Insights
Perspectives on security, resilience & transformation.
The themes shaping how boards and executive teams should think about cyber risk, technology, and change. Full articles published on LinkedIn.
Focus themes
What I write and speak about.
Translating the frontier of cybersecurity and technology into board-level strategy.
Cyber Resilience by Design
Building organisations that withstand, respond to, and recover from cyber disruption — beyond compliance, towards true operational resilience.
Agentic AI & AI Governance
Adopting AI responsibly when the AI acts on its own: agent inventory, identity and permission scoping, audit trails, and the controls that let enterprises capture value without losing control.
Board-Level Cyber
Reporting cyber risk in the language of the board — connecting security investment to enterprise value and confidence.
Regulation & Compliance
Turning regulatory obligation into competitive advantage across financial services and critical infrastructure.
Enterprise Transformation
Operating-model change, M&A integration, and modernisation delivered without compromising security.
Cloud, OT & Modernisation
Modernising legacy estates, adopting cloud, and securing converged IT/OT and critical infrastructure to IEC 62443 — with resilience engineered in from the start.
Selected articles & commentary
Published perspectives.
Commentary on the strategic and regulatory issues shaping board-level technology decisions across the UK and internationally.
UK Cyber Security & Resilience Bill
Analysis of what the Bill — through the Commons and now in Lords scrutiny — means for CISO accountability, supply chain security, and board governance obligations in regulated sectors.
Regulatory Strategy · Board Governance
AI Governance: From Policy to Practice
How organisations move from regulatory compliance to genuine AI governance — building the controls, accountability structures, and board visibility that the EU AI Act and ISO 42001 demand.
AI Governance · EU AI Act · ISO 42001
Board Cyber Liability: The Shifting Landscape
With DORA supervised, NIS2 enforced through national law, and CRA reporting obligations now applicable, individual director liability for cyber failures is no longer theoretical. What boards need to understand now.
Board Risk · DORA · NIS2 · CRA
Post-Quantum Cryptography: A Board Briefing
The standards are set, RSA-2048 and ECC P-256 are deprecated from 2030, and FIPS 140-2 validated certificates have now moved to NIST's Historical list. Industry surveys in 2026 suggest most organisations have not meaningfully begun. Where to start: discovery, inventory, agility.
Quantum Risk · Emerging Threat · NIST PQC
Operational Resilience vs Cyber Resilience
Understanding the distinction — and the overlap — between operational resilience frameworks and cyber resilience programmes, and how CISOs should brief boards on both.
Operational Resilience · DORA · NIST CSF
The AI Copyright & IP Challenge for Enterprises
How organisations deploying generative AI face emerging intellectual property risks — and the governance framework senior leaders need to protect their organisations.
AI Risk · IP Governance · Responsible AI
Current perspectives
The issues that demand board attention now.
Where strategy, regulation, and technology converge — and what leadership teams need to act on.
UK Cyber Security & Resilience Bill
Through all Commons stages on 16 June 2026 and past four Grand Committee sittings in the Lords, the Bill now awaits Report stage — date unannounced. Royal Assent is expected late 2026 or spring 2027 depending on parliamentary progress, with substantive obligations expected around 2028 through secondary legislation. Map your exposure now.
EU AI Act: Compliance is Just the Floor
Transparency obligations have applied since August 2026, and the Digital Omnibus has pushed high-risk obligations out to December 2027 and August 2028 — time to build properly, not time to stop. Most organisations are focused on mapping systems to risk tiers. The harder question — and the one that creates competitive advantage — is how to build AI governance that improves decision quality, not just audit outcomes.
Post-Quantum: Start the Migration Conversation
NIST's PQC standards are finalised, FIPS 140-2 certificates are now Historical, and RSA-2048 and ECC P-256 are deprecated from 2030. Cryptographically Relevant Quantum Computers remain years away — but data harvested today will be vulnerable when they arrive. The migration window is open and closing.
DORA, NIS2 & CRA: Beyond Checkbox Compliance
DORA has applied since January 2025 and financial entities are now being actively supervised; NIS2 enforcement is stepping up through national law; CRA reporting obligations became applicable in September 2026, with full application in December 2027. Organisations treating any of it as a controls refresh — rather than a governance transformation — are underestimating their exposure.
Shadow Agents: The Permission Problem
Agent fleets are growing faster than the identity and logging estate around them. Over-permissioned agents acting without an audit trail are the emerging attack surface of 2026 — and the first question a regulator will ask is which agents you have, what they can do, and who approved it.
Media & speaking
A trusted voice for boards, conferences & media.
Available for keynotes, panels, executive briefings, and media commentary on the issues reshaping enterprise risk.
Keynotes & conferences
Keynote and panel speaking on cybersecurity strategy, AI governance, operational resilience, and post-quantum readiness — translating complex risk into board-ready insight.
Board & executive briefings
Closed-door briefings for boards, audit & risk committees, and executive teams on emerging threats and the decisions they demand.
Media commentary
Commentary and thought leadership on cyber, AI, and quantum risk for industry and mainstream media.
Organisations don't lose systems first. They lose decision authority — and then everything else follows. Security leadership exists to keep the board in command.
Follow along
Read the full perspectives.
Articles, commentary, and updates are published on LinkedIn.