I work on independent cyber security testing and evaluation methodologies. I assess the practical limits of defensive products in real environments.
My focus is on how security controls actually behave under attack, as well as why many testing approaches are misleading. I am also interested in how organisations interpret (and misinterpret) security metrics.
At the core of all this is a wide understanding of threat intelligence.
Cyber security is a practical discipline, not a product
Current work
- SE Labs – independent security testing and research
- The-C2 – cyber security threat intelligence conference
- Cyber Security Decoded – podcast on security testing and decision-making