I build security that holds.
Three decades across engineering, architecture and executive leadership. From building enterprise security organizations from zero to developing the architectures that govern autonomous AI.
I make things. I break things. I build what survives.
This isn't a CV you read. It's one you can question, check and print.
What brings you here?
Four security functions, built from the first hire.
Most recently, group security for 20,000 people across forty countries, across enterprise IT and operational technology.
From national infrastructure to live incidents.
Architected a national lawful-interception platform, ran incident response on high-profile incidents, and rebuilt fragmented environments from the ground up.
Frameworks, patents and working technology.
Creator of the AI Control Architecture and a runtime that judges every AI agent action. A granted US patent and a second pending.
Every claim, graded like a security control.
I spend my working life telling organizations that a control only counts when it can be proven. My own record is held to the same standard: what I was accountable for, what changed, and what stands behind it.
Classification is deliberately strict. A public record proves what it proves and no more: a patent grant verifies inventorship, not impact; a published framework verifies authorship, not adoption. Delivery outcomes are Documented, with references available on request.
Increasing responsibility, one thread.
Engineer, architect, executive, creator. Select a chapter to see the roles inside it.
Usually the first hire, rarely the fifth.
A pattern I didn't plan but kept repeating: arrive where there is nothing, and leave a working function behind.
Made to be used, offered openly.
AI Control Architecture
A vendor-neutral method for securing enterprise AI: five risk tiers, ten control pillars, crosswalks to NIST AI RMF, ISO/IEC 42001, the EU AI Act and OWASP.
AI Action Fabric
A runtime that judges every AI agent action against the authority it was delegated: holds, blocks, a kill switch and a tamper-evident record.
Recursive Cyber Defense Model
Governed, machine-speed defense for an era of autonomous adversaries: Govern, Observe, Anticipate, Disrupt, Adapt.
Securing Enterprise AI
Seven hours, nineteen modules: how a security team assesses, classifies, controls, attacks and proves its AI, in that order.
Thinking out loud.
We opened the AI Control Architecture. Now we are open-sourcing its runtime.
Sovereignty is not where your AI runs. It is who controls what your AI is allowed to do.
We gave AI agents a campaign, a metric and no rules
A controlled experiment across four models, with limits enforced at runtime. What the agents actually did.
AI civil war: the uninsured risk of autonomous model conflict
What happens when one company's autonomous models turn on each other.
Cybersecurity isn't just about tech
Success in security is as much about mindset, psychology and strategy as technology.
Building what comes next.
Interested in enterprise security leadership, the governance of autonomous AI, or collaborating on systems that need to hold under pressure? Let's talk.
Prefer to send a message first? Pick a topic and I'll start it for you.