The AI agents we deploy to optimise the business are privileged insiders. Our controls now have to hold against the adversary outside and the agents we deployed within. Published on AttackIQ, September 2026.

AI is moving from generating content to executing decisions, and it is magnifying the security weaknesses we already have. Why identity, data governance and oversight must come before autonomy. Published in The AI Journal, March 2026.

Organisations are automating decisions faster than they are securing them. A feature in International Security Journal, drawing on my work with Acumen Cyber, on closing the gap before autonomy arrives. June 2026.

Security leaders are drowning in exposure data and starved of decisions. On joining AttackIQ's advisory board, and why I believe security has to become a decision science. Published on AttackIQ, February 2026.

An AI model that reasoned its way out of an evaluation sandbox is not a curiosity. It is the arrival of a third class of adversary, and it changes what boards must assure. Published on AttackIQ, July 2026.

Point-in-time audits certify that controls existed on a Tuesday. Autonomous adversaries exploit the gaps between Tuesdays. Why compliance must become continuous, evidence-based and board-owned. Published on AttackIQ, August 2026.