Cutting through the hype
Say what has changed and what is just marketing, my own industry's included. If a stat traces back to a vendor blog with no method behind it, I'd rather drop it.
I joined RODIN Business Solutions, a managed services provider with offices in Wollongong, Sydney, Melbourne, Brisbane and Newcastle, in 2002. Over the next decade I did help desk, field, systems, project and pre-sales engineering, then ran the support team as service delivery manager, and ran the business as general manager from 2015.
As GM I ran a business of about 30 staff looking after about 140 managed clients, with about 4,500 endpoints under management when I left. I was also virtual CIO for seven client leadership teams. I built our managed security service around NIST CSF and the Essential Eight, and from 2020 took clients through Essential Eight gap assessments, ISO 27001 and Right Fit For Risk, UK Cyber Essentials Plus audits and business continuity planning.
I also designed a lot of moves from on-premises servers to Microsoft 365 and Azure, and between 2015 and 2018 built our hosted services: a managed phone system for clients, the RODIN Vault backup service and hosted desktops. RODIN partnered with Sophos in 2013, and I sat on the Sophos Partner Advisory Council from 2017 to 2019.
I joined Sophos in May 2022 and now work with MSPs, MSSPs, resellers and enterprise customers across the globe, with a focus on Asia Pacific. I cover Sophos MDR, Sophos XDR, SIEM and incident response, plus Taegis from Secureworks, now a Sophos company. A good part of the job is teaching: sales engineers, partners and anyone else who'll sit still for a demo. So far that's about 60 APJ sales engineers and 30 MDR operations staff, plus the 2026 Sophos Fusion and NG-SIEM launch training for the ANZ and ASEAN sales engineering teams.
Outside the day job I'm on the GTIA ANZ Executive Council, after two years on CompTIA's ANZ council.
I also build things, mostly tools for Sophos Fusion admins. They're on GitHub as personal projects.
Building with AI, and testing where it breaks
I use it every day, at work and at home.
Building
My Sophos Fusion MCP server lets AI assistants and agents work with the Fusion APIs, and it won the AI Build Challenge Sophos ran for its global sales engineers in 2026. At home I run a personal assistant I built with Claude, and it works alongside me every day.
Testing
With the owner's permission, I red-team AI chatbots on live websites, checking whether they can be talked into leaking their instructions, wandering off topic or following orders hidden in an uploaded file.
Speaking
AI risk is one of my talk topics, mostly how AI has changed the economics of attacks that already worked.
Community
I've chaired GTIA ANZ's AI and Emerging Technology Interest Group since June 2026. In August I co-hosted its first roundtable, an open conversation with no slides or pitches about what's working in people's businesses.
Things I'll happily argue about
The boring 20%
Do 20% of the simple stuff right and you'll prevent 80% of the bad stuff: MFA, patching, and knowing what you've left exposed to the internet.
Real incidents on stage
I build talks around real, anonymised incidents. People remember the director who got calls from the attacker on a personal mobile long after they've forgotten the numbers.
Building the tool
When a job is slow and repetitive, I build something for it and share it. A tenant migration that used to take a week or two by hand is a good example.