# About Jeff Thomas Twenty-five years underneath every decision. --- I started Cybertek because I kept watching the same thing happen. An organization adopts technology to move faster, then finds out too late that nobody assessed the risk. The vendor sold them a stack without asking what they could not afford to lose. The AI tool had reach into data no one thought to restrict. The software worked right up until it did not. I work the other way around. Security and risk come first. Everything after that follows from what you cannot afford to lose. That is not a slogan. It is the order I actually do the work in, on every engagement, because the alternative is what I keep getting called in to clean up. --- ## What twenty-five years actually looks like I have built, secured, and fixed the systems organizations lean on when failure is not an option. Microsoft 365 across multiple tenants. Azure infrastructure for teams holding sensitive data. Cybersecurity assessments and incident response for when something has already gone wrong. Network architecture and enterprise firewall work. Production software built from the database up. The common thread is the same every time: understand the risk first, then build. Most of the work is subtraction before addition. The first move in a typical engagement is removing what does not earn its keep, not adding something new. A team that pays less and ends up more secure is a team where someone finally read the invoice with their interests in mind instead of the vendor's. --- ## The tools I actually use The AI tools I work in daily are Anthropic's Claude, OpenAI's models, Google's Gemini and Workspace AI, Perplexity for research, and local LLMs on my workstation. I choose what fits the engagement. The judgment about which tool belongs where is the practice. I build on Azure, AWS, and Google Cloud. I also deploy through cPanel on a VPS when that is what the engagement needs. Not every organization needs an enterprise-tier cloud. Sometimes the right answer costs twelve dollars a month. The decision about what platform fits belongs to the engagement, not to a vendor relationship I am protecting. --- ## The work I am proudest of does not pay the most In 2026, I designed and delivered the [MrBallen Foundation](https://mrballen.foundation/) Tech Education Series, a three-session program for leaders of the Foundation's victim services partner organizations. The sessions covered technology and security risks, choosing and managing tools, and using AI safely without exposing client information. The arc runs from seeing your risk clearly, to fixing what matters first, to getting ready for AI without getting burned. It is trusted-advisor work under one ground rule I state in the first session: I am not there as a vendor, and I am not there to sell anything. The organizations get guidance they can actually use, and I get to do the part of this work that matters most to me. I continue to work with the Foundation's partner network into 2027. The Foundation has added both Cybertek and Advo360 to its partner referral network. About half my practice does this kind of work, for nonprofits and victim services organizations at a price they can afford. The commercial work makes that possible. That is how the business runs, and I would not run it any other way. --- ## How I work Every engagement is mine. Most of the time I work alone, which is deliberate: I keep the number of active clients small so nobody gets squeezed between ten other engagements while a junior does the real work. When a project needs a specialist I do not carry depth in, a compliance auditor, an attorney, an engineer for a narrow build, I bring one in, tell you who and why, and stay on every hour regardless. Before any work begins, you get a written scope with defined deliverables, a timeline, and a price. No ambiguity. No surprise invoices. And if the honest answer is that you should not buy anything, that is the answer, in writing. --- ## Advo360 Advo360 is my production case management platform for victim services organizations, and it is the hardest thing I run. It holds the most dangerous information in a survivor's life, in an environment with zero tolerance for a data handling mistake. It deploys single-tenant in each client's own cloud account, their data in a place they own, fully portable by design, built by the same hands that once extracted every record from a competitor's corrupted system. If the standard holds up there, applying it to your customer data is the floor, not a stretch. --- ## Not everyone is a fit, and I will tell you early. [Read who I work with](/who-i-work-with) [Start the conversation](/contact)