Insights
Perspectives on security, resilience & transformation.
The themes shaping how boards and executive teams should think about cyber risk, technology, and change. Full articles published on LinkedIn.
Focus themes
What I write and speak about.
Translating the frontier of cybersecurity and technology into board-level strategy.
Cyber Resilience by Design
Building organisations that withstand, respond to, and recover from cyber disruption — beyond compliance, towards true operational resilience.
Agentic AI & Agent Governance
Adopting AI — and autonomous agents — responsibly: agent inventory, scoped permissions, audit trails, and the controls that let enterprises capture value without losing control.
Board-Level Cyber
Reporting cyber risk in the language of the board — connecting security investment to enterprise value and confidence.
Regulation & Compliance
Turning regulatory obligation into competitive advantage across financial services and critical infrastructure.
Enterprise Transformation
Operating-model change, M&A integration, and modernisation delivered without compromising security.
OT/ICS & Critical Infrastructure
Industrial and critical-infrastructure resilience — IEC 62443 segmentation, secure modernisation of legacy estates, and the product-security duties the Cyber Resilience Act now imposes.
Selected articles & commentary
Published perspectives.
Commentary on the strategic and regulatory issues shaping board-level technology decisions across the UK and internationally.
UK Cyber Security & Resilience Bill
Analysis of what the Bill — through the Commons and now in Lords scrutiny — means for CISO accountability, supply chain security, and board governance obligations in regulated sectors.
Regulatory Strategy · Board Governance
AI Governance: From Policy to Practice
How organisations move from regulatory compliance to genuine AI governance — building the controls, accountability structures, and board visibility that the EU AI Act and ISO 42001 demand.
AI Governance · EU AI Act · ISO 42001
Board Cyber Liability: The Shifting Landscape
With DORA supervised, NIS2 enforcing across member states and Cyber Resilience Act reporting obligations now applicable, individual director liability for cyber failures is no longer theoretical. What boards need to understand now.
Board Risk · DORA · NIS2
Post-Quantum Cryptography: A Board Briefing
Why the quantum threat to current encryption is not a distant horizon — crypto discovery and inventory, agility, and a migration plan that lands before NIST deprecates RSA-2048 and ECC P-256 in 2030. Industry surveys in 2026 suggest most organisations have not meaningfully begun.
Quantum Risk · Crypto-Agility · NIST PQC
Operational Resilience vs Cyber Resilience
Understanding the distinction — and the overlap — between operational resilience frameworks and cyber resilience programmes, and how CISOs should brief boards on both.
Operational Resilience · DORA · NIST CSF
The AI Copyright & IP Challenge for Enterprises
How organisations deploying generative AI face emerging intellectual property risks — and the governance framework senior leaders need to protect their organisations.
AI Risk · IP Governance · Responsible AI
Current perspectives
The issues that demand board attention now.
Where strategy, regulation, and technology converge — and what leadership teams need to act on.
UK Cyber Security & Resilience Bill
Through all Commons stages on 16 June 2026 and past four Grand Committee sittings in the Lords, the Bill now awaits Report stage — date unannounced. Royal Assent is expected late 2026 or spring 2027 depending on parliamentary progress, with substantive obligations expected around 2028 through secondary legislation. Map your exposure now.
EU AI Act: Compliance is Just the Floor
Prohibited practices and GPAI duties already bite, transparency obligations went live in August 2026, and the Digital Omnibus has pushed high-risk obligations out to December 2027 and August 2028. That deferral is breathing room, not a reprieve — the harder question is how to build AI governance that improves decision quality, not just audit outcomes.
Post-Quantum: The Migration Is Overdue
NIST's PQC standards have been final since 2024, and CMVP has now moved the remaining FIPS 140-2 validated certificates to the Historical list. Industry surveys in 2026 suggest only around one in eight organisations has PQC in production. Discovery, inventory and crypto-agility are this year's work, not 2030's.
DORA, NIS2 & the CRA: Beyond Checkbox Compliance
DORA has applied since January 2025 and is being actively supervised; NIS2 national laws are in force with enforcement stepping up; CRA reporting obligations became applicable on 11 September 2026, with full application in December 2027. Organisations treating this as a controls refresh — rather than a governance transformation — are underestimating their exposure.
Shadow Agents: The Permission Problem Nobody Owns
Agent fleets are growing faster than the controls around them. Agents provisioned outside IAM, holding excessive standing permissions and leaving no audit trail, are the emerging attack surface of 2026 — and the first question a board should be asking is simply: how many do we have?
Media & speaking
A trusted voice for boards, conferences & media.
Available for keynotes, panels, executive briefings, and media commentary on the issues reshaping enterprise risk.
Keynotes & conferences
Keynote and panel speaking on cybersecurity strategy, AI governance, operational resilience, and post-quantum readiness — translating complex risk into board-ready insight.
Board & executive briefings
Closed-door briefings for boards, audit & risk committees, and executive teams on emerging threats and the decisions they demand.
Media commentary
Commentary and thought leadership on cyber, AI, and quantum risk for industry and mainstream media.
Organisations don't lose systems first. They lose decision authority — and then everything else follows. Security leadership exists to keep the board in command.
Follow along
Read the full perspectives.
Articles, commentary, and updates are published on LinkedIn.