Ben Ennis
Founder, Ennis Studio · Editor, Change Risk Intel
Independent research on IT change management, operational risk, and ITSM/GRC tooling.
Bio
Ben Ennis is a software entrepreneur and product builder based in Grand Rapids, Michigan. He spent part of his career at ServiceNow as a Partner Technology Advisor, working with implementation partners on the ITSM platform that a large share of enterprise change management actually runs on. That is the direct source of the CAB mechanics, CMDB modelling, and change-workflow detail covered on this site.
He now runs Ennis Studio, where he builds and operates SaaS products in adjacent infrastructure and security domains. CertIndex is a Certificate Transparency log API and MCP data service; GuardHound is a consumer domain security monitoring product. Both keep him working in the same territory this site covers — cloud infrastructure, API reliability, certificate and TLS plumbing, and the operational risk that surfaces when any of it changes without warning.
At Change Risk Intel, Ben writes and edits coverage of IT change management, operational risk intelligence, and ITSM/GRC tooling, with a focus on the practical mechanics that CAB leads, SREs, and risk teams use in production rather than the vendor-facing version of the same topics.
How I approach coverage
Ben's approach to coverage starts with understanding the domain deeply, citing primary sources, and staying vendor-neutral. Change Risk Intel is the editorial expression of that philosophy — applied across ITSM, GRC, and operational risk.
- Domain-deep — no thin summaries or AI-only rewrites.
- Primary-source cited — CISA, NIST, vendor status pages, SEC filings.
- Vendor-neutral — no undisclosed affiliate or sponsor influence.
- Practical — written for the CAB lead, SRE, or risk officer, not the boardroom.
Areas of expertise
- Change management and CAB operations
- Enterprise ITSM platforms, including ServiceNow
- IT service management (ITSM) and GRC tooling
- Operational and cyber risk intelligence
- SaaS architecture and compliance technology
- Certificate Transparency and TLS infrastructure
- Cloud infrastructure, CI/CD, and API reliability
Additional notes
Change Risk Intel is edited from Grand Rapids, Michigan. If you have a tip, a correction, or want to reach the desk, use the contact page.
Recent articles
- Zammad KEV: When Your Helpdesk Becomes the Breach Path
CISA added two Zammad flaws to KEV after a breach at DIVD. What the chain exposes, why the vendor and CSIRT disagree, and how to treat your helpdesk.
- Deployment Rings: How Staged Rollouts Fit Into Change Control
How deployment rings and staged rollouts cap the blast radius of a bad change, what Apple, Google, AWS and Azure stages do, and what a CAB should require.
- This Week in Change Risk — Week of Sep 28, 2026
This week's change-risk digest: exploited NetScaler, FortiMail and SD-WAN bugs, an Azure outage from two colliding changes, and PCI Secure SLC v2.0.
- Cloud Provider Incidents: A Standing Item for Your CAB Agenda
How to make upstream cloud incidents a standing CAB agenda item: triggers, owners, and what AWS, Azure, Google Cloud, and Cloudflare actually publish.
- This Week in Change Risk — Week of Sep 21, 2026
This week's change-risk digest: 7 CISA KEV entries on 3-day clocks, including F5 BIG-IP APM, Cloudflare's APAC subsea-cable congestion, and CRA reporting.
- Auth Gateways Compared: oauth2-proxy, Authelia, Pomerium
Compare oauth2-proxy, Authelia, Cloudflare Access, and Pomerium as reverse-proxy auth gateways for internal apps that lack native SSO, with a matrix.
- SOC 2 Type II Evidence: What Auditors Actually Sample
How a SOC 2 Type II auditor samples the observation window: sample size by control frequency, population completeness, and why exceptions happen.
- This Week in Change Risk — Week of Sep 14, 2026
This week's change-risk digest: 4 new CISA KEV entries with two CVSS-10 Cisco flaws, a GitHub P1 outage, PagerDuty's SRE Agent GA, and an RDS patch bug.
- Azure Outage History: A Timeline of Change-Triggered Failures
A timeline of major Azure outages from 2018 to 2026, and why almost every one traces back to a change: a config push, a code deploy, or a key rotation.
- PCI DSS 6.4.3: Payment-Page Scripts as a Change-Control Problem
PCI DSS 6.4.3 and 11.6.1 have been mandatory since March 2025. Here is how to wire payment-page script authorization into your change process.