PageSourceSearch

https://mattpalmer.net/

html mattpalmer.net collected 2026-10-10 00:32:40 UTC 53,858 bytes, 85 lines download raw bytes

1<!DOCTYPE html><html lang="en"><head><meta charSet="utf-8"/><meta name="viewport" content="width=device-width, initial-scale=1"/><link rel="preload" as="image" href="/matt-palmer-avatar.webp"/><link rel="stylesheet" href="/assets/styles-DorvbPmt.css" data-precedence="default"/><title>Matt Palmer — Cyber resilience, assurance, governance</title><meta name="author" content="Matt Palmer"/><meta property="og:type" content="website"/><meta property="og:image" content="https://mattpalmer.net/og-image.jpg"/><meta property="og:image:width" content="1200"/><meta property="og:image:height" content="630"/><meta property="og:image:alt" content="Matt Palmer"/><meta name="twitter:card" content="summary_large_image"/><meta name="twitter:image" content="https://mattpalmer.net/og-image.jpg"/><meta name="description" content="Matt Palmer — cyber resilience leader, former CISO and non-executive director. Projects, writing and Incidentally, by Matt Palmer."/><meta property="og:title" content="Matt Palmer"/><meta property="og:description" content="Cyber resilience, assurance and governance."/><meta property="og:url" content="https://mattpalmer.net/"/><link rel="modulepreload" href="/assets/index-Cw7_u0LI.js"/><link rel="modulepreload" href="/assets/index-H7qfW_gM.js"/><link rel="modulepreload" href="/assets/error-page-Bk9_MwxI.js"/><link rel="modulepreload" href="/assets/index-CMWY28qc.js"/><link rel="modulepreload" href="/assets/useSuspenseQuery-WbFqyiib.js"/><link rel="preload" href="/assets/cormorant-garamond-latin-wght-normal-CUoBjw-S.woff2" as="font" type="font/woff2" crossorigin="anonymous"/><link rel="preload" href="/assets/inter-tight-latin-wght-normal-DX-nOvPD.woff2" as="font" type="font/woff2" crossorigin="anonymous"/><link rel="icon" href="/favicon.ico" sizes="any"/><link rel="icon" type="image/png" sizes="512x512" href="/icon-512.png"/><link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png"/><link rel="alternate" type="application/rss+xml" title="Incidentally, by Matt Palmer" href="https://feeds.feedburner.com/mattpalmeroncybersecurity"/><link rel="canonical" href="https://mattpalmer.net/"/>
1<script type="application/ld+json">{"@context":"https://schema.org","@type":"Person","name":"Matt Palmer","url":"https://mattpalmer.net","jobTitle":"Cyber resilience leader","sameAs":["https://www.linkedin.com/in/mattpalmercyber/","https://feeds.feedburner.com/mattpalmeroncybersecurity"]}</script>
1</head><body><!--$--><a href="#main-content" class="sr-only focus:not-sr-only focus:fixed focus:top-2 focus:left-2 focus:z-50 focus:rounded focus:bg-primary focus:px-4 focus:py-2 focus:text-sm focus:font-medium focus:text-primary-foreground focus:outline-none focus:ring-2 focus:ring-ring">Skip to main content</a><div class="min-h-screen flex flex-col bg-background text-foreground"><header class="border-b border-border/60 bg-background/80 backdrop-blur supports-[backdrop-filter]:bg-background/60 sticky top-0 z-40"><div class="mx-auto flex max-w-5xl items-center justify-between px-6 py-5"><a class="flex items-center gap-3 font-display text-xl tracking-tight text-foreground hover:text-primary transition-colors active" href="/" data-status="active" aria-current="page"><img src="/matt-palmer-avatar.webp" alt="" width="32" height="32" class="h-8 w-8 rounded-full object-cover" loading="eager"/>Matt Palmer</a><nav aria-label="Primary" class="hidden items-center gap-6 text-sm md:flex"><a class="text-muted-foreground hover:text-primary transition-colors" href="/about">About</a><a class="text-muted-foreground hover:text-primary transition-colors" href="/projects">Projects</a><a class="text-muted-foreground hover:text-primary transition-colors" href="/incidentally">Incidentally</a><a class="text-muted-foreground hover:text-primary transition-colors" href="/media">Media</a><a class="text-muted-foreground hover:text-primary transition-colors" href="/contact">Contact</a></nav><nav aria-label="Primary" class="relative md:hidden"><button type="button" aria-label="Menu" aria-expanded="false" aria-controls="_R_qiq_" class="inline-flex items-center justify-center rounded p-2 text-muted-foreground hover:text-primary transition-colors focus:outline-none focus-visible:ring-1 focus-visible:ring-primary"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-menu h-6 w-6" aria-hidden="true"><path d="M4 5h16"></path><path d="M4 12h16"></path><path d="M4 19h16"></path></svg></button><ul id="_R_qiq_" hidden="" class="absolute right-0 top-full z-50 mt-1 w-44 rounded-md border bg-popover p-1 text-popover-foreground shadow-md"><li><a class="block rounded-sm px-2 py-1.5 text-sm outline-none transition-colors hover:bg-accent hover:text-accent-foreground focus-visible:bg-accent focus-visible:text-accent-foreground" href="/about">About</a></li><li><a class="block rounded-sm px-2 py-1.5 text-sm outline-none transition-colors hover:bg-accent hover:text-accent-foreground focus-visible:bg-accent focus-visible:text-accent-foreground" href="/projects">Projects</a></li><li><a class="block rounded-sm px-2 py-1.5 text-sm outline-none transition-colors hover:bg-accent hover:text-accent-foreground focus-visible:bg-accent focus-visible:text-accent-foreground" href="/incidentally">Incidentally</a></li><li><a class="block rounded-sm px-2 py-1.5 text-sm outline-none transition-colors hover:bg-accent hover:text-accent-foreground focus-visible:bg-accent focus-visible:text-accent-foreground" href="/media">Media</a></li><li><a class="block rounded-sm px-2 py-1.5 text-sm outline-none transition-colors hover:bg-accent hover:text-accent-foreground focus-visible:bg-accent focus-visible:text-accent-foreground" href="/contact">Contact</a></li></ul></nav></div></header><main id="main-content" tabindex="-1" class="flex-1 focus:outline-none"><!--$--><!--$--><div><section class="border-b border-border/40"><div class="mx-auto max-w-5xl px-6 pt-24 pb-20"><div class="text-xs uppercase tracking-[0.25em] text-primary/80">Personal site</div><h1 class="mt-4 font-display text-5xl md:text-7xl leading-[1.05] text-foreground">Matt Palmer</h1><p class="mt-6 font-display italic text-2xl md:text-3xl text-primary/90 max-w-2xl leading-snug">Risk &amp; cyber resilience leader. Former CISO. NED.</p><p class="mt-8 max-w-2xl text-base md:text-lg text-muted-foreground leading-relaxed whitespace-pre-line">Director of Jersey Cyber Security Centre and Guernsey Cyber Security Centre, leading national cyber resilience for two international financial centres.</p><div class="mt-10 flex flex-wrap gap-3"><a class="inline-flex items-center rounded-sm bg-primary px-5 py-3 text-sm font-medium text-primary-foreground hover:bg-accent transition-colors" href="/projects">Selected projects</a><a class="inline-flex items-center rounded-sm border border-border px-5 py-3 text-sm font-medium text-foreground hover:border-primary hover:text-primary transition-colors" href="/incidentally">Incidentally →</a></div></div></section><section class="mx-auto max-w-5xl px-6 py-20"><div class="flex items-end justify-between gap-4 border-b border-border/60 pb-4"><div><div class="text-xs uppercase tracking-[0.25em] text-primary/80">Featured writing</div><h2 class="mt-2 font-display text-3xl md:text-4xl">From Incidentally</h2></div><a href="/incidentally" class="hidden md:inline-block text-sm text-primary hover:text-accent transition-colors whitespace-nowrap">All posts<!-- --> →</a></div><div class="mt-10 grid gap-8 md:grid-cols-3"><article class="group"><div class="text-xs uppercase tracking-widest text-muted-foreground">August 2026</div><h3 class="mt-2 font-display text-2xl leading-tight"><a class="group-hover:text-primary transition-colors" href="/incidentally/human-review-of-ai-decisions-the-wrong-control-at-the-wrong-time">The red flag for AI?</a></h3><p class="mt-3 text-sm text-muted-foreground leading-relaxed line-clamp-4">Mandatory human checkpoint before every AI decision mirrors the 1865 Red Flag Act—a control that kills the speed advantage while real risks need different management.</p></article><article class="group"><div class="text-xs uppercase tracking-widest text-muted-foreground">October 2025</div><h3 class="mt-2 font-display text-2xl leading-tight"><a class="group-hover:text-primary transition-colors" href="/incidentally/the-emperors-new-clothes-why-compulsory-cbts-and-phishing-tests-keep-failing">The Emperor’s New Clothes: Why Compulsory CBTs and Phishing Tests Keep Failing</a></h3><p class="mt-3 text-sm text-muted-foreground leading-relaxed line-clamp-4">Most phishing training, and indeed most compulsory computer-based training (CBT) modules, are largely ineffective in reducing incidents - and are therefore a waste of time and resources. Finally we have the data we need to challenge this, and find a better path to user awareness </p></article><article class="group"><div class="text-xs uppercase tracking-widest text-muted-foreground">June 2025</div><h3 class="mt-2 font-display text-2xl leading-tight"><a class="group-hover:text-primary transition-colors" href="/incidentally/lessons-from-the-titanic-when-you-dont-respond-to-a-crisis">
1Lessons from the Titanic: when you don’t respond to a crisis</a></h3><p class="mt-3 text-sm text-muted-foreground leading-relaxed line-clamp-4">When the RMS Titanic hit an iceberg on 15 April 1912, she set off flares and her wireless operator sent out a distress call. The RMS Carpathia responded, but by the time she arrived, the Titanic had already sunk: only those who had made it to the lifeboats could be saved. Some 1,</p></article></div></section><section class="border-t border-border/40 bg-surface/40"><div class="mx-auto max-w-5xl px-6 py-20"><div class="flex items-end justify-between gap-4 border-b border-border/60 pb-4"><div><div class="text-xs uppercase tracking-[0.25em] text-primary/80">Selected projects</div><h2 class="mt-2 font-display text-3xl md:text-4xl">Things I&#x27;m building</h2></div><a href="/projects" class="hidden md:inline-block text-sm text-primary hover:text-accent transition-colors whitespace-nowrap">All projects<!-- --> →</a></div><div class="mt-10 grid gap-6 md:grid-cols-3"><a class="block border border-border/60 bg-background hover:border-primary transition-colors group overflow-hidden" href="/cyber-incident-interoperability-jesip"><div class="aspect-[16/10] overflow-hidden bg-surface border-b border-border/40"><img src="https://qtudfnbdgnpjvxwozbje.supabase.co/storage/v1/object/public/media/migrated/cfa98592-unsplash-image-SgyH_Ix9lNE.jpg" alt="" loading="lazy" class="w-full h-full object-cover group-hover:scale-[1.02] transition-transform duration-500"/></div><div class="p-6"><div class="text-xs uppercase tracking-widest text-primary/80">2025</div><h3 class="mt-3 font-display text-xl leading-tight group-hover:text-primary transition-colors">Cyber Incident Interoperability</h3><p class="mt-3 text-sm text-muted-foreground leading-relaxed">How CSIRTs, emergency services and private sector responders prepare to work together effectively during a cyber or hybrid incident.</p></div></a><a class="block border border-border/60 bg-background hover:border-primary transition-colors group overflow-hidden" href="/duchessofbrittany"><div class="aspect-[16/10] overflow-hidden bg-surface border-b border-border/40"><img src="https://qtudfnbdgnpjvxwozbje.supabase.co/storage/v1/object/public/media/migrated/2dfa20fa-g-aorg_de_havilland_heron_jersey.jpg" alt="" loading="lazy" class="w-full h-full object-cover group-hover:scale-[1.02] transition-transform duration-500"/></div><div class="p-6"><div class="text-xs uppercase tracking-widest text-primary/80">ongoing</div><h3 class="mt-3 font-display text-xl leading-tight group-hover:text-primary transition-colors">G-AORG, &#x27;Duchess of Brittany&#x27;</h3><p class="mt-3 text-sm text-muted-foreground leading-relaxed">Preserving an historic de Havilland Heron aircraft based in Jersey.</p></div></a><a class="block border border-border/60 bg-background hover:border-primary transition-colors group overflow-hidden" href="/jcsc-gcsc"><div class="aspect-[16/10] overflow-hidden bg-surface border-b border-border/40"><img src="https://qtudfnbdgnpjvxwozbje.supabase.co/storage/v1/object/public/media/migrated/00d34821-linkedin_profile_square.png" alt="" loading="lazy" class="w-full h-full object-cover group-hover:scale-[1.02] transition-transform duration-500"/></div><div class="p-6"><div class="text-xs uppercase tracking-widest text-primary/80">2020–present</div><h3 class="mt-3 font-display text-xl leading-tight group-hover:text-primary transition-colors">Jersey &amp; Guernsey Cyber Security Centres</h3><p class="mt-3 text-sm text-muted-foreground leading-relaxed">A new capability to prepare, protect and defend the Channel Islands from cyber threats.</p></div></a></div></div></section><section class="mx-auto max-w-5xl px-6 py-20 grid md:grid-cols-[1fr_2fr] gap-10"><div class="text-xs uppercase tracking-[0.25em] text-primary/80">About</div><div><p class="font-display text-2xl md:text-3xl leading-snug text-foreground">Matt Palmer is a Risk &amp; cyber security specialist with leadership experience across regulated industry, national infrastructure, and the public sector.</p><a class="mt-6 inline-block text-sm text-primary hover:text-accent transition-colors" href="/about">Read the longer version →</a></div></section><section class="border-t border-border/40"><div class="mx-auto max-w-5xl px-6 py-20"><div class="flex items-end justify-between gap-4 border-b border-border/60 pb-4"><div><div class="text-xs uppercase tracking-[0.25em] text-primary/80">Media &amp; interviews</div><h2 class="mt-2 font-display text-3xl md:text-4xl">In conversation</h2></div><a href="/media" class="hidden md:inline-block text-sm text-primary hover:text-accent transition-colors whitespace-nowrap">All media<!-- --> →</a></div><ul class="mt-10 divide-y divide-border/40"><li><a href="https://www.wsj.com/articles/a-day-in-the-life-of-a-ciso-matt-palmer-willis-towers-watson-1513340826" target="_blank" rel="noopener noreferrer" class="group grid md:grid-cols-[180px_1fr_80px] gap-4 py-5 items-baseline"><div class="text-xs uppercase tracking-widest text-primary/80">Wall Street Journal</div><div class="font-display text-lg text-foreground group-hover:text-primary transition-colors">A Day in the Life of a CISO — Matt Palmer, Willis Towers Watson<!-- --> <span aria-hidden="true" class="text-primary/70">↗</span><span class="sr-only"> (opens in new tab)</span></div><div class="text-xs text-muted-foreground md:text-right">Feature · 2017</div></a></li><li><a href="https://www.infosecurity-magazine.com/interviews/interview-jersey-cyber-security/" target="_blank" rel="noopener noreferrer" class="group grid md:grid-cols-[180px_1fr_80px] gap-4 py-5 items-baseline"><div class="text-xs uppercase tracking-widest text-primary/80">Infosecurity Magazine</div><div class="font-display text-lg text-foreground group-hover:text-primary transition-colors">Interview: Building Jersey&#x27;s Cyber Security Centre<!-- --> <span aria-hidden="true" class="text-primary/70">↗</span><span class="sr-only"> (opens in new tab)</span></div><div class="text-xs text-muted-foreground md:text-right">Interview · 2024</div></a></li><li><a href="https://www.securityforum.org/spotlight-on/creating-a-cert-on-jersey-part-one/" target="_blank" rel="noopener noreferrer" class="group grid md:grid-cols-[180px_1fr_80px] gap-4 py-5 items-baseline"><div class="text-xs uppercase tracking-widest text-primary/80">Information Security Forum</div><div class="font-display text-lg text-foreground group-hover:text-primary transition-colors">
1Spotlight On: Creating a CERT in Jersey (Part One)<!-- --> <span aria-hidden="true" class="text-primary/70">↗</span><span class="sr-only"> (opens in new tab)</span></div><div class="text-xs text-muted-foreground md:text-right">Podcast</div></a></li><li><a href="https://www.iod.je/interviews/matt-palmer" target="_blank" rel="noopener noreferrer" class="group grid md:grid-cols-[180px_1fr_80px] gap-4 py-5 items-baseline"><div class="text-xs uppercase tracking-widest text-primary/80">Institute of Directors</div><div class="font-display text-lg text-foreground group-hover:text-primary transition-colors">IoD Jersey — Member Interview<!-- --> <span aria-hidden="true" class="text-primary/70">↗</span><span class="sr-only"> (opens in new tab)</span></div><div class="text-xs text-muted-foreground md:text-right">Interview</div></a></li></ul></div></section></div><!--/$-->
1<script>(function(a,f){let l;try{l=JSON.parse(sessionStorage.getItem(a)||"{}")}catch{return}const n=l?.[f||history.state?.__TSR_key];let c=!1;for(const t in n){const e=n[t],o=e?.scrollX,s=e?.scrollY;if(Number.isFinite(o)&&Number.isFinite(s)){if(t==="window")scrollTo(o,s),c=!0;else if(t)try{const r=document.querySelector(t);r&&(r.scrollLeft=o,r.scrollTop=s)}catch{}}}if(c)return;const i=location.hash.slice(1);if(i){const t=history.state?.__hashScrollIntoViewOptions??!0;if(t){const e=document.getElementById(i);e&&e.scrollIntoView(t)}return}scrollTo(0,0)})("tsr-scroll-restoration-v1_3");document.currentScript.remove()</script>
1<!--/$--></main><footer class="mt-24 border-t border-border/60 bg-background"><div class="mx-auto max-w-5xl px-6 py-12 grid gap-8 md:grid-cols-3 text-sm text-muted-foreground"><div><div class="font-display text-lg text-foreground">Matt Palmer</div><p class="mt-2 max-w-xs whitespace-pre-line">Cyber resilience leader, former CISO and non-executive director. Writing in a personal capacity.</p></div><div><div class="text-xs uppercase tracking-widest text-primary/80">Elsewhere</div><ul class="mt-3 space-y-1.5"><li><a class="hover:text-primary transition-colors" href="https://feeds.feedburner.com/mattpalmeroncybersecurity" target="_blank" rel="noopener noreferrer">RSS — Incidentally<span class="sr-only"> (opens in new tab)</span></a></li><li><a class="hover:text-primary transition-colors" href="https://www.linkedin.com/in/mattpalmercyber/" target="_blank" rel="noopener noreferrer">LinkedIn<span class="sr-only"> (opens in new tab)</span></a></li><li><a class="hover:text-primary transition-colors" href="/media">Media &amp; interviews</a></li><li><a class="hover:text-primary transition-colors" href="/contact">Email</a></li></ul></div><div><div class="text-xs uppercase tracking-widest text-primary/80">Disclaimer</div><p class="mt-3 leading-relaxed whitespace-pre-line">All views are personal and do not represent any current or former employer, board, or client. Content is provided for general information only.</p></div></div><div class="border-t border-border/40"><div class="mx-auto max-w-5xl px-6 py-5 text-xs text-muted-foreground flex flex-wrap items-center justify-between gap-2"><span>© <!-- -->2026<!-- --> Matt Palmer</span><span class="flex items-center gap-4"><a class="hover:text-primary transition-colors" href="/privacy-policy">Privacy</a><a class="hover:text-primary transition-colors" href="/security">Security</a><span class="font-display italic">mattpalmer.net</span></span></div></div></footer></div><!--/$-->
1<script data-tsr-stream-part="">(self.$R=self.$R||{})["tsr"]=[];self.$_TSR={h(){this.hydrated=!0,this.c()},e(){this.streamEnded=!0,this.c()},c(){this.hydrated&&this.streamEnded&&(delete self.$_TSR,delete self.$R.tsr)},p(e){this.initialized?e():this.buffer.push(e)},buffer:[]}</script>
1<script data-tsr-stream-part="">$_TSR.router=($R=>$R[0]={manifest:$R[1]={routes:$R[2]={__root__:$R[3]={preloads:$R[4]=["/assets/index-Cw7_u0LI.js"],scripts:$R[5]=[$R[6]={attrs:$R[7]={type:"module",async:!0,src:"/assets/index-Cw7_u0LI.js"}}]},"/":$R[8]={preloads:$R[9]=["/assets/index-H7qfW_gM.js","/assets/error-page-Bk9_MwxI.js","/assets/index-CMWY28qc.js","/assets/useSuspenseQuery-WbFqyiib.js"]}}},matches:$R[10]=[$R[11]={i:"__root__�",u:1791592359977,s:"success",ssr:!0},$R[12]={i:"��",u:1791592359983,s:"success",ssr:!0}],dehydratedData:$R[13]={query:$R[14]={initial:$R[15]=[$R[16]={dehydratedAt:1791592359983,state:$R[17]={data:$R[18]={footer_brand:$R[19]={title:"Matt Palmer",body:"Cyber resilience leader, former CISO and non-executive director. Writing in a personal capacity."},footer_elsewhere:$R[20]={title:"Elsewhere",items:$R[21]=[$R[22]={label:"RSS — Incidentally",href:"https://feeds.feedburner.com/mattpalmeroncybersecurity",external:!0},$R[23]={label:"LinkedIn",href:"https://www.linkedin.com/in/mattpalmercyber/",external:!0},$R[24]={label:"Media & interviews",href:"/media",external:!1},$R[25]={label:"Email",href:"/contact",external:!1}]},footer_disclaimer:$R[26]={title:"Disclaimer",body:"All views are personal and do not represent any current or former employer, board, or client. Content is provided for general information only."}},dataUpdateCount:1,dataUpdatedAt:1791592359977,error:null,errorUpdateCount:0,errorUpdatedAt:0,fetchFailureCount:0,fetchFailureReason:null,fetchMeta:null,isInvalidated:!1,status:"success",fetchStatus:"idle"},queryKey:$R[27]=["site_content","chrome"],queryHash:"[\"site_content\",\"chrome\"]"},$R[28]={dehydratedAt:1791592359983,state:$R[29]={data:$R[30]={media_intro:$R[31]={eyebrow:"Media",headline:"Interviews & appearances",body_html:"\x3Cp>Selected interviews, podcasts and commentary on cyber security, resilience and governance. For new enquiries please use the \x3Ca href=\"/contact\">contact page\x3C/a>.\x3C/p>"},media_interviews:$R[32]={items:$R[33]=[$R[34]={id:"7d011e6c-89d8-4f9e-915a-0b8efff3a1df",outlet:"Wall Street Journal",title:"A Day in the Life of a CISO — Matt Palmer, Willis Towers Watson",href:"https://www.wsj.com/articles/a-day-in-the-life-of-a-ciso-matt-palmer-willis-towers-watson-1513340826",year:"2017",format:"Feature"},$R[35]={id:"f2850212-7b8f-4c5b-a6d4-66c720d04ea6",outlet:"Infosecurity Magazine",title:"Interview: Building Jersey's Cyber Security Centre",href:"https://www.infosecurity-magazine.com/interviews/interview-jersey-cyber-security/",year:"2024",format:"Interview"},$R[36]={id:"25f74754-6a75-47b8-825e-c58e724d79d9",outlet:"Information Security Forum",title:"Spotlight On: Creating a CERT in Jersey (Part One)",href:"https://www.securityforum.org/spotlight-on/creating-a-cert-on-jersey-part-one/",format:"Podcast"},$R[37]={id:"a2ba65f1-a683-48cf-bb4f-c7c6283b2dc1",outlet:"Institute of Directors",title:"IoD Jersey — Member Interview",href:"https://www.iod.je/interviews/matt-palmer",format:"Interview"},$R[38]={id:"a57d4a00-d85b-4add-b0b9-bd3a9d2f5df1",outlet:"Infosecurity Magazine",title:"Interview: Matt Palmer, Skipton Building Society",href:"https://www.infosecurity-magazine.com/interviews/interview-matt-palmer-skipton-building-society/",year:"2012",format:"Interview"}]},footer_brand:$R[39]={title:"Matt Palmer",body:"Cyber resilience leader, former CISO and non-executive director. Writing in a personal capacity."},footer_elsewhere:$R[40]={title:"Elsewhere",items:$R[41]=[$R[42]={label:"RSS — Incidentally",href:"https://feeds.feedburner.com/mattpalmeroncybersecurity",external:!0},$R[43]={label:"LinkedIn",href:"https://www.linkedin.com/in/mattpalmercyber/",external:!0},$R[44]={label:"Media & interviews",href:"/media",external:!1},$R[45]={label:"Email",href:"/contact",external:!1}]},footer_disclaimer:$R[46]={title:"Disclaimer",body:"All views are personal and do not represent any current or former employer, board, or client. Content is provided for general information only."},about_page:$R[47]={title:"Matt Palmer",eyebrow:"About",body_html:"\x3Cp>\x3Cstrong>I'm \x3C/strong>Director of Jersey Cyber Security Centre and Guernsey Cyber Security Centre, leading national cyber resilience for two international financial centres.\x3Cbr>\x3Cbr>I work at the intersection of finance, technology, and regulation — bringing governance discipline to cyber risk and technical depth to financial services. My interest is in how organisations make good decisions under uncertainty, and how risk and capital are allocated to produce outcomes that matter.\x3Cbr>\x3Cbr>Previously Chief Information Security Officer at global financial institutions across insurance, private equity, c
1apital markets and retail banking, including Willis Towers Watson. Trained at KPMG.\x3Cbr>\x3Cbr>Non-executive experience includes Commissioner at the Jersey Financial Services Commission, and NED and audit and risk committee chair roles across fintech, capital markets, healthcare and housing.\x3Cbr>\x3Cbr>Recognised in CSO Online's Top 30 CISOs, Security Leader of the Year, and a contributor to the World Economic Forum on cyber resilience. Featured in the Wall Street Journal, the Economist, BBC and Sky News.\x3C/p>\x3Ch2>Recent work\x3C/h2>\x3Cul>\x3Cli>\x3Cp>Former Chief Information Security Officer roles in regulated industry.\x3C/p>\x3C/li>\x3Cli>\x3Cp>Establishment of Jersey Cyber Security Centre.\x3C/p>\x3C/li>\x3Cli>\x3Cp>Non-executive and advisory roles across capital markets, fina\x3Cstrong>n\x3C/strong>cial services, regulation &amp; government\x3C/p>\x3C/li>\x3C/ul>\x3Ch2>Writing &amp; media\x3C/h2>\x3Cp>I write at \x3Ca target=\"_blank\" rel=\"noopener noreferrer\" href=\"/incidentally\">Incidentally\x3C/a> and have contributed commentary and interviews to industry and mainstream publications including the Wall Street Journal, BBC News, Sky News, The Economist and Infosecurity Magazine. A selected list lives on the \x3Ca target=\"_blank\" rel=\"noopener noreferrer\" href=\"/media\">media &amp; interviews\x3C/a> page. The blog has run since 2014 and is intentionally archived in full.\x3C/p>\x3Ch2>Get in touch\x3C/h2>\x3Cp>The best route is \x3Ca target=\"_blank\" rel=\"noopener noreferrer\" href=\"/contact\">the contact page\x3C/a>. I read everything; replies depend on capacity.\x3C/p>\x3Cblockquote>\x3Cp>All views on this site are personal and do not represent any current or former employer or client.\x3C/p>\x3C/blockquote>\x3Cp>\x3C/p>"},home_hero:$R[48]={lead:"Director of Jersey Cyber Security Centre and Guernsey Cyber Security Centre, leading national cyber resilience for two international financial centres.",eyebrow:"Personal site",tagline:"Risk & cyber resilience leader. Former CISO. NED."},home_about:$R[49]={body:"Matt Palmer is a Risk & cyber security specialist with leadership experience across regulated industry, national infrastructure, and the public sector.",eyebrow:"About",link_label:"Read the longer version →"},post_author_bio:$R[50]={heading:"About the author",body_html:"\x3Cp>\x3Ca href=\"https://mattpalmer.net/\" target=\"_blank\" rel=\"noopener\">Matt Palmer\x3C/a> is an award winning cyber security leader. He currently runs national cyber defence for a small island state. He can be found on \x3Ca href=\"https://linkedin.com/in/mattpalmercyber\" target=\"_blank\" rel=\"noopener\">linkedin\x3C/a> or on \x3Ca href=\"https://bsky.app/profile/matt.je\" target=\"_blank\" rel=\"noopener\">bluesky\x3C/a>.\x3C/p>"},signals_provenance:$R[51]={eyebrow:"Signals",title:"How this is made",body_html:"\x3Cp>This publication examines board decision-making under technical and risk uncertainty: how serious organisations should reason when technology, risk and expectations collide and the answer is not knowable in time. It looks at \x3Cem>decisions in play\x3C/em> — current situations where external expectation meets technical or risk reality, and a decision-maker is caught in the gap. Its governing principle is to \x3Cstrong>judge the decision, not the outcome\x3C/strong>: to assess the reasoning available at the time rather than the result with hindsight.\x3C/p>\n\x3Ch2>The two layers\x3C/h2>\n\x3Cp>A \x3Cstrong>real-time stream\x3C/strong> surfaces current decisions in play. These are selected and summarised with the assistance of an AI model, which filters and ranks candidate developments against a defined editorial criterion and prepares a factual summary. The model selects and summarises; it does not form or publish opinion.\x3C/p>\n\x3Cp>A layer of \x3Cstrong>finished analysis\x3C/strong> follows: considered pieces, written by me, applying a consistent method to situations drawn from the stream. All analysis, judgement and opinion is mine, and is reviewed and approved by me before publication.\x3C/p>\n\x3Ch2>Provenance\x3C/h2>\n\x3Cp>I do not label individual items as AI-assisted. This policy is that disclosure: it sets out, in one place, the model's role and the point at which human judgement takes over, and it is kept current. The commitment is simple — nothing carrying analysis or opinion is published without my review, and the factual stream is produced to the standard described here.\x3C/p>\n\x3Ch2>Editorial stance\x3C/h2>\n\x3Cp>I assess decisions on the information available to the decision-maker at the time, not on how things turned out. A good decision can produce a bad result, and a reckless one can get lucky; judging the reasoning by the result teaches the wrong lessons.\x3C/p>\n\x3Cp>I watch for error in both directions: doing something because it is expected and calling it risk reduction, and dismissing a real risk as mere expectation. And I hold my own published analysis to the same standard — where later information shows a call of mine was wrong, I say so.\x3C/p>\n\x3Ch2>Independence and personal capacity\x3C/h2>\n\x3Cp>I write here in a personal capacity. Nothing on this site represents the views of the Jersey Cyber Security Centre, the Guernsey Cyber Security Centre, or any current or former employer, board or client. That work is context for my experience, not the subject of this publication. I do n
1ot comment on matters directly involving those organisations, and I do not use confidential information from any current or former role.\x3C/p>\n\x3Ch2>What this is not\x3C/h2>\n\x3Cp>This is general commentary, not advice. Nothing here is investment, legal or security advice for any particular organisation, and it should not be relied on as such. I do not speculate on live incidents under investigation, where those involved know more than the public and comment would be guesswork; I analyse a situation only when enough is known to reason about it responsibly.\x3C/p>\n\x3Ch2>Fairness and sources\x3C/h2>\n\x3Cp>I analyse decisions, not people, and I work from public information. I try to represent the situation and the decision-maker's position fairly, including the constraints they faced. I do not reproduce others' material beyond brief, attributed quotation.\x3C/p>\n\x3Ch2>Corrections and feedback\x3C/h2>\n\x3Cp>I correct errors openly. Material corrections — to facts or conclusions — are noted with a date rather than made silently, so the record shows what changed and why. If you think something here is wrong, tell me via the \x3Ca href=\"/contact\">contact page\x3C/a> and I will look into it.\x3C/p>"}},dataUpdateCount:1,dataUpdatedAt:1791592359983,error:null,errorUpdateCount:0,errorUpdatedAt:0,fetchFailureCount:0,fetchFailureReason:null,fetchMeta:null,isInvalidated:!1,status:"success",fetchStatus:"idle"},queryKey:$R[52]=["site_content"],queryHash:"[\"site_content\"]"},$R[53]={dehydratedAt:1791592359983,state:$R[54]={data:$R[55]=[$R[56]={slug:"cyber-incident-interoperability-jesip",title:"Cyber Incident Interoperability",tagline:"How CSIRTs, emergency services and private sector responders prepare to work together effectively during a cyber or hybrid incident.",summary:"Cyber Incident Interoperability — the ability of organisations to work together coherently as a matter of routine while responding to a cyber security or hybrid incident.",bodyIntroHtml:"\n      \x3Cblockquote>\"Interoperability is defined as the extent to which organisations can work together coherently as a matter of routine\"\x3Cbr/>— JESIP\x3C/blockquote>\n      \x3Ch3>What is Cyber Incident Interoperability?\x3C/h3>\n      \x3Cp>Cyber Incident Interoperability means the ability of organisations to work together coherently as a matter of routine whilst responding to a cyber security or hybrid incident.\x3C/p>\n      \x3Cp>It includes how Cyber Security Incident Response Teams (CSIRTs), Emergency Services, private sector responders, and others, are prepared to work together effectively to minimise the real world impacts of a cyber incident.\x3C/p>\n      \x3Ch3>What is JESIP?\x3C/h3>\n      \x3Cp>The \x3Ca href=\"https://www.jesip.org.uk/\" target=\"_blank\" rel=\"noopener noreferrer\">Joint Emergency Services Interoperability Programme (JESIP)\x3C/a> was established to bring about changes at the operational level that lead to the emergency services working together more effectively in response to major incidents.\x3C/p>\n      \x3Ch3>Is there a 'Cyber JESIP'? Do we need one?\x3C/h3>\n      \x3Cp>JESIP is traditionally used by 'blue light' services rather than cyber security incident responders, however the development of hybrid warfare practices, the integration of technology in societal wellbeing, and the reliance of people on digital services, mean the likelihood of a cyber or hybrid cyber incident having a real world impact has never been higher, and the potential impact of cyber and hybrid cyber incidents on life and wellbeing are increased. This creates a need for effective collaboration between cyber incident responders and emergency services, and therefore a need for interoperability.\x3C/p>\n      \x3Cp>Three possible approaches include:\x3C/p>\n      \x3Col>\n        \x3Cli>Creation of a separate 'CyberJESIP' framework.\x3C/li>\n        \x3Cli>Identifying the highest value elements of emergency services protocols and embedding them into existing cyber standards.\x3C/li>\n        \x3Cli>Aligning cyber standards with emergency services protocols by creating common implementation playbooks.\x3C/li>\n      \x3C/ol>\n      \x3Ch3>Do existing cyber incident management frameworks cover this?\x3C/h3>\n      \x3Cp>No. Existing cyber incident management frameworks (such as NIST or ISO) are generally designed with single organisation response in mind, with suppliers and customers involved in the incident response process as external stakeholders. Interoperability means having the ability to mount a single response to an incident that impacts multiple organisations. Existing Cyber IR protocols are not designed to do this.\x3C/p>\n      \x3Ch3>Can existing protocols simply be applied to cyber?\x3C/h3>\n      \x3Cp>Key challenges in applying existing JESIP protocols to cyber centre include language and communication, the global impacts of cyber, and different professional approaches, tools and training. For example:\x3C/p>\n      \x3Cul>\n        \x3Cli>Co-location in JESIP is generally considered to be physical co-location, but in a cyber incident is likely to be virtual. This raises a different set of challenges and needs.\x3C/li>\n        \x3Cli>JESIP is a UK protocol, with other countries having different approaches, but many severe cyber incidents are international.\x3C/li>\n        \x3Cli>Cyber Incident Response standards such as NIST SP800-63 or ISO27035 are high level frameworks that are applied differently in each organisation, whereas Emergency Services tend to have common (and therefore more interoperable) implementation approaches.\x3C/li>\n      \x3C/ul>\n      \x3Ch3>Where can I read more?\x3C/h3>\n      \x3Cp>I presented on this topic at \x3Ca href=\"https://mattpalmer.net/first-copenhagen\" target=\"_blank\" rel=\"noopener noreferrer\">FIRST 2025 in Copenhagen — supporting information is here\x3C/a>.\x3C/p>\n      \x3Ch3>
1How can I discuss this with you?\x3C/h3>\n      \x3Cp>I'm happy to discuss this further. It is a common (though unsolved) issue, and there are many different views and approaches. Please do \x3Ca href=\"/contact\">connect here\x3C/a>, \x3Ca href=\"https://jcsc.je/\" target=\"_blank\" rel=\"noopener noreferrer\">at work\x3C/a>, or on \x3Ca href=\"https://linkedin.com/in/mattpalmercyber\" target=\"_blank\" rel=\"noopener noreferrer\">LinkedIn\x3C/a>. You're also welcome to subscribe to my occasional newsletter, \x3Ca href=\"https://incidentally.mattpalmer.net/\" target=\"_blank\" rel=\"noopener noreferrer\">Incidentally\x3C/a>.\x3C/p>\n    ",bodyOutroHtml:"",year:"2025",status:"ongoing",externalUrl:void 0,heroImage:"https://qtudfnbdgnpjvxwozbje.supabase.co/storage/v1/object/public/media/migrated/cfa98592-unsplash-image-SgyH_Ix9lNE.jpg",featured:!0,tags:$R[57]=["incident-response","csirt","jesip","critical-infrastructure","cyber-incidents"]},$R[58]={slug:"duchessofbrittany",title:"G-AORG, 'Duchess of Brittany'",tagline:"Preserving an historic de Havilland Heron aircraft based in Jersey.",summary:"A personal project seeing to preserve as living history G-AORG, 'Duchess of Brittany', a 1956 de Havilland Heron aircraft based in Jersey.",bodyIntroHtml:"\x3Cp>\x3Cstrong>G-AORG\x3C/strong>, the \x3Cem>Duchess of Brittany\x3C/em>, is a \x3Cstrong>1956 \x3C/strong>de Havilland Heron based in Jersey.\x3Cstrong> After flying for Jersey Airlines, and then the the Royal Navy, she was bought by a group of volunteers to run 'family and friends' flights, before falling into admin\x3C/strong>i\x3Cstrong>stration during COVID19 due to restoration costs. I bought her for £1 as a community project and am still trying to fine her a sustainable future.\x3C/strong>\x3C/p>\x3Cp>If you \x3Cstrong>would like to help, or \x3C/strong>have photographs, logbooks, or anecdotes relating to G-AORG, please \x3Ca target=\"_blank\" rel=\"noopener noreferrer\" href=\"/contact\">get in touch\x3C/a>.\x3C/p>",bodyOutroHtml:"",year:"ongoing",status:"ongoing",externalUrl:"https://jerseyaviationheritage.je",heroImage:"https://qtudfnbdgnpjvxwozbje.supabase.co/storage/v1/object/public/media/migrated/2dfa20fa-g-aorg_de_havilland_heron_jersey.jpg",featured:!0,tags:$R[59]=["g-aorg","duchess-of-brittany","heron","aircraft-preservation","jersey"]},$R[60]={slug:"jcsc-gcsc",title:"Jersey & Guernsey Cyber Security Centres",tagline:"A new capability to prepare, protect and defend the Channel Islands from cyber threats.",summary:"A new national CSIRT to protect an island community and leading international finance centre.",bodyIntroHtml:"\x3Ch2>New national CSIRT\x3Cstrong>s\x3C/strong> to protect an island community and leading international finance centre.\x3C/h2>\x3Cp>Following the Government of Jersey's 2017 Cyber Security Strategy, we're building a new capability to prepare, protect and defend the island from cyber threats: \x3Ca target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://jcsc.je/\">Jersey Cyber Security Centre\x3C/a>. As of 2025, we're building an equivalent capability in Guernsey - \x3Ca target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://gcsc.gg\">Guernsey Cyber Security Centre\x3C/a>.\x3C/p>\x3Cp>Two independent jurisdictions with distinctive cultures and histories, Jersey and Guernsey have a population of just over 160,000 between them, and operate its own critical infrastructure, as well as hosting a significant finance industry, digital, tourism and agriculture.\x3C/p>\x3Cp>More: \x3Ca target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://jcsc.je/\">jcsc.je\x3C/a> · \x3Ca target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://gcsc.gg\">gcsc.gg\x3C/a>\x3C/p>",bodyOutroHtml:"",year:"2020–present",status:"live",externalUrl:"https://jcsc.je/",heroImage:"https://qtudfnbdgnpjvxwozbje.supabase.co/storage/v1/object/public/media/migrated/00d34821-linkedin_profile_square.png",featured:!0,tags:$R[61]=["jcsc","gcsc","csirt","channel-islands","cyber-security"]},$R[62]={slug:"scamwatcher",title:"Scamwatcher",tagline:"AI-assisted scam reporting and triage platform for the public and accredited analysts.",summary:"Scamwatcher accepts scam reports from the public, triages each with an LLM and external threat intelligence, replies to the reporter, and g
1ives accredited analysts a dashboard to investigate trends, domains and campaigns.",bodyIntroHtml:"\n      \x3Cp>\x3Cstrong>Scamwatcher\x3C/strong> is an AI-assisted scam reporting and triage platform. Members of the public submit suspicious messages — either through a web form or by forwarding an email to a monitored address — and accredited analysts work the resulting case load through a dedicated dashboard.\x3C/p>\n      \x3Cp>A reference deployment runs at \x3Ca href=\"https://scamwatcher.mattpalmer.net\" target=\"_blank\" rel=\"noopener noreferrer\">scamwatcher.mattpalmer.net\x3C/a>. The codebase is self-hostable on any Supabase project plus a static host.\x3C/p>\n\n      \x3Ch3>What it does\x3C/h3>\n      \x3Cul>\n        \x3Cli>\x3Cstrong>Public submission.\x3C/strong> Anonymous web form plus inbound-email ingestion. Optional Cloudflare Turnstile for bot mitigation.\x3C/li>\n        \x3Cli>\x3Cstrong>Pre-assessment threat intel.\x3C/strong> Before AI triage, VirusTotal and AbuseIPDB are queried for sender domains, link domains, IPs and URLs, and the findings are fed into the prompt.\x3C/li>\n        \x3Cli>\x3Cstrong>AI triage.\x3C/strong> Each report is classified with a verdict (\x3Cem>likely_scam\x3C/em> / \x3Cem>likely_legitimate\x3C/em> / \x3Cem>inconclusive\x3C/em>), a \x3Ca href=\"https://www.gov.uk/government/publications/professional-development-framework-for-all-source-intelligence-assessment\" target=\"_blank\" rel=\"noopener noreferrer\">UK PHIA probability yardstick\x3C/a> confidence band, indicators, suggested tags and plain-English guidance.\x3C/li>\n        \x3Cli>\x3Cstrong>Automated reply.\x3C/strong> Reporters with an email address receive a tailored confirmation; a reforward flow lets analysts ask for the original message back when headers are missing.\x3C/li>\n        \x3Cli>\x3Cstrong>Threat intelligence panel.\x3C/strong> On-demand enrichment across eight sources — VirusTotal, AbuseIPDB, URLScan, RDAP/WHOIS, PhishTank, Spamhaus DBL/ZEN, Google Safe Browsing and ipinfo.io — with caching and analyst-gated file uploads.\x3C/li>\n        \x3Cli>\x3Cstrong>False positive management.\x3C/strong> Exact, wildcard and exception rules suppress spurious intel hits across all reports, with a human review queue.\x3C/li>\n        \x3Cli>\x3Cstrong>Indicator watchlist.\x3C/strong> Analysts subscribe to indicators (domain, registered domain, wildcard, ASN) and get email alerts when a new report mentions one.\x3C/li>\n        \x3Cli>\x3Cstrong>GeoIP enrichment.\x3C/strong> ipinfo lookups for malicious IPs, submitter IPs, and accredited-user logins in the audit log.\x3C/li>\n        \x3Cli>\x3Cstrong>Automated research reports.\x3C/strong> Multi-source intel fan-out plus an AI-synthesised deep assessment, weighting domain age, registrar and registration data as scam signals.\x3C/li>\n        \x3Cli>\x3Cstrong>Related reports.\x3C/strong> Event pages surface other reports sharing the same sender domain or scammer contact, helping spot campaigns.\x3C/li>\n        \x3Cli>\x3Cstrong>Email header forensics.\x3C/strong> Multi-level forward unwrapping, original-header recovery from inline forwards or \x3Ccode>.eml\x3C/code> attachments, and SPF/DKIM/DMARC parsing.\x3C/li>\n        \x3Cli>\x3Cstrong>Export.\x3C/strong> Bulk CSV and single-report PDF, in Full mode (with reporter PII) or Redacted mode (safe for partner handoff).\x3C/li>\n        \x3Cli>\x3Cstrong>Accredited dashboard.\x3C/strong> Analysts, auditors and admins browse reports, events, tags, domain drilldowns, DNS audit, email deliverability and the audit log.\x3C/li>\n        \x3Cli>\x3Cstrong>Audit log.\x3C/strong> Logins (with geolocation), report views, edits, threat lookups and AI assessments — admin-only, filterable, paginated.\x3C/li>\n        \x3Cli>\x3Cstrong>DNS and deliverability tooling.\x3C/strong> Scheduled DNS / SPF / DKIM / DMARC checks plus end-to-end mail deliverability probes.\x3C/li>\n        \x3Cli>\x3Cstrong>Org-scoped access.\x3C/strong> Roles (\x3Ccode>admin\x3C/code>, \x3Ccode>analyst\x3C/code>, \x3Ccode>auditor\x3C/code>, \x3Ccode>organisation_admin\x3C/code>) in a dedicated \x3Ccode>user_roles\x3C/code> table; organisation admins are scoped strictly to their own organisation.\x3C/li>\n      \x3C/ul>\n\n      \x3Ch3>Stack\x3C/h3>\n      \x3Cul>\n        \x3Cli>\x3Cstrong>Frontend:\x3C/strong> React 18, Vite, TypeScript, Tailwind CSS, shadcn/ui, TanStack Query, React Router, React Hook Form + Zod.\x3C/li>\n        \x3Cli>\x3Cstrong>
1Backend:\x3C/strong> Supabase — Postgres + RLS, Auth, Storage, Edge Functions (Deno).\x3C/li>\n        \x3Cli>\x3Cstrong>AI:\x3C/strong> provider-agnostic gateway across OpenAI, Google Gemini and Anthropic, switchable from the admin UI.\x3C/li>\n        \x3Cli>\x3Cstrong>Email:\x3C/strong> Postmark (inbound and outbound) with server-rendered React Email templates.\x3C/li>\n      \x3C/ul>\n\n      \x3Ch3>Security model\x3C/h3>\n      \x3Cul>\n        \x3Cli>Roles live in a dedicated table, queried via \x3Ccode>SECURITY DEFINER\x3C/code> helpers to avoid recursive RLS.\x3C/li>\n        \x3Cli>No anon writes — public submissions flow through a service-role edge function with validated intake, idempotency, and signed-URL attachment uploads.\x3C/li>\n        \x3Cli>Analyst consent is required before file bytes leave the platform for VirusTotal.\x3C/li>\n        \x3Cli>Sensitive functions verify the caller's JWT role; errors are sanitised; everything sensitive is audit-logged.\x3C/li>\n      \x3C/ul>\n\n      \x3Cp>If you work in trading standards, consumer protection, law enforcement or threat intelligence and would like to discuss a deployment or collaboration, please \x3Ca href=\"/contact\">get in touch\x3C/a>.\x3C/p>\n    ",bodyOutroHtml:"",year:"2025",status:"live",externalUrl:"https://scamwatcher.mattpalmer.net",heroImage:"/scamwatcher-hero.jpg",featured:!1,tags:$R[63]=["fraud","ai-scams","threat-intelligence","public-private-collaboration","scam-reporting"]},$R[64]={slug:"the-cyber-ned",title:"The Cyber-NED",tagline:"A guide for cyber literate boards.",summary:"Advice and guidance to help boards and nomination committees make good decisions on ensuring sufficient board level cyber skills, and to support cyber leaders developing for board roles.",bodyIntroHtml:"\n      \x3Cp>\x3Cem>In progress.\x3C/em>\x3C/p>\n      \x3Cp>With cyber consistently named a top-10 global issue by the WEF and regularly rated as one of board's top risks, regulators and markets expect well run companies to have appropriate cyber security skills within their Board. This does not necessarily mean having a dedicated '\x3Cstrong>Cyber-NED\x3C/strong>', or an executive CISO with a board seat — sometimes it is about a depth of experience across the board room as a whole.\x3C/p>\n      \x3Cp>However with a lack of board-ready cyber specialists and the need for all directors to be able to contribute fully to broader board discussions, addressing this is a challenge for everyone.\x3C/p>\n      \x3Cp>This project brings together the \x3Cstrong>advice and guidance necessary to help boards\x3C/strong> and nomination committees make good decisions on ensuring sufficient board level cyber skills, and also to \x3Cstrong>support cyber leaders in developing their skills for board roles\x3C/strong>.\x3C/p>\n      \x3Cp>Please \x3Ca href=\"/contact\">contact me\x3C/a> for further information.\x3C/p>\n    ",bodyOutroHtml:"",year:"2024–present",status:"ongoing",externalUrl:void 0,heroImage:"https://qtudfnbdgnpjvxwozbje.supabase.co/storage/v1/object/public/media/migrated/5ec36318-image-asset__1_.jpeg",featured:!1,tags:$R[65]=["cyber-ned","board-governance","non-executive-director","cyber-security","leadership"]},$R[66]={slug:"it-audit-careers-guide",title:"IT Audit Careers Guide",tagline:"Advice and guidance to help you navigate your career in IT Audit & Information Assurance.",summary:"The IT audit and information assurance careers guide — what IT audit is, who does it, how to get in, and how to progress. Freshly updated from 2004 to 2024.",bodyIntroHtml:"\n      \x3Cp>Welcome to the \x3Cstrong>IT audit and information assurance careers guide\x3C/strong>, explaining what IT audit and information (or cyber security) assurance is, who does it, how to get in to it and how to progress as a specialist information systems auditor or cyber security assurance professional.\x3C/p>\n      \x3Cp>This was originally posted on a website called ISRisk, and I have now updated and reposted it here because — 15 years later — it's still popular. So much so that people were pulling it from Wayback Machine. So now, if you like it, it's here to stay. I hope you find it useful as you set out on your journey in audit and assurance.\x3C/p>\n    ",bodyOutroHtml:"",year:"2004–present",status:"live",externalUrl:void 0,heroImage:"https://qtudfnbdgnpjvxwozbje.supabase.co/storage/v1/object/public/media/migrated/6f5296f9-IMG_0109.jpeg",featured:!1,tags:$R[67]=["it-audit","careers","information-assurance","guide"]}],dataUpdateCount:1,dataUpdatedAt:1791592359981,error:null,errorUpdate
1Count:0,errorUpdatedAt:0,fetchFailureCount:0,fetchFailureReason:null,fetchMeta:null,isInvalidated:!1,status:"success",fetchStatus:"idle"},queryKey:$R[68]=["projects","list"],queryHash:"[\"projects\",\"list\"]"},$R[69]={dehydratedAt:1791592359983,state:$R[70]={data:$R[71]=[$R[72]={title:"The red flag for AI?",slug:"human-review-of-ai-decisions-the-wrong-control-at-the-wrong-time",link:"/incidentally/human-review-of-ai-decisions-the-wrong-control-at-the-wrong-time",external:!1,pubDate:"Sat, 01 Aug 2026 00:00:00 GMT",pubDateISO:"2026-08-01T00:00:00+00:00",tags:$R[73]=["ai-ethics","governance","oversight","policy"],excerpt:"Mandatory human checkpoint before every AI decision mirrors the 1865 Red Flag Act—a control that kills the speed advantage while real risks need different management."},$R[74]={title:"The Emperor’s New Clothes: Why Compulsory CBTs and Phishing Tests Keep Failing",slug:"the-emperors-new-clothes-why-compulsory-cbts-and-phishing-tests-keep-failing",link:"/incidentally/the-emperors-new-clothes-why-compulsory-cbts-and-phishing-tests-keep-failing",external:!1,pubDate:"Sun, 05 Oct 2025 00:00:00 GMT",pubDateISO:"2025-10-05T00:00:00+00:00",tags:$R[75]=["cyber-security","cyber-security-assurance","cyber-security-management","phishing","security-awareness"],excerpt:"Most phishing training, and indeed most compulsory computer-based training (CBT) modules, are largely ineffective in reducing incidents - and are therefore a waste of time and resources. Finally we have the data we need to challenge this, and find a better path to user awareness "},$R[76]={title:"Lessons from the Titanic: when you don’t respond to a crisis",slug:"lessons-from-the-titanic-when-you-dont-respond-to-a-crisis",link:"/incidentally/lessons-from-the-titanic-when-you-dont-respond-to-a-crisis",external:!1,pubDate:"Wed, 25 Jun 2025 23:10:53 GMT",pubDateISO:"2025-06-25T23:10:53+00:00",tags:$R[77]=["crisis-management","incident-response","leadership"],excerpt:"When the RMS Titanic hit an iceberg on 15 April 1912, she set off flares and her wireless operator sent out a distress call. The RMS Carpathia responded, but by the time she arrived, the Titanic had already sunk: only those who had made it to the lifeboats could be saved. Some 1,"}],dataUpdateCount:1,dataUpdatedAt:1791592359975,error:null,errorUpdateCount:0,errorUpdatedAt:0,fetchFailureCount:0,fetchFailureReason:null,fetchMeta:null,isInvalidated:!1,status:"success",fetchStatus:"idle"},queryKey:$R[78]=["posts","summaries",$R[79]={limit:3}],queryHash:"[\"posts\",\"summaries\",{\"limit\":3}]"}],stream:$R[80]=($R[81]=(stream) => new ReadableStream({ start(controller) {
2	stream.on({
3		next(value) {
4			try {
5				controller.enqueue(value);
6			} catch (_error) {}
7		},
8		throw(value) {
9			controller.error(value);
10		},
11		return() {
12			try {
13				controller.close();
14			} catch (_error) {}
15		}
16	});
17} }))($R[82]=($R[83]=() => {
18	const buffer = [];
19	const listeners = [];
20	let alive = true;
21	let success = false;
22	let count = 0;
23	const internal = {
24		flush(value, mode, x) {
25			for (x = 0; x < count; x++) {
26				const listener = listeners[x];
27				if (listener) listener[mode](value);
28			}
29		},
30		up(listener, x, z, current) {
31			for (x = 0, z = buffer.length; x < z; x++) {
32				current = buffer[x];
33				if (!alive && x === z - 1) listener[success ? "return" : "throw"](current);
34				else listener.next(current);
35			}
36		},
37		on(listener, temp = 0) {
38			let subscribed = alive;
39			if (alive) {
40				for (temp = 0; temp < count; temp++) if (!listeners[temp]) break;
41				if (temp === count) count++;
42				listeners[temp] = listener;
43			}
44			internal.up(listener);
45			return () => {
46				if (alive && subscribed) {
47					subscribed = false;
48					listeners[temp] = void 0;
49					while (count > 0 && !listeners[count - 1]) count--;
50					listeners.length = count;
51				}
52			};
53		}
54	};
55	return {
56		__SEROVAL_STREAM__: true,
57		on(listener) {
58			return internal.on(listener);
59		},
60		next(value) {
61			if (alive) {
62				buffer.push(value);
63				internal.flush(value, "next");
64			}
65		},
66		throw(value) {
67			if (alive) {
68				buffer.push(value);
69				internal.flush(value, "throw");
70				alive = false;
71				success = false;
72				listeners.length = 0;
73			}
74		},
75		return(value) {
76			if (alive) {
77				buffer.push(value);
78				internal.flush(value, "return");
79				alive = false;
80				success = true;
81				listeners.length = 0;
82			}
83		}
84	};
85})())}}})($R["tsr"])</script>
85<script data-tsr-stream-part="">{let s=document.currentScript,p;while((p=s.previousElementSibling)&&p.hasAttribute('data-tsr-stream-part'))p.remove();s.remove()}</script>
85<script type="module" async="" src="/assets/index-Cw7_u0LI.js"></script>
85<script>document.currentScript.remove();/*$tsr-stream-boundary*/</script>
85<script>($R=>$R[82].return(void 0))($R["tsr"]);$_TSR.e();document.currentScript.remove()</script>
85</body></html>

Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.