Engineer. Securing the systems that run things.

Engineer working across OT security, networks and AI.

I have spent most of my career working with systems that carry information into the physical world. I started in military communications and later worked in satellite systems, large-scale IP networking and industrial cybersecurity. I now work mainly across operational technology, industrial networks and AI-enabled automation.

During my RAF career, I worked at RAF Oakhanger across complete satellite communications paths, from incoming baseband traffic through the modems and RF equipment to the antenna and spacecraft. I remember planning and configuring a satellite loop, then seeing the signal return two seconds later. The system had answered back, from space.

That work required an understanding of the whole path. A fault observed at one point might have originated somewhere quite different, and test results could become misleading if the assumed topology was wrong. I still tend to approach systems that way: establish the actual route, understand each transformation and then work out what the available observations can support.

Operational technology

My current work includes IEC 62443 conformance, remote-access architecture, firewall governance, cross-domain risk and incident readiness. Much of it involves industrial environments where ageing equipment, modern networks, vendor access and safety requirements have to coexist.

The work rarely stays within one discipline. A technically strong security control can still be wrong for the process, prevent recovery or introduce a different operational risk. Understanding the plant, the architecture and the people who operate both is part of the security problem.

I am particularly interested in instrumentation and observability. Complex estates are difficult to secure when nobody can reliably describe their assets, connections, dependencies or current state. Earlier in my career, I built a small device that sat in people’s homes, measured their broadband performance every few minutes and graphed the results through a web interface. It nearly became a commercial product. More importantly, it taught me how useful even simple instrumentation can be when a system’s behaviour is otherwise hidden.

Neural models and cyber-physical systems

Much of my experimental work is done in Python, building and modifying neural models to see how changes in architecture, data and representation affect their behaviour. I have worked with model training, embeddings, transfer learning, data lineage, drift detection and adversarial behaviour. What interests me is tracing the effect of a change through the system rather than treating the model as a finished component.

That interest becomes more consequential when neural models are connected to cyber-physical environments. AI and machine-learning systems produce estimates, classifications and generated values probabilistically. Industrial control systems ultimately require definite inputs on which they can act. Connecting the two creates an interface problem that is not resolved by reporting model confidence.

That interface is the subject of my current research project, Attestable.

An AI or machine-learning subsystem can produce a plausible value without having established that the value is true. If it passes that value to a controller, interlock or actuator, the receiving system may have no way to distinguish it from a measured and verified fact. In critical infrastructure or a hazardous process, that distinction can determine whether physical action should be permitted.

Attestable calls this failure False Determinism: a probabilistic claim acquires the authority of settled fact because it has crossed into a system that accepts deterministic input.

The proposed discipline attaches an attestation to the value. The attestation records how the claim was produced and the basis on which it is held. Before the value enters the deterministic system, an admissibility gate compares that basis with the standard required for the intended action. If the evidence is insufficient, the value does not pass.

Human handovers offer an accessible way to explain the problem, since findings, assumptions and inferences are often carried forward without being marked as such. The principal focus of Attestable, however, is the machine boundary between probabilistic AI and cyber-physical systems.

Other interests

Music has been present throughout my life, although I have never been much of a player. I am drawn to its internal structure and can usually hear a wrong note before I can explain why it is wrong. Bach’s fugues particularly interest me because a subject can move between voices and remain recognisable through transposition, inversion and other changes.

Modulation, steganography, mathematics and language occupy neighbouring territory: each involves information or meaning encoded into a structure and preserved through transformation.

Skydiving was a major part of my life. I made around 1,100 jumps, became an instructor and had the opportunity to coach British Army personnel in California. Beneath all the speed and spectacle is a surprisingly spare piece of engineering: a harness, two canopies, lines and deployment mechanisms, equipment simple enough to understand completely and reliable enough to step out of an aircraft wearing it.

Outside technical work, I am drawn to music, language, travel and the sea. I am currently learning Chinese and returning to sailing, both for the pleasure of entering a world that has to be understood on its own terms.

Read the Attestable project →