied reader is a practitioner responsible for certificates, not an executive deciding where to spend.
• The webinar post is tied to a specific past event and will date quickly.

Examples: Source 1 · Source 2