Senior CISO advisory · AI agents · Identity · Post-quantum
Tier 1 financial-services CISO experience — HSBC, JPMorgan Chase, UK government and critical national infrastructure — applied to the risks now landing on your desk: AI agent assurance, identity and privileged access, post-quantum cryptography and regulatory resilience.
Five tollgates every agent action should pass
The problem
Most security programmes were built for human users, classical cryptography and one regulator at a time. None of those assumptions hold for the next three years.
They hold credentials, call tools and move data across systems your identity and access controls were never designed for. Every one is a non-human identity that needs an owner, a scope and an audit trail.
The NCSC expects organisations to complete cryptographic discovery and have an initial migration plan by 2028. Inventories always take longer than anyone budgets for.
NCSC discovery milestone · 31 Dec 2028
Time remaining until the NCSC post-quantum discovery milestone on : approximately 831 days.
DORA is in force, EU AI Act obligations are phasing in, ISO/IEC 42001 is becoming a procurement question and the UK’s Cyber Security and Resilience Bill widens the net to managed service providers. Your board wants one coherent answer.
The framework
“AI security” is three different problems with three different owners. Treating it as one is the most common — and most expensive — mistake we see.
Front 01
Withstand attack that now runs at machine speed and machine scale.
Front 02
Adopt AI — including autonomous agents — without surrendering control of execution.
We govern agents through five execution tollgates: the control points that keep an autonomous system accountable to a named human decision-maker. Scroll through them.
Tollgate
Every agent has a verifiable, owned, non-human identity.
No shared credentials, no orphaned service accounts, no agent acting under a human’s session. If you cannot name its owner, it should not be running.
Tested in AI Agent Access Review Identity & Privileged Access Assurance AI Governance, ISO/IEC 42001 & EU AI Act Readiness
Tollgate
Least privilege, scoped to the task and bounded in time.
Delegation is explicit, never inherited. Standing access is replaced with just-in-time grants that expire when the task does.
Tested in AI Agent Access Review Agentic AI Security Assessment & Red Teaming Identity & Privileged Access Assurance
Tollgate
High-impact actions pass policy — and a human where it matters.
Tool calls are checked against policy before they run. Payments, deletions and external communications need an accountable approver.
Tested in Agentic AI Security Assessment & Red Teaming AI Governance, ISO/IEC 42001 & EU AI Act Readiness
Tollgate
Every prompt, tool call and decision is attributable.
Logs your SOC can actually use, tied to an identity and a business owner, retained long enough to reconstruct what happened and why.
Tested in AI Agent Access Review Agentic AI Security Assessment & Red Teaming Identity & Privileged Access Assurance
Tollgate
When an agent misbehaves, you can stop it and explain it.
A tested kill switch, a rollback path and a board-ready account of events within hours, not weeks.
Tested in Agentic AI Security Assessment & Red Teaming AI-Incident Tabletop Exercises AI Governance, ISO/IEC 42001 & EU AI Act Readiness
Front 03
Use AI inside the security function itself — deliberately, and defensibly.
Services
Fixed-scope assessments when you need an answer, retained leadership when you need an owner. Every engagement is led, and delivered, by a senior practitioner.
= tollgates covered
An independent review of every agent, service account and token acting on your behalf — who owns it, what it can reach, and whether it should.
Explore AI Agent Access ReviewAdversarial testing of your agents and the tools they call — prompt injection, tool abuse, privilege escalation and exfiltration paths.
Explore Agentic AI Security Assessment & Red TeamingJoiner–mover–leaver, PAM and non-human identity controls, tested against how attackers — and agents — actually move.
Explore Identity & Privileged Access AssuranceExecutive and operational exercises built around a rogue or compromised agent. Find the gaps before an incident — or a regulator — does.
Explore AI-Incident Tabletop ExercisesCryptographic discovery, a risk-ranked inventory and a funded migration roadmap aligned to the NCSC’s 2028, 2031 and 2035 milestones.
To the NCSC discovery milestone
Time remaining until the NCSC post-quantum discovery milestone on : approximately 831 days.
An AI management system your auditors, regulators and board can follow, mapped to ISO/IEC 42001 and the EU AI Act.
Explore AI Governance, ISO/IEC 42001 & EU AI Act ReadinessSeparate AI as a threat, AI to govern and AI you use — so directors can challenge with confidence.
Explore Board AI Risk Briefing & Director TrainingA senior CISO on a retained basis, accountable to your board — with AI and agent risk built in from day one.
Explore vCISO for AIFor managed service providers and critical suppliers — scope, incident reporting, supply-chain duties and the evidence to prove them.
Explore Cyber Security and Resilience Bill ReadinessCredentials
Security leadership forged in global banking, UK government and critical national infrastructure — where a control failure is a market event, not an incident ticket. CISO to CISO, we speak your board’s language and your engineers’.
Career includes
Tier 1 financial market infrastructure
Security operating model and agentic AI roadmap
Redesigned the security operating model for a Tier 1 global exchange group, ran a privileged access uplift in parallel and built the roadmap for its first agentic AI deployments.
Tier 1 global bank
Strategy and investment at global scale
Designed and executed the cybersecurity strategy and investment roadmap across more than 50 countries, while embedding a leaner operating model.
Enterprise SaaS platform
FedRAMP Rev5 and 20x readiness
Leading a fast-scaling platform through FedRAMP Rev5 authorisation while standing up SOC coverage, vulnerability management, GRC and continuous monitoring.
How we work
Free diagnostic
Score your agent controls against Identity, Authorisation, Execution, Observation and Containment. About four minutes. Your result appears on screen — no email required.
Sixty minutes with a senior practitioner. No sales team, no obligation — just a candid view of where you stand and what to do first.