# Rory Canavan

Rory Canavan writes about IT asset management (ITAM), software licensing and vendor audits, and the role of asset data in managing security and AI risks. Their LinkedIn posts also promote ITAM resources and consulting services.

- Profile: https://b2binfluencer.marketing/creators/rory-canavan/
- LinkedIn: https://www.linkedin.com/in/rorycanavan
- LinkedIn followers: 15,572
- Median of last 8 posts: 9 reactions, 3 comments (checked 2026-11-02)
- YouTube: https://www.youtube.com/channel/UC-emx_Q26jgdPLWE0dVMd_A
- Topics: artificial-intelligence, cybersecurity, ai-governance
- Based on 8 dated posts, latest 2026-10-05

## Summary

They are most useful for ITAM, software licensing, vendor audit, and AI risk thought leadership.

- Best for: A software asset management and vendor-risk consultancy wanting thought-leadership collaboration on ITAM and audits.
- Not for: A consumer software brand wanting paid LinkedIn posts with demographic targeting and direct purchase calls.
- Check first: Confirm recent post reach, engagement, follower breakdown, and whether sponsorship formats exist.

### Takeaways

- An ambush audit can arrive as a sales pitch, health check, or technical discussion.
- A survey found 32% of audited companies pay more than $1 million to resolve findings.
- The IBM and BMC dispute involved a managed service provider selling competing software.

## Main ideas

- **The vendor audit that never announces itself**: Canavan picks up a new piece of terminology from LicenseFortress, which calls a routine licensing review an "Ambush Audit", and argues the term is new while the tactic is not. The pattern Canavan describes is a vendor-initiated information-gathering exercise that arrives as a sales pitch, a technical discussion or a health check and ends as a compliance claim, a financial demand or a forced purchase. What makes it work, in Canavan's account, is that it carries none of the signals that trigger internal escalation: no official audit notice, no defined scope, no procedural boundaries, and nothing that alerts legal or executive leadership. In that window the organisation volunteers information it would never have handed over had a formal letter arrived first, and by the time legal is involved the vendor already holds the data it needs to build its claim. Canavan traces the practice to ERP vendors running what were then called soft audits since at least 2020.
- **You cannot govern what you have not inventoried**: Canavan reads major breaches as asset management problems rather than purely cybersecurity ones. The argument is that the perimeter can hold while regulated data still walks out through a third party, so if an organisation does not know which third-party applications hold its regulated data, which vendors have access to which systems, and what the contractual obligations around that access are, its risk register is missing its most consequential entries. Canavan's closing line makes the reframe explicit: "You don't have an ITAM problem - you have a risk problem that involves IT."
- **AI risk is a governance failure, not a model failure**: Canavan works through IBM's 2026 Cost of a Data Breach Report and argues the headline number is not the important one. The finding Canavan singles out is that 92% of organisations that experienced an AI-related breach lacked proper AI access controls at the time, which Canavan reads as evidence that the wiring around the model, not the model itself, is the weak point. The underlying disciplines that have governed software entitlement for decades, inventory, ownership, classification and access governance, are in Canavan's account the same disciplines AI risk management now demands, which makes the asset management function a natural home for AI risk visibility.
- **An "optimised" asset management programme can still fail an AI-readiness test**: Canavan argues the AI gap is about process maturity, not AI governance. Even organisations that placed themselves in the top tier of traditional asset management maturity were not AI-ready in the survey Canavan discusses, which is the detail Canavan finds most unsettling. What changes when AI enters the estate, in this reading, is not the fundamental discipline: the inventory still needs to be accurate, current and reconciled, ownership still needs assigning, and data quality still needs governing. What changes is the pace, the breadth of asset types and the cross-functional dependency on that data, and a programme built on periodic snapshots, manual reconciliation and a single system of record cannot keep up. Canavan adds that most organisations discover the gap through an audit finding, a budget surprise or an AI governance question they cannot answer, at which point building maturity under pressure costs more than building it ahead of the curve.
- **Contract clauses are only as strong as your own visibility**: Canavan uses a single legal dispute to argue that a contract term is worthless without independent knowledge of your own estate. The scenario Canavan draws out is not exotic: a managed service provider runs your infrastructure, your incumbent software vendors have contracts with that provider, and the provider has its own software to sell, so the commercial incentive to consolidate is structural and the information asymmetry is significant unless your own function keeps a current record of what software runs where, on what terms, and what displacement would actually cost. Canavan's summary is that you cannot negotiate your way out of a risk you have not mapped.
- **Vendors' own system activity can be metered as your overage**: Canavan describes tracing a Microsoft capacity charge inside their own environment and argues that the vendor's own system activity was being counted against the customer. The account owner runs Microsoft 365 only, with no Power Platform, in the single default environment Microsoft provisions, yet was alerted that the tenant had used 100% of its Dataverse File capacity. Canavan notes that Microsoft moved solution metadata from database to file reporting in April, with storage enforcement beginning on 9 November, that the first support reply was AI-generated and offered a temporary capacity extension, which Microsoft's documentation describes as a bridge while capacity add-ons are bought, and that Microsoft's later reply confirmed the reclassified metadata was not excluded from entitlement and that the figures could not be reconciled. Canavan traced the usage to the AsyncOperation table, Microsoft's system job log, at 11.4GB across about 1,526 jobs, every one owned by SYSTEM, roughly 7.5MB per job, and a separate provisioning job that failed 11 times with "CPU exceeded threshold", with no known link between the two.
- **Turning the argument into a test someone can run before signing**: Canavan's method is consistent: open with a published finding, reframe the problem as asset management, then hand over a named, self-contained decision tool rather than a general service pitch. The AI Justification Test is a free two-page cheat sheet of ten questions for any AI business case, each with a good sign and a red flag, four of which are gates that stop the AI element whatever the total score: problem fit, cost of being wrong, data rights, and regulatory and contractual position. Two of the ten questions are framed in asset management terms. The same pattern appears elsewhere, with a Negotiating with Goliath white paper on ten ITAM processes and a CRO and ITAM white paper, and the reader-facing artefacts usually sit in the comments rather than in the post body.
- **The mapping method reaches outside IT**: Canavan applies the same standards-mapping approach in a different function, which shows the method is not confined to software licensing. The post is short and asks for help rather than making an argument, so it is a single data point rather than a developed position, but it does show a working preference for mapping a function's processes against a published standard and then having practitioners review the result.

## Work to read

- ["Ambush Audit": the licensing review that was never called a review](https://www.linkedin.com/posts/rorycanavan_licensefortress-has-a-new-name-for-what-most-activity-7520439915457724416-cgXN)
- [Four of August's five largest breaches walked out through a vendor](https://www.linkedin.com/posts/rorycanavan_itam-riskmanagement-risk-activity-7511386066470297602-B43G)
- [The AI breach statistic that sits on page 40](https://www.linkedin.com/posts/rorycanavan_ibms-2026-cost-of-a-data-breach-report-puts-activity-7521506781236449280-9tk6)
- [The $1.6 billion clause that took a decade to mean anything](https://www.linkedin.com/posts/rorycanavan_bmc-ibm-samcharter-activity-7511027477704667137-Rj1M)
- [When the vendor's own system jobs are billed as your overage](https://www.linkedin.com/posts/rorycanavan_microsoft-samcharter-activity-7522987672072626176-BlBY)
- [The AI Justification Test: ten questions to ask before signing](https://www.linkedin.com/posts/rorycanavan_sp-global-market-intelligence-says-circa-activity-7521965585417768960-eyW-)
- [Why an "optimised" ITAM programme can still fail an AI-readiness test](https://www.linkedin.com/posts/rorycanavan_enterprise-management-associates-ema-surveyed-activity-7520788110150975488-gnW_)

## Brand relationships

- **LicenseFortress** (disclosed_partnership)
- **SAMCharter** (disclosed_partnership)
- **ITAM Surgery** (disclosed_partnership)
- **Microsoft** (mention)
- **IBM** (mention)
- **BMC Software** (mention)
- **Enterprise Management Associates** (mention)

## Partnerships

The reviewed material documents no sponsorship, paid-placement, or brand-partnership formats from Rory Canavan, so a buyer should not budget on the assumption one exists. What the posts do show is a consistent promotion pattern for Rory Canavan's own commercial resources rather than third-party sponsorships: each substantive post ends by pointing readers to a company whitepaper or service, with the link placed in the comments rather than the body. Examples named in the posts include the Negotiating with Goliath whitepaper on ITAM processes, the CRO & ITAM whitepaper on ITAM and risk management, a free two-page AI Justification Test, and a two-day ITAM Surgery assessment. Several posts also carry their own branded hashtags (#SAMCharter, #HRCharter, #ISO30201), which identify the programmes being promoted rather than marking a paid partner. Distinct from that, one post asks for volunteer reviewers to check HR process mappings against ISO 30201 — an unpaid call for collaboration, not a partnership offer. Because no sponsor policy, media kit, rate card, or partnership inquiry route was found in the reviewed evidence, this section does not list formats and does not link an inquiry route; treating a profile page as a partnership channel would overstate what is documented. For a thought-leadership collaboration brief, the practical implication is that any arrangement would need to be negotiated directly with Rory Canavan's business, and its terms cannot be inferred from the posts reviewed. This is an absence of evidence in the material reviewed, not a finding that sponsorship is never accepted.

## Alternatives

- Paul Borochin: Choose Paul Borochin for a campaign about AI security, software supply-chain attacks, or liability when AI agents cause harm. His post on the LiteLLM compromise shows how a malicious package could expose credentials; another examines the legal uncertainty around damage caused by autonomous agents.
- Jake “EJ” Celler: Choose Jake “EJ” Celler for a campaign aimed at defense contractors navigating CMMC. His posts trace the program’s development and recount a conversation with a former DoD cybersecurity official, including an example of sensitive aircraft design information on a small contractor’s laptop.
- Leonardo Martins: Choose Leonardo Martins for a strategic AI-and-data campaign aimed at leaders in regulated financial-market organisations. His post argues that proprietary data history, permission to use it, and an established audit record can be more defensible than access to a particular AI model. It also sketches a path from data retrieval to AI-native products.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/