James Drew

Senior Security Consultant

James Drew

James has spent the last 6+ years working in cyber security, helping organisations understand how attackers think and how to stay one step ahead. Having always had a keen interest in cyber security, James spent a considerable amount of time “tinkering” with various aspects of security, whether that was learning, using labs like HTB, getting involved in bug bounty schemes, or helping the team with hands-on training. James holds certifications including OSCP and CyberScheme CSTM, along with cloud security training across Microsoft, AWS, and Google platforms.

James has worked with a wide range of industries, from financial services and healthcare through to retail and tech. His projects have ranged from one-off security assessments for small teams to large-scale red team campaigns for global enterprises. James believes the best results come when complex problems are broken down into clear, actionable steps, and he enjoys sharing knowledge, simplifying the technical, and helping both security teams and non-technical readers feel more confident about the risks they face.

Connect with James

Areas of expertise

  • Web and mobile app penetration testing
  • Red teaming and adversary simulation
  • Infrastructure assessments
  • Cloud security (Microsoft 365, Azure, AWS, Google Workspace)
  • Social engineering and phishing

Writing focus

James writes guides and resources that can be applied practically to secure applications and infrastructure, provide guidance on cloud configurations, and, where possible, create tools to assist. James aims to simplify complex topics and help readers take actionable steps to improve security.

James' work

  1. CVE-2026-40372 ASP.NET Core Privilege Escalation
  2. Azure Virtual Network (VNET) Outbound Network Access Default Changing March 2026
  3. BeyondTrust Privileged Remote Access Vulnerability (CVE-2026-1731)
  4. Cisco Unified CM RCE Vulnerability CVE-2026-20045
  5. Duo CA Bundle Updates Coming February 2026
  6. Enumerating Users and Mailboxes in Microsoft 365

    December 11, 2025

    Enumerating Users and Mailboxes in Microsoft Outlook 365 Web

    Read more arrow_right_alt

  7. Blocking device code flow authentication in Microsoft Entra ID

    April 15, 2025

    Blocking Device Code Flow in Microsoft Entra ID

    Read more arrow_right_alt

  8. IoT in cyber security - what you need to know

    February 1, 2024

    Internet of Things (IoT) in Cyber Security

    Read more arrow_right_alt

  9. Application Security 101: HTTP Headers explained