Insights
Perspectives on security, resilience & transformation.
The themes shaping how boards and executive teams should think about cyber risk, technology, and change. Full articles published on LinkedIn.
Focus themes
What I write and speak about.
Translating the frontier of cybersecurity and technology into board-level strategy.
Cyber Resilience by Design
Building organisations that withstand, respond to, and recover from cyber disruption — beyond compliance, towards true operational resilience.
Agentic AI & Agent Governance
Autonomous agents are the fastest-growing surface in the enterprise: shadow agents with excessive permissions and no audit trail, and identity sprawl across expanding agent fleets. The controls that let enterprises capture value without losing control.
Board-Level Cyber
Reporting cyber risk in the language of the board — connecting security investment to enterprise value and confidence.
Regulation & Compliance
Turning live obligations — DORA, NIS2, the EU AI Act and the Cyber Resilience Act — into competitive advantage across financial services and critical infrastructure.
Enterprise Transformation
Operating-model change, M&A integration, and modernisation delivered without compromising security.
Cloud & Modernisation
Modernising legacy estates and adopting cloud with security and resilience engineered in from the start.
Selected articles & commentary
Published perspectives.
Commentary on the strategic and regulatory issues shaping board-level technology decisions across the UK and internationally.
UK Cyber Security & Resilience Bill
Analysis of what the Bill — through the Commons and now in Lords scrutiny — means for CISO accountability, supply chain security, and board governance obligations in regulated sectors.
Regulatory Strategy · Board Governance
AI Governance: From Policy to Practice
How organisations move from regulatory compliance to genuine AI governance — building the controls, accountability structures, and board visibility that the EU AI Act and ISO 42001 demand.
AI Governance · EU AI Act · ISO 42001
Board Cyber Liability: The Shifting Landscape
With DORA supervised, NIS2 enforced and the CRA's reporting duties now applicable, individual director liability for cyber failures is no longer theoretical. What boards need to understand now.
Board Risk · DORA · NIS2 · CRA
Post-Quantum Migration: A Board Briefing
The standards are finalised, RSA-2048 and P-256 are deprecated from 2030, and every remaining FIPS 140-2 certificate has moved to NIST's Historical list — yet industry surveys in 2026 suggest most organisations have barely begun. Where to start: crypto discovery, inventory and agility.
Quantum Risk · Crypto-Agility · NIST PQC
Operational Resilience vs Cyber Resilience
Understanding the distinction — and the overlap — between operational resilience frameworks and cyber resilience programmes, and how CISOs should brief boards on both.
Operational Resilience · DORA · NIST CSF
The AI Copyright & IP Challenge for Enterprises
How organisations deploying generative AI face emerging intellectual property risks — and the governance framework senior leaders need to protect their organisations.
AI Risk · IP Governance · Responsible AI
Current perspectives
The issues that demand board attention now.
Where strategy, regulation, and technology converge — and what leadership teams need to act on.
UK Cyber Security & Resilience Bill
Through all Commons stages on 16 June 2026 and past four Grand Committee sittings in the Lords, the Bill now awaits Report stage — date unannounced. Royal Assent is expected late 2026 or spring 2027 depending on parliamentary progress, with substantive obligations expected around 2028 through secondary legislation. Map your exposure now.
EU AI Act: Compliance is Just the Floor
Transparency duties have applied since August 2026 and GPAI rules since August 2025; high-risk obligations now land in December 2027 and August 2028. That deferral is breathing room, not a reprieve. The harder question — and the one that creates competitive advantage — is how to build AI governance that improves decision quality, not just audit outcomes.
Post-Quantum: Start the Migration Conversation
NIST's PQC standards are finalised, every remaining FIPS 140-2 certificate has moved to the Historical list, and RSA-2048 and P-256 are deprecated from 2030. Data harvested today will be readable when quantum computers arrive. Crypto discovery, inventory and agility start now.
DORA, NIS2 & the CRA: Beyond Checkbox Compliance
DORA has applied since January 2025 and is being actively supervised; NIS2 is transposed and enforcement is stepping up; the CRA's reporting obligations became applicable on 11 September 2026, with full application in December 2027. Organisations treating this as a controls refresh — rather than a governance transformation — are underestimating their exposure.
Media & speaking
A trusted voice for boards, conferences & media.
Available for keynotes, panels, executive briefings, and media commentary on the issues reshaping enterprise risk.
Keynotes & conferences
Keynote and panel speaking on cybersecurity strategy, agentic AI governance, OT and critical-infrastructure resilience, and post-quantum migration — translating complex risk into board-ready insight.
Board & executive briefings
Closed-door briefings for boards, audit & risk committees, and executive teams on emerging threats and the decisions they demand.
Media commentary
Commentary and thought leadership on cyber, AI, and quantum risk for industry and mainstream media.
Organisations don't lose systems first. They lose decision authority — and then everything else follows. Security leadership exists to keep the board in command.
Follow along
Read the full perspectives.
Articles, commentary, and updates are published on LinkedIn.