Tim Wainwright wants to launch 1,000 cybersecurity careers

A thousand careers is an unusual ambition to put beside a cybersecurity business. It asks the founder to imagine a great many first days: a student opening a laptop, a career changer learning unfamiliar vocabulary, a junior colleague discovering that an intimidating problem can be taken apart. Tim Wainwright wants Security Risk Advisors to help make those beginnings possible.

The goal reaches beyond filling the next vacancy. It includes giving people an entrance to the profession and helping them develop once inside it. For a company whose work involves finding weaknesses, it is a pleasingly constructive measure of success. The vulnerabilities may be unwelcome. The newcomers are rather the point.

Wainwright helped found SRA in 2010. Today, his responsibilities cover strategy, culture and growth. His public work repeatedly returns to the same practical concern: whether a security organization is becoming more capable. That question applies to its defenses, certainly. It also applies to the people expected to operate them.

Expansion, with reservations

Ask a founder about growth and you may receive a chart. Wainwright has offered a restaurant. In conversation with CISO Executive Network’s Bill Sieglein, he compared expansion choices with those facing a successful chef. A business can become a chain, or choose a more selective addition. The question is what happens to the experience that made people return.

“We only add another restaurant when we know that all of the others are doing great.”

Tim Wainwright, in conversation with Bill Sieglein

The analogy is useful because it makes capacity visible. Another dining room requires more than another sign above a door. Someone has to run the kitchen. Someone has to notice when standards slip. In consulting, the equivalent is the attention and judgment available for each engagement.

His formulation gives existing commitments a vote in future expansion. Repeat work and recommendations become checks on whether the organization is delivering. A founder can be ambitious while remaining answerable to the customers already seated. The restaurant metaphor also permits a small mercy: a strategy discussion with something edible in it.

The consultant owes you a difficult question

In a 2021 interview, Wainwright described a profession whose importance had changed since SRA’s founding. Cybersecurity had become a board concern, with organizations facing demands for more effective detection and a shortage of specialist talent. An outside adviser had to contribute something the client could not readily provide alone.

His account of useful consulting had three parts: keep developing knowledge, help clients turn it into measurable controls, and question accepted practice. That final obligation is awkward in the productive way. A comfortable answer can remain comfortable long after the circumstances that justified it have changed.

For the customer, this makes the adviser’s value harder to reduce to a finished report. The work must travel into decisions and operating practice. A recommendation has to survive contact with budgets, teams and the person who will actually implement it. Expertise that never completes that journey makes handsome reading and expensive stationery.

Learning together, without keeping score against one another

Wainwright’s 2019 writing on purple teams approaches security as a shared learning exercise. Red-team specialists simulate attacks; blue-team specialists work on defense. Purple teaming brings their knowledge together so they can investigate what the controls actually do and agree on improvements.

He argues for an exercise where nobody needs to hide a gap to preserve their reputation. The attacker should provide enough detail for the defender to reproduce the behavior. The defender should be able to acknowledge where a tool, configuration or detection rule fell short. Both should leave with work they understand and credit they can share.

That arrangement changes the reward. A clever intrusion can become a lesson someone else can use. A missed alert can become a specific engineering task. The interesting result is what the organization learns to handle afterward.

There is a recognizable management idea beneath the technical vocabulary: people exchange more useful information when helping a colleague matters more than winning the encounter. In Wainwright’s version, cooperation belongs inside the test itself.

An alarm is only the beginning

Writing with Kevin Foster, Wainwright drew a careful distinction between testing readiness and testing response. A collaborative session can show that an alert appeared. It cannot, simply by asking the participating responders, establish what they would have done during an unexpected incident.

Someone saying they would act is making a prediction. Watching whether they act in a surprise exercise produces a different kind of evidence. The distinction is small enough to disappear in a meeting and substantial enough to shape an entire testing program.

Their proposed sequence puts collaborative work on protection and detection before a stealthier test of response. Practice gives the organization a chance to improve the controls that a later exercise will challenge. It is a modestly unfashionable proposition in a field with an appetite for dramatic demonstrations: preparation should have its appointment before the examination.

A dashboard with fewer fireworks

Wainwright’s concern with evidence also runs through his writing on metrics. A vast count of blocked events may sound impressive while revealing little about readiness for a consequential attack. The question he wants answered is more particular: can an organization demonstrate that its defenses work against selected attack behaviors?

In his 2022 account, he described bringing practitioners together, beginning in early 2020, to agree on relevant threats and build repeatable procedures. The original index contained 56 test cases. Consistency made comparison more useful: teams needed a shared understanding of what had been tested.

The resulting threat-resilience measure expresses passed tests as a percentage. Its meaning depends on the test set, the recorded outcomes and the improvements made over time. It is no promise that every attack will fail. Its attraction is that the next conversation can begin with a result someone can inspect.

A smaller number, properly earned, can demand more attention than a spectacular one.

Chocolate cake, carefully specified

For someone occupied with technical risk, Wainwright gives food a respectable amount of editorial space. His 2023 discussion of continuous security testing uses chocolate cake to explain why a program needs different layers and a deliberate recipe.

The essential distinction is between vulnerability and visibility. One concerns what can be exploited. The other concerns whether defenders can detect exploitation and respond. A testing calendar concentrated on a single activity can leave the second question underexamined, however continuous the activity sounds.

He also warns against allowing suppliers’ available services to become the customer’s requirements. The program should follow the organization’s needs, scope and budget. A vendor’s enthusiasm for an ingredient does not settle how much belongs in the cake.

The culinary language does useful work. It makes a technical allocation problem easier to discuss without pretending that one more tool will resolve every weakness. The recipe requires judgment, and someone remains responsible for the finished result.

Making the work inspectable

VECTR gives this emphasis on recorded evidence a practical home. Wainwright’s April 2025 announcement of VECTR Satellite described a managed option in Azure Marketplace that runs within an organization’s own private Azure tenant.

The platform tracks testing exercises and their results, with reporting tied to the MITRE ATT&CK framework of adversary techniques. It allows teams to revisit individual cases and compare assessments. Those functions suit an argument he has made for years: a security exercise should leave behind knowledge people can use.

His November 2024 article with Stephen Burke examined another use: organizing documentation for threat-led penetration testing. Access controls, structured records and reporting help different participants keep track of the work. The article presents VECTR as an aid within a wider process, a sensible limit for a tool expected to serve complicated engagements.

A founder’s work can change shape

The personal turn in Wainwright’s technical writing comes when he recalls being overtaken by other practitioners early in his career. He describes recognizing that leadership offered a way to help others advance. That recollection informs his insistence that experienced specialists should invest in the next generation.

His argument makes room for exploration, too. Someone attracted to red teaming may discover a better fit in another specialty after seeing the work closely. Development includes learning which kind of technical contribution suits a person, rather than treating one coveted role as everyone’s destination.

In his June 2025 conversation on The New How Podcast, Wainwright discussed experience before entrepreneurship, values, delegation and the continuing importance of human interaction alongside technical skills. Those subjects give the career ambition its practical weight. A thousand beginnings would require many people prepared to teach, share responsibility and make room.

The technical work continues. In March 2026 he presented a VECTR session on validating coverage against Iranian threat groups. The founder remains engaged with the question of what defenders can prove. Alongside it sits a longer project: helping enough people learn the work that they can carry it forward themselves.