Insights
Perspectives on security, resilience & transformation.
The themes shaping how boards and executive teams should think about cyber risk, technology, and change. Full articles published on LinkedIn.
Focus themes
What I write and speak about.
Translating the frontier of cybersecurity and technology into board-level strategy.
Cyber Resilience by Design
Building organisations that withstand, respond to, and recover from cyber disruption — beyond compliance, towards true operational resilience.
Agentic AI & Agent Governance
Adopting autonomous AI responsibly: agent registers, scoped permissions, audit trails, and the controls that let enterprises capture value without losing control of what their agents are doing.
Board-Level Cyber
Reporting cyber risk in the language of the board — connecting security investment to enterprise value and confidence.
Regulation & Enforcement
Turning live obligation — DORA, NIS2, the Cyber Resilience Act and the EU AI Act — into competitive advantage across financial services and critical infrastructure.
Enterprise Transformation
Operating-model change, M&A integration, and modernisation delivered without compromising security.
OT, ICS & Post-Quantum
Critical-infrastructure resilience to IEC 62443, and the cryptographic discovery and agility work that post-quantum migration actually depends on.
Selected articles & commentary
Published perspectives.
Commentary on the strategic and regulatory issues shaping board-level technology decisions across the UK and internationally.
UK Cyber Security & Resilience Bill
Analysis of what the Bill — through the Commons and now in Lords scrutiny — means for CISO accountability, supply chain security, and board governance obligations in regulated sectors.
Regulatory Strategy · Board Governance
AI Governance: From Policy to Practice
How organisations move from regulatory compliance to genuine AI governance — building the controls, accountability structures, and board visibility that the EU AI Act and ISO 42001 demand.
AI Governance · EU AI Act · ISO 42001
Board Cyber Liability: The Shifting Landscape
With DORA supervised, NIS2 enforced nationally and CRA reporting duties live, individual director liability for cyber failures is no longer theoretical. What boards need to understand now.
Board Risk · DORA · NIS2
Post-Quantum Cryptography: A Board Briefing
The NIST standards are finalised, FIPS 140-2 certificates have moved to the Historical list, and RSA-2048 and P-256 are deprecated from 2030. Why crypto discovery and agility are board business now, not a horizon item.
Quantum Risk · Emerging Threat · NIST PQC
Operational Resilience vs Cyber Resilience
Understanding the distinction — and the overlap — between operational resilience frameworks and cyber resilience programmes, and how CISOs should brief boards on both.
Operational Resilience · DORA · NIST CSF
The AI Copyright & IP Challenge for Enterprises
How organisations deploying generative AI face emerging intellectual property risks — and the governance framework senior leaders need to protect their organisations.
AI Risk · IP Governance · Responsible AI
Current perspectives
The issues that demand board attention now.
Where strategy, regulation, and technology converge — and what leadership teams need to act on.
UK Cyber Security & Resilience Bill
Through all Commons stages on 16 June 2026 and past four Grand Committee sittings in the Lords, the Bill now awaits Report stage — date unannounced. Royal Assent is expected late 2026 or spring 2027 depending on parliamentary progress, with substantive obligations expected around 2028 through secondary legislation. Map your exposure now.
EU AI Act: Compliance is Just the Floor
Prohibited practices and GPAI duties already apply, and transparency obligations have been live since August 2026; the high-risk requirements have been deferred to December 2027 and August 2028 — which is runway, not reprieve. The harder question is how to build AI governance that improves decision quality, not just audit outcomes.
Shadow Agents: The Permissions Nobody Signed Off
Agent fleets are growing faster than the registers, identities and audit trails meant to contain them. The pattern is consistent: autonomous agents with standing, over-broad permissions and no record of what they did on whose authority. Agent identity is the attack surface of this cycle — and boards should be asking who owns the register.
Post-Quantum: Start the Migration Conversation
The standards are settled and the validation baseline has moved — every remaining FIPS 140-2 certificate is now Historical. Industry surveys in 2026 suggest most organisations have not meaningfully begun. Start with crypto discovery: you cannot migrate an inventory you do not have.
CRA, NIS2 & DORA: Enforcement Has Arrived
DORA has applied since January 2025 and is actively supervised. NIS2 is transposed and enforcement is stepping up. Cyber Resilience Act reporting obligations became applicable on 11 September 2026, with full application in December 2027. Organisations treating this as a controls refresh rather than a governance transformation are underestimating their exposure.
Media & speaking
A trusted voice for boards, conferences & media.
Available for keynotes, panels, executive briefings, and media commentary on the issues reshaping enterprise risk.
Keynotes & conferences
Keynote and panel speaking on agentic AI governance, post-quantum migration, OT and critical-infrastructure resilience, and CRA/NIS2 enforcement — translating complex risk into board-ready insight.
Board & executive briefings
Closed-door briefings for boards, audit & risk committees, and executive teams on emerging threats and the decisions they demand.
Media commentary
Commentary and thought leadership on cyber, AI, and quantum risk for industry and mainstream media.
Organisations don't lose systems first. They lose decision authority — and then everything else follows. Security leadership exists to keep the board in command.
Follow along
Read the full perspectives.
Articles, commentary, and updates are published on LinkedIn.