I’ve written a new piece for NCC Group’s Research Blog on how goal-based regulation is changing the way we think about cybersecurity assurance — moving from prescriptive checklists to defensible reasoning about what “secure enough” really means.
You can read it here:
👉 Goal-Based Regulation — NCC Group Research Blog
Corporate DEI became a kind of spell. It was repeated in annual reports and all-hands meetings, pinned to office walls, and whispered as proof that an organization possessed a conscience. But somewhere between the town-hall slide deck and the social-media banner, it lost its substance. Now, as the political climate
Threat modelling is frequently discussed as if it were a singular, monolithic exercise. In reality, applying a one-size-fits-all methodology across diverse engineering and cyber-physical boundaries usually results in misallocated resources, frustrated development teams, and defensive gaps that miss the operational reality of the architecture. This guide serves as a practical
A brief logging event to mark a significant professional milestone. I was incredibly honored to be shortlisted as a finalist for the Outstanding Security Researcher/Analyst Award at this year’s Security Excellence Awards at One Moorgate Place. While I didn't bring home the physical trophy this time,
When a supplier delivers a component implementing complex cryptographic functions, a standard black-box penetration test is entirely insufficient to prove security. Navigating third-party validation requires a structured, evidence-based assurance framework. This piece outlines how automotive and industrial OEMs can design pre-sales and scoping phases to explicitly uncover and verify structural