Operational Risk Advisory
Many operational resilience problems are symptoms of deeper issues.
I help leadership teams understand the implications of quantum technologies and advanced AI for the security and sustainability of their business operations. I identify underlying weaknesses and model the likelihood and impact of potential outcomes to inform board decisions.
Our approach combines established root cause analysis with forward-looking risk modelling, grounded in operational and financial data. The result is clearer foresight and a stronger basis for investment decisions.
Why
Different teams have different views of the same exposure. The risk register contains it, but there is no shared understanding of what is causing it, how material it is or what happens if assumptions fail.
Milestones are being reported, yet dependencies are slipping, suppliers are creating friction, decisions are being deferred and management cannot see where failure is most likely to emerge.
A service depends on one provider, technology, counterparty or hidden chain of dependencies, but nobody has established how far failure would propagate or what the real concentration risk is.
Critical services have recovery plans and tolerances, yet it is unclear whether those assumptions hold when multiple systems, suppliers or operational dependencies fail together.
AI, quantum, automation or another emerging technology is changing the operating environment faster than existing policies, controls and assurance processes can adapt.
The decision is material, the consequences are significant and the available information is fragmented, overly technical or influenced by vendors and internal interests.
Teams are treating symptoms, incidents keep recurring or remediation is not fixing the problem because the underlying causal structure has not been properly identified.
Incidents recur, remediation programmes close without resolving the underlying issue, or one failure is replaced by another because the organisation is addressing visible symptoms rather than the causal structure behind them.
Approach
Understand why the risk exists before deciding how to manage it.
Operational risk is not simply a list of controls, incidents or red ratings. It is the combined effect of dependencies, decisions and failure paths across technology, suppliers, operations and governance.
Most risk assessments begin with a list of risks. My approach begins one step earlier: what causes the exposure?
The analysis follows the relationships between business objectives, critical services, operational processes, technology, data, people, suppliers, counterparties and infrastructure, identifying root causes, shared dependencies, concentration, correlation, failure propagation and business consequences.
Only then should the organisation decide how the risk should be treated.
The value I bring is simple: clearer causality, better decisions and faster action on complex risk.
Not every risk needs a full investigation. Sometimes the most valuable outcome is knowing whether the exposure is material at all.
Discuss a Risk or ProgrammeServices
Independent investigations and advisory engagements for Boards, executives and programme leaders.
Entry point
A tightly scoped independent investigation of a specific operational, technology or emerging-risk question. Suitable where management suspects an exposure but does not yet know whether it justifies a larger programme.
Discuss a DiagnosticCORE ENGAGEMENT
A structured investigation of a material operational or technology risk. Includes causal analysis, dependency mapping, third-party exposure, scenario construction and executive/Board briefing.
Discuss an AssessmentComplex exposures
For complex exposures involving multiple business services, technologies, counterparties, suppliers or shared dependencies. Multi-layer dependency analysis, cascading scenarios, financial exposure, Board/ExCo briefing.
Discuss a Systemic Risk EngagementIn Practice
Control, resilience and delivery problems traced back to hidden dependencies, concentration, governance gaps and incorrect assumptions.
Analysis has progressed into prioritised remediation, programme decisions, executive recommendations and clearer ownership of material exposure.
Findings are challenged against operational reality, stakeholder evidence and system behaviour, with conclusions revised where the facts require it.
Work has spanned banking infrastructure, telecommunications, critical systems, technology programmes, third parties and emerging technology risk.
Industries
Most of my work is concentrated around international financial networks, with growing engagements in telecommunications, government and other critical infrastructure teams. My focus right now is handling the increased risk and disruption from agentic AI and a potential AGI, but this also extends into cryptographic risk and opportunities from new modalities of computation, including quantum.
Helping technology vendors clarify the value proposition and capabilities they can bring in relation to AI and quantum cryptographic risk.
Utilities and network operators where failure has consequences beyond the balance sheet.
Card networks, payment gateways and settlement rails, and the dependencies that keep a transaction clearing.
Credit bureaux, scoring engines and lending infrastructure across retail and commercial credit.
Exchanges, clearing houses and the trading systems that match, settle and report every order.
Custody, exchange and settlement infrastructure for tokenised and cryptographic assets.
Underwriting, claims and policy administration systems across life, general and specialty lines.
Network operators, carriers and the infrastructure that keeps voice, data and signalling running.
Programme and supplier risk across defence procurement and public sector delivery.
Photos: Havarhen, Lotus Head, Bidgee, Stefan Andrej Shambora (CC BY-SA/CC BY via Wikimedia Commons); Harland Quarrington/MOD (Open Government Licence); Library of Congress and public domain sources.
I help Boards, executives and leadership teams understand what is actually driving complex technology and operational risk. This matters most where risk spans multiple systems, suppliers, functions or critical infrastructure.
In complex environments, the visible problem is often not the real problem. Risk can sit in hidden dependencies, concentrated suppliers, weak interfaces, fragmented ownership or assumptions that no longer hold. Conventional risk assessments can identify the exposure without explaining what is causing it, how a failure could propagate, or where intervention will have the greatest effect.
That is the problem I help solve.
I work with leadership teams to identify the underlying causes of complex risk, map the dependencies that matter, understand how failures could develop and propagate, and determine where action will most effectively reduce exposure. The objective is not simply to produce another risk assessment. It is to give leadership the clarity needed to decide what to fix, what to prioritise and where to invest.
I have worked with successful international leadership teams for more than 30 years, across both technical, product management and senior commercial leadership roles on both vendor and end user sides of the table.
My particular strength is bridging two worlds: I can speak fluently to the Board and just as fluently to the engineering team. I can work deeply with technical teams while translating complex dependencies, emerging risks and technical uncertainty into issues that leadership can understand and act upon.
My approach draws on established disciplines including root-cause analysis, systems thinking, dependency analysis, causal modelling, failure-mode analysis, scenario analysis, risk propagation and resilience assessment, applied selectively depending on what the specific risk actually requires.
Through QSECDEF and Applied Quantum, my work focuses on the operational and systemic risks emerging from advanced computational technologies, including quantum computing and AI. I work alongside specialists across innovation, cryptography, cybersecurity, operations, policy and compliance to understand how emerging technologies translate into real operational and strategic risk.
The outcome is a clearer understanding of what is changing, what could fail, how failure could propagate and where intervention matters most. That gives leadership the clarity to make better decisions, prioritise effectively and act before a complex risk becomes a costly failure.
“The outcome is a clearer understanding of what is changing, what could fail, how failure could propagate and where intervention matters most. That gives leadership the clarity to make better decisions, prioritise effectively and act before a complex risk becomes a costly failure.”
Find me working with international financial clients at Applied Quantum. Read more about Applied Quantum ↗
Find me engaged with the wider user community at QSECDEF, which provides specialist services for post-quantum migration. Read more about QSECDEF ↗
Insights
AI Research
The 2025 Chroma study tested 18 frontier models and found every single one degrades as context grows. Here is what Anthropic, OpenAI, Google, and Meta are doing to fix it.
AI Research
Quantum computing gets proposed as a fix for LLM context window limits. Our research team investigated. The answer is no, and the reasons why are worth understanding.
AI Governance
A failed AI governance audit is a specific, recoverable problem. The boards that recover well focus on causal gaps first and documentation second. Most do it in reverse.
Resources
Over the past three years I have been focused on understanding and helping to categorise Post Quantum and Advanced Technology operational risk within critical infrastructure environments, with a focus on international finance and government. The published research below is licensed under CC BY 4.0, free to use, adapt and share, including for commercial purposes, with relevant attribution and without the need to engage my services.
The tools below are free directional analysis tools built on the same compliance models, risk and impact data, and generate a directional report instantly.
The Applied Quantum Cryptographic Concentration Framework (CCF) is a second-line method for measuring cryptographic concentration and contagion risk. It includes a global payments extension.
CBOM Profile is a property taxonomy layered on CycloneDX (ECMA-424) for cryptographic bills of materials. It defines the registered appliedquantum namespace: 50 properties across eight subnamespaces, covering post-quantum migration governance, financial-sector and custody context, and the inputs a cryptographic concentration computation needs. It serves the PQC Migration Framework and the Cryptographic Concentration Framework.
The QSECDEF Migration Index gives organisations a single number that answers a question every board is starting to ask but few CISOs, innovation leads or project heads can yet answer cleanly: are we actually going to be ready in time?
An open-access, practitioner-grounded methodology covering the complete 8-phase PQC migration lifecycle, from securing executive mandate and building cryptographic inventories through CBOM documentation, risk-prioritised roadmaps, hybrid pilots, infrastructure modernisation, and vendor governance. Published by Marin Ivezic of Applied Quantum.
A Bitcoin Improvement Proposal for a phased, pre-announced sunset of ECDSA/Schnorr signatures: new sends to quantum-vulnerable addresses are disallowed first, those addresses become unspendable at a fixed flag-day roughly five years later, with a possible future mechanism to recover frozen funds via zero-knowledge proof of seed-phrase ownership. Co-authored with Jameson Lopp, Christian Papathanasiou and others.
Post Quantum Cryptography Tools
Executive
Assess your organisation's current cryptographic exposure to quantum threats and receive a structured report for board-level discussion.
Open Tool ↗Executive
A structured decision framework to identify which migration pathway best fits your organisation's size, sector, and risk tolerance.
Open Tool ↗Executive
Generate a tailored readiness checklist based on your industry, infrastructure profile, and current PQC programme status.
Open Tool ↗Executive
Estimate your organisation's exposure window relative to projected quantum computing timelines and your current migration velocity.
Open Tool ↗Executive
Estimate the complexity, timeline, and cost band for migrating your blockchain deployment to post-quantum cryptographic standards. Covers programme structure, smart contract dependencies, and regulatory requirements.
Open Tool ↗Security Team
Map your current cryptographic assets against quantum threat vectors and receive a prioritised risk profile for your security architecture.
Open Tool ↗Security Team
Calculate your exposure to store-now-decrypt-later attacks based on data sensitivity classifications and estimated Q-Day timelines.
Open Tool ↗Security Team
Track the remaining operational lifespan of your current cryptographic algorithms against published deprecation schedules and emerging standards.
Open Tool ↗Security Team
Match your use case requirements to the appropriate NIST-standardised post-quantum algorithm across key encapsulation and digital signature functions.
Open Tool ↗Security Team
Rank your cryptographic assets by migration urgency, factoring in data sensitivity, algorithm lifespan, and operational dependency.
Open Tool ↗Security Team
Score your blockchain deployment across six quantum exposure dimensions: signing algorithm, address reuse, smart contracts, protocol upgrade feasibility, key management, and data sensitivity.
Open Tool ↗Security Team
Dual-vector assessment scoring both signing key exposure (authentication threat) and encrypted data vulnerability (harvest now, decrypt later). Produces a composite quantum exposure profile for your blockchain infrastructure.
Open Tool ↗OT Security
Score OT assets across five dimensions: lifecycle, cryptographic vulnerability, operational impact, migration feasibility, and regulatory exposure. Produces a ranked migration register with Mosca analysis and PDF report.
Open Tool ↗OT Security
Select the OT communication protocols deployed in your network. Identifies which use classical asymmetric cryptography a quantum computer would break, maps the specific vulnerable functions, and returns the available migration pathway for each protocol.
Open Tool ↗Sales
Quickly determine whether a prospect has a genuine, near-term PQC requirement. Structured for early-stage discovery conversations.
Open Tool ↗Sales
Assess whether a prospect's infrastructure and use case justify a quantum key distribution solution, before investing in a full technical proposal.
Open Tool ↗Need help gauging quantum risk based on your organisation’s unique circumstances? An initial risk assessment brings clarity and urgency to teams evaluating cryptographic risk, with a full report delivered within 7 days.
Discuss a Risk or ProgrammeUpcoming Events
Catch me at the following events as a speaker or a panellist. It's always great to meet people who share an interest in the topic.
Live Training
Here are some of the training courses and resources that I recommend for those new to Quantum Technologies.
Working with advanced technology risk is not as depressing as it may sound. The process can, and often does, uncover commercial opportunities for innovation, cost savings and process improvements that lead to competitive advantage, better security and a more robust organisation.
If you are a CRO, COO, Head of TPRM, Programme Director or a Board member carrying the quantum or AI risk question nobody else seems to own, I am happy to help. Drop me a line.
Discuss a Risk or ProgrammeYou are subscribed.
Look out for the next issue. Check your junk folder and add the sender to your safe senders list.
Commercial investigations into advanced technologies. Published occasionally, roughly once per month. By a human.
You can unsubscribe at any time. View the privacy policy.
