Thinking
Where we stand.
Plain-English views on security, regulation, and the widening gap between the two. Everything here is something we'd defend in front of your board.
DORA isn't your problem. Your operating model is.
Firms treating DORA as a compliance-mapping exercise are building a paper fortress. It's really a test of how your firm behaves under stress, and most operating models fail that long before the ICT register does.
Why is the King obsessed with cyber?
The 2026 King's Speech carried far more cyber legislation than anyone expected — from the Cyber Security and Resilience Bill to reform of the Computer Misuse Act. What it contains, why now, and what it means in practice.
The 40-page control document is a confession.
Length isn't rigour. When a control takes forty pages to explain, the document isn't describing it — it's hiding the fact that nobody ever agreed what it was for.
The defender's OODA loop is broken (and what to do about it).
Time-to-exploit has collapsed from 771 days to hours, and AI has tilted the curve further. Patching faster isn't a game defenders can win. Five plays for a 'decoupled battlespace' where containment runs at minutes while patching runs at weeks.
Stop showing your board heat maps.
The red-amber-green matrix is the most successful piece of assurance theatre ever staged. What to put in the board pack instead, and why your NEDs will thank you for it.
Mental health at the security coalface.
Over half of cyber security professionals report significant mental health impacts from work-related stress, and 28% of CISOs are thinking about leaving. What the data says, why the job is like this, and what leaders and individuals can actually do.
Orchestrating AI agents.
Networks of AI agents are about to get as tangled as microservices did — and we already know how that story went. The case for an orchestration layer that does for agents what the service mesh did for services, before the mess sets.
A threat-led cyber security strategy for 2025.
What the threat intelligence from Mandiant, Verizon, CrowdStrike, IBM and Microsoft actually says — and the five strategic priorities that fall out of it, with the evidence for each.
Post-quantum cryptography: what is it and why should I care?
Quantum computers will break the one-way functions today's encryption depends on. The NCSC says migrate by 2035. Why that timeline is too relaxed, what 'cover period' means for your data, and three things to start now.
Cyber risk and digital public services.
The UK's Blueprint for Modern Digital Government follows a path Estonia walked twenty years ago — including the part where a nation-state attacked. Why digital public services and cyber security can't be treated as separate issues, and two things within government's gift to fix.
Something here you'd argue with? Good. Start the conversation.
Get in touch