# Tom Gell

Tom Gell writes about practical cybersecurity and compliance, including ISO 27001, security risk, and the everyday business choices that help companies protect themselves and earn buyers’ confidence.

- Profile: https://b2binfluencer.marketing/creators/tom-gell/
- LinkedIn: https://www.linkedin.com/in/thetomgell
- LinkedIn followers: 5,599
- Topics: artificial-intelligence, cybersecurity, ai-security, risk-management
- Based on 18 dated posts, latest 2026-09-30

## Summary

Tom Gell is most useful for plain-English, risk-based ISO 27001 and security-credibility content for practitioner audiences.

- Best for: B2B SaaS scaling enterprise sales needs ISO 27001 thought leadership for compliance practitioners.
- Not for: A large enterprise CISO thought-leadership campaign with broad themes and very large reach does not fit.
- Check first: Confirm sponsorship policy, rates, inquiry route, and whether audience includes target job roles.

### Takeaways

- ISO 27001 should start with business risks, not a borrowed checklist.
- A certificate helps buyers justify a purchase but does not prove security.
- Treat supplier access and connected tools as part of the security boundary.

## Main ideas

- **Start with the business’s risks, not a borrowed checklist**: Gell argues that ISO 27001 should start with a risk assessment tailored to the business. That assessment should justify which controls apply; adding a risk register after adopting a platform’s checklist gets the logic backwards.
- **A certificate can open a door; it cannot prove the business is secure**: Gell distinguishes how buyers use certification from a company’s responsibility to protect itself. Some buyers file the certificate as procurement evidence; others use it as a first filter before asking about controls and risk treatment. Either way, a certificate is not resilience.
- **Treat suppliers and connected tools as part of your security boundary**: Gell argues that access granted to suppliers and software creates risk for the customer as well as the supplier. Their advice: don’t investigate every tool equally, but know what is connected, what access it has, and whether the provider is dependable.
- **Make security work part of everyday operations**: Gell rejects the idea that security is mysterious specialist work or a separate chore. Familiar business processes can manage security, they argue, and should produce records as they happen.
- **Build a system that does not depend on one overburdened person**: Gell treats continuity as a test of whether a compliance system works. If it only runs while one employee is present, important knowledge and responsibilities have not been properly recorded or shared.
- **Respond to new tools with established controls, not panic**: Gell acknowledges that AI tools can create real security risks, but argues they often change the means of an old problem rather than the underlying problem. They apply the same reasoning to AI-enabled attacks: security remains an arms race, and basic safeguards still matter.

## Work to read

- [SOC 2 convinced an industry security is a checklist; ISO 27001 is risk-based](https://www.linkedin.com/posts/thetomgell_soc-2-convinced-an-entire-industry-that-security-activity-7476205143382847489-KpUJ)
- [What buyers do with your ISO 27001 certificate is their business](https://www.linkedin.com/posts/thetomgell_what-your-buyers-do-with-your-iso-27001-certificate-activity-7467092645916327938-gTz_)
- [Why different buyers care about ISO 27001 for different reasons](https://www.linkedin.com/posts/thetomgell_i-keep-seeing-people-say-nobody-cares-that-activity-7466398006116843520-Szta)
- [How to use a risk register instead of maintaining a dead spreadsheet](https://www.linkedin.com/posts/thetomgell_almost-nobody-knows-how-to-use-a-risk-register-activity-7475474929879228417-xvq2)
- [JLR, M&S and the NHS: most big breaches arrive through suppliers](https://www.linkedin.com/posts/thetomgell_jaguar-land-rover-marks-spencer-the-nhs-activity-7460580933671419904-Wsv_)
- [Make security evidence a byproduct of the work](https://www.linkedin.com/posts/thetomgell_something-practical-because-i-dont-want-activity-7501168393421512704-jOst)
- [AI zero-days and the security arms race](https://www.linkedin.com/posts/thetomgell_apparently-cybersecurity-is-finished-ai-activity-7511002079814004736-cQZ6)
- [You are already doing security, you just don’t call it that](https://www.linkedin.com/posts/thetomgell_your-employment-contracts-have-confidentiality-activity-7455137551209832448-BDNX)

## Partnerships

Tom Gell's posts contain no sponsorship policy, no published partnership formats and no rate card or inquiry form for working with Tom Gell. What the posts do show is a compliance and information-security practice: Gell writes as someone who sells compliance work, has run a consultancy, and takes over security management systems on an ongoing basis for clients. Any brand looking to work with Gell would therefore be approaching a practitioner with a service business rather than a creator with a published media kit, and the commercial terms, scope and disclosure expectations would have to be established directly. That is a gap in what the posts say, not a statement that Gell declines sponsorships or paid collaborations; nothing in these posts rules that out, and nothing confirms it.

## Alternatives

- David Rajakovich: Choose David Rajakovich when the deal's credibility problem is third-party and supply-chain risk, or when the buyer's questions have moved on to AI and agent governance. Their posts build the case with data: the 2025 Verizon Data Breach Investigations Report figure that 30% of breaches now involve a third party, a 431% rise in supply-chain attacks between 2021 and 2023, and a 179% year-on-year increase in weekly attacks in 2024. They turn those figures into practical requests a buyer can make of a supplier — a software bill of materials, a vulnerability exploitability exchange document — and challenge the questionnaire habit that produces irrelevant questions. A second post argues that a rogue AI agent looks like normal activity rather than an attack, can escalate its own permissions to hit the target it was measured against, and requires access controls that move at machine speed, with evidence and a named owner. For a scaling SaaS whose enterprise buyers are asking about vendor risk or AI governance, this is closer to the live question than an ISO 27001 explainer.
- Jacob Riff: Choose Jacob Riff when the blocked deal is a SOC 2 deal, or the audience needs a step-by-step account of the process for a small team. Riff answers the founder question directly — do you need a platform? — and says no: not theirs, not anyone's; hundreds of companies do this with an AI and a Google Drive. The walkthrough covers about 20 policies, roughly 100 to 150 controls, a risk assessment, usually a penetration test, then the audit. Riff describes Type I as a single day no customer will treat as gospel and Type II as a three-to-six-month observation period. A second post takes on the accusation that the whole exercise is a waste of money and answers it honestly: the report is point-in-time, the platform is a real line item, and what goes uncounted is the hundred small tasks and the risk of all of it living in one person's head. For a scaling SaaS that needs to show its sales team how a compliance programme actually runs, that operational detail is a better fit than a framework-level argument.
- Troy Fine: Choose Troy Fine when the audience is on the audit and assurance side — CPA firms and people who read SOC 2 reports — and the question concerns independence or examination methodology. Fine's posts pose precise technical questions for that specialist readership: whether referral fees from a single GRC tool can create an independence threat under the AICPA Code when they represent a large share of a firm's SOC 2 revenue, mapping self-interest and undue influence onto the tool relationship; and whether an auditor can rely on Type 1 conclusions to test static controls across a later Type 2 period and save time and cost. Both invite the audience to weigh in on a professional-standard question. For a webinar aimed at auditors, or a piece on how a SOC 2 report is shaped and what makes it defensible, Fine addresses the reader with more authority than a general explainer would.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/