What decisions are being made without seeing the behaviour behind them?
The question behind three decades of practice, and the thread through everything I write. Institutions measure harm after it occurs. Behaviour signals it as it forms.
Why every materialised risk began as a change in behaviour
Boards, models and the accountability gap
Encryption, regulation and the limits of content-based protection
Chapter 2: The Good Politicians of the C-Suite (The Flashlight Effect)
When the normal governance pathways are deactivated, the transition from corporate leader to career politician is complete.
When a Platform Tells a Government to Make It Comply
Digital sovereignty, accountability and the limits of enforcement.
I Never Got the Degree: The Myth of the Master Plan
A retrospective on being bored, getting lucky, and the absolute chaos of building a thirty-year career in cybersecurity.
One Thing Has Always Fascinated Me About Intelligence Services
The strange problem of proving the value of disasters that never happened.
The Model Isn’t The Problem
What a ten-minute laptop experiment tells us about who is really protecting our children online, and who isn’t.
The Internet Changed Before We Understood What It Was Becoming
Operation Cathedral, safeguarding history, and why the current online-safety debate increasingly misses the deeper problem.
Before I Understood Risk, I Learned What Uncertainty Felt Like
How invisible environments shape human behaviour before we fully understand them.
Encryption Is Not the Problem. Visibility Is.
Encryption did not create the safeguarding problem. It exposed it.
The Internet is Not Failing Children. Our Model of Protection is.
We have built child safety systems on a false assumption.