Lester Chng

Cyber CEOs Brand Strategist. I build your brand as you build your business. | Senior Cybersecurity Advisor | Author | Naval Officer | CISSP | 🇨🇦🇸🇬 |

You head a leading cybersecurity firm.
But your online presence doesn't reflect it.

In fact, being invisible is damaging. 

You understand the power of thought leadership.
You know LinkedIn shapes deal flow and adds credibility in the industry.
You just don’t have the cycles (or the copy) to share your expertise and experience.

You have stories worth telling.

The insights from being in the trenches.
The deep conversations with your ace teams.
The hard discussions with your clients. 

Don’t let this wisdom go to waste.

That’s where I come in.

--------------------------------------------------------------------------------------------

How we work together.

Profile & Positioning
=> Rebuild your LinkedIn profile so visitors see industry authority, not “another vendor.”

Content engine
=> Ghostwritten posts that leverage your insights and expertise into engaging LinkedIn posts. 

Outreach campaign
=> Targeted DM campaigns and audience-building strategies that build your authority and land you on podcasts and conference stages.

--------------------------------------------------------------------------------------------

You focus on growing your firm and protecting your clients.
And we will ensure the industry, clients, prospects, and investors can’t ignore it.

Let’s build the personal brand that commands the cybersecurity conversation and drives business.


Worked with global client portfolio 
- MSPs
- MSSPs
- Agentic AI SOC
- AI-powered GRC 
- Operational Resilience 

Senior Advisor, Financial Crimes Unit Exercises. BMO Fusion Centre

Execution of Financial Crimes Unit Exercise and Drill Program
• Design and execution of exercises and drills to operationalize the Financial Crimes Unit Fusion Centre
• Scenario creation and exercise execution for Information Security, Enterprise Fraud Management, Physical Security, and Global Crisis and Continuity Management teams 
• Providing effective challenge of incident response readiness through exercise observation
• Execution of enterprise-wide Purple Team Exercise


Cybersecurity Exercises: Purple Team, Ransomware, DDoS, Malware, Data Corruption, Data Breach, 3rd Party Incidents
Fraud Exercises: ATOs, Attack on Payment systems, Business Email Compromise, PII Breach
Physical Security Exercise: Active Assailant, Civil Unrest, Bomb Threats
Crisis Exercises: Disaster Recovery, Business Continuity, Operational Resilience, Fire Incidents, Natural Disasters, Utilities Disruption

I lost my voice on many occasions.  
 
But LinkedIn helped me find it again. 
 
I lost my voice when I left the Navy. 
12 years in service.  
It remains a part of me. 
Naval terms. Military speak.  
Barking orders and receiving them. 
 
And then I left the Navy.  
 
I lost my voice when I left the country. 
34 years in the land. 
I will always belong there. 
Singlish, slang, and all I knew. 
Culture, habits, being a local. 
 
And then I left the country. 
 
I lost my voice when I began abroad. 
8 years since I landed. 
I wonder if I'll ever belong. 
New nuances, new circumstances. 
 
And then I began again. 
 
I lost my voice when I lost my job. 
I will never forget the letter. 
"Changing business requirements" 
I told myself this will never be a chore. 
 
And then I found my voice. 
 
You may find this platform a bore. 
"I need a job" 
"I am excited to...." 
"🚀🚀🚀🚀🤖🤖🤖🤖" 
"Are you interested in buying.." 
 
But it has allowed me to find my voice. 
 
Cause one day, I may lose it again. 
 
Have you lost your voice before?
What steps are u taking to mitigate?

No alternative text description for this image

Running naval wargames and designing cyber exercises at a bank are more similar than people expect.

It did help that the big boss at the bank was a former naval aviator. 

He knew with a fusion centre structure of managing security incidents across cyber, fraud, physical security, and crisis management, the teams needed a robust training program to drive operational excellence and achieve full operating capabilities. 

That was the first task. 

Get back to basics. 
Sort out the procedures. 
Drill the response teams. 

Do you run drills for your teams?

Or assume they will respond to your expectations?

You know Canada is on the up when Dad sends you a TikTok (no i dont have an account) about the upcoming increase in defence spending.

What about Canada do you appreciate?

I like the cold...... what about you?

undefined undefined

bootcamp

Sign up here:
https://catalystcorporatetraining.classe365.com/form/view/AutoBootCamp?_gl=1*9rfqtg*_ga*MTQ4NTczNDM0MC4xNjk4MjQxODM1*_ga_YYXBQS6S5Q*MTcwNzgzMzEyNi4xODEuMS4xNzA3ODMzMTYwLjI2LjAuMA

Building a cyber company is not for everyone.

Do you even have the commitment to do so?

I interviewed Eldon Sprickerhoff to get his insights for the next generation of founders. He is an Entrepreneur-in-Residence and a mentor at Rogers Cybersecure Catalyst, Toronto Metropolitan University. 


𝗧𝗵𝗲 𝗰𝘂𝗿𝗿𝗲𝗻𝘁 𝗰𝗵𝗮𝗽𝘁𝗲𝗿. 𝗦𝘁𝗶𝗹𝗹 “𝗖𝗼𝗺𝗺𝗶𝘁𝘁𝗲𝗱”

𝘘: 𝘞𝘩𝘢𝘵 𝘵𝘩𝘦𝘮𝘦𝘴 𝘰𝘳 𝘤𝘩𝘢𝘭𝘭𝘦𝘯𝘨𝘦𝘴 𝘬𝘦𝘱𝘵 𝘴𝘩𝘰𝘸𝘪𝘯𝘨 𝘶𝘱 𝘪𝘯 𝘤𝘰𝘯𝘷𝘦𝘳𝘴𝘢𝘵𝘪𝘰𝘯𝘴 𝘸𝘪𝘵𝘩 𝘧𝘰𝘶𝘯𝘥𝘦𝘳𝘴 𝘵𝘩𝘢𝘵 𝘶𝘭𝘵𝘪𝘮𝘢𝘵𝘦𝘭𝘺 𝘭𝘦𝘥 𝘺𝘰𝘶 𝘵𝘰 𝘸𝘳𝘪𝘵𝘦 𝘊𝘰𝘮𝘮𝘪𝘵𝘵𝘦𝘥 𝘢𝘯𝘥 𝘤𝘳𝘦𝘢𝘵𝘦 𝘵𝘩𝘦 𝘮𝘢𝘴𝘵𝘦𝘳𝘤𝘭𝘢𝘴𝘴?


I kept seeing the same patterns: some passionate and brilliant technical founders hitting predictable walls - raising capital without understanding dilution consequences, scaling teams without proper foundations, pursuing growth without sustainable unit economics, or worse: flailing in the market with a product/offering that didn’t have an obvious value or importance.

What frustrated me was that these weren't unsolvable problems. They were challenges we had faced and eventually figured out, often painfully. I realized this knowledge could help others avoid the same expensive mistakes.

The recurring theme was the gap between technical excellence and business fundamentals. Founders could build incredible technology but struggled with identifying their true “ideal client profile”, minimally viable offering, go-to-market strategy, fundraising dynamics, or organizational design. "Committed" became my way of sharing survival strategies that weren't readily available elsewhere.


𝘘: 𝘞𝘩𝘢𝘵 𝘢𝘳𝘦 𝘺𝘰𝘶 𝘮𝘰𝘴𝘵 𝘪𝘯𝘵𝘦𝘳𝘦𝘴𝘵𝘦𝘥 𝘪𝘯 𝘸𝘰𝘳𝘬𝘪𝘯𝘨 𝘰𝘯 𝘰𝘳 𝘤𝘰𝘯𝘵𝘳𝘪𝘣𝘶𝘵𝘪𝘯𝘨 𝘵𝘰 𝘳𝘪𝘨𝘩𝘵 𝘯𝘰𝘸, 𝘢𝘯𝘥 𝘩𝘰𝘸 𝘥𝘰𝘦𝘴 𝘵𝘩𝘦 𝘮𝘢𝘴𝘵𝘦𝘳𝘤𝘭𝘢𝘴𝘴 𝘧𝘪𝘵 𝘪𝘯𝘵𝘰 𝘵𝘩𝘢𝘵 𝘧𝘰𝘤𝘶𝘴?

Right now, I'm focused on helping the next generation of cybersecurity founders build enduring companies. Through my consulting and advisory roles, I'm seeing exceptional technical talent that needs guidance on the business side.

The masterclass is a way to scale that impact. I can only mentor a handful of founders directly, but the principles I learned building eSentire are broadly applicable. I want to help founders avoid the mistakes that nearly killed our company early on and accelerate their path to product-market fit and sustainable growth.

What excites me most is seeing founders take these lessons and apply them in ways I never imagined - solving problems that didn't exist when we started eSentire. The cybersecurity landscape keeps evolving, and I want to help the best founders navigate it successfully.


If you enjoyed this interview series, please follow Eldon and get his book at https://lnkd.in/gS2HNAnY


P.S. Have you read Committed? 
Get it already.

Dear LinkedIn,
Here is what it is like using the app. 

Suggested

Suggested

Suggested

Sponsored

Suggested

Sponsored 

Suggested

Sponsored


What’s up with this feed?

Did you even consider the experience?

Pls bring my connections’ posts. 

Sincerely,
Everyone.

LinkedIn

It is RSAC in a couple of weeks. 
Yet your meeting calendar is scarily empty.

Your VP Marketing has been urging you to post more on LinkedIn during the lead-up to RSAC.

But is has been crazy busy with client demos, contract negotiations, partner agreements, manpower turnover, investor updates, fund-raising, and just LIFE.

The start of the year flew by and you didn't realize RSAC is just around the corner. The conference that costs a pretty penny but you don't feel like you have good momentum going into the event.

Your last LinkedIn post was a report of a company announcement 3 weeks ago. Your DMs are all full of spam. And you ignored your VP Marketing's email to post more.

But where do you start? What do you post about?

I have 2 resources for you.
1. The Cybersecurity CEO’s Personal Brand Blueprint
2. 5 LinkedIn Posts Templates for Cyber CEOs

You have 1 week to catch up.

Don't waste another year at RSAC.

DM or comment "RSAC" and I'll send you both.

When I first moved to Canada, I remember reading about their Navy and Air Force capabilities (don’t ask me why I didn’t bother abt the Army). 

12 Halifax frigates. Ageing, 1990s
4 Victoria subs. Second hand. 
6 OPVs. Still coming online. 
12 Patrol crafts. 

F18s - started from 1982….


And to defend coast to coast….
to the True North

Was an impossible task. 

This Defence budget and Strategy is long overdue and may be the silver lining in this rocky new world. 

We are all pulling in the same direction. 

Rogers Cybersecure Catalyst, Toronto Metropolitan University will offer every company in every Catalyst program strategic insights to help them explore and pursue opportunities in Canada’s growing defence sector.

Stay connected and pull together.

Rogers Cybersecure Catalyst, Toronto Metropolitan University

The reason your posts fall flat? 
They read like press releases.

Most posts I see on LinkedIn read like they were written by a corporate communications team.

They’re clean. Safe. 
Approved by six people.
And boring as hell. 

Here are a few lessons that I gained after writing >1000+ posts. 
⸻

Lesson 1: Write as you would speak. 
You don’t need big words or long sentences.
Short. Direct. Clear.
If you wouldn’t say it in a conversation, don’t write it in a post.

⸻

Lesson 2: Share what it means, not just what happened.
Describe what you learned from it.
What changed for you? 
For your clients?
That’s the part people care about.

⸻

Lesson 3: Write to one person.
Think of someone specific — a client, a peer, a younger version of yourself.
Write as if you’re speaking to them.
That’s what makes people stop scrolling.

⸻

LinkedIn isn’t a press room.
It’s a coffee chat. 

Incorporate these lessons and the posts will start landing.

Whose posts do you enjoy reading?

Sick of tabletop exercises?

Here are other training tools to use. 

Picture this. 
You designed and planned for your tabletop exercise for months. 

The date is decided and you sent out the calendar hold. 

“Urghh”. The synchronized groans echo across the office space. 


Johnny Smarty Pants: “I bet it’s an AI or ransomware scenario again”. 

Jimmy Old Timer: “Time to dust off the old playbook”. 


How do you think the exercise will go?
Probably the same as the last 5..

Even MSPs know that this is a problem. 
“Our clients are bored of TTXs”.


Here’s how to shake things up. 

1. Use short drills instead
2. Execute unalerted exercises
3. Ask delegates to be the primary 
4. Allocate budget for a simulation ex

You can and should incorporate some variety and creativity in your training. 

Otherwise it’s a bloody snooze fest. 

Everyone know it and just goes through the motion at your tabletop. 

Depressing stuff. 

P.S any other bright training ideas?

4 types of people in tabletop exercises.

And how to deal with them.

It is every facilitator's nightmare. You spend hours designing and scheduling a tabletop exercise and you practice and envision every conversation, pushback, scenario.

Yet you still feel unprepared because you don't fully know who the audience is, what they are like, and whether they will chew you up and spit you out.

Here are the 4 archetypes and how to manage these characters.

1. The Know-it-all

If we all conduct a blind survey in the room and ask everyone to close their eyes and point to the person who "Knows-it-all", they will all point to the same person.

How to tell who this person is?

Don't worry. When the exercise reaches the first discussion point, this person will start talking about Step A to Z on what he or his team will do. He knows his plans, critical processes, who to call, what to ask, what to investigate, how long it takes, priorities etc

How do you handle the "Know-it-all"?

This is a good thing.
Don't discourage the sharing. Instead leverage what the person is sharing and post some of the things he raised to other teams.

Example:
Know-it-all: For this particular incident, we will triage and send out the initial report within 30 mins

You: That is excellent. Operations team (or any other team that should receive the report), is the information within the initial report sufficient or what other types of info will help your team's processes?

Know-it-alls are good for keeping the flow of the exercise. Leverage them well.

2. The Forever-Skeptic (FS for short)

Signs of the FS.
- This will never happen
- We have implemented tools for this
- This inject is not applicable for our env

I know. 
You may find yourself sweating at this point. But don't worry, leverage your exercise design partner to help expand on the inject to make it relevant.

OR if all else fails. 
This is one trick that works.

Ask the FS straight up. 
"Is there a similar inject or scenario where in your experience and expertise, you know will triggers an event/incident that needs your team's response?"

1. This strokes FS's ego.
2. You have trapped FS. He can't say there is no such scenario.
3. Smile and pivot from FS's suggestion.
4. Rem to tie it back to the overall scenario.

3. The Conversation Hogger

Signs of the Hogger
- This is a no brainer. If you record the whole, the hogger probably took up 70% of the air time.

It is likely that the hogger has gone too far down a rabbit hole. 

Acknowledge the hogger's contribution and bring others in the convo.

4. The silent ones

No sound. No inputs. No involvement.
Ask them directly what they think or they would do. 
Do it with every inject.

What other characters are there and how do you deal w them?

LinkedIn  isn’t rocket science. 
10 things you can do today that will take less than 1 min. 

Forget the polished profile. 
Funnel content tactics. 
Funky AI graphics. 

Keep it simple. 

Do one of these (or all) and make LinkedIn work for you. 

1. Send a DM to refer someone
2. Send a DM to encourage someone
3. Comment on a stranger’s post
4. Reconnect w an ex colleague
5. Congratulate an achievement
6. Say hi to a stranger in your field
7. Say hi to a stranger not in your field
8. Ask for insights from an expert
9. Ask someone for that referral
10. Ask someone if they need help

Try it out. 
Let me know how many you hit today.

P.S when was the last time you did any of the above?

Running the Naval Wargaming & Simulation Centre provided a strong foundation for running cyber exercises.

Here was what a typical week looked like.

• detailing injects
• designing exercise scenarios
• preparing exercise with instructors
• running exercises for warfare teams
• keeping up to date with naval tactics
• tracking and assessing performances
• planning out future exercise schedules
• conducting pre and post-exercise briefs
• discussing the ship's exercise objectives
• ensuring teams are up to date on Red Team tactics

Now you can understand the transferable skills in Cybersecurity exercises.

It’s 2026 and it’s still a VUCA world. 

Volatilite
Uncertain
Complex
Ambiguous 

No wonder there is a continued demand for crisis mgmt professionals. 

VUCA was introduced in 90s to describe the post Cold War period. 
Still as relevant today. 


In fact, things may escalate. 

BANI is added to the frame with pandemics, AI, and whatever’s next. 

Brittle
Anxious
Nonlinear 
Incomprehensible


Stay safe out there. 

P.S Just saw the missile attack on the base in Bahrain where I was stationed back in the day.

Building a product isn’t the hardest part for cyber founders. 

It’s building trust. 

- Enterprise buyers make a decision about a founder before they ever get on a call. 

- Investors decide whether to respond to your email based on what they find when they search your name. 

-Partners size you up against competitors who’ve been showing up publicly for years.

You can have the best product in the market and still lose the deal to someone with an inferior solution and a stronger presence.

Trust is built before the conversation starts and your presence on LinkedIn shouldn’t be overlooked.  

What does your LinkedIn say about you to someone who’s never heard of your company?

Imagine exercising the exact scenario a couple of weeks before an incident. 

This is how some teams would have managed the lead up to this weekend. 

The sharpest teams would have tracked the escalation and highlighted the threat scenarios weeks ago. This can only happen if your threat intel teams covers beyond just cyber. 

The risk teams would be pulled in and have a quick reassessment. This can only happen if your intel and risk teams know how to work together. 

The exercise and security teams collaborate to rapidly design and develop exercise scenarios. This can only happen if leaders carve out time. 

The leadership team prepare briefs to the executive leadership and board. This can only happen if there is trust. 

Can you predict when something kicks off? Nope but you can certainly prep for it in advance. 

And when you run the exact scenario weeks before it actually happens. 

Imagine the credibility your team gains. This doesn’t happen by chance but by an intricate and established machinery. 

P.S 
how are you actively managing risks?

If the message is still unclear, do this. 
- review last few major incidents 
- identify the most relevant scenarios
- refresh or recirculate response plans
- stand up a quick incident drill 
- plan for a near term exercise 
- run the exercise and note lessons
- update leadership on readiness


Write a quick doc on this process. 
That is your response playbook. 
Don’t fumble the next crisis.

Cybersecurity marketing truth:

Conference booth: $40,000 for 72 hours of exposure
LinkedIn: $0 for year-round client acquisition

Let me explain why this matters:

The math simply doesn't add up anymore.

That $40K RSAC booth gets you:
- A week of fighting for attention
- Hundreds of scanned badges (most whom will never respond)
- A team of exhausted sales reps
- Maybe 2-3 qualified opportunities if you're lucky

Meanwhile, the most successful cybersecurity leaders I work with are building personal brands on LinkedIn that generate:
- Continuous inbound leads
- Speaking invitations
- Media opportunities
- Partnerships
- Investor interest
- And yes, actual customers

The key difference? 
Trade shows are transactional. 
LinkedIn is relational.

Here's what a strategic LinkedIn approach for cybersecurity leaders looks like:

𝟭. 𝗙𝗼𝗰𝘂𝘀 𝗼𝗻 𝗮 𝘀𝗽𝗲𝗰𝗶𝗳𝗶𝗰 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗱𝗼𝗺𝗮𝗶𝗻
Don't try to be everything to everyone. Are you an identity expert? Cloud security specialist? OT security veteran? Pick your lane and own it.

𝟮. 𝗦𝗵𝗮𝗿𝗲 𝘆𝗼𝘂𝗿 𝗼𝗽𝗲𝗿𝗮𝘁𝗶𝗼𝗻𝗮𝗹 𝗸𝗻𝗼𝘄𝗹𝗲𝗱𝗴𝗲
CISOs don't need another vendor telling them breaches are bad. They need practical insights from someone who's been in the trenches.

𝟯. 𝗛𝘂𝗺𝗮𝗻𝗶𝘇𝗲 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗰𝗵𝗮𝗹𝗹𝗲𝗻𝗴𝗲𝘀
Most security content feels like it was written by robots for robots. Talk about the human elements - the stress, the politics, the wins.

𝟰. 𝗗𝗼𝗰𝘂𝗺𝗲𝗻𝘁 𝘆𝗼𝘂𝗿 𝗷𝗼𝘂𝗿𝗻𝗲𝘆
Building or selling security solutions is hard. Share your progress, setbacks, and lessons. Vulnerability builds trust.

𝟱. 𝗘𝗻𝗴𝗮𝗴𝗲 𝗰𝗼𝗻𝘀𝗶𝘀𝘁𝗲𝗻𝘁𝗹𝘆
This isn't about posting once a month. It's about showing up regularly to add value to industry conversations.

The cybersecurity industry has a trust problem. Your LinkedIn presence helps solve that by building relationships before the sales pitch.

Is a LinkedIn-first approach right for every security company? No.

But if you're spending $200K+ annually on trade shows without a personal brand strategy, you're leaving opportunities on the table.

What's your experience with cybersecurity marketing? Is LinkedIn working for you or is the trade show circuit still your primary channel?


P.S who has the best pre-RSAC game?

It’s RSAC week and if you are the Head of Marketing and your CEO only makes 1 "I’m going to RSAC" post. 

U know u have missed an opportunity. 

An opportunity to raise awareness. 
An opportunity to warm up leads. 
An opportunity to stand out. 

Now all you can do is pray that the thousands that walk by your booth will be pulled in by the free tshirt. 

And spend 45 seconds giving yr marketing reps a slight nod every once in a while, with a sheepish smile. 
And a thank you. Before scurrying away with their prize in hand. 

You’ll never hear from them again. 

Hated reading that?

While it may be slightly late to "build authority", at least try to raise awareness for your organization with a last minute 5-post sequence.

Drop me a DM, I'll send you:
1. The Cybersecurity CEO’s Personal Brand Blueprint
2. 5 LinkedIn Posts Templates for Cyber CEOs


Stay safe.

Here is what Cyber CEOs should post on LinkedIn. Save this for ideas.  

Most Cyber CEOs only repost their company's content.
Or share updates about the latest hacks. Or they post random AI blogs.

But here's the thing:

- Those posts are generic.
- They don't stand out.
- They don't show leadership.

You are the leader. Lead by example.

Share customer success stories.
Talk about business lessons. 
Have a contrarian viewpoint. 

This is how you can stand out:

→ Highlight customer success stories.
Share real examples of how your company helped clients.
It builds trust and showcases your value.

→ Discuss lessons learned.
Talk about your experiences and what you’ve learned.
It shows you are growing and learning.

→ Voice strong opinions.
Take a stand on industry issues.
It positions you as a thought leader.

By doing this, you'll not just be another CEO. You'll position as aa leader who leads by example.

Make those posts count. 

Here are 26 types to choose from.

Type 1: Authority Posts
Examples:
Deep dive into project implementation
Demonstration of expertise
Client transformation
Knowledge sharing
Client testimonial
Opinions
Insights
Trends

Type 2: Personal Posts
Vision for company
Vision for products
Lessons learned
Founder stories
Team culture
Challenges
Leadership
Resilience
Wins

Type 3: Trust Posts
Highlight value proposition
Talk about problems solved
Demonstrate solutions
Customer pain points
Decision making 
Social proof
Principles
Results
Values

5 things Cyber CEOs do on LinkedIn that harms their brand and rep. 

Before you dismiss it as trivial, your prospects, clients, partners have and will take a glance at your profile. 

How will you show up in their snapshot assessment? Can you risk of they form an early impression?

1. Empty Profile

This may be acceptable in 2010. 
It will raise more questions than answers and you don’t want that. 

2. Unprofessional Pic and Banner

If you don’t accept a shoddy website, why would you accept an unpolished profile?

3. Boring copy across page 

From your headline to your about section and even your outdated experience page. 

If it screams a lack of attention and effort, doesn’t really move the needle forward does it?

4. Effortless content

Repost, repost, repost, repost

And you wonder why this platform sucks. 


5. Full on AI Bonanza

We have all seen it. 
Posts with more fluff than insights. 
Comments that don’t make sense. 
Spam DMs that lead to being reported. 

This is a straight road to being banned.  



When was the last time you audited your profile and campaign?

P.S what else are folks doing wrong here?

I spent years simulating attacks and training naval warfare teams. 

Wargaming and simulation to hone tactical nuance, command and control, and making decisions under pressure.  

These played out in a simulation centre so that when the teams are out at sea, they have the confidence and clarity in execution. 

It is not so much different to readiness in cyber incident response. 

I started building and running tabletop exercises and cyber range simulations for banks, regulators, manufacturers, ministries. 

Same discipline, different domain. 

Subject teams to pressure and guide how they handle it. 

What I kept noticing had nothing to do with firewalls or detection tools. It was about who could communicate clearly when the pressure builds. 

Who could look at a chaotic situation and build a clear picture of what was happening, what it meant, and what needed to happen next.

The technical teams usually understood the problem. The ones who succeeded were the ones who could explain it to everyone else in the room.

What are some horror stories you have seen during incident response and exercises?

Digital infrastructure and AI are reshaping the global economy.At the centre of this shift lies a complex stack of systems and dependencies. AI runs on data centres, connects with enterprise platforms, and depends on energy infrastructure - all under tightening performance and sustainability demands.For nearly two decades, I've written about enterprise IT, data centres, AI, and cybersecurity, along with the operational realities behind them. Having worked across editorial, agency, and brand roles, I understand not just how technology works, but how narratives shape markets.In an era where generative AI can produce endless content, the advantage no longer lies in volume. It lies in perspective and authority.✨ How do you stand out when everyone is publishing?✨ How do you attract the right audience?✨ How do you build trust in a noisy market?That's where I come in.---What I bring:✅ Technical fluency from a prior career in IT.✅ 18 years of editorial judgement.✅ Deep familiarity with APAC data centre and digital infrastructure ecosystem.✅ Experience shaping narratives that resonate with technically literate audiences.---How we can work together: Work with me directly👉 Consulting on AI, data centre and technology trends.👉 Strategic content advisory and executive positioning.👉 Speaking, moderation and industry panels.Reach my audience👉 Strategic editorial collaborations.👉 Authority-building brand partnerships.---If you would like to read more of my content:🔸Follow me on LinkedIn.🔸Tech Stories Blog: https://www.techstoryteller.co🔸Weekly newsletter: https://www.techstories.co/updates🔸Clearly Tech Substack: https://www.clearlytech.co🔸WhatsApp Channel: https://whatsapp.com/channel/0029VbB6pYr9hXF32Ycd4t2f---You can contact me via LinkedIn message (no need to connect first) or email at: paul@techstoryteller.co

Paul Mah

STT GDC India last week announced the launch of its fourth data centre in Chennai, India, with phase one of the 45MW facility operational.

✅ Join my WhatsApp Channel (1-click): https://lnkd.in/gfZUWPSe

𝟭/ 𝗦𝗧𝗧 𝗚𝗗𝗖 𝗶𝗻 𝗜𝗻𝗱𝗶𝗮

Located in the SIPCOT IT Park, Siruseri, the STT Chennai 7 data centre is designed as a 45MW "AI-ready" facility. The first phase that is currently operational is 7.2MW.

STT GDC India also has 40MW already operational at its Chennai Ambattur campus, split between the STT Chennai 2 and STT Chennai 3 data centres.

Earlier this month, STT GDC India held the groundbreaking of STT Chennai 4, also in the Ambattur campus. According to the company website, it will offer 18MW of capacity.

𝟮/ 𝗣𝗼𝘀𝘀𝗶𝗯𝗹𝗲 𝗜𝗣𝗢 𝗺𝗼𝗼𝘁𝗲𝗱

In its press release, STT GDC India says it is evaluating options for future expansion in India, including a potential IPO in 1H 2027 to accelerate growth.

STT GDC holds a 74% stake in STT GDC India with Tata Communications holding the remainder - STT GDC in 2016 acquired a controlling interest in Tata Communications' data centre business in India.

A KKR-led consortium in February announced the full acquisition of STT GDC at an enterprise value of S$13.8 billion. (Read: https://lnkd.in/ggFvPASA)

𝟯/ 𝗜𝗻𝗱𝗶𝗮 𝗼𝗻 𝘁𝗵𝗲 𝗳𝗮𝘀𝘁 𝘁𝗿𝗮𝗰𝗸

As I noted in August last year, there's just 1.4 GW of data centres in operation across India today. That's a dismal figure given the fact that it is the world's most-populous nation with over 1.4 billion people.

The Indian government is making a concerted push to woo investors to get on the AI bandwagon and leapfrog ahead in the digital infrastructure race.

On 1 Feb, Finance Minister Nirmala Sitharaman announced that India will offer a 20-year tax holiday to overseas firms that offer global data centre services from the South Asian country.

Finally, India has other things going for it, including some 11.18GW of renewables at the moment and a push to develop more.

📆 𝗚𝗲𝘁 𝗺𝘆 𝗰𝗼𝗻𝘁𝗲𝗻𝘁

✅ Weekly newsletter: techstories.co/updates
✅ WhatsApp Channel (If 1-click doesn't work): techstories.co/wa

𝗣𝗵𝗼𝘁𝗼 𝗖𝗿𝗲𝗱𝗶𝘁: STT GDC. STT Chennai 7.

Helping growing tech companies with their content and strategy

Adani Group this week announced plans to invest as much as US$100 billion by 2035 to develop AI data centres in India.

Specifics are not provided, though the press release says it builds on AdaniConneX's existing 2GW national data centre roadmap and will take total planned target to 5GW.

AdaniConneX is a 50:50 joint venture by Adani Enterprises and US-based EdgeConneX, and is touted as India's largest hyperscale data centre operator.

✅ Join my WhatsApp Channel (one-click): https://lnkd.in/gfZUWPSe

𝟭/ 𝗔𝗜 𝗱𝗮𝘁𝗮 𝗰𝗲𝗻𝘁𝗿𝗲𝘀

The data centre expansion is anchored by partnerships with Google, Microsoft and Flipkart. According to Adani, this includes:

🔸Google for a 1GW AI data centre campus in Visakhapatnam, as well as additional campuses in Noida.

🔸The building of data centres spanning Hyderabad and Pune for Microsoft.

🔸Plans to develop a second AI data centre with India e-commerce firm Flipkart.

The Adani Group is also in discussion with other major players to build large scale data centre campuses across India.

𝟮/ 𝗘𝗻𝗱-𝘁𝗼-𝗲𝗻𝗱 𝘀𝘁𝗮𝗰𝗸

Adani Group chairman, Gautam Adani spoke of a five-layer AI stack, a framework that essentially covers apps, AI models, semiconductor chips, energy, and data centres.

The idea is to catalyse and leverage additional investments across server manufacturing and supply chains to make India an "AI-first superpower" as described by Adani's CFO.

Indeed, Adani is investing heavily to expand its renewable energy portfolio, which will include the world's largest battery energy storage systems (BESS).

𝟯/ 𝗗𝗲𝗺𝗮𝗻𝗱 𝗳𝗼𝗿 𝗱𝗮𝘁𝗮 𝗰𝗲𝗻𝘁𝗿𝗲𝘀

From a population and digitalisation standpoint, India currently does not have enough data centres to serve its own needs.

But Adani has clearly set its sights beyond traditional data centres and is looking to leapfrog ahead through multiple AI data centre deployments.

The India AI Impact Summit held in New Delhi this week has drawn attendees with around 10 heads of state and industry luminaries such as Alphabet's Sundar Pichai, OpenAI's Sam Altman, and Anthropic's Dario Amodei.

Where do you see India's data centre market heading?

📆 𝗚𝗲𝘁 𝗺𝘆 𝗰𝗼𝗻𝘁𝗲𝗻𝘁

✅ Weekly newsletter: techstories.co/updates
✅ WhatsApp Channel (If 1-click doesn't work): techstories.co/wa

𝗣𝗵𝗼𝘁𝗼 𝗖𝗿𝗲𝗱𝗶𝘁: AdaniConneX. AdaniConneX's Chennai 1 data centre in Chennai, India.

Singapore says it will impose PUE requirements on both old and new data centres with the upcoming Digital Infrastructure Act (DIA).

Speaking at the launch of a Centre of Excellence for Applied AI by Singtel's Digital InfraCo and Nvidia this morning, Senior Minister of State Tan Kiat How made two key announcements.

✅ Join my WhatsApp Channel (one-click): https://lnkd.in/gfZUWPSe

𝟭/ 𝗗𝗶𝗴𝗶𝘁𝗮𝗹 𝗜𝗻𝗳𝗿𝗮𝘀𝘁𝗿𝘂𝗰𝘁𝘂𝗿𝗲 𝗔𝗰𝘁 𝗰𝗼𝗺𝗶𝗻𝗴

The Digital Infrastructure Act (DIA), which is designed to enhance the security and resilience of critical digital infrastructure (CII) such as data centres, will be tabled in parliament later this year. 

First mentioned in January 2024, the DIA was originally scheduled to be introduced last year. It is not known why this was pushed back, though my personal speculation is that the DIA was meant to come after the DC-CFA2, which only kicked off in December 2025.

Another possibility could be the complexity of the legislation, or that CIIs in Singapore coming under state-sponsored attacks last year could have resulted in changes or new provisions being added. Regardless, it sounds like the DIA will be passed into law soon.

𝟮/ 𝗕𝗮𝘀𝗲𝗹𝗶𝗻𝗲 𝗲𝗻𝗲𝗿𝗴𝘆 𝗲𝗳𝗳𝗶𝗰𝗶𝗲𝗻𝗰𝘆

One new revelation that I wasn't aware before, is how DIA will also seek to establish "baseline energy efficiency requirements" for data centres in Singapore.

This includes both existing and new ones that will be built, which will see the imposition of PUE requirements, though no PUE figures were mentioned this morning.

In his speech, the minister also alluded to the systematic raising of the "energy efficiency and sustainability" of all data centres in Singapore to create "more headroom" to support growing digital demands here.

𝟯/ 𝗦𝘂𝘀𝘁𝗮𝗶𝗻𝗮𝗯𝗶𝗹𝗶𝘁𝘆 𝗽𝗹𝗮𝘆

A regional data centre hub, Singapore has a plan to build a green energy hub and unlock sustainable data centre growth.

It is worth noting that the IMDA-BCA Green Mark for Data Centres 2024 standard imposes tighter requirements on how PUE is measured. This means operators should probably not count on being able to evade this requirement.

You can read more about this in "Singapore's audacious bet on sustainable data centres" here: go.clearlytech.co/k4Hj

I'll share more about the DIA when I learn more about it.

📆 𝗚𝗲𝘁 𝗺𝘆 𝗰𝗼𝗻𝘁𝗲𝗻𝘁

✅ Weekly newsletter: techstories.co/updates
✅ WhatsApp Channel (If 1-click doesn't work): techstories.co/wa

𝗣𝗵𝗼𝘁𝗼 𝗖𝗿𝗲𝗱𝗶𝘁: Unsplash/CHUTTERSNAP

Using Claude Code, a man accidentally broke into thousands of live DJI Romo robot vacuums, accessing camera feeds and remotely controlling them.

This #UnfilteredFirday, let's talk about IoT security. And where AI could get us.

✅ Join my WhatsApp Channel (1-click): https://lnkd.in/gfZUWPSe

𝟭/ 𝗪𝗵𝗼𝗼𝗽𝘀, 𝗜 𝗵𝗮𝗰𝗸𝗲𝗱 𝘆𝗼𝘂𝗿 𝘃𝗮𝗰𝘂𝘂𝗺

Hoping to link his brand-new DJI Romo vacuum to a PS5 controller for a geeky side project, a man fired up Claude Code and got to work.

By reverse engineering the protocol used to communicate with the vacuum, Sammy Azdoufal gained direct control of his robot vacuum.

But it turned out it also gave him access to thousands of other DJI robot vacuums too. Sammy could now:

- Check battery levels.
- View live camera feeds.
- Remotely control robots.
- Listen through microphones.
- Generate 2-D maps of each home.

What's more, with the IP addresses of the robots, he could also estimate the location of each device.

𝟮/ 𝗜𝗻 𝘀𝗶𝗺𝗽𝗹𝗲 𝘁𝗲𝗿𝗺𝘀

The DJI Romo uses the well-established and robust MQTT protocol to communicate with DJI servers and the official mobile phone app.

But while proper authentication was required to access a DJI Romo, poor design meant any authentication token could be used to control all connected robot vacuums.

This wasn't a problem with the official app, which restricted access to local devices. But when Sammy extracted his own authentication token* using Claude Code, it gave him access to every device out there.

*An authentication token is a temporary, unique code issued upon verification of a password, ensuring that the password doesn't need to be resent every time.

𝟯/ 𝗔𝗻𝘆𝘁𝗵𝗶𝗻𝗴 𝗰𝗮𝗻 𝗯𝗲 𝗵𝗮𝗰𝗸𝗲𝗱

When the story first broke earlier in the week on The Verge, DJI was already informed and it sent a statement that the issue was resolved prior to public disclosure.

Sammy claims other weaknesses remain, though he could no longer see or hear through other devices.

The issue here is weak app design on the part of DJI. However, it's worth noting how Claude Code lowered the barriers of entry, making it far easier to find or exploit security flaws.

The other consideration is this: If even a commercial product could contain such security oversights, what of vibe coded apps created by non-technical users?

I personally operate on the assumption that my home smart devices can be compromised. This is because cybersecurity is often last on the list for consumer products, and products are rarely - or never - patched after they are released.

Anyway, I'm curious about your thoughts on this: Are we facing a potential vibe-coded security apocalypse?

📆 𝗚𝗲𝘁 𝗺𝘆 𝗰𝗼𝗻𝘁𝗲𝗻𝘁

✅ Weekly newsletter: techstories.co/updates
✅ WhatsApp Channel (If 1-click doesn't work): techstories.co/wa

𝗣𝗵𝗼𝘁𝗼 𝗖𝗿𝗲𝗱𝗶𝘁: DJI.

AI is simultaneously creating and solving problems. Cybersecurity is just the start.

In my latest Substack piece, I look at why rapid AI-driven transitions are becoming the new normal, and why no industry will be spared.

You can read it here: go.clearlytech.co/fsOo

Here's the quick read version.

𝟭/ 𝗔𝗜 𝗮𝘀 𝗯𝗼𝘁𝗵 𝘁𝗵𝗲 𝗽𝗿𝗼𝗯𝗹𝗲𝗺 𝗮𝗻𝗱 𝘀𝗼𝗹𝘂𝘁𝗶𝗼𝗻

(a) Looming vibe-coding security apocalypse

A man hacking his own robot vacuum found a flaw that gave him control over thousands of others. If that can happen with a commercial product, what about the flood of vibe-coded apps out there?

(b) AI as its own antidote

Anthropic's latest AI model has already uncovered over 500 vulnerabilities in mature open-source codebases - bugs that slipped past expert review for decades.

𝟮/ 𝗕𝗿𝗮𝗰𝗲 𝗳𝗼𝗿 𝗽𝗿𝗼𝘁𝗿𝗮𝗰𝘁𝗲𝗱 𝘂𝗽𝗵𝗲𝗮𝘃𝗮𝗹𝘀

My hypothesis: we can expect years of transitions even if AI stops getting better. Spoiler: there's no sign of AI slowing down. Every industry will eventually feel this.

tldr; We're far from understanding what AI means for cybersecurity.

How do you think AI will impact your industry?

📆 𝗚𝗲𝘁 𝗺𝘆 𝗰𝗼𝗻𝘁𝗲𝗻𝘁

✅ Weekly newsletter: techstories.co/updates
✅ WhatsApp Channel: techstories.co/wa

𝗣𝗵𝗼𝘁𝗼 𝗖𝗿𝗲𝗱𝗶𝘁: Unsplash/Jerry Wang

taplio

The Battle

Lester Chng

Paul Mah

Followers

Posts

Engagements

Likes

Performance ScoreLester Chng's LinkedIn Performance

Performance ScorePaul Mah's LinkedIn Performance

Ready to grow your LinkedIn presence?

taplio

The Battle

Lester Chng

Paul Mah

Followers

Posts

Engagements

Likes

Performance Score.css-goub6s{font-size:var(--chakra-fontSizes-md);font-weight:500;color:var(--chakra-colors-gray-600);display:block;margin-top:var(--chakra-space-1);}Lester Chng's LinkedIn Performance

Performance ScorePaul Mah's LinkedIn Performance

Ready to grow your LinkedIn presence?

Performance ScoreLester Chng's LinkedIn Performance