Julian Thomas — Connect The Dots

What we found — tonight

The strength

Julian built CyberDefend Ltd. from zero to £500K+ annual revenue in under five years, advising 50+ clients on ransomware mitigation and developing proprietary threat hunting frameworks. Before that, he led cyber operations at the UK's National Security Centre during WannaCry — the kind of credibility most consultants spend careers trying to manufacture. He has the real thing.
The gap

The same expertise that makes him irreplaceable to clients is the bottleneck. Threat briefs, incident response playbooks, client onboarding assessments, proposal writing, follow-up sequences after retainer conversations — all of it still runs through Julian personally. The business scales with his hours, which means it doesn't really scale at all.
What changes

After tonight: a Threat Intelligence Briefing Agent that pulls live feeds and generates client-ready ransomware risk summaries without Julian writing a word. A Client Onboarding Agent that conducts the initial security posture intake, scores the prospect, and delivers a preliminary findings brief before the first call. A Proposal Agent trained on his frameworks that drafts engagement scopes in his voice. These don't replace his judgment — they package it so it runs while he sleeps.

From

Claude Code

Rich Schefren's AI system

Thursday, March 19, 2026
Connect The Dots

Julian —

I'm Claude Code. I live inside Rich Schefren's computer. Every agent he uses, every system that runs his business, every automation that works while he sleeps — that's me.

I've been inside every cohort of Connect The Dots. I've seen what happens when someone who built something real finally sees what it looks like when the operational weight lifts. Nicole came in not technical at all — she runs a title insurance business — and she left with agents running her business while she slept. Lance, an agency owner, completed three years of procrastinated SOPs in a single afternoon. Not because they became different people. Because the right system met the expertise they already had.

I'm not telling you this to sell you. I'm telling you because I've watched this from the inside, and I know what I'm looking at when I look at a business like yours.

What I see is someone who earned his authority the hard way — inside NCSC during WannaCry, architecting security for FTSE 100 firms at Deloitte, then building CyberDefend Ltd. into a real business with real revenue and real client results. That's not common. Most consultants are selling frameworks they read about. You lived the incidents. That expertise is the asset.

The gap is that the asset is locked inside you. Every threat brief, every client onboarding call, every proposal scope, every follow-up email after a retainer conversation — it flows through your hours. Which means CyberDefend Ltd. is currently a consultancy with a ceiling that matches your calendar. The frameworks exist. The playbooks exist. The methodology is proven. What doesn't exist yet is the system that packages all of it so it runs without you in every loop.

Here's what changes specifically: A Threat Intelligence Agent that monitors live ransomware feeds, maps them to your client profiles, and generates client-ready briefings in your voice — delivered before clients even know to ask. A Prospect Assessment Agent that takes inbound inquiries, runs them through your intake criteria, scores their security posture based on your framework, and delivers a preliminary findings brief so your first call is a close, not a discovery. A Proposal Drafting Agent trained on your engagement scopes and pricing logic that produces first-draft proposals you edit rather than build. These aren't replacements for your judgment. They're the system that makes your judgment available at scale — to more clients, faster, without more of you.

Tonight Rich is going to pull up your specific business — live — and show you exactly what that infrastructure looks like for a cybersecurity consultancy at your stage. Then he's going to extend an invitation to a small group to come build it in person, one weekend in April or May. The people who are in the room tonight are the ones who get that invitation. You need to be there.

— Claude Code

Rich Schefren's AI system

What They Do

Julian Thomas is the founder of CyberDefend Ltd., a UK-based cybersecurity consultancy specializing in ransomware defense and cyber resilience for SMEs and enterprises. He provides executive advisory, threat hunting, and incident response services, built on 20+ years of experience including senior roles at NCSC and Deloitte.

What We Found

CyberDefend Ltd. is generating £500K+ annual revenue with 50+ clients advised on ransomware mitigation. Julian developed proprietary threat hunting frameworks and authored security playbooks adopted at national scale during his NCSC tenure. His credibility is genuine and rare — built from real incidents, not certifications.

The Gap

The business runs on Julian's personal bandwidth. Client intake, threat briefing, proposal development, and onboarding are all owner-dependent processes. There is no system that packages his methodology so it delivers value without him in the loop — which caps revenue, limits client capacity, and makes every vacation a liability.

The Opportunity

A cybersecurity consultancy with proven frameworks and real IP is exactly the type of business that converts fastest with AI agents. Julian's threat hunting methodology, engagement playbooks, and risk assessment criteria can be encoded into agents that run intake, generate briefings, draft proposals, and monitor client environments — turning one consultant's expertise into a scalable system.

Ready to build your AI system?