Rory Canavan

The pattern Canavan describes is a vendor-initiated information-gathering exercise that arrives as a sales pitch, a technical discussion or a health check and ends as a compliance claim, a financial demand or a forced purchase.

• What makes it work, in Canavan's account, is that it carries none of the signals that trigger internal escalation: no official audit notice, no defined scope, no procedural boundaries, and nothing that alerts legal or executive leadership.
• In that window the organisation volunteers information it would never have handed over had a formal letter arrived first, and by the time legal is involved the vendor already holds the data it needs to build its claim.
• Canavan traces the practice to ERP vendors running what were then called soft audits since at least 2020.

Canavan cites the Rising Cost of Software Compliance survey finding that 32% of audited companies pay more than $1 million to resolve findings, and argues that the settlement figure understates the real cost once internal resource drain, legal oversight, operational disruption and long-term commercial concessions are counted. The organisations that handle this best, Canavan writes, are not the ones that fight hardest once the claim arrives but the ones that never volunteer what they do not have to.

Read original

The argument is that the perimeter can hold while regulated data still walks out through a third party, so if an organisation does not know which third-party applications hold its regulated data, which vendors have access to which systems, and what the contractual obligations around that access are, its risk register is missing its most consequential entries. Canavan's closing line makes the reframe explicit: "You don't have an ITAM problem - you have a risk problem that involves IT."

Canavan cites McKesson, described as a $403 billion pharmaceutical distributor, which filed an SEC Form 8-K in August confirming unauthorised access and data exfiltration through third-party applications it did not operate. Using PKWARE's 2026 breach tracker, Canavan reports that in four of August's five largest breaches (McKesson, Baxter International, Heights Finance and Unlimited Technology Systems) the regulated data sat on infrastructure the breached organisation did not run, across different sectors and attack groups.

Read original

The finding Canavan singles out is that 92% of organisations that experienced an AI-related breach lacked proper AI access controls at the time, which Canavan reads as evidence that the wiring around the model, not the model itself, is the weak point. The underlying disciplines that have governed software entitlement for decades, inventory, ownership, classification and access governance, are in Canavan's account the same disciplines AI risk management now demands, which makes the asset management function a natural home for AI risk visibility.

Alongside IBM's record global average of $4.99 million, Canavan reports shadow AI incidents more than doubling from 20% to 43% of breached organisations, regulatory fines in roughly one in five of those cases, and AI-related breaches averaging $5.33 million, $630,000 above the global mean. Canavan quotes IBM's own conclusion that root causes were often structural, involving compromised APIs, applications and cloud misconfiguration, indicating governance failures rather than model risk.

Read original

Even organisations that placed themselves in the top tier of traditional asset management maturity were not AI-ready in the survey Canavan discusses, which is the detail Canavan finds most unsettling.

• What changes when AI enters the estate, in this reading, is not the fundamental discipline: the inventory still needs to be accurate, current and reconciled, ownership still needs assigning, and data quality still needs governing.
• What changes is the pace, the breadth of asset types and the cross-functional dependency on that data, and a programme built on periodic snapshots, manual reconciliation and a single system of record cannot keep up.
• Canavan adds that most organisations discover the gap through an audit finding, a budget surprise or an AI governance question they cannot answer, at which point building maturity under pressure costs more than building it ahead of the curve.

Canavan cites an Enterprise Management Associates survey of 203 IT professionals: 71.9% of organisations report broad operational AI adoption, but only 22.2% describe their ITAM function as AI-ready.

• Within the top traditional maturity tier, only 9.4% used runtime asset data, against 62.2% of the AI-ready group.
• The post closes by promoting an "ITAM Surgery", a two-day baseline across five process domains that produces a prioritised roadmap.

Read original

The scenario Canavan draws out is not exotic: a managed service provider runs your infrastructure, your incumbent software vendors have contracts with that provider, and the provider has its own software to sell, so the commercial incentive to consolidate is structural and the information asymmetry is significant unless your own function keeps a current record of what software runs where, on what terms, and what displacement would actually cost. Canavan's summary is that you cannot negotiate your way out of a risk you have not mapped.

IBM maintained AT&T's mainframes, which ran BMC Software, and IBM's contract contained a clause specifically prohibiting a switch to IBM's own software.

• A lower court found that IBM had secretly agreed to do exactly that while negotiating the contract that banned it, with damages of $1.6 billion.
• The US Supreme Court declined to hear the case in March 2025, ending it in IBM's favour on appeal, though Canavan notes the facts that produced the original judgment were not in dispute.
• The clause existed, in Canavan's reading, because someone understood the risk and tried to contractualise their way out of it; it took a decade of litigation to establish whether it meant anything.

Read original

The account owner runs Microsoft 365 only, with no Power Platform, in the single default environment Microsoft provisions, yet was alerted that the tenant had used 100% of its Dataverse File capacity.

• Canavan notes that Microsoft moved solution metadata from database to file reporting in April, with storage enforcement beginning on 9 November, that the first support reply was AI-generated and offered a temporary capacity extension, which Microsoft's documentation describes as a bridge while capacity add-ons are bought, and that Microsoft's later reply confirmed the reclassified metadata was not excluded from entitlement and that the figures could not be reconciled.
• Canavan traced the usage to the AsyncOperation table, Microsoft's system job log, at 11.4GB across about 1,526 jobs, every one owned by SYSTEM, roughly 7.5MB per job, and a separate provisioning job that failed 11 times with "CPU exceeded threshold", with no known link between the two.

The numbers Canavan reports are 10.92GB used against an entitlement of 0MB, and about 1,526 system-owned jobs averaging roughly 7.5MB each.

• Canavan's stated objection is an alert email that treats Microsoft's own system activity as the customer's capacity problem, and a support reply that points toward buying more capacity, when Microsoft has the data and tools to find the fault itself.
• The post ends with a practical instruction: tenants running Microsoft 365 only should check their Dataverse capacity report before 9 November.

This is the one post in the available set where Canavan investigates a live problem in their own environment rather than commenting on published research, litigation or a survey, which makes it the clearest demonstration of the reconciliation discipline the other posts advocate.

Read original

The AI Justification Test is a free two-page cheat sheet of ten questions for any AI business case, each with a good sign and a red flag, four of which are gates that stop the AI element whatever the total score: problem fit, cost of being wrong, data rights, and regulatory and contractual position.

• Two of the ten questions are framed in asset management terms.
• The same pattern appears elsewhere, with a Negotiating with Goliath white paper on ten ITAM processes and a CRO and ITAM white paper, and the reader-facing artefacts usually sit in the comments rather than in the post body.

Canavan opens with S&P Global Market Intelligence's estimate that around 42% of AI initiatives end up abandoned by their own corporate parents, then makes it concrete with an AI graveyard round-up: OpenAI shut down Sora in March, its Atlas browser was discontinued in August less than a year after launch, and Relay, a five-year-old AI workflow tool, closed the same month once larger platforms built the same automation into their own products. The two asset management questions in the test are whether software licence terms permit AI or automated access, and whether every AI agent is registered as an asset in its own right.

Read original · Original 2 · Original 3

The post is short and asks for help rather than making an argument, so it is a single data point rather than a developed position, but it does show a working preference for mapping a function's processes against a published standard and then having practitioners review the result.

Canavan reports completing a mapping of 29 HR processes against ISO 30201, the HR management systems standard, and asks for volunteers with HR experience to review a process or two, explicitly asking for shares to get the request beyond the account's usual IT audience.

Read original

It is the clearest single statement of the problem Canavan keeps returning to.

Canavan takes a new piece of terminology — LicenseFortress calling a routine licensing review an "Ambush Audit" — and uses it to describe a pattern they say is old: a vendor-initiated information-gathering exercise that arrives as a sales pitch, a health check or a technical discussion, and ends as a compliance claim, a financial demand or a forced purchase.

• The mechanism they emphasise is the absence of escalation signals.
• No official audit notice, no defined scope, no procedural boundaries, no trigger that alerts legal, so the organisation volunteers information it would never have handed over in response to a formal letter.
• They cite the Rising Cost of Software Compliance survey finding that 32% of audited companies pay more than $1 million to resolve findings, and argue the settlement figure understates the real cost once internal resource drain, legal oversight and long-term commercial concessions are counted.

For brands planning a campaign

A vendor-risk thought-leadership collaboration can use this as the opening argument: it names a specific, checkable commercial tactic, gives a cost figure, and turns a supplier relationship problem into an internal process discipline a client can act on.

Canavan cites McKesson's August SEC Form 8-K confirming unauthorised access and data exfiltration, and notes the entry point was third-party applications McKesson did not operate.

• They then cite PKWARE's 2026 breach tracker for the claim that in four of August's five largest breaches — McKesson, Baxter International, Heights Finance and Unlimited Technology Systems — the regulated data sat on infrastructure the breached organisation did not run.
• The argument is that the perimeter held and the data left anyway, which makes this an asset management problem rather than a purely cybersecurity one: you cannot govern what you have not inventoried, and third-party applications, vendor access and the contractual terms around that access are often missing from the risk register entirely.
• The closing line is "You don't have an ITAM problem - you have a risk problem that involves IT."

For brands planning a campaign

Useful for a campaign aimed at risk and compliance functions rather than IT alone — it gives a named-breach hook and a reframe (ITAM as the visibility layer in risk management) that a consultancy can own.

Canavan argues it is not in the model.

Working through IBM's 2026 Cost of a Data Breach Report, Canavan leads with the headline global average of $4.99 million and then moves to the finding they consider more important: 92% of organisations that suffered an AI-related breach lacked proper AI access controls at the time.

• They also report shadow AI incidents more than doubling from 20% to 43% of breached organisations, regulatory fines in roughly one in five of those cases, and AI-related breaches averaging $5.33 million — $630,000 above the global mean.
• Canavan quotes IBM's own conclusion that root causes were often structural, involving compromised APIs, applications and cloud misconfiguration, and reads that as a governance failure rather than model risk.
• The link they draw is that inventory, ownership, classification and access governance transfer directly from software licensing to AI systems.

For brands planning a campaign

Presents a numbers-led board-level angle: an AI governance gap that existing ITAM disciplines already answer, rather than a new tool purchase.

Canavan recounts the IBM and BMC dispute: IBM maintained AT&T's mainframes running BMC software, and its contract contained a clause specifically prohibiting a switch to IBM's own software.

• A lower court found that IBM had secretly agreed to do exactly that while negotiating the contract that banned it, with damages of $1.6 billion.
• The US Supreme Court declined to hear the case in March 2025, ending it in IBM's favour on appeal, though Canavan notes the facts behind the original judgment were not in dispute.
• Their reading is that a managed service provider running your infrastructure, whose own vendors have contracts with that provider, has a structural commercial incentive to consolidate, and that the information asymmetry is significant unless your own function keeps an independent record of what software runs where, on what terms, and at what displacement cost.
• They close with "You cannot negotiate your way out of a risk you have not mapped."

For brands planning a campaign

A ready-made case study for vendor-risk content: it shows that a non-displacement clause is only as strong as the independent visibility behind it.

Read it to see the reconciliation discipline Canavan advocates actually being carried out, line by line.

Canavan describes a Microsoft 365-only tenant with no Power Platform use being alerted that it had used 100% of its Dataverse File capacity: 10.92GB used against an entitlement of 0MB, in the single default environment Microsoft provisions.

• They note Microsoft moved solution metadata from database to file reporting in April, with storage enforcement starting 9 November, and that the first support reply was AI-generated and offered a temporary capacity extension, which Microsoft's own documentation describes as a bridge while capacity add-ons are bought.
• Microsoft's later reply, they say, confirmed the reclassified metadata was not excluded from entitlement and that the figures could not be reconciled.
• Canavan traced it: the AsyncOperation table, Microsoft's system job log, held 11.4GB across roughly 1,526 jobs, every one owned by SYSTEM, about 7.5MB each, so the vendor's own system activity was being metered as the customer's overage against a zero allowance.
• A separate Microsoft provisioning job, they add, failed 11 times with "CPU exceeded threshold," and they do not yet know whether the two are linked.

For brands planning a campaign

Strong credibility evidence for a collaboration: it demonstrates the kind of independent, granular verification a vendor-management practice sells, on a live and verifiable-sounding example.

It is the most immediately portable thing in the set.

Canavan opens with S&P Global Market Intelligence's estimate that around 42% of AI initiatives are abandoned by their own corporate parents, then makes it concrete with examples from an AI graveyard round-up: OpenAI shutting Sora in March, its Atlas browser discontinued in August less than a year after launch, and Relay, a five-year-old AI workflow tool, closing once larger platforms folded the same automation into their own products.

• The argument is that funding, scaling, competition and weak demand questions belong before the contract is signed, not after a shutdown notice arrives.
• The response is a free two-page cheat sheet, The AI Justification Test, of ten questions with a good sign and a red flag for each, four of which are gates — problem fit, cost of being wrong, data rights, and regulatory and contractual position — that stop the AI element regardless of total score.
• Two questions come from ITAM: whether licence terms permit AI or automated access, and whether every AI agent is registered as an asset.

For brands planning a campaign

A co-brandable asset: a short downloadable gate-test framework is cheap to produce, easy to sponsor, and gives an expert-backed checklist format a partner can distribute.

Canavan works through an Enterprise Management Associates survey of 203 IT professionals: 71.9% of organisations report broad operational AI adoption, but only 22.2% describe their ITAM function as AI-ready.

• The detail they single out is that even organisations placing themselves in the top traditional maturity tier were not AI-ready — only 9.4% of that optimised group used runtime asset data, against 62.2% of the AI-ready group.
• Canavan's reading is that the gap is process maturity rather than AI governance, and that what changes when AI enters the estate is not the underlying discipline — inventory still has to be accurate, current and reconciled, ownership assigned, data quality governed — but the pace, the breadth of asset types and the cross-functional dependency on that data.
• Programmes built on periodic snapshots, manual reconciliation and a single system of record, they argue, cannot keep up.
• Most organisations, they add, discover this through an audit finding, a budget surprise or an AI governance question they cannot answer.
• The post promotes an "ITAM Surgery" baseline across five process domains.

For brands planning a campaign

Pairs a citable research statistic with a defined service engagement, which suits content aimed at buyers who want a diagnostic before committing to a programme.

One post labels a vendor-initiated information-gathering exercise an "Ambush Audit" — an informal-looking review that ends in a compliance claim, a financial demand, or a forced purchase — and argues the label is new but the tactic is not, pointing to ERP vendors running what were called soft audits since at least 2020, where a sales pitch doubles as evidence collection and a health check doubles as a position paper.

• The post also cites a survey finding that 32% of audited companies pay more than $1 million to resolve findings.
• Another post uses the IBM and BMC mainframe dispute, where a contract clause barred switching software and a lower court found IBM had secretly agreed to do exactly that while negotiating the clause that banned it, to argue that a managed service provider running your infrastructure while selling competing software is a structural incentive rather than an exotic scenario.
• The damages were $1.6 billion, and the Supreme Court declined to hear the appeal in March 2025.

For brands planning a campaign

This is the most developed commercial theme in the set.

• A sponsorship could supply the case detail and data these posts currently draw from third-party research, co-produce an audit-preparation or vendor-negotiation playbook, or fund a short series on the tactics that precede a formal claim.
• It suits a sponsor with audit defence, licence optimisation, or vendor-negotiation expertise, and works best when the brand brings proprietary data rather than generic advice.

Examples: Source 1 · Source 2

A post on the McKesson breach notes the entry point was third-party applications the company did not operate, and that in four of the five largest August breaches the regulated data sat on infrastructure the breached organisation did not run; the conclusion is that you cannot govern what you have not inventoried, including third-party applications and the contractual terms around vendor access.

• A post on IBM's 2026 Cost of a Data Breach Report makes the same move for AI, holding on the finding that 92% of organisations that experienced an AI-related breach lacked proper AI access controls, and quoting IBM's own conclusion that the causes were structural — connected APIs, applications, cloud misconfiguration — rather than model risk.
• Shadow AI incidents and regulatory fines are cited as evidence that the wiring around the model, not the model, is the weak point.

For brands planning a campaign

Strong territory for a sponsor that wants to be associated with risk and governance arguments rather than product messaging.

• A collaboration could pair the consultancy's client data with the breach and AI findings, or support a board-level briefing on where asset data surfaces in AI governance and third-party risk.
• The argument lands harder when the sponsor can supply original incident or control data to sit alongside the published figures.

Examples: Source 1 · Source 2 · Source 3

Examples in the reviewed set include IBM's Cost of a Data Breach Report, an Enterprise Management Associates survey of 203 IT professionals, and S&P Global Market Intelligence figures on abandoned AI initiatives.

• The EMA post is the clearest structure: 71.9% of organisations have broad operational AI adoption, only 22.2% describe ITAM as AI-ready, and even the top traditional maturity tier falls short, with 9.4% of that group using runtime asset data against 62.2% of the AI-ready group.
• The IBM post uses the report's headline number to set up a finding further inside the report, and the S&P post uses a 42% abandonment figure to introduce a decision tool.

For brands planning a campaign

Useful for a sponsor wanting a commentator who can turn external benchmarks into a specific buyer decision.

• The pattern suits a brand that has its own survey or benchmark to place, because the posts show the argument will be built around it.
• Sponsors should expect the research to be steered toward an ITAM conclusion, so the fit is strongest where that conclusion is also the sponsor's position.

Examples: Source 1 · Source 2 · Source 3

The AI Justification Test is described as a free two-page cheat sheet of ten questions for AI business cases, each with a good sign and a red flag, and four gates — problem fit, cost of being wrong, data rights, and regulatory and contractual position — where any red flag stops the proposal.

• Two of the ten questions are framed in ITAM terms.
• The ITAM Surgery is a two-day baseline across five process domains that produces a prioritised roadmap.
• The posts also point to a Negotiating with Goliath white paper on ten ITAM processes and to a CRO and ITAM white paper.

The recurring structure is a research hook, a reframe that relocates the problem inside ITAM, and a named downloadable asset at the close.

For brands planning a campaign

A sponsor can co-produce the next diagnostic — a scoring sheet, gated checklist, or maturity baseline — with the writer supplying the framing and the brand supplying the data or tooling.

• The existing assets are short and self-contained, which makes them easy to adapt into a sponsored resource.
• Because the call to action usually sits in the comments, the destination and its measurement should be agreed before work starts.

Examples: Source 1 · Source 2 · Source 3 · Source 4

The account owner reports a tenant at 100% of Dataverse File capacity — 10.92GB used against a 0MB entitlement — while running Microsoft 365 only, with no Power Platform and only the default environment Microsoft provisions.

• The post explains that Microsoft moved solution metadata from database to file reporting in April, with storage enforcement beginning on 9 November, that the first support reply offered a temporary capacity extension, and that Microsoft later could not reconcile the figures.
• It then traces the usage to the AsyncOperation system job log at 11.4GB across about 1,526 jobs, all owned by SYSTEM and roughly 7.5MB per job, and argues the vendor's own system activity is being metered as customer overage against an allowance of zero.
• A separate provisioning job failure is flagged as possibly related.

This is the only post in the set where the writer describes tracing a problem inside their own environment rather than commenting on external research, litigation, or a survey.

For brands planning a campaign

The strongest demonstration of first-hand problem-solving in the reviewed set.

• A sponsor with a data or platform angle could commission a similar teardown of vendor billing, entitlement enforcement, or metering disputes, where the writer investigates a live case rather than summarising a report.
• The value depends on access to a real environment and real support correspondence, which is a harder thing for a sponsor to guarantee.

Examples: Source 1

This is the only subject in the set outside IT asset management, licensing, and security. It shows a repeatable standards-mapping method being applied in another function, but one post is a single data point.

For brands planning a campaign

Low direct relevance to an ITAM sponsorship, but it indicates the writer will apply the same mapping approach outside IT. A sponsor with HR, compliance, or cross-functional reach could test whether the method transfers to their own domain; for a software asset management brief, this is background rather than a campaign theme.

Examples: Source 1

Hashtags such as #SAMCharter, #ITAM, and #RiskManagement appear on the more commercial posts, and posts often end on a short aphorism. Two posts sit outside the research-led pattern: the Dataverse investigation and a notice asking readers to delete emails impersonating the writer after a password change.

For brands planning a campaign

Practical for planning.

• The stable structure means a sponsor can brief a post or short series around a single finding and a single destination asset, and can rely on the writer to supply the reframe and concrete case.
• Sponsors should also expect the reader-facing artefact to sit in the comments rather than in the post body, which affects how a campaign is tracked.

Examples: Source 1 · Source 2 · Source 3 · Source 4 · Source 5 · Source 6 · Source 7 · Source 8

The post does not state whether Canavan works for, advises, or otherwise contracts with LicenseFortress.

View example

The posts do not state Canavan's role or ownership.

View example

The post does not state whether the service is Canavan's own, an employer's, or a client's.

View example

No commercial or sponsorship relationship is stated.

View example

No relationship beyond mention is stated.

View example

No commercial relationship is stated.

View example

No relationship is stated.

View example

Both use a timeline to explain why a rule exists — Celler walks back through DFARS, the interim rule, the shift from five levels to three and the recent contractual pause, while Canavan traces soft audits and metadata reclassification to show how a current problem was set up years earlier. Both also interview or cite insiders to go behind the published position.

Celler's subject is CMMC and the defence supply chain, and the format leans on a recorded conversation with a former DoD cybersecurity chief, with compliance explained through a practitioner story about a welding shop holding F-22 design data on a laptop. Canavan stays in commercial software and asset management, builds arguments from published research rather than interviews, and closes each post at a named diagnostic or white paper.

Read original · Original 2

Both write in short, well-structured posts for a technical or risk-literate readership, and both treat security events as consequences of organisational choices rather than isolated attacks — Canavan reads four of August's largest breaches as inventory failures, Borochin reads a compromised AI gateway package as a supply-chain risk created by how software is now built.

Borochin's territory is emerging AI liability and hacking law, including the absence of rules covering autonomous agents and proposed legislation such as the RAISE Act, and the argument ends on a legal gap. Canavan routes almost every problem back to asset management and vendor licence exposure, and ends on a tool or framework the reader can apply before a contract is signed.

Read original · Original 2

Where Canavan argues that AI risk management is really inventory, ownership and access governance, Martins argues that an AI moat in a regulated industry is the compound of proprietary data history, regulatory permission and audit record rather than the model. Both use structured, numbered reasoning and concrete cost or scale figures to make the case.

Martins writes for exchanges, index providers, clearing houses and custodians, and addresses strategy at the level of a firm's data franchise, with a multi-part technical series behind the argument. Canavan works at the level of the estate in front of you — entitlements, contracts, breach entry points and vendor billing — and his posts point to short downloadable diagnostics rather than a build strategy.

Read original · Original 2

His post on the LiteLLM compromise shows how a malicious package could expose credentials; another examines the legal uncertainty around damage caused by autonomous agents.

These examples focus on AI security and liability, not IT asset management, software licensing, or vendor-audit preparation. Canavan is the more direct choice for those topics.

Examples: Source 1 · Source 2

His posts trace the program’s development and recount a conversation with a former DoD cybersecurity official, including an example of sensitive aircraft design information on a small contractor’s laptop.

The emphasis is CMMC history and protecting defense information, rather than software licensing, vendor audits, or ITAM-led risk management. Canavan is a closer fit for those subjects.

Examples: Source 1 · Source 2

His post argues that proprietary data history, permission to use it, and an established audit record can be more defensible than access to a particular AI model. It also sketches a path from data retrieval to AI-native products.

This is a strategy and product-positioning angle, not a practical guide to software asset management, licensing disputes, or audit readiness. Canavan is more relevant for those operational concerns.

Examples: Source 1 · Source 2