Report an Incident Become a Partner Careers Contact
Book a Demo
Adam Jones
CTO & Co-Founder

Adam Jones

Microsoft and Cisco certified

Adam Jones is CTO and co-founder of Wizard Cyber. His background is networking and security — Microsoft and Cisco certified — and that infrastructure grounding shapes how he approaches detection and response. He is the principal designer and architect of CYBERSHIELD AI, Wizard Cyber's agentic AI SOC platform, where specialised agents carry the triage and investigation workload and senior analysts stay accountable for every consequential decision.

LinkedIn

Written by Adam Jones

24 articles

Managed SOC

80 Nationally Significant Incidents: What The NCSC's 'Tech On The Cheap' Warning Means For The Mid-Market

The NCSC counted 80 nationally significant incidents and warned of "tech on the cheap". What that looks like in a mid-sized estate, and where to spend.

5 min read Governance

Your Provider Has A Key To Your Tenant. Do You Know Which One?

Stolen app secrets at IT providers reached 27 organisations this week. The partner roles, apps and secrets in your tenant, and what to ask about them.

5 min read Managed SOC

Two Weeks For Laptops, A Year For Appliances: Your Edge Is Patched Slowest And Exploited Fastest

Microsoft's data: laptops are patched in about two weeks, network appliances in over a year. Exploitation takes days. What to do in the gap.

5 min read Governance

The Appliance Account That Could Read Every LAPS Password

One VPN service account was enough to start searching AD for LAPS passwords and BitLocker keys. Six controls for the accounts your appliances hold.

5 min read Managed SOC

The Account You Excluded From Containment Is The One They Used

Automatic disruption blocked 1,000+ attempts, but one excluded admin account carried the data out. Why every exclusion needs an owner, an expiry and a fallback.

5 min read Governance

One Laptop, One Extension: Why Developer Workstations Belong In Tier 0

A backdoored editor extension and a theft traced to an engineer's laptop, in one week. Why developer machines need Tier 0 controls, and five places to start.

5 min read AI Driven Security Operations

Whose AI Agent Is Using Your Admin Credentials?

A contractor allegedly gave a personal AI agent admin access to a sensitive network. What your contracts, access and SOC should do about supplier agents.

5 min read

Wizard Cyber Launches CYBERSHIELD AI, An Agentic AI SOC Platform

Wizard Cyber has launched CYBERSHIELD AI, an agentic AI SOC platform where specialised agents carry triage and investigation and analysts sign off.

4 min read Governance

Patched The Server, Not The App: Why Library Flaws Hide From Your Patch Report

PHP2Shell and the Brotli flaw both live inside other software. Why OS patch compliance misses them, and how to answer "are we affected?" in an hour.

5 min read AI Driven Security Operations

A Crew Of One: What The First AI-Assisted Mass-Hacking Arrest Means For Mid-Market Defenders

One former pentester used an AI attack framework to breach 90+ organisations. Why attacker headcount no longer limits volume, and what changes for defenders.

5 min read Governance

Test2, Password1, Twelve Years: Who Owns The Accounts Nobody Uses?

The ICO reprimanded a public body and its IT provider over a 12-year-old test account. Why dormant accounts need an owner, and a contract that says so.

5 min read AI Driven Security Operations

Your AI Gateway Holds More Keys Than Your Domain Admin

Last week's supply chain attack went straight for an AI gateway's keys. Why AI gateways belong in Tier 0, and six steps to protect them like it.

5 min read Governance

The Authenticator On Your Staff's Phones Is An Identity Provider. Who Patches It?

CVE-2026-80097 let a zero-permission Android app pull Microsoft 365 tokens from Authenticator. Why broker apps belong in your patch scope, and who owns them.

5 min read Managed SOC

A Blocked Sign-In Is Still A Breached Password

AADSTS53003 means Conditional Access stopped a sign-in with the right password. Why SOCs should triage on credential validity, not spray volume.

5 min read AI Driven Security Operations

When The Agent Strays: What Your SOC Does When An AI Agent Goes Off-Task

Microsoft now says to treat AI agents as insiders. What an off-task agent looks like, who decides to contain it, and the playbook to write first.

6 min read Managed SOC

Patched Isn't Fixed: Why Exploited Bugs Keep Coming Back As New CVEs

Fixes for exploited bugs are reported broken four times as often as others. Why a patch should start a test, not close a ticket, and what to do instead.

5 min read Governance

Microsoft Is About To Switch On A Policy In Your Tenant. Have You Read It?

A Microsoft-managed Conditional Access policy for high-risk users switches on in the week of 28 October. What it does, what to check, and who should decide.

5 min read Fundamentals

What Is A Supply Chain Attack? Types, Real Examples And How To Reduce Your Exposure

A supply chain attack reaches you through a supplier you trust. The main types, real examples, and the practical steps that reduce your exposure.

9 min read Incident Response

Eighteen Months Later, The Breach Got Bigger: Why Scoping Takes So Long, And How To Shorten It

The Legal Aid Agency breach now reaches records from 1978. Why scoping a breach takes months, and the five things that shorten it.

6 min read Governance

Abandoned Tenants Are The New Expired Domains

A phishing crew built a business on Microsoft 365 tenants their owners had stopped watching. Cloud estates need a leaver process, just like people do.

6 min read Managed SOC

1,413 CVEs In One Month: Patch Lists Don't Scale, Exploitability Does

October's Patch Tuesday fixed a record 1,413 flaws, and one was already exploited. Severity scores can't rank that many. Exploitation and exposure can.

6 min read AI Driven Security Operations

What Is Shadow AI? Risks, Examples And How To Get Visibility

Shadow AI is AI used at work without IT's knowledge or approval. The risks, common examples, and how to find and govern it in Microsoft 365.

9 min read AI Driven Security Operations

Every AI Agent Is A New Joiner: Why Agent Identities Need A Lifecycle

Staff are connecting AI agents to work email and files already. Treat each one like a new joiner: an owner, least privilege, a review and an exit.

6 min read Managed SOC

The Patch Existed. The Contractor Didn't Apply It. Who Owns Patching On Platforms You Don't Run?

The FBI says a contractor's missed patch let attackers in. Outsourcing a platform doesn't outsource the risk. What to ask suppliers, and what to watch.

6 min read
Where to start

Talk to the people
who do the work.

A demo against your own estate rather than a canned one, run by an analyst rather than a salesperson.

Book a demo Contact us