About James Shank
Director of Threat Operations at Expel. Chairperson of the Board of the Internet Fire Brigade Society.
James Shank is Director of Threat Operations at Expel, where he is responsible for threat intelligence, vulnerability intelligence, and threat hunting. He is also Chairperson of the Board of the Internet Fire Brigade Society, a nonprofit that holds Internet security projects that fall outside commercial incentives.
James keeps the needs of the Internet security community at the center of his work, and he helps to run several community projects against online threats. One of these was the Emotet takedown of January 2021. Emotet was widely known at the time as the largest security threat in the world, and James helped to bring network operators and law enforcement together to take it down.
Some problems are too large for one operator to solve, so James works on them with others in the community. He facilitates several trust groups that connect Internet security operators, and that connection helps to keep the Internet running.
Current work
At Expel, James leads the Threat Operations department, which covers threat intelligence, threat hunting, and vulnerability intelligence for a managed detection and response service. The department turns adversary research into hunts, detections, and guidance that customers can act on.
Three pieces of his current work are public:
- The AI Security Risk Framework, which Expel published.
- The talk How NOT to be Your Adversary's Best Friend at FIRST CTI 2026, with Brian Hein.
- The talk Red Teams and Real Attacks at CanSecWest 2026, on 30 September 2026.
Career
James's work moved from engineering to IT leadership, and then to security, threat intelligence, product strategy, threat operations, and AI.
-
St. John's Catholic Newman Center
2001 to 2010
Engineering, IT leadership
- Director of Information Technology2003
- Network Administrator2001
James started as the network administrator and became Director of Information Technology, with responsibility for policy, budget, and staff. He sat on the executive team and chaired the IT advisory board for a large building project.
-
Team Cymru
2010 to 2023
Security, threat intelligence
- Chief Architect, Community Services2019
- Senior Technical Advisor2017
- Manager of Engineering2014
- Senior Engineer2010
James built large security data systems for threat intelligence and abuse mitigation, then managed the engineers, advised the CEO, and became chief architect of the community services. His work from this time includes Taking Down Emotet, the Pandamic research, CVE-2022-26143, and his part in the Ransomware Task Force.
-
SpyCloud
2023 to 2025
Product strategy
- Director of Product, Data and Analytics2024
- Director of Data Product Strategy2023
James set the product strategy for data, analytics, and consumer protection, and he is a co-inventor of an AI model that predicts ransomware risk. While at SpyCloud he spoke at Black Hat USA 2023, wrote Criminals are Easily Bypassing Passkeys, and led the Cyber Risk Working Group.
-
Expel
2025 to now
Threat operations, AI
- Director of Threat Operations2025
James leads threat intelligence, threat hunting, and vulnerability intelligence at Expel. He is the author of the AI Security Risk Framework, which he presented at Black Hat USA 2026, and he spoke at CanSecWest 2026 on 30 September 2026.
-
Building companies
2022 to now
His own companies
- Acutis Ventures2022
- Ocular Braid2023
- HeedGood2021, pre-launch
- Blue Castle Consortium2023, pre-launch
Since 2022, James has also built companies of his own: Acutis Ventures, Ocular Braid, HeedGood, and Blue Castle Consortium.
Community
Board positions, working groups, and task forces, with the most recent first.
| Position | Organization | Years | One line |
|---|---|---|---|
| Chairperson of the Board | Internet Fire Brigade Society | 2021 to now | A nonprofit for Internet security projects that fall outside commercial incentives. Incorporation date 2021-07-12. |
| Liaison | FIRST (Forum of Incident Response and Security Teams) | Current | Incident response and security teams, worldwide. |
| Task force participant | Joint Ransomware Task Force (CISA) | Companies and the United States Government, together against ransomware. | |
| Contributor | Ransomware Threat Focus Hub | Coordinated ransomware response between industry and government. | |
| Advisory group participant | NetDiligence Ransomware Advisory Group | Ransomware risk, for the insurance market. | |
| Task force participant. Chair of the Worst Case Scenario subcommittee. | Institute for Security and Technology, Ransomware Task Force | From 2021 | Its report had an effect on the 2021 United States policy on ransomware. |
| Facilitator | Cyber Risk Working Group | 2024 to 2025 | Insurance risk experts and cybersecurity experts, in a closed group. See the project page. |
| Facilitator | A DDoS working group, with participants from many companies | Coordinated work against DDoS attacks, across companies. | |
| Facilitator | Trust groups | Current | Operators who keep the Internet in operation. |
| Community-side coordinator | Emotet Working Group | 2018 to 2021 | Organized the community side of the work that led to the January 2021 Emotet takedown. |
| Founding member | DNS Transparency Project | 2019 to now | Makes changes to core DNS zones auditable, in the style of Certificate Transparency. Housed by the Internet Fire Brigade Society. |
| Board member and cofounder | Las Vegas Internet Exchange | 2024 to now | Strategy, security and partnerships for a new Internet exchange. |
| Volunteer presenter and author | Human Trafficking Task Force | 2015 to 2018 | A local campaign to raise awareness of human trafficking. |
| Contributor | DNS Changer Working Group | 2011 to 2012 | Community coordination and response for the DNS Changer takedown. |
| Program Committee member | NANOG | 2022 to 2024 | Selects the talks for the NANOG meetings. |
Speaking and media
James speaks to security leaders, founders, and senior practitioners about threat intelligence, cybercrime economics, and defender coordination. He has spoken at CanSecWest 2026, Black Hat USA 2026, FIRST CTI 2026, Black Hat USA 2023, Virus Bulletin 2020, NANOG 77, and DNS-OARC 31.
The press has quoted him in The Washington Post, The Associated Press, Dark Reading, BankInfoSecurity, SC Media, TechTimes, and Intelligent CIO.
Companies
James also owns several companies.
Education
James has a Bachelor of Arts in Philosophy from the University of Illinois at Urbana-Champaign, with a minor in Computer Science.
Contact
Contact: LinkedIn.