Cybersecurity, Data Protection & Enterprise Risk

I’m brought in when the cost of being wrong is high; legally, operationally, or reputationally.

• Regulatory scrutiny

  Regulators require answers, evidence, and decisions that withstand formal challenge.

• Board accountability

  Leadership must justify ownership, oversight, and decisions with confidence.

• Material exposure

  Exposure has become significant enough to require intervention or explicit risk acceptance.

• Strategic decisions

  Important decisions carry consequences that may be difficult to reverse.

• Decision deadlock

  Stakeholders disagree on exposure, priorities, obligations, or acceptable risk.

• High-consequence initiatives

  Critical programmes demand independent judgement before commitments are made.

• What do we really know?

  Separate evidence from opinion and establish what can actually be substantiated.

• What are we assuming?

  Challenge accepted conclusions and expose blind spots before they become consequential.

• What are we trying to solve?

  Examine underlying causes before committing resources to treating symptoms.

• What matters most?

  Separate material risks from distractions and focus resources where consequences matter.

Some of the most important work takes place under conditions that do not permit public disclosure.

1. Criminal compromise threatened core business operations

   A multinational mobility platform operating across 100+ countries commissioned an independent assessment of its production environment. Unknown to the organisation, a covertly reconfigured cloud component had enabled criminal actors to exploit core infrastructure without detection.

   My investigation uncovered evidence suggesting insider involvement and identified infrastructure being used to host and distribute child sexual abuse material. I advised executive leadership, coordinated with law enforcement, and provided the technical evidence required to support remediation and takedown efforts.

   The organisation was able to act before the exposure became public, cooperate with authorities, remediate the affected environment, and contain significant regulatory, legal, and reputational exposure.

2. Cryptocurrency market entry blocked by regulatory and banking scrutiny

   A cryptocurrency platform preparing to launch in the Netherlands faced two critical barriers to market entry across European jurisdictions. Regulatory approval was required before launch, and major banks were unwilling to provide services to crypto firms they considered too high-risk.

   I established the security, compliance, and fraud prevention operating model required to satisfy regulatory expectations, withstand banking due diligence, and support regulated market entry.

   The organisation secured regulatory approval, established a banking relationship with BNP Paribas, and entered the Dutch and European markets. It subsequently established a leading market position and was acquired by Kraken.

3. Assurance failure threatened trust in patient care

   A healthcare platform supporting patient self-assessment, medical records, and video consultations failed a formal audit while already serving patients. The failure exposed weaknesses in security, privacy, and operational assurance.

   My assessment identified application security vulnerabilities, weaknesses in access control, and systemic deficiencies in secure development and data protection practices. I advised leadership on remediation priorities, established security and data protection standards, and directed their adoption.

   The platform achieved certification and established the controls and oversight required to support continued patient care and withstand regulatory scrutiny.

4. Travel platform instability threatened growth, trust, and regulatory standing

   A major European travel platform faced increasing instability as demand grew. Service failures during national television advertising campaigns constrained bookings and attracted scrutiny from the Dutch Authority for Consumers and Markets, including threats of enforcement action.

   I identified systemic weaknesses, led the redesign of critical platform components and integrations, and contributed directly to their implementation while advising leadership on resilience and regulatory priorities.

   The platform achieved a 500-fold performance improvement, eliminated downtime during peak demand, reduced regulatory exposure, and supported continued growth on a substantially more resilient platform.

5. Enterprise growth depended on regulatory and ecosystem trust

   A social media intelligence platform was expanding into enterprise, financial-sector, and public-sector markets while relying on continued access to major technology ecosystems. Growth increasingly depended on demonstrating governance, assurance, and regulatory maturity across multiple jurisdictions.

   I established an integrated governance model spanning cybersecurity, privacy, compliance, AI governance, and supply chain assurance. This included custom governance tooling for risk oversight, evidence management, control monitoring, and continuous compliance across evolving regulatory obligations.

   The organisation established the assurance required for enterprise procurement, maintained access to critical technology ecosystems, and continued expanding into regulated markets.