# Thomas McClendon

Thomas McClendon writes about practical cybersecurity for business owners, including the questions owners should ask, preparation for cyberattacks, and recovery when technology fails. McClendon is the author of *7 Cybersecurity Questions Every Business Owner Should Ask*.

- Profile: https://b2binfluencer.marketing/creators/thomas-mcclendon/
- LinkedIn: https://www.linkedin.com/in/cyberavenger
- LinkedIn followers: 18,278
- Topics: cybersecurity, risk-management, incident-response
- Based on 12 dated posts, latest 2026-10-07

## Summary

They are most useful for plain language cybersecurity content that helps business owners ask better questions and prepare for disruption.

- Best for: Cybersecurity awareness training firms co-branding webinars for small business owners.
- Not for: Technical practitioner campaigns for IT and security staff or endpoint and backup vendors.
- Check first: Confirm audience breakdown and comparable business owner content results before contacting them.

### Takeaways

- Cybersecurity is a business decision for the owner, not an IT task.
- A backup is not a recovery strategy.
- Being with the FBI or insured is not a recovery plan.

## Main ideas

- **Cybersecurity is a business decision for the owner, not an IT task**: Across the reviewed writing, the central argument is that security failures at small companies stem from decisions the owner makes—or leaves unmade. An IT person may configure the firewall, manage the computers, reset passwords, and handle backups. But that doesn’t answer how much downtime the business can survive, what happens if customer information is stolen, which risks are acceptable, or who is ultimately responsible for keeping the business operating. McClendon’s answer to each question is the business owner. Owners don’t need to understand every protective technology, but they do need to know what to ask the people who do.
- **Teach owners to ask questions, not become experts**: McClendon describes their book as a guide for readers who don’t need to become cybersecurity experts, only to learn enough to ask the right questions. The intended reader is the owner who believes technology is handled because there’s an IT person, the computers and email work, and files appear to be backed up. The problem isn’t that owners don’t care about security; it’s that they don’t know which questions to ask. So the book is organized around questions, not a technical manual.
- **A backup isn’t a recovery strategy**: Owners often conflate having backups with being able to recover. Servers, hardware, and technology will fail; the question is what happens to the business when they do. In the case described, the technology failed but the recovery strategy held, and preparation made the difference. The post leaves owners with one testable question: do we hold a copy, or a thought-through plan? It focuses on that distinction rather than the technical details of the restore.
- **Being “with the FBI”—or insured—isn’t a recovery plan**: McClendon warns that public reassurance after an attack can itself pose a risk. In the case described, a local business shut down after a cyberattack and told customers it was working with the FBI. That can create a false sense of security: investigators document the crime but don’t restore systems, recover data, or prevent lost revenue. McClendon advocates preparation, sound security practices, and suitable cyber insurance arranged well before an incident. The post distinguishes investigation from recovery and presents insurance and preparation as complementary, not interchangeable. It’s the only post here that discusses insurance; ask what advisory services, if any, McClendon offers in this area.
- **Disciplined response matters more than perfect defence**: A shorter, operator-facing strand argues that perfect security is rare and disciplined response carries a business through an incident. The sequence: restore fast, verify hard, keep moving; then protect what matters, document what happened, improve the system, repeat. Written for practitioners rather than owners, the posts set out a response posture without case details, timelines, or a named environment. They show the other side of McClendon’s audience, alongside the owner-education material.

## Work to read

- [Announcing the book: 7 Cybersecurity Questions Every Business Owner Should Ask](https://www.linkedin.com/posts/cyberavenger_cybersecurity-smallbusiness-businessowners-activity-7511472847299616768-cBe-)
- [Cybersecurity is a business issue, not an IT issue](https://www.linkedin.com/posts/cyberavenger_cybersecurity-businessowners-smallbusiness-activity-7511825475162435584-NK9d)
- [Backup and recovery strategy are not the same thing](https://www.linkedin.com/posts/cyberavenger_cybersecurity-businessresilience-disasterrecovery-activity-7496784415079981056-4l6V)
- [Being 'with the FBI' is not a recovery plan](https://www.linkedin.com/posts/cyberavenger_cybersecurity-smallbusinessrisk-cyberinsurance-activity-7397053024029859841-AEMK)
- [Resilience for the people doing the work](https://www.linkedin.com/posts/cyberavenger_cybersecurity-incidentresponse-blueteam-activity-7429566381505028096-rRRT)

## Brand relationships

- **Citadel Networks** (mention)
- **Amazon** (mention)

## Partnerships

McClendon's five posts, published between 19 November 2025 and 2 October 2026, offer business-owner-facing cybersecurity commentary and promote the book *7 Cybersecurity Questions Every Business Owner Should Ask*. The only commercial link is an Amazon purchase link for the book. The posts publish no partnership terms, sponsorship formats, rate card, audience or pricing specifications, or inquiry route, and document no paid sponsorships, co-branded webinars, or brand collaborations. For a co-branded webinar on cybersecurity questions for small-business owners, the subject is a close fit; ask directly whether a partnership is available and confirm scope, deliverables, exclusivity, and fees. LinkedIn is the only public contact channel identified; it is a general profile link, not a verified partnership intake.

## Alternatives

- Frank Policastro: Choose Policastro for campaigns aimed at executives, finance leads, or IT and security leaders, focused on recovery budgets rather than small business owners. Two posts describe a Pondurance partnership with HSB - Hartford Steam Boiler in which selected managed detection and response offerings now include up to $250,000 in warranty coverage for eligible expenses following a covered security breach, alongside 24/7 MDR and immediate access to incident-response specialists. The other post argues that cybersecurity is a leadership issue rather than a technology one and lists the questions executives should be able to answer: do we understand our risk, can we detect an attack quickly, do we know how we will respond, and can we keep the business operating. A co-branded session on resilience and financial recovery after an incident, pitched to the leadership team and featuring a named insurance-backed example, would build on the strengths shown in the posts rather than rely on borrowed framing.
- Bradley Richards: Choose Richards when a campaign needs to explain the operational side of resilience—why known vulnerabilities stay unpatched and privileged accounts go unprotected—to an IT-adjacent or security-operations audience rather than owners. Richards's posts examine the mechanics: ransomware groups exploiting known Fortinet VPN vulnerabilities while organisations rely on MFA alone, and a PAYLOAD ransomware case that used compromised domain credentials and Active Directory Group Policy to disable security controls without dropping malicious software. The posts also offer a diagnostic question that translates directly into a webinar: if a known vulnerability existed in your environment today, how confident are you that it would be identified, prioritized and remediated before attackers found it? The stated position that identity protection, privilege management and recovery readiness matter as much as prevention gives a session a clear spine.
- Anne Bisagno: Choose Bisagno when a campaign centres on hybrid work, device trust and policy rather than a list of questions for owners. Bisagno's posts argue that bring-your-own-device programmes are a governance initiative balancing productivity, security, compliance and employee experience, not an IT decision, and that Device Trust—validating the security posture of the device as well as the user's identity—reduces risk without a wholesale infrastructure rebuild. The second post sets out a phased route toward Zero Trust aligned to real business goals, aimed at business leaders and touching on regulated industries and Microsoft 365. A co-branded session on governing personal devices and building toward Zero Trust incrementally would draw on framing that already exists.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/