Security architecture for the operationally honest
Most architecture diagrams describe a posture that nobody can run. Here is what changes when you design for the team that has to operate it at three in the morning.
Cyber defence · consulting · engineering
I help organisations build cyber defence that works in the real world.
Detection engineering, incident response, threat-led testing, and the messy human reality of running security in real organisations. Based in the UK, working in UTC.
Selected work
Projects
For the people who land here needing help
Privacy & anti-surveillance
Practical, opinionated, UK-flavoured resources for taking back control of your exposure and resisting the steady normalisation of surveillance. Long-time supporter of the EFF; long-time user of OpenPGP.
Recent writing
From the blog
Threat hunting without the marketing
Strip the buzzwords away and threat hunting becomes a small, disciplined practice. Here is what it actually looks like in a real estate.
Building a defence function people don't quietly leave
Talent retention is the unspoken metric on which every security programme actually rests. Here is what changes when you start designing the function for the people inside it.