blog July 14, 2026 2 Minutes

A few years ago, my friend Jim Shields wrote a book called Three Guys Walk Into a Bar.

The basic premise is that there are three kinds of people.

There is a guy. You need a wall painted, so you find a guy. Any reasonably competent person with a brush, a ladder and enough spatial awareness not to paint themselves into a cupboard will do.

Then there is that guy. Someone recommended him. You have seen his work. He charges more, is booked until October and communicates exclusively through three-word WhatsApp messages, but you want that guy.

Finally, there is THE Guy.

You are no longer asking for a wall to be painted. You are asking Michelangelo to recreate the Sistine Chapel ceiling above your downstairs toilet.

In this context, “guy” is gender-neutral. It can also describe a company, a team, a report or anything else that becomes the automatic answer to a particular question.

For breach data, for example, the Verizon DBIR is THE report. You do not need to search your memory for alternatives. It has already arrived, put its coat over the chair and ordered a drink.

The same principle applies to people.

Need help with incident response? Who comes to mind first?

What about red teaming? Security leadership? Identity? Cloud security? Explaining cyber risk to a board without causing three directors to visibly enter sleep mode?

The first name that appears has probably done something to earn that position.

I was reminded of this after reading about ZEGO, a German textile company that filed for insolvency after a cyberattack reportedly halted production for nearly six weeks.

My immediate thought was: I need to send this to Adrian Sanabria.

Why Adrian?

Because Adrian is THE Guy for one very specific question: Can a cyberattack actually cause a company to collapse?

He started trying to answer it years ago by maintaining a public Google Sheet. No grand launch. No venture funding. No dramatic photograph of him staring thoughtfully through a glass wall. He simply noticed that people kept repeating dubious statistics about companies folding after cyberattacks and decided to collect the evidence.

That spreadsheet eventually became Destroyed by Breach, a proper website tracking organisations that appear to have been finished off by an incident.

It is not his full-time job. It is not even his part-time job. It is just a useful contribution that became associated with his name.

That is the bit people often miss when trying to become known for something. They assume it requires a personal brand strategy, a ring light and daily LinkedIn posts beginning with “I’m humbled”.

Usually, it begins much more quietly.

Ask a worthwhile question. Keep pulling the thread. Make the answer useful to other people. Repeat until your name becomes attached to the problem.

So, what do people think of when your name is mentioned?

Is there a particular problem they would bring to you before anyone else? If not, perhaps that question offers some direction for where to take your career next.

Alternatively, enrol in my six-week winter programme, From Random Bloke to THE Guy, co-hosted with Jim Shields. Module one covers strategic self-promotion. Module two is just changing your LinkedIn headline until it sounds expensive.

Places are limited because the course does not exist.