Contact us
About GCIT

Elliot Munro, CISO and AI practice lead at GCIT

Elliot Munro is the Chief Information Security Officer at GCIT, the managed IT, cybersecurity and AI business in Burleigh Heads founded in 2015. He leads our security and AI work, reviews the AI guidance we publish, and holds Anthropic’s Claude Certified Architect - Professional credential.
Book a free discovery callRead the companion guide
His certifications link to the issuers, so you can check them yourself.
Elliot Munro, CISO at GCIT, at his desk in the Burleigh Heads office
Elliot Munro, CISO, GCITPublished , last reviewed
Elliot’s current certifications and training. Check each certification with the issuer.
Claude Certified Architect - ProfessionalIssued by Anthropic to Elliot Munro, through CredlyVerify on CredlyMicrosoft Certified: Cybersecurity Architect ExpertIssued by Microsoft to Elliot Munro, current to March 2027Verify on Microsoft LearnMicrosoft 365 Certified: Administrator ExpertIssued by Microsoft to Elliot Munro, current to February 2027Verify on Microsoft LearnMicrosoft Certified: Identity and Access Administrator AssociateIssued by Microsoft to Elliot Munro, current to February 2027Verify on Microsoft LearnMicrosoft Certified: Security Operations Analyst AssociateIssued by Microsoft to Elliot Munro, earned March 2026Verify on Microsoft Learn
Essential Eight Assessment CourseTAFE Queensland (TAFEcyber). Completed in January 2026 with a satisfactory result.
Profile

Who is Elliot Munro?

GCIT is led by James and Elliot Munro. Elliot is GCIT’s CISO. GCIT was founded in 2015. It is a managed IT and cybersecurity provider based in Burleigh Heads on the Gold Coast. Elliot is responsible for security and automation: making sure best-practice security is applied consistently across every customer environment we look after, and building the GCIT tooling that lets our technicians manage those environments securely at scale.
He also leads our AI and automation practice. That means designing the AI coworkers and Model Context Protocol (MCP) tooling we run on our own service desk, deciding what is safe to automate, and reviewing the AI guidance on this website before it goes live. When a page says “Reviewed by Elliot Munro”, this is the person behind it.
Elliot is one of three Claude Certified Architects at GCIT, with Phoenix Asange-Harper, our Automation Engineer, and Shay Brokensha, our Junior Automation Engineer.
Everything he works on ties back to GCIT’s mission: “Empowering a secure and productive Gold Coast”.
In one lineElliot’s job is to make sure the technology GCIT runs for you, AI included, is secure before it is anything else.
Microsoft 365 securityMicrosoft Entra IDClaudeClaude CodeModel Context Protocol (MCP)AI agentsConnectWise PSA
What he does

What does Elliot do at GCIT, day to day?

Three things. He is responsible for security across the customer environments GCIT manages, he leads our AI and automation practice, and he teaches other IT businesses how to build AI agents safely. The security rules come first, and the AI work follows them.

Security for every customer

Elliot makes sure best-practice security is applied consistently across every customer environment GCIT manages, and he leads our ISO compliance work.

AI built on GCIT first

We got our own house in order first. GCIT built and ran its AI tooling internally before offering it to clients, and Elliot designs and reviews that tooling.

Teaching what works

He presents to IT business owners on building AI agents safely, and wrote the companion guide that goes with his talk, so the lessons are written down and checkable.
The companion guide
Credentials and talks

What has Elliot earned and presented in 2026?

In short: a new Anthropic architect credential, a Sydney conference session on agentic AI, a place on the keynote panel at ConnectWise’s regional conference, a New Zealand chapter talk, and the written companion guide to his Sydney session.
  1. 21 July 2026
    Claude Certified Architect - Professional
    Elliot Munro, GCIT’s CISO, earned Anthropic’s Claude Certified Architect - Professional credential on 21 July 2026, less than two weeks after the exam opened.
  2. 23 July 2026
    SMBiT Professionals’ Next Level 2026, Sydney
    Elliot presented Get up to speed with Agentic AI (without breaking too many things) at SMBiT Professionals’ Next Level 2026, Sydney, 23 July 2026.
  3. 27 August 2026
    ConnectWise IT Nation Connect ANZ 2026
    Elliot joined the keynote panel Build, Buy, Partner at ConnectWise IT Nation Connect ANZ 2026, Sydney, 27 August 2026, speaking for building.
  4. September 2026
    SMBiT Professionals New Zealand chapter
    Elliot presented to the SMBiT Professionals New Zealand chapter in September 2026.
  5. From July 2026
    Author of the agentic AI companion guide
    Elliot wrote the companion guide to his Sydney session. More than 20 IT businesses across Australia and New Zealand have requested GCIT’s free companion guide, an 18-section, email-gated guide to deploying agentic AI securely.
Elliot Munro seated in a lounge chair in the GCIT office, smiling, with a window and indoor plants behind him
In Elliot’s words

What is an AI agent, in plain English?

An AI agent is software that works through a job the way a new staff member would. It follows standing instructions, uses the systems it has been given access to, and keeps going until the job is done. This is the definition Elliot uses in his talks and his guide.
An agent is three things plus a loop: a system prompt (the employee handbook), a tool registry (the portal logins), and a task (the ticket).
Elliot Munro, CISO, GCIT, from the agentic AI companion guide
The agent loop Elliot teaches
A diagram of the definition above, drawn by GCIT. It shows how the parts fit, not a measurement.
Diagram: three inputs, a system prompt described as the employee handbook, a tool registry described as the portal logins, and a task described as the ticket, feed a loop that reads the task, thinks, picks a tool, runs it and checks the result, repeating until the task is done. A band underneath shows the harness runs each tool, which is where the controls sit.System promptthe employee handbookTool registrythe portal loginsTaskthe ticketRead the taskThinkPick a toolRun itCheck resultGo again until the task is doneThe model only asks for a tool. The harness runs it,so the harness is where the security controls belong.
What the agent is givenWhere the controls sit
Source: Elliot Munro, Get up to speed with Agentic AI, companion guide, the agentic loop section, July 2026.
Show the diagram as text
PartWhat it isEveryday equivalent
System promptStanding instructions for how the agent worksThe employee handbook
Tool registryThe systems the agent is allowed to useThe portal logins
TaskThe job to be doneThe ticket
LoopRead the task, think, pick a tool, run it, check the result, repeatWorking the ticket until it is closed
HarnessThe software that actually runs each toolThe place where permissions and checks are enforced
His approach

How does Elliot approach AI for a small or medium business?

Security first, a narrow scope, and a clear return before anything is built. These are the rules he applies to GCIT’s own AI work and to every client conversation.
  • Fix the process before adding AI. Many requests framed as AI are better served first by data clean-up, integration or deterministic automation, with AI added at decision points and a person in the loop.
  • Keep the scope narrow. Our first AI project lost money because it wasn’t properly scoped. Now every scope is narrow and tied to an ROI.
  • Put guardrails in code. Guardrails belong in deterministic code, not in the prompt.
  • Keep client data in business plans. Client data belongs in team or enterprise AI plans, never in personal or consumer accounts.
There’s really two main opportunities. You can build things for your customers, or you can secure and govern things that you’ve built or someone else has built.
Elliot Munro, CISO, GCIT, speaking to IT business owners
What that means for youWhether GCIT builds something new for your business or checks a tool your team already uses, the same security review applies to both.
For your IT lead: how Elliot designs agents and MCP tooling
The technical view, for the person who will ask how an agent reaches your systems. These are the patterns Elliot teaches in the companion guide. What GCIT implements for you is written into your own scope.
The loop
The model proposes tool calls and the harness executes them. The model never runs anything itself, so permissions, logging and approvals are enforced in the harness. Claude Code is this loop in a terminal, and claude.ai is the same loop in a browser.
Protocol
Tools are exposed through the Model Context Protocol (MCP), the open standard Anthropic published in late 2024 and now governed under the Linux Foundation’s Agentic AI Foundation. An MCP host (such as Claude) connects through a client to MCP servers that offer tools, resources and prompts, with remote servers using Streamable HTTP and OAuth.
Controls
Six controls: read and write tools separated in code, role-based access with a few roles, a two-phase confirm on destructive tools, a full audit trail, secrets held in a vault, and allow-listing for anything internet-facing.
Customer tenants
Any AI-driven action in a Microsoft 365 customer tenant should be bounded by the same GDAP permissions Microsoft already enforces on human technicians. That means two authorisation checks, the MCP server’s own role-based access and then Microsoft’s GDAP roles, with each action attributed to a named person in both audit trails.
Untrusted input
Email, documents and retrieved records are wrapped as data, never instructions. A low-cost pass with no tools screens inbound content for prompt injection before a tool-using agent sees it, and a person approves the final step.
Working style
“As you work with agents, you’ll see your job is just organising context for agents in an efficient way.” On code: “It is now just unproductive to be writing code any other way.”
Keep reading

Where should you go next?

Start with the service overview if you are weighing up AI for your business, then see how an engagement runs, step by step.
Services

AI and automation services

What GCIT builds with Microsoft 365 and Claude, and how an engagement starts small.
AI & Automation Services
The process

How we work

A free discovery call, the AI Discovery Workshop, your first build, then quarterly build cycles or gcOS Care.
How we work
Connections

Custom MCP servers

Connecting Claude to the systems your business already runs on, with your Microsoft 365 sign-in and an audit trail.
Custom MCP servers
The company

About GCIT

The team, the Burleigh Heads office and the principles behind how we work.
About GCIT
GCIT across all managed services300+ Microsoft 365 tenants managed by GCIT97% positive customer ratings in 2025 SmileBack CSATISO 27001, 9001 and 14001 certified
FAQ

Questions people ask about Elliot

Elliot Munro is the Chief Information Security Officer (CISO) at GCIT, a managed IT, cybersecurity and AI business in Burleigh Heads founded in 2015. He leads GCIT’s security and AI work and reviews the AI guidance GCIT publishes.

The Claude Certified Architect - Professional chip links to Elliot’s badge on Credly, where Anthropic issues the credential. The four Microsoft certification chips link to his Microsoft Learn transcript, which shows each certification and its current status.

Elliot Munro, GCIT’s CISO, earned Anthropic’s Claude Certified Architect - Professional credential on 21 July 2026, less than two weeks after the exam opened.

Usually, yes. Elliot generally joins discovery calls, together with members of GCIT’s internal development team. Calls are booked through Harry Morris, so tell us what you would like to cover when you book.

Send a request through our contact page with the audience, the date and the topic, and we will let you know if he is available. He has presented on AI to SMBiT Professionals in Sydney and to its New Zealand chapter, and joined the keynote panel at ConnectWise IT Nation Connect ANZ 2026.

More than 20 IT businesses across Australia and New Zealand have requested GCIT’s free companion guide, an 18-section, email-gated guide to deploying agentic AI securely. It is written for IT teams, so if you run a business rather than an IT department, pass it to your IT lead or book a discovery call instead.

Yes. GCIT holds ISO/IEC 27001:2022, ISO 9001:2015 and ISO 14001:2015 certification, certified by Southpac Certifications and listed on the JAS-ANZ register.
Get in touch

Talk to GCIT about AI, with security built in from the start

The discovery call is free. Tell us the job that takes up your team’s time and we will tell you honestly whether AI is the right fix.
Book a free discovery callRead the companion guide
Sales
0755 999 999
Email
hello@gcit.com.au
Office
1/16 Dover Drive, Burleigh Heads QLD 4220
ISO 27001  |  ISO 9001  |  ISO 14001  |  Essential Eight assessment certified (TAFE Queensland)  |  Microsoft Solutions Partner
Ready to secure and simplify your IT? Talk to a GCIT expert today.
Sales 0755 999 999 Book a free consultation