Research
My research explores the intersection of cybersecurity, digital risk, emerging technology and organisational resilience.
I am particularly interested in how technological change affects the assumptions behind cyber risk, how organisations adapt their governance and defensive models, and how leaders make decisions under increasing technological complexity.
My approach is grounded in connecting technical developments with their wider implications for organisations, risk management and decision-making.
This page brings together selected research, analysis and areas of ongoing interest.
Research Themes
Cybersecurity & Digital Risk
Exploring how evolving cyber threats, technology dependencies and changing attacker capabilities affect organisational risk and resilience.
A particular area of interest is how changes in attacker capability can alter assumptions about likelihood, exposure and previously accepted cyber risks.
AI & Emerging Technology Risk
Examining the security implications of Frontier AI, autonomous systems and other emerging technologies.
Rather than viewing emerging technologies only as new sources of risk, I am interested in how they may change the speed, scale, economics and operating assumptions behind risks that organisations already manage.
Cyber Resilience & Security Architecture
Exploring how established security principles and architectures need to evolve as cyber operations become faster, more automated and increasingly interconnected.
Areas of interest include Defence-in-Depth, Zero Trust, identity, vulnerability management, attack-path analysis and connected defensive capabilities.
Board-Level Cybersecurity & Digital Risk Governance
Examining how cybersecurity and digital risk are understood, governed and integrated into organisational strategy, enterprise risk management and decision-making.
This includes how boards and senior leaders interpret cyber risk, challenge underlying assumptions and make decisions that strengthen organisational resilience.
Featured Research
Frontier AI Cybersecurity Series
The Frontier AI Cybersecurity Series examines how increasingly capable AI systems may change cyber threats, defensive models and the governance of cyber risk.
Rather than assuming that Frontier AI will create an entirely new cybersecurity landscape, the series explores a different possibility: that AI may significantly change cyber risk by reducing the time, expertise and effort required to discover, understand and exploit weaknesses that already exist.
The series progresses across three questions:
What is changing in the cyber threat model?
How should cyber defence evolve?
How should leaders and boards govern the resulting risk?
Part 1 — Frontier AI and the New Cyber Threat Model
What the Hugging Face Incident Really Tells Us
Frontier AI may not simply give attackers better tools. Increasingly capable AI systems could change the operating tempo of cyber operations through greater speed, scale, persistence and autonomy.
Part 1 examines the progression from AI-assisted activity toward increasingly autonomous cyber operations and considers what this means for traditional assumptions about cyber threats.
Part 2 — Defending at Machine Speed: How Defence-in-Depth and Zero Trust Must Evolve
If attackers can increasingly discover weaknesses, adapt and move through environments at machine speed, cyber defence may also need to become faster, more connected and more adaptive.
Part 2 examines time compression, security debt, changing attacker economics and vulnerability chaining, and considers how Defence-in-Depth and Zero Trust may need to evolve without abandoning the principles on which they were built.
A central question is whether risk decisions made under yesterday’s attacker economics remain appropriate when the adversary’s capability, cost and speed change.
Part 3 — From Cyber Risk to Board Risk: Governing Security in the Age of Frontier AI
Coming soon
If Frontier AI changes the threat model, exposes previously tolerated security debt and compresses the time available for defence, the next question moves beyond cybersecurity operations.
Part 3 will examine how cybersecurity leaders, executives and boards should think about governance, risk appetite, accountability and decision-making when the assumptions behind existing cyber-risk decisions are themselves beginning to change.
Selected Publications & Analysis
Frontier AI and the New Cyber Threat Model
Frontier AI Cybersecurity Series — Part 1 of 3
An analysis of how Frontier AI may change cyber operations by increasing speed, scale, persistence and autonomy, and why the emerging risk may be less about AI replacing attackers than about compressing the time between attacker intent and attacker action.
September 2026
Defending at Machine Speed: How Defence-in-Depth and Zero Trust Must Evolve
Frontier AI Cybersecurity Series — Part 2 of 3
An examination of how Frontier AI may compress attack timelines, change attacker economics, make previously tolerated security debt more reachable and increase the importance of connected, adaptive cyber defence.
Coming soon
Current Research Interests
My current areas of interest include:
- Frontier AI and the evolution of cyber threat models
- AI-enabled and increasingly autonomous cyber operations
- Security debt and changing attacker economics
- Vulnerability chaining and attack-path discovery
- Defence-in-Depth and Zero Trust in machine-speed environments
- Cyber resilience and adaptive security
- Board-level cybersecurity and digital risk governance
- Cyber risk integration with organisational strategy and enterprise risk management
These areas are interconnected. My broader interest is in understanding how changes in technology alter the assumptions behind existing risk decisions — and what organisations, cybersecurity leaders and boards should do when those assumptions no longer hold.
Disclaimer
The views expressed on this page and in the research and analysis published on this website are those of the author and are provided for general informational and educational purposes only. They do not represent the views of the author’s employer or any organisation with which the author is affiliated.
Nothing published here should be construed as legal, regulatory, investment, or professional advice. Readers should assess the relevance and applicability of any observations or recommendations based on their own circumstances and requirements.