About

Biography

I came to cyber threat intelligence from military aviation, and the route matters more than it might appear. Aviation is a discipline organised almost entirely around a single problem: how to act correctly on incomplete information, under time pressure, where being confidently wrong has consequences that arrive quickly and cannot be revised. Everything in the profession — the checklists, the cross-checks, the insistence that an instrument reading be corroborated before it is trusted — exists because someone once learned, expensively, that judgement alone is not sufficient.

What struck me on moving into intelligence work was how much of that machinery was missing. Security teams collect enormous volumes of data and reason about it with remarkably little of the structure aviation takes for granted. Sources are rarely graded. Findings are rarely corroborated from genuinely independent origins. Assessments are issued without stating what would refute them. And — the failure I keep returning to — instruments routinely report what they examined while saying nothing at all about what they could not examine, which means their silence gets read as an all-clear.

So my work now is largely about importing that discipline: building intelligence systems where provenance survives every transformation, where confidence is stated on a published scale rather than invented, and where “we did not look” is structurally distinguishable from “we looked and found nothing”. More recently that has extended to language models, which I treat as instruments with an error profile to be measured rather than as oracles to be believed — the same posture a pilot takes toward an altimeter, and for the same reason.

Career journey

1. Military Aviation — Operational discipline, procedure, and consequence.
2. Cyber Intelligence — Threat intelligence, collection, and analysis.
3. AI Systems — Applied AI and multi-agent system design.
4. Entrepreneurship — Building technology ventures.

This account is deliberately brief. Dates, organisations, appointments and certifications are stated only where they can be verified by a reader, and are omitted rather than approximated. That restraint is the same standard I apply to intelligence reporting, and it would be incoherent to relax it here.

How I work

• Evidence before assertion. A claim without a traceable source is a hypothesis, not a finding.
• Measure what the instrument misses. A tool that cannot report its own blind spots cannot be trusted at scale.
• Distinguish “unknown” from “clear”. Silence and success must never look the same.
• Prove the control fires. A gate never seen to go red is indistinguishable from one that does not work.

Areas I write about

Cyber threat intelligence, OSINT tradecraft, AI-assisted analysis, security engineering and automation, and the design of agentic systems that remain auditable. Writing is collected under Articles, with longer-running themes under Research.