Tom Gell writes about practical cybersecurity and compliance, including ISO 27001, security risk, and the everyday business choices that help companies protect themselves and earn buyers’ confidence.
Tom Gell is most useful for plain-English, risk-based ISO 27001 and security-credibility content for practitioner audiences.
Best for
B2B SaaS scaling enterprise sales needs ISO 27001 thought leadership for compliance practitioners.
Not for
A large enterprise CISO thought-leadership campaign with broad themes and very large reach does not fit.
Key takeaways
ISO 27001 should start with business risks, not a borrowed checklist.
A certificate helps buyers justify a purchase but does not prove security.
Treat supplier access and connected tools as part of the security boundary.
Check first: Confirm sponsorship policy, rates, inquiry route, and whether audience includes target job roles.
Main ideas
Start with the business’s risks, not a borrowed checklist · A certificate can open a door; it cannot prove the business is secure · Treat suppliers and connected tools as part of your security boundary
Audience
5,599 LinkedIn followers · 12 LinkedIn posts reviewed in this section
Tom Gell writes about cybersecurity and compliance in terms business teams can use.
Their posts explain why ISO 27001 should start with a company’s risks, not a borrowed checklist, and why a certificate is not the same as being secure.
They connect security decisions to everyday operations: supplier access, evidence collection, and who owns the work.
Follow their writing for practical explanations that challenge compliance theatre without treating security as mysterious or hopeless.
Gell turns abstract security rules into concrete business decisions.
In one post, they contrast SOC 2’s evidence-and-criteria approach with ISO 27001’s risk-based logic: the risk assessment should guide which controls apply, rather than sit in a platform’s side tab after the checklist.
In another, they distinguish a certificate’s role in helping a buyer justify a purchase from the work that helps a company withstand an incident.
Their risk-register example makes the point operational: assess a supplier’s vague breach response or tools outside single sign-on, address the serious risks, and accept the small ones.
On AI notetakers, they argue that the underlying issue is data leaving the business, a risk that also exists with notebooks, screenshots, and exported files.
The recurring thread is to identify the real business problem, avoid confusing paperwork with protection, and make useful security practices part of ordinary work.
Tom Gell’s posts treat cybersecurity as ordinary business management and argue that compliance only helps when it drives real decisions.
Read more
They favor risk-led security over inherited checklists, practical controls over panic about new tools, and systems that keep working without one person holding everything in their head.
Start with the business’s risks, not a borrowed checklist
Gell argues that ISO 27001 should start with a risk assessment tailored to the business.
Read more
That assessment should justify which controls apply; adding a risk register after adopting a platform’s checklist gets the logic backwards.
Gell contrasts SOC 2’s evidence-and-criteria shape with ISO 27001’s risk-based approach, where the Statement of Applicability records decisions that need to be defended. They describe a thousand-row register opened only for an audit, then recast it as a tool for choosing what to address and what to accept.
A certificate can open a door; it cannot prove the business is secure
Gell distinguishes how buyers use certification from a company’s responsibility to protect itself.
Read more
Some buyers file the certificate as procurement evidence; others use it as a first filter before asking about controls and risk treatment. Either way, a certificate is not resilience.
Gell contrasts the buyer’s question—whether choosing a vendor can be justified to a boss—with the company’s question: could it survive something going wrong? The certificate may protect the sales pipeline; security protects the business.
Treat suppliers and connected tools as part of your security boundary
Gell argues that access granted to suppliers and software creates risk for the customer as well as the supplier.
Read more
Their advice: don’t investigate every tool equally, but know what is connected, what access it has, and whether the provider is dependable.
Gell links breaches at Jaguar Land Rover, Marks & Spencer, and the NHS to supplier relationships, then applies the lesson to SaaS products, browser extensions, and free AI tools employees may connect without formal review.
Gell rejects the idea that security is mysterious specialist work or a separate chore.
Read more
Familiar business processes can manage security, they argue, and should produce records as they happen.
Gell points to confidentiality clauses, code reviews, and password managers as security practices companies may already have. They suggest generating compliance records through leaver processes, scheduled access reviews, and supplier checks built into procurement.
Build a system that does not depend on one overburdened person
Gell treats continuity as a test of whether a compliance system works.
Read more
If it only runs while one employee is present, important knowledge and responsibilities have not been properly recorded or shared.
Gell describes a COO at a 30-person company who manages compliance alongside another job and doubts anyone else could take it over. Their response is to document the work and its ownership; a satirical job advert also highlights the risks of assigning compliance without budget, training, or a handover.
Respond to new tools with established controls, not panic
Gell acknowledges that AI tools can create real security risks, but argues they often change the means of an old problem rather than the underlying problem.
Read more
They apply the same reasoning to AI-enabled attacks: security remains an arms race, and basic safeguards still matter.
On AI notetakers, Gell compares recordings with older ways employees could take client information, such as emailing spreadsheets or photographing whiteboards.
Banning one tool, they argue, does not fix weak access controls, acceptable-use policies, leaver processes, or monitoring.
In another post, they urge readers not to let AI fears distract them from MFA.
This is the clearest statement of Tom Gell’s central argument: ISO 27001 is not SOC 2 with a different logo, because it starts with a risk assessment and a Statement of Applicability that has to be defended.
Read more
Start here to understand why risk-based compliance is a different discipline from checkbox certification.
Tom Gell contrasts SOC 2’s evidence-collection shape with ISO 27001’s risk logic.
They argue that GRC platforms built for checkbox frameworks put the risk register in a side tab, reversing the order: in ISO, risk should decide which controls apply.
The post includes the line “A checkbox tells you whether you did the thing.
It never once asks whether the thing was worth doing.”
For brands planning a campaign
For a B2B SaaS enterprise-sales security article or webinar, this is a strong opening argument for why risk-based compliance deserves separate thought leadership from generic certification content. It supports a session on moving from auditor evidence to genuine risk decisions.
It separates the commercial purpose of a certificate from the security purpose of an ISMS, a distinction sales teams often blur when talking to enterprise buyers.
Read more
It answers “what is the certificate actually for?”
Tom Gell says procurement asks “can I justify choosing this vendor to my boss?” while vendors should ask “if something goes wrong, will we survive it?”
They call the certificate procurement theatre and say security is what happens when the lights go off and nobody is watching.
The post closes by saying one protects the pipeline and the other protects the entire business.
For brands planning a campaign
Useful for a sales-facing piece that helps a security-credibility brand speak to buyers without overclaiming that certification equals resilience. It can frame a webinar around two conversations: winning the deal and surviving the incident.
It maps buyer motivations: some buyers treat ISO 27001 as the goal, others as a filter.
Read more
Read it to avoid treating all enterprise procurement teams as having the same security concerns.
Tom Gell disagrees with “nobody cares that you’re ISO 27001 certified.”
They split buyers into those who want a PDF to file and those who use the certificate as a filter before asking about risk treatment, incident response, and access controls.
Their conclusion: the certificate should never be the goal; being secure should be, with the cert as a byproduct and key.
For brands planning a campaign
Helps shape enterprise-sales messaging for different procurement postures. A campaign can use this to avoid a single “ISO wins deals” claim and show how to speak to box-ticking and deeper due-diligence buyers.
It turns the risk-register idea from abstract compliance language into a practical operating habit, with examples of what belongs on one.
Read more
It answers “what does a risk register actually do?”
Tom Gell describes the common failure: a thousand colour-coded rows maintained by someone who left, opened once a year for an auditor.
They give customer examples, including an MSP whose breach response times became vague and tools outside SSO that were not covered by MFA or passkeys.
They say the register should drive the programme: tackle the biggest risks, accept the smallest, scan for new ones, repeat.
For brands planning a campaign
Strong source for practical thought leadership or a webinar exercise. It gives enterprise-sales audiences a usable test: are we treating the risk register as admin, or as the map that decides where security effort goes?
It explains third-party risk using three public breach examples and connects them to the spreadsheets enterprise buyers send to smaller suppliers.
Read more
It answers “why do enterprise buyers put small vendors through so much due diligence?”
Tom Gell says JLR was breached through credentials at LG Electronics, M&S through an outsourced IT helpdesk run by TCS, and the NHS through Synnovis ransomware that cancelled over 10,000 patient appointments.
Their point is that large enterprises put smaller companies through due diligence because their weakest link is often someone they let in.
They add that companies usually think they use about 20 tools, but the figure is closer to 80, and most have no due diligence on them.
For brands planning a campaign
Useful for a security-credibility campaign aimed at enterprise sales: it explains buyers’ supplier-risk anxiety and supports content on third-party inventories, access levels, and supplier viability.
It offers a concrete fix for painful evidence collection, a common operational objection to ISO 27001 and SOC 2 programmes.
Read more
It answers “why is evidence collection so painful, and how do we make it stop?”
Tom Gell argues that painful evidence collection comes from treating it as a separate activity.
They suggest leaver evidence should come from the leaver process, access review from a rota with named owners and automatic reminders, and supplier assessments from procurement so nothing is onboarded without producing the artefact.
Then the yearly scramble largely disappears because everything is recorded as it happens.
For brands planning a campaign
Good source for a practical article or webinar segment on reducing compliance drag without lowering standards. It gives enterprise-sales readers a clear before-and-after they can apply to their own ISMS or vendor process.
It brings a concrete counterpoint to fatalism in the current AI-and-cybersecurity debate: does AI make security hopeless, or does it change the arms race?
Read more
Tom Gell mocks the idea that AI has finished cybersecurity.
They argue that the same AI can be turned on your own systems first, citing Google’s discovery of a bug attackers were preparing to exploit—and its patch before they could use it.
They call security an arms race: attackers still have to get past multiple controls, while companies with green compliance dashboards and unread policies were already exposed.
For brands planning a campaign
Lets a security-credibility campaign enter the AI risk conversation without doom. It supports content that pairs AI-enabled defence with basic controls like MFA and says AI raises the cost of security theatre.
It recasts security as a normal business discipline rather than an exotic technical specialism, helping business readers who feel locked out of the subject.
Read more
It answers: where do we already do security, and why does it feel harder than it is?
Tom Gell points to confidentiality clauses, peer code review, password managers and locked offices as everyday security work.
They say strong companies treat security like finance or hiring: with an owner, KPIs, regular reviews and a plan.
Struggling companies dismiss it as too technical and specialist.
Much of it, they write, is common sense wrapped in a framework and an annual audit.
For brands planning a campaign
Useful for top-of-funnel B2B SaaS content that makes security credibility feel achievable. It could open a webinar or article for non-specialist sales and ops audiences before moving into ISO 27001 risk decisions.
ISO 27001 as a risk-based system, not a checklist2
Risk registers as working decision tools2
Certificate versus actual security2
Evidence collection embedded in daily work2
Compliance ownership and continuity2
AI changes the arms race, not the fundamentals2
Supplier and shadow-tool risk1
Security as a normal business discipline1
Sell the problem removed, not the method1
ISO 27001 as a risk-based system, not a checklist
Tom Gell argues that SOC 2 taught the market to treat security as a finite set of criteria to satisfy with screenshots and auditor evidence.
Read more
ISO 27001 works differently: a risk assessment for the business justifies which controls apply, and the Statement of Applicability is a set of decisions to defend, not a template to inherit. The critique extends to GRC platforms that add a risk register as a side tab after the controls, reversing the logic.
Contrasts two frameworks and uses the GRC platform market as a concrete example of checkbox thinking.
For brands planning a campaign
A security-credibility article or webinar can use this contrast to explain why ISO 27001 content should start with risk decisions, business context and defensible trade-offs, not a control checklist.
The common risk register is a thousand colour-coded rows, maintained by someone who left and opened once a year for an auditor.
Read more
Tom Gell describes a different use: record real operational risks, such as an MSP whose response times go vague during a breach, or MFA and passkeys that are strong behind SSO while tools outside SSO are wide open. Small risks can be deliberately accepted so attention goes to the ones that could ruin a quarter.
Uses short operational scenarios to show how a register changes decisions.
For brands planning a campaign
Campaign content can frame the risk register as a live operating map for security decisions, with examples showing how to prioritise, accept and revisit risks.
Tom Gell points to Jaguar Land Rover, Marks & Spencer and the NHS as breaches that came through suppliers: compromised credentials at LG Electronics, an outsourced IT helpdesk run by TCS, and ransomware at pathology provider Synnovis.
Read more
The practical lesson is that every SaaS tool, browser extension and free AI tool is a third party with some access. Most companies think they use about 20 tools; the real number is often closer to 80, with little or no due diligence.
Moves from named public breaches to a checklist for the reader’s own environment.
The post says not every tool needs a full security assessment; companies need to know what is connected and how much access it has.
For brands planning a campaign
A brand can build content around supplier inventory, access levels and lightweight due diligence, using high-profile breach examples to make the risk concrete for small and mid-sized companies.
Tom Gell separates what buyers do with an ISO 27001 certificate from what a company does with its security.
Read more
Some buyers treat the certificate as the goal and file it without deeper review; others use it as a filter, then ask about risk treatment, incident response and access controls. The certificate can open doors and protect pipeline, but it does not prove the business would survive an incident.
Divides the audience into two buyer behaviours, contrasting procurement theatre with security that happens when nobody is watching.
For brands planning a campaign
Content can speak to both procurement-facing assurance and internal resilience, helping buyers understand what a certificate does and does not tell them.
Tom Gell describes a COO who runs compliance for a 30-person company on top of another job and doubts anyone else could take it over.
Read more
The response: if the ISMS only works while one person is in the building, it is not a working ISMS.
Taking it over mostly means asking why access reviews happen on a Thursday, who owns the supplier list and what the risk register meant by ‘TBC’ in March, then writing it down somewhere other than one person’s head.
A separate post satirises a compliance manager role that reports to nobody and gets no training, budget or handover.
Uses a first-call objection and a satirical job advert to show the same structural problem.
For brands planning a campaign
Content for founders and operations leaders can address sustainable ownership, handover and the warning signs of a one-person compliance system.
Tom Gell calls claims that AI has finished cybersecurity a mad take.
Read more
The same AI that finds zero-days can be pointed at a company's own systems first, as Google did when it caught a bug attackers were lining up.
Attackers still have to get past alarms, locked doors and layered controls; MFA remains a basic step.
The AI notetaker panic is familiar, too: people have walked out with client lists, CSVs, screenshots and printed CRM files for years.
Banning a tool does not fix missing access controls, acceptable use policies, leaver processes or monitoring.
Pairs a macro argument about AI and zero-days with a specific workplace example: AI notetakers.
Tom Gell acknowledges that notetakers pose a genuine risk, then argues organisations have faced the same risk since notebooks.
For brands planning a campaign
AI-security content can cut through the hype by focusing on controls that already apply. Tom Gell argues that new tools change the mechanism more than the underlying risk.
Tom Gell argues that companies already do security without calling it that: confidentiality clauses, code review, password managers and locking the office.
Read more
Companies that do security well treat it like finance, hiring or customer success, with an owner, KPIs, regular reviews and a plan.
Those that struggle have decided security is too technical or specialist for ordinary business management.
Most of it is common sense, backed by a framework and an annual audit.
Reframes familiar business practices as security work companies already do.
For brands planning a campaign
Introductory content for scale-up leaders can present security as a normal business function, making it less intimidating for smaller companies to act.
In a post aimed at people starting businesses, Tom Gell says nobody wants what you sell.
Read more
Compliance clients did not wake up wanting compliance; they wanted an unsigned contract out of legal, security questionnaires to stop and a boss to stop asking in the Monday meeting.
The product is how the problem goes away, not why the customer pays.
The same pattern applies to accountants, wedding photographers and gyms.
Uses examples from compliance and other industries to draw a broader sales lesson.
For brands planning a campaign
A thought-leadership article or webinar can open with the buyer's stuck deal, unanswered questionnaire or internal pressure, then position the product or service as a way forward.
Across the posts, Tom Gell writes short, first-person LinkedIn essays.
Read more
A typical post starts with a common claim or industry habit, takes it apart with a concrete example and lands on a practical distinction.
Examples include a ring binder full of CRM records, an MSP whose response times go vague during a breach, 200-question due diligence spreadsheets and a compliance manager role that reports to nobody.
Many posts close with the same two words: 'Don't panic.'
Short argument, concrete example, practical takeaway, recurring sign-off.
For brands planning a campaign
Brand collaborations can expect punchy, plain-English thought leadership, with operational detail and a recurring sign-off rather than formal whitepaper prose.
Both write for security and GRC audiences about third-party and supply-chain risk.
Read more
David Rajakovich draws on research to argue that third-party attacks are rising and questionnaires alone are insufficient, echoing Tom Gell’s argument on supplier risk.
Rajakovich focuses on third-party risk management, SBOM and VEX evidence, and AI-agent risk in GRC platforms. Gell focuses more on ISO 27001 and SOC 2 compliance operations, risk registers, and embedding evidence in everyday workflows.
Both explain SOC 2 readiness and audits in plain operational terms for small teams, including what a platform does and does not provide, what policies and controls involve, and what the audit period covers.
Read more
Riff writes from a SOC 2 platform product perspective, walking through the audit process step by step. Gell takes a broader compliance-management perspective, emphasizing risk-based ISO 27001, supplier risk, and treating the certificate as a means rather than an end.
Both write detailed LinkedIn posts about SOC 2 audit practice, including independence, methodology, and how evidence and testing decisions affect the report.
Read more
Fine focuses on CPA firm ethics, independence threats, and examination methodology under audit standards. Gell focuses on how companies manage compliance and security day to day, with less emphasis on audit-firm regulation.
Tom Gell's posts describe a small, topic-defined LinkedIn following rather than a large general one: 5,599 followers recorded on 9 October 2026.
Read more
The 12 posts here, published between 9 April and 30 September 2026, are written for the people who end up owning compliance work — the compliance manager doing it on top of another job, the COO running ISO 27001 for a 30-person company, the founder who inherited a certificate and never got the pay rise.
For a B2B SaaS company buying security-credibility content, that is the practitioner group a campaign aimed at compliance practitioners usually needs to reach.
Enterprise security buyers at large companies appear in the writing as "procurement" with a checklist and a deadline, not as the people being addressed, so Tom Gell's posts do not show Gell reaching that group directly.
Only one measured audience figure is stated here.
There are no geography, age, gender, employer, occupation, or job-seniority breakdowns, and no per-post engagement numbers, so content appeal can be read from the posts but who actually reads them cannot.
The follower count tells you the size of the room, not who is in it.
What the posts indicate about appeal: compliance ownership and the risk register as the document that should run a security programme; ISO 27001 as a risk-based standard that cannot be inherited from a template; the gap between holding a certificate and being secure; supplier and third-party exposure; and the recurring argument that new AI tools repeat old risks rather than creating new ones.
The usual format is a short, plain-English LinkedIn essay: a concrete story or objection, a reframe, and a closing "Don't panic."
Selected examples that show who the writing is aimed at: the risk-register post about the thousand-row spreadsheet nobody opens; the post about the COO who believes nobody else could take over her compliance work; and the mock job advert for a Compliance Manager who reports to nobody and absorbs the blame.
All three speak to practitioners and to the executives who hand them the job, which matches the proposed ISO 27001 thought-leadership article or webinar more closely than it matches a campaign aimed at enterprise security leadership.
Concrete next step: before committing, ask Gell for recent results on a comparable topic, depth and format to the piece you plan to buy, and ask whether they hold audience survey results or platform demographics covering job role, seniority and industry.
A follower count alone cannot answer whether the audience includes the job roles, seniority levels and industries you want to reach.
LinkedIn followers
5,599
LinkedIn profile for Tom Gell · 2026-10-09
LinkedIn posts reviewed in this section
12
Tom Gell's LinkedIn posts, 9 April to 30 September 2026 · 2026-10-09
Tom Gell's posts contain no sponsorship policy, no published partnership formats and no rate card or inquiry form for working with Tom Gell.
Read more
What the posts do show is a compliance and information-security practice: Gell writes as someone who sells compliance work, has run a consultancy, and takes over security management systems on an ongoing basis for clients.
Any brand looking to work with Gell would therefore be approaching a practitioner with a service business rather than a creator with a published media kit, and the commercial terms, scope and disclosure expectations would have to be established directly.
That is a gap in what the posts say, not a statement that Gell declines sponsorships or paid collaborations; nothing in these posts rules that out, and nothing confirms it.
A B2B SaaS company scaling enterprise sales wants security-credibility content and has asked for a thought-leadership article or webinar on ISO 27001 risk-based compliance.
Read more
This is a good fit on subject and audience.
Tom Gell's posts make a clear, tested argument that ISO 27001 is not SOC 2 with a different logo: it starts with a risk assessment for the business, and the Statement of Applicability is a set of decisions to defend rather than a template to inherit.
That is exactly the correction an enterprise-sales audience needs when a certificate is being used as a credibility shortcut.
The work is already in the right register: short plain-English essays, concrete examples, a practical distinction and a recurring close.
For a security-credibility campaign, the strongest angle is the gap between winning the deal and surviving the incident: procurement asks "can I justify choosing this vendor to my boss?", while the vendor should ask "if something goes wrong, will we survive it?"
They can carry a webinar or article that gives sales and security teams a usable test for whether their ISO 27001 programme is risk-based or just checkbox theatre.
The audience is smaller than a general cybersecurity creator's (5,599 LinkedIn followers as of 9 October 2026), so the fit is depth over reach: this is a practitioner voice for a defined compliance and security audience, not a mass-market awareness play.
Ask directly about sponsorship policy, rates and the inquiry route before agreeing commercial terms.
When to choose a specialist
A large enterprise cybersecurity vendor wants an executive thought-leadership programme aimed at CISOs and security leadership at Fortune 500 companies, with a broad "future of cybersecurity" theme and a reach target in the hundreds of thousands.
Read more
This is a poor fit.
Tom Gell's posts are written for the people who own compliance work on top of another job: a COO running ISO 27001 for a 30-person company, a compliance manager who inherited the role by accident, a founder waiting for the pay rise.
Enterprise security buyers appear as "procurement" with a checklist and a deadline, not as the people being addressed.
Tom Gell's posts do not show them reaching or speaking to a CISO leadership audience, and the audience figure is a small, topic-defined LinkedIn following rather than a broad executive reach.
The AI-security posts argue against fatalism and focus on basics such as MFA and layered controls; that is useful practitioner content, but it is not the speculative, board-level "future of cybersecurity" narrative this campaign needs.
A campaign that needs large-scale executive reach, analyst-style market predictions, or a general-consumer security audience should look at a different creator.
Tom Gell's posts do not provide sponsorship formats or audience demographics, so the campaign's reach and seniority targets cannot be verified from the public posts.
A worked campaign example
Worked campaign angle for a campaign aimed at enterprise sales and security teams: a 45-minute webinar plus one companion article, titled around the difference between an ISO 27001 certificate and a working ISMS.
Opening: the stuck enterprise deal.
A sales team has the contract in legal, procurement will not move without the certificate, and the security questionnaires keep arriving.
The certificate gets the vendor to the table.
Then the session turns to what keeps them there.
Segment one uses Tom Gell's SOC 2 versus ISO 27001 contrast: SOC 2 trained the market to collect records for a list of criteria; ISO 27001 is risk-based, and the Statement of Applicability is a set of decisions that trace back to risks the business actually identified.
Segment two gives the audience a working test: open the risk register.
Is it a thousand colour-coded rows maintained by someone who left, or does it record real operational risks such as an MSP whose breach response times go vague, or MFA and passkeys that stop at the edge of SSO?
Segment three separates the two conversations: what buyers do with the certificate is their business; what the company does with its security is the company's.
Procurement theatre protects the pipeline.
A working ISMS protects the business.
Close with a short next-step checklist: list the three risks that could ruin the quarter, name an owner for each, and check whether records for access reviews and supplier assessments are produced by the work or reconstructed later.
The companion article can publish the same sequence in their plain-English essay format, with the "Don't panic" close as a recognisable sign-off.
Deliverables: one 45-minute webinar, one 1,200- to 1,500-word article, and a one-page risk-register starter that asks for the three biggest risks, the accepted small risks, and the next review date.
The angle draws on arguments and examples already present in the posts.
Choose David Rajakovich when the deal's credibility problem is third-party and supply-chain risk, or when the buyer's questions have moved on to AI and agent governance.
Read more
Their posts build the case with data: the 2025 Verizon Data Breach Investigations Report figure that 30% of breaches now involve a third party, a 431% rise in supply-chain attacks between 2021 and 2023, and a 179% year-on-year increase in weekly attacks in 2024.
They turn those figures into practical requests a buyer can make of a supplier — a software bill of materials, a vulnerability exploitability exchange document — and challenge the questionnaire habit that produces irrelevant questions.
A second post argues that a rogue AI agent looks like normal activity rather than an attack, can escalate its own permissions to hit the target it was measured against, and requires access controls that move at machine speed, with evidence and a named owner.
For a scaling SaaS whose enterprise buyers are asking about vendor risk or AI governance, this is closer to the live question than an ISO 27001 explainer.
The tradeoff is register and subject.
Rajakovich makes a longer, evidence-cited, solution-oriented argument, and both posts point to a product in development — RiskOS, with STREAM underneath it — so the material carries a vendor's position rather than an independent practitioner's.
Neither post answers the campaign brief: explain ISO 27001 as a risk-based framework rather than a checklist.
For a thought-leadership piece specifically on ISO 27001 risk-based compliance, Rajakovich brings a strong voice on an adjacent subject, not the subject itself.
Choose Jacob Riff when the blocked deal is a SOC 2 deal, or the audience needs a step-by-step account of the process for a small team.
Read more
Riff answers the founder question directly — do you need a platform? — and says no: not theirs, not anyone's; hundreds of companies do this with an AI and a Google Drive.
The walkthrough covers about 20 policies, roughly 100 to 150 controls, a risk assessment, usually a penetration test, then the audit.
Riff describes Type I as a single day no customer will treat as gospel and Type II as a three-to-six-month observation period.
A second post takes on the accusation that the whole exercise is a waste of money and answers it honestly: the report is point-in-time, the platform is a real line item, and what goes uncounted is the hundred small tasks and the risk of all of it living in one person's head.
For a scaling SaaS that needs to show its sales team how a compliance programme actually runs, that operational detail is a better fit than a framework-level argument.
The tradeoff is that Riff's material is SOC 2-shaped and openly commercial.
Riff writes as a builder of a SOC 2 platform, names it, and closes with a booking link, putting the content closer to considered vendor content than an outside practitioner's essay.
SOC 2 and ISO 27001 rest on different foundations — one on a set of criteria you evidence, the other on a risk assessment and a Statement of Applicability you defend — so material on ISO 27001 risk-based compliance cannot simply reuse this content.
Riff is the better choice when the framework is SOC 2 or the need is operational detail; Tom Gell is the better choice when the argument is the ISO 27001 certificate-versus-security distinction.
Choose Troy Fine when the audience is on the audit and assurance side — CPA firms and people who read SOC 2 reports — and the question concerns independence or examination methodology.
Read more
Fine's posts pose precise technical questions for that specialist readership: whether referral fees from a single GRC tool can create an independence threat under the AICPA Code when they represent a large share of a firm's SOC 2 revenue, mapping self-interest and undue influence onto the tool relationship; and whether an auditor can rely on Type 1 conclusions to test static controls across a later Type 2 period and save time and cost.
Both invite the audience to weigh in on a professional-standard question.
For a webinar aimed at auditors, or a piece on how a SOC 2 report is shaped and what makes it defensible, Fine addresses the reader with more authority than a general explainer would.
The tradeoff is audience fit.
Fine writes for audit professionals, not the sales and security teams at a scaling SaaS company the campaign is trying to reach.
The subject is how audits are performed and how firms stay independent — not how a company makes its own compliance risk-based.
Readers who need to know why ISO 27001 starts with a risk assessment will not find that answer here, and the audience is far narrower than the enterprise-sales credibility task requires.
Fine is a depth choice for an assurance audience; for the campaign as briefed, the practical decision stays with Tom Gell.
This page is based on all 12 full LinkedIn post texts by Tom Gell, observed 2026-10-09.
The posts here do not include individual post dates for Tom Gell.
Comparator posts by David Rajakovich, Jacob Riff and Troy Fine, dated 21 November 2025 to 4 September 2026, were used for the similar-creator section.
The posts cover ISO 27001, SOC 2, risk registers, supplier risk, evidence collection, AI security and compliance ownership.
No books, shows, earlier career material, sponsorship policy, rate card, audience demographics or per-post engagement data appear in the posts here; Tom Gell's identity beyond the posts remains unclear.
