Ben Ennis
Founder, Ennis Studio · Editor, Change Risk Intel
Independent research on IT change management, operational risk, and ITSM/GRC tooling.
Bio
Ben Ennis is a software entrepreneur and product builder based in Grand Rapids, Michigan. He spent part of his career at ServiceNow as a Partner Technology Advisor, working with implementation partners on the ITSM platform that a large share of enterprise change management actually runs on. That is the direct source of the CAB mechanics, CMDB modelling, and change-workflow detail covered on this site.
He now runs Ennis Studio, where he builds and operates SaaS products in adjacent infrastructure and security domains. CertIndex is a Certificate Transparency log API and MCP data service; GuardHound is a consumer domain security monitoring product. Both keep him working in the same territory this site covers — cloud infrastructure, API reliability, certificate and TLS plumbing, and the operational risk that surfaces when any of it changes without warning.
At Change Risk Intel, Ben writes and edits coverage of IT change management, operational risk intelligence, and ITSM/GRC tooling, with a focus on the practical mechanics that CAB leads, SREs, and risk teams use in production rather than the vendor-facing version of the same topics.
How I approach coverage
Ben's approach to coverage starts with understanding the domain deeply, citing primary sources, and staying vendor-neutral. Change Risk Intel is the editorial expression of that philosophy — applied across ITSM, GRC, and operational risk.
- Domain-deep — no thin summaries or AI-only rewrites.
- Primary-source cited — CISA, NIST, vendor status pages, SEC filings.
- Vendor-neutral — no undisclosed affiliate or sponsor influence.
- Practical — written for the CAB lead, SRE, or risk officer, not the boardroom.
Areas of expertise
- Change management and CAB operations
- Enterprise ITSM platforms, including ServiceNow
- IT service management (ITSM) and GRC tooling
- Operational and cyber risk intelligence
- SaaS architecture and compliance technology
- Certificate Transparency and TLS infrastructure
- Cloud infrastructure, CI/CD, and API reliability
Additional notes
Change Risk Intel is edited from Grand Rapids, Michigan. If you have a tip, a correction, or want to reach the desk, use the contact page.
Recent articles
- Google Cloud europe-west2 Outage: What One Zone Failure Exposed
A power event in one London zone hit 38 Google Cloud products for 7h 52m on Oct 20. What it means for zonal design, failover plans and change control.
- Cloud Provider Health Feeds: AWS, Azure, Google, Cloudflare
AWS Health, Azure Service Health, Google Personalized Service Health and Cloudflare alerts compared as ITSM inputs: scope, API access, history and gaps.
- This Week in Change Risk — Week of Oct 12, 2026
Seven KEV adds with 3-day deadlines, a record Patch Tuesday, Cloudflare's rough week in Ashburn, ServiceNow AI Passport, and PCI SSC's Oct 31 sunsets.
- Ivanti Connect Secure CVE-2026-104935: Patching Is Not Recovery
CVE-2026-104935 hit Ivanti Connect Secure with a 3-day KEV deadline, a missed integrity check and an unpatched third bug. A change plan beyond the patch.
- October 2026 Patch Tuesday: A CAB Plan Through Year-End
Oct 13 Patch Tuesday lands on 33 Microsoft lifecycle changes, a Secure Boot CA expiry and the last Exchange ESU month. A CAB plan for Q4 and the freeze.
- This Week in Change Risk — Week of Oct 5, 2026
This week's change-risk digest: five old CVEs back on KEV, a NetScaler SAML bug, four critical GitHub incidents, and FedRAMP's Rev5 cutoff date.
- Zammad KEV: When Your Helpdesk Becomes the Breach Path
CISA added two Zammad flaws to KEV after a breach at DIVD. What the chain exposes, why the vendor and CSIRT disagree, and how to treat your helpdesk.
- Deployment Rings: How Staged Rollouts Fit Into Change Control
How deployment rings and staged rollouts cap the blast radius of a bad change, what Apple, Google, AWS and Azure stages do, and what a CAB should require.
- This Week in Change Risk — Week of Sep 28, 2026
This week's change-risk digest: exploited NetScaler, FortiMail and SD-WAN bugs, an Azure outage from two colliding changes, and PCI Secure SLC v2.0.
- Cloud Provider Incidents: A Standing Item for Your CAB Agenda
How to make upstream cloud incidents a standing CAB agenda item: triggers, owners, and what AWS, Azure, Google Cloud, and Cloudflare actually publish.