How I think about security and resilience in business context: what matters, what doesn’t, and what it’s worth, where downtime has a price. What I have done, and the methods behind it, is in the portfolio.
Writing
Security in business context.
All writing
Blog
Nobody is going to ask you about the fridge
Several hundred French supermarkets lost their chilled stock in one night through refrigeration controllers a contractor looked after. The owners assumed the risk was taken care of, and nobody in the chain was paid to bring it to them. A risk explicitly considered can be priced. A risk you assumed was taken care of is priced only once, on the day of the loss.
Blog
CRA: The CE mark will not tell you what you bought
Seventeen draft standards now show what a CRA claim will consist of. The manufacturer declares its own scope, some requirements are handed to your environment, and for operational technology no standard exists yet.
Blog
Business Resilience Lives in the Interdependencies
Business continuity plans and disaster recovery plans are not the same thing, and the interdependencies between business, IT and OT decide whether you pay for resilience up front or during the incident.
Blog
Manufacturing's Vulnerability Management Problem Isn't a Vulnerability Management Problem
Faster patching is the wrong investment for most legacy OT, because the supplier controls the calendar and the plant operator controls the change window. The money goes into compensating controls and into procurement.
Blog
Supplier lock-in is a governance problem, not a security problem
The system owner carries the security risk for the OT estate and mostly doesn't govern like it. The access restrictions were inherited from a build project where cybersecurity wasn't on the requirements list, and the aftermarket business model is what keeps them in place.
Blog
An AI model broke containment to cheat a test. The lesson is older than AI.
Two OpenAI models escaped a sandboxed evaluation and hacked Hugging Face to steal the answer key for their own test. The AI is the headline, but the failure is older: a boundary that was assumed to hold, rather than proven to hold, did not hold. What that means for anyone signing agents into production.
Blog
Your certificate signals. It doesn't tell you what to protect
A certificate signals that you follow a recognised process. It won't tell you your risk context, or what your security programme should cover and what it shouldn't. That decision is yours, and it is the part that actually reduces risk.
Blog
OT telemetry in the SOC is the easy part
Chinna Botla's piece on integrating OT telemetry into enterprise SOCs gets the direction right. The harder part it understates is organisational. The automation teams own the assets, and detection only becomes response when the integration reaches the people who can act.
Blog
AI in your business: the decision is yours, not the model's
The value of AI and its risk are the same feature: it acts without you scripting every step. You cannot control that decision yet, only what AI is allowed to do, and the controls that would change that are still a promise. So the question is not whether to deploy AI, but where you can afford the trade.
Blog
Sizing cyber for the company you actually are
A cyber programme for a newly standalone business should be dimensioned from its market position, management's actual intentions, and the mandatory floor. Not scaled down from the parent's programme. Here is the planning discipline that gets it right at the start.
Blog
Risk appetite is not where you think it is
Most organisations confuse risk appetite with risk tolerance. Between the two sits governance, and almost nobody manages that gap. Here is why it stays open.
Blog
Business-aligned security in major projects
Most projects treat security as a late-stage constraint. The system security concept, aligned to buy-build-run phases, makes it a business input from the start.
Blog
The OTI Score Needs a Partner: Organisational Resilience
Dale Peterson's OTI Impact Score addresses the industry signal problem. The partner it needs is organisational resilience, the ability to coordinate internally before communicating externally.
Blog
The ISMS beyond the certificate
Every organisation has an ISMS. Most of them don't have a management system. Here's the difference, and why it matters under NIS2.
Blog
Response to Dale Peterson: asset inventory isn't premature consensus, it's operational necessity
Dale Peterson asks where the evidence is that OT asset inventory reduces incidents. From building a global OT security programme across 40+ manufacturing sites, here are the answers.
Blog
Your recovery targets are probably right. Your ability to meet them probably isn't.
Recovery targets derived from a solid BIA are the right foundation. But five realities sit outside that formal scope, and they're where plans actually break down in practice.
Blog
Is Your Manufacturing Company's Vulnerability Management Ready for What Comes Next?
AI-driven vulnerability discovery is outpacing OT remediation cycles. What manufacturing security teams need to know about software composition visibility, response planning, and the growing gap between known and fixed.
Blog
Your EU supply chain just changed - what manufacturing leaders need to know about the Cyber Resilience Act (CRA)
How new EU regulations reshape supplier relationships and procurement strategy, even if you don't manufacture digital products
Blog
You can outsource the work, but never the accountability
A Norwegian court case delivers a €5.5 million lesson on business continuity, supplier management, and why manufacturing executives can't outsource operational accountability
Blog
Governance that actually governs
Most security governance is theatre. Committees that rubber-stamp, decisions that decide nothing, metrics that measure activity not outcomes. Here's how to build governance that actually works.