AI Risk & Readiness Assessment
I look at what your AI systems actually do, rather than what the documentation says they do, score each one against the published OSRA model, and hand you a remediation roadmap in the order I would work it.
Practice
I have run security and technology organizations. Now I audit whether yours stands up to regulators and attackers.
I run the work on OSRA, a methodology I wrote and published in full. It goes looking for AI operational risk in the place I kept finding it as an operator: the infrastructure underneath the governance layer, which the frameworks above it assume is sound and were never built to check. Anyone can pick the method up. Reading what it turns up is the part that took me nearly three decades to learn.
Scoped
A fixed scope, a fixed fee and a date it ends. We agree all three before I start, and I do not bill by the hour.
Full OSRA Engagement
I run all four OSRA phases across the whole estate rather than a sample, and you end up with a convergence risk summary and a remediation programme your teams can pick up and run.
Ongoing
Work that does not end with a report. We set a cadence at the start and I keep to it, on a monthly fee fixed in writing before the first month runs.
Fractional CISO Retainer
I take the security leadership seat for organizations that need CISO judgment without a full-time hire, and for the ones now working through what an assessment found.
CTO Advisor
I work with founders and leadership teams on platform architecture, technology strategy, and the structural choices that decide whether a system scales cleanly or quietly accumulates fragility.
Executive & Board Advisory
I sit with leadership teams, boards and audit committees on AI governance, platform risk, cybersecurity obligations and regulatory exposure, and I hold non-executive director and advisory board seats.
Track record
Nearly three decades
Running security and technology organizations as CISO and as CTO.
Four regions
Deployments and accountability across the US, Europe, Japan and APAC.
Patents on AI agent infrastructure
Named inventor on interoperable digital asset execution and on contextual data for AI agent activity, alongside three earlier web platform families.
OSRA, published in full
Methodology, scoring model, practitioner templates and a 22-action catalogue, under CC BY-SA 4.0.
A worked example
All four OSRA phases run against a DORA-regulated bank, published so buyers can read the output first.
Two books
The Split Problem and The Hacker's Letters, both Quill House Press, 2026.
Writing
I have written two books, one on AI and one telling my years in security as fiction, and I have been writing essays long enough that they are worth reading before you book a call.
Next step
Book a call
Thirty minutes on a call. You tell me what you are running and where you think the exposure is, and I tell you whether an engagement is worth it or whether you can handle it in-house.