“Resilience Isn’t a Detection Problem”, Tanium’s James Greenwood on Why Most Enterprises Already Know What’s Wrong

Every enterprise security team has more data than it knows what to do with. James Greenwood, AVP of Solution Engineering for APAC at Tanium, thinks that’s exactly the problem. In his view, the industry’s biggest misconception is treating cyber resilience as a detection challenge, when most organisations already have the visibility they need. What they lack is the ability to act on it fast enough, consistently enough, and with enough context to know what actually matters.

Greenwood leads solution engineering across a region where digital maturity, regulation, and infrastructure vary enormously from market to market, from organisations still running monthly patch cycles to those building AI-enabled operating models. In this conversation, he discusses why Tanium is betting on Autonomous IT rather than another dashboard, what separates a real operating-model shift from simply bolting AI onto existing tools, and why the biggest blind spot for leaders over the next five years won’t be a lack of AI features, but a lack of trusted, real-time data underneath them.

Tanium's Autonomous IT platform combines AI with real-time endpoint intelligence. How does this unified approach help organisations strengthen security while simplifying IT operations?

The value comes from combining intelligence, decision support and action in the same governed environment. AI can help operators interpret what is happening, but it is only useful when it is grounded in accurate, real-time data from across the endpoint estate.

Tanium’s approach brings telemetry, guidance and remediation together so teams can move from identifying an issue to acting on it without switching between disconnected tools or relying on stale information. That matters because many organisations do not struggle to detect vulnerabilities. They struggle to understand which ones affect their environment, which are being actively exploited, and what action should be taken first.

By automating routine work such as patching, compliance validation and vulnerability closure, organisations can respond at machine speed while keeping people focused on policy, exceptions and high-risk decisions. This reduces manual effort, simplifies operations and gives security and IT teams a shared source of truth. The result is not just better visibility, but faster and more consistent action across the enterprise.

As Area VP of Solution Engineering for APAC, you connect customer challenges with business outcomes. How has your role evolved, and what defines successful solution engineering today?

Solution engineering has evolved from demonstrating product features to helping customers redesign how work gets done. The role now requires a much deeper understanding of operational constraints, regulatory expectations, workforce pressures and the outcomes the organisation is trying to achieve.

Detecting an issue is only one part of the problem for our customers. They want to know whether it can help them act faster, reduce risk, simplify operations and support change across complex environments. That means successful solution engineering must connect technical capability to measurable operational value.

In practice, this involves understanding where processes are still manual, where tools are fragmented, and where decision-making is slowed by incomplete data or unclear ownership. It also means being realistic about organisational readiness. The technology to improve patching, visibility and response already exists, but adoption is often held back by governance, operating models and resistance to change.

The strongest solution engineers today are therefore part technologist, part advisor and part change partner. Their role is to help customers move from isolated use cases to a more autonomous and resilient operating model.

APAC presents diverse levels of digital maturity and regulatory complexity. How do you align Tanium's solutions with these regional realities while delivering consistent customer value?

APAC cannot be treated as a single market. Organisations across the region operate at very different levels of digital maturity, and they face different regulatory, infrastructure and workforce pressures.

The starting point is to understand the customer’s environment as it exists today. In some markets, the immediate priority may be consolidating fragmented tools and improving basic endpoint visibility. In others, the focus may be automating patching, strengthening operational resilience or supporting more advanced AI-enabled workflows.

The consistent value comes from the underlying foundation: real-time visibility, accurate endpoint data and the ability to take governed action across the estate. The way that capability is applied will differ by market and by sector.

For example, organisations in critical sectors may need to respond to stricter incident reporting, patching and resilience expectations. In Malaysia, Tanium has highlighted the gap between AI-accelerated vulnerability discovery and organisations that still depend on monthly patching cycles. The principle is the same across the region: customers need current, environment-specific information so they can prioritise and act based on actual risk rather than generic severity scores.

Real-time endpoint intelligence is increasingly becoming a strategic asset. How do you see it reshaping IT operations, cybersecurity, and enterprise decision-making over the next few years?

Real-time endpoint intelligence will become the operational foundation for AI across IT and security. AI models can reason, summarise and recommend, but the quality of those outputs depends on the accuracy and immediacy of the data underneath them.

For IT operations, this means moving away from periodic checks, static dashboards and manual investigation toward continuous awareness and automated action. Teams will be able to identify issues, understand their impact and remediate them in the same environment.

For cybersecurity, real-time intelligence will be essential because the window between vulnerability disclosure and exploitation is continuing to shrink. Defenders will need to know not only that a vulnerability exists, but whether it is present in their environment, whether it is being exploited and which systems should be prioritised first.

At an enterprise level, endpoint data will also support better decisions about software, compliance, risk, productivity and investment. Over time, the most valuable platforms will not simply present more data. They will turn trusted, real-time context into governed action, while keeping people accountable for the decisions that require judgement.

From your experience working with enterprises across APAC, what's the biggest misconception leaders have about modern endpoint management or cyber resilience?

The biggest misconception is that resilience is primarily a detection problem. Most organisations already have large amounts of security data and multiple tools capable of identifying issues. The real challenge is acting on that information quickly and consistently.

Many leaders still assume that if a vulnerability has a lower severity score, or if a patch is scheduled within a monthly cycle, the risk is under control. That assumption is becoming increasingly dangerous. AI is making it easier and cheaper to identify and weaponise vulnerabilities, including those that may previously have been considered unlikely to be exploited.

Modern endpoint management therefore cannot be limited to inventory, monitoring or scheduled maintenance. It needs to provide real-time visibility, threat-informed prioritisation and the ability to remediate at scale.

There is also a misconception that technology is the main barrier. In many cases, the capability already exists. The harder problems are fragmented ownership, slow approval processes, tool sprawl and limited appetite for operational change. Cyber resilience depends as much on the operating model as it does on the technology.

Looking five years ahead, what will distinguish organisations that lead in Autonomous IT from those that simply adopt AI? What blind spot should leaders address today?

The organisations that lead will be those that redesign their operating model around trusted data, governed automation and clear human accountability. Simply adding an AI assistant to an existing toolset will not be enough.

Leaders will use AI to move routine operational work to machine speed, including patching, compliance checks, vulnerability closure and continuous monitoring. Their people will remain responsible for setting policy, reviewing exceptions and approving higher-risk changes. That balance between autonomy and control will be critical.

The major blind spot is the data and operational foundation. AI cannot reliably act on fragmented, stale or incomplete information. Nor can it deliver value if every recommendation still has to pass through slow, manual processes across multiple teams and tools.

Organisations should therefore focus now on creating a complete, real-time view of their environment, simplifying workflows and defining where automation can act safely. The future advantage will not come from having the most AI features. It will come from being able to turn accurate intelligence into trusted action faster than the organisation’s risk environment changes.