Thomas Kranz

Thomas Kranz

Thomas Kranz is a cybersecurity consultant, a senior security & technology leader, and an author, with more than 30 years of experience in the global cybersecurity sector. As a consultant, Thomas provides security leadership and solutions while delivering vCISO services, including cyber security strategies, roadmaps, white papers, and policies, to a wide range of private sector clients across the EMEA region.

As a security and IT specialist, Thomas has been featured on global keynote panels and industry events, where he produced and presented talks and workshops on cybersecurity strategies, policies, processes, resources, and technology. His trusted voice has earned him a notable spot on the esteemed Forbes Technology Council.

Tom lives in Italy, where he cares for a collection of rescue dogs and cats, many opinionated ducks, some angry geese - and a pet wild boar.



Now available, Tom's new book - Making Sense of Cybersecurity from Manning.

Forbes •

13 Best Practices For Developing A Robust Data Governance Strategy

From establishing team leaders to understanding your own data, there’s a lot to keep in mind when developing a well-thought-out data governance strategy. However, with the right team and know-how, a successful strategy will create effective and productive data collection and management processes and establish future-forward standards for a business. As experienced tech leaders, the members of Forbes Technology Council understand the importance of creating strong data governance strategies in th
ITProPortal •

Why contact tracing apps don't work, and why the UK's NHSX app will fail

People are fed up of lockdown. Families want to get out, people need to earn money, and employers want their teams back at work. Contact tracing apps are being floated as the solution to easing the current lockdown - but will they work? NCSC (the partnership arm of GCHQ) has been busy reassuring people that the NHSX app is secure, useful, and that everyone should do their part and install it. But is that actually the case? The first problem is that the development team have decided to not use
ITPro Portal •

Why interception of WhatsApp and Facebook Messenger isn't just flawed, it's dangerous

There have been a number of articles in the press recently on how the UK government has agreed with social media platforms like Whatsapp and Facebook to share user's encrypted messages with police. While it's true that GCHQ and various civil servants have been trying to push for interception capabilities on these platforms for a while now, despite the headlines, nothing has actually been agreed. This is down to two main problems: that encryption doesn't work that way, and that the proposal is da
LinkedIn •

Building your career in Cyber Security: Certifications

"The long term benefits of sunscreen have been proved by scientists, whereas the rest of my advice has no basis more reliable than my own meandering experience. I will dispense this advice, now." Following on from my previous article about getting started in Cyber Security, I want to move on to certifications. I've interviewed a lot of people over the years. A lot. And then I've had to built out and lead teams for various clients with the people I interviewed and hired. Certifications are a rec
LinkedIn •

How do I get into Cyber Security?

Along with "You can't say that" and "Hey, how'd you get in here?", one of the things I've been hearing from people recently is "How do I get a career in Cyber Security?" I thought I'd throw my notes from those conversations in a sort of Liber Primus for those interested in moving into Cyber Security - either as a side hustle or a career. First: what is it you actually want? I need to be honest - if you're in it for the money, there's much better options out there. Work in finance. Become a pol
Medium •

Google do not care about the user.

Google had previously tried to break usability on the web by removing the “www.” and “http(s)://” parts of the URL displaying in Chrome. Facing a strong backlash from users, they quietly shelved the plans. Now they are trying again, with the same nonsense excuses for it: “ The Chrome team values the simplicity, usability, and security of UI surfaces. To make URLs easier to read and understand, and to remove distractions from the registrable domain, we will hide URL components that are irrelevan
Medium •

The ICO’s £183m GDPR fine for British Airways is the wrong thing to do

There’s lots of flag waving about how the ICO finally has some teeth, and how GDPR is going to keep companies on their toes from now on. Nothing will change. GDPR will have no impact on cyber security apart from employing a lot more auditors, with even more ineffectual checklists. The ICO’s “record breaking fine” will result in zero improvements in cyber security. Companies should be punished financially for having weak security when handling customer’s data — but it’s the executive team who s
Hiscox London Market •

All the gear and no idea

Support when you need it, where you need it. Even with high-tech security in place, many companies still suffer cyber attacks due to simple set-up blunders. Most companies that suffer a cyber attack believed it would never happen to them. What makes it even harder to understand is the costly, cutting-edge security they had in place to deter hackers. But, these strong defences turn out to be a cyber Maginot Line if they’re not activated or deployed properly – ineffective because they could be e
Professional Security Magazine •

Ways to close the digital skills gap in cyber

Tom Kranz, Director of Cyber Lab at 6point6, a technology consultancy, writes that the digital skills shortage is a permanent thorn in the cyber industry’s side that needs to be tackled now before it’s left to fester any longer and cause real long term damage. Despite being exaggerated by many as a full-blown crisis, the talent shortage is actually something that needs properly addressing, not hyperbole. With hackers ramping up attacks and developing increasingly sophisticated tools and methods
Computer Weekly •

Why cyber security needs to be prioritised at board level

There is growing evidence that cyber attacks are now deliberately targeting executives and board members – not businesses themselves – which shows that attackers believe this group is particularly vulnerable as well as valuable. More must be done to raise awareness of potential cyber threats at board level, as well as supporting businesses in developing a strategy that offers solutions to combat potential weaknesses in a company. Typically, hackers attack companies and their employees to steal
Load More Articles