Report an Incident Become a Partner Careers Contact
Book a Demo
Adam Jones
CTO & Co-Founder

Adam Jones

Microsoft and Cisco certified

Adam Jones is CTO and co-founder of Wizard Cyber. His background is networking and security — Microsoft and Cisco certified — and that infrastructure grounding shapes how he approaches detection and response. He is the principal designer and architect of CYBERSHIELD AI, Wizard Cyber's agentic AI SOC platform, where specialised agents carry the triage and investigation workload and senior analysts stay accountable for every consequential decision.

LinkedIn

Written by Adam Jones

24 articles

Governance

The CEO On The Call Isn't The CEO: $129 Million Says Payment Approvals Need A Second Channel

Cloned executive voices and fake lawyers took $129m from firms worldwide. Why payment approvals must verify the request, not the voice.

5 min read Governance

Paint Is Patched By The Store, Not Windows Update. Does Your Patch Report Know That?

A Paint RCE fix ships through the Microsoft Store, not Windows Update. Why Store and self-updating apps need an owner and a version check.

5 min read Governance

63% Of The Spoofed Phish Had An Exception Applied. Who Signed Off Your Allow-List?

Microsoft found overrides applied to 63% of spoofed malicious email with a recorded outcome. Why exceptions need owners, scope and an expiry date.

5 min read AI Driven Security Operations

$100,000 A Day In AI Nobody Ordered: Your Cloud Bill Is Now A Security Signal

Attackers are running AI models on stolen cloud access, at up to $100,000 a day. Why AI spend belongs in the SOC, and what to watch in Azure.

5 min read Governance

Eleven AI Developer Platforms Breached In 28 Days. Which Of Them Hold Your Tokens?

Attackers breached AI and developer platforms to steal customers' keys. Why these platforms are suppliers, and a register, reduce, rotate, watch routine.

5 min read Governance

Every Exploit In The Chain Was Already Patched: Why Phones Are Your Slowest-Patched Endpoints

A nation-state crew stole phone data using only patched flaws. Who owns mobile patching, and how Intune minimum OS rules close the gap.

5 min read Managed SOC

80 Nationally Significant Incidents: What The NCSC's 'Tech On The Cheap' Warning Means For The Mid-Market

The NCSC counted 80 nationally significant incidents and warned of "tech on the cheap". What that looks like in a mid-sized estate, and where to spend.

5 min read Governance

Your Provider Has A Key To Your Tenant. Do You Know Which One?

Stolen app secrets at IT providers reached 27 organisations this week. The partner roles, apps and secrets in your tenant, and what to ask about them.

5 min read Managed SOC

Two Weeks For Laptops, A Year For Appliances: Your Edge Is Patched Slowest And Exploited Fastest

Microsoft's data: laptops are patched in about two weeks, network appliances in over a year. Exploitation takes days. What to do in the gap.

5 min read Governance

The Appliance Account That Could Read Every LAPS Password

One VPN service account was enough to start searching AD for LAPS passwords and BitLocker keys. Six controls for the accounts your appliances hold.

5 min read Managed SOC

The Account You Excluded From Containment Is The One They Used

Automatic disruption blocked 1,000+ attempts, but one excluded admin account carried the data out. Why every exclusion needs an owner, an expiry and a fallback.

5 min read Governance

One Laptop, One Extension: Why Developer Workstations Belong In Tier 0

A backdoored editor extension and a theft traced to an engineer's laptop, in one week. Why developer machines need Tier 0 controls, and five places to start.

5 min read AI Driven Security Operations

Whose AI Agent Is Using Your Admin Credentials?

A contractor allegedly gave a personal AI agent admin access to a sensitive network. What your contracts, access and SOC should do about supplier agents.

5 min read

Wizard Cyber Launches CYBERSHIELD AI, An Agentic AI SOC Platform

Wizard Cyber has launched CYBERSHIELD AI, an agentic AI SOC platform where specialised agents carry triage and investigation and analysts sign off.

4 min read Governance

Patched The Server, Not The App: Why Library Flaws Hide From Your Patch Report

PHP2Shell and the Brotli flaw both live inside other software. Why OS patch compliance misses them, and how to answer "are we affected?" in an hour.

5 min read AI Driven Security Operations

A Crew Of One: What The First AI-Assisted Mass-Hacking Arrest Means For Mid-Market Defenders

One former pentester used an AI attack framework to breach 90+ organisations. Why attacker headcount no longer limits volume, and what changes for defenders.

5 min read Governance

Test2, Password1, Twelve Years: Who Owns The Accounts Nobody Uses?

The ICO reprimanded a public body and its IT provider over a 12-year-old test account. Why dormant accounts need an owner, and a contract that says so.

5 min read AI Driven Security Operations

Your AI Gateway Holds More Keys Than Your Domain Admin

Last week's supply chain attack went straight for an AI gateway's keys. Why AI gateways belong in Tier 0, and six steps to protect them like it.

5 min read Governance

The Authenticator On Your Staff's Phones Is An Identity Provider. Who Patches It?

CVE-2026-80097 let a zero-permission Android app pull Microsoft 365 tokens from Authenticator. Why broker apps belong in your patch scope, and who owns them.

5 min read Managed SOC

A Blocked Sign-In Is Still A Breached Password

AADSTS53003 means Conditional Access stopped a sign-in with the right password. Why SOCs should triage on credential validity, not spray volume.

5 min read AI Driven Security Operations

When The Agent Strays: What Your SOC Does When An AI Agent Goes Off-Task

Microsoft now says to treat AI agents as insiders. What an off-task agent looks like, who decides to contain it, and the playbook to write first.

6 min read Managed SOC

Patched Isn't Fixed: Why Exploited Bugs Keep Coming Back As New CVEs

Fixes for exploited bugs are reported broken four times as often as others. Why a patch should start a test, not close a ticket, and what to do instead.

5 min read Governance

Microsoft Is About To Switch On A Policy In Your Tenant. Have You Read It?

A Microsoft-managed Conditional Access policy for high-risk users switches on in the week of 28 October. What it does, what to check, and who should decide.

5 min read Fundamentals

What Is A Supply Chain Attack? Types, Real Examples And How To Reduce Your Exposure

A supply chain attack reaches you through a supplier you trust. The main types, real examples, and the practical steps that reduce your exposure.

9 min read
Where to start

Talk to the people
who do the work.

A demo against your own estate rather than a canned one, run by an analyst rather than a salesperson.

Book a demo Contact us