Different rooms. Same questions.

At NTT I lead International Security Partnerships. The job is reading risk early enough to act on it. A policy shift in one capital becomes, five steps of cause and effect later, an exposure half a world away. I turn that chain into a posture a Fortune 100 telecom can carry through a quarter or a decade.

The instinct comes from seven years as a Navy Cryptologic Warfare Officer, with stops at NSA, U.S. Cyber Command, and the bridge of USS Boxer in the Western Pacific. Then came four years on the commercial side, at CyberWire and a defense startup, where a customer renews only when the last thing you delivered actually worked.

Executives reach out when they need someone who has run the operations and will tell them which of their decisions still hold after contact with the real world.

Bombadil, LLC is my own firm. Most of its work is fractional CISO work: security programs, governance, risk, and compliance, the secure development lifecycle, product security, and privacy. I keep two to four clients at a time, and the details stay private.

I also forecast cyber risk in dollars, so a board or an underwriter can see what a bad year could cost and what each control buys back. It is the same method Rick Howard and I teach at learnfirstprinciples.com.

More clients now want AI agents that do the toil inside their operations while their people make the calls. I design and build those systems. I run my own work on one, called AIOS, and license it to firms that want the same.

Through Bombadil I run AI-enabled vulnerability research and penetration tests on software, web applications, APIs, and networks. The work fits a team heading into a major release, an audit, or a customer's security review.

Agents read the code and probe the running system, then a separate check throws out the guesses. A finding reaches your report only after it has been proved on your own system. When I have your code, the agents prove each finding on a copy built from it, so production stays out of the blast radius. I review every finding myself before it goes out.

Each finding comes with its proof and a recommended fix, so your engineers spend their week fixing things. Every engagement starts with written authorization and a signed scope, and nothing outside that scope gets touched.

I think the market prices national security too narrowly. It watches the weapons system and the contract vehicle. The companies that decide how much the country can actually build work one layer down, in manufacturing, supply chains, and the data tools a system needs to perform when it counts. As Venture Partner at Fulcrum Venture Group, I evaluate companies in that layer.

I built one myself, a startup that took next-generation networks for U.S. special operations from concept to $1.25 million in first-year revenue. Founders get an evaluator who has done the operational work their technology has to survive.

I keynote conferences, brief boards, and guest on podcasts about cybersecurity and dual-use technology in national security. Recent platforms include RSA Conference, InfoSec World, the CyberWire Daily and T-Minus Space Daily podcasts, USNI, Breaking Defense, and Via Satellite. My weekly column, A Discipline of Seeing, covers the same ground.

With Rick Howard I teach First Principles Risk Forecasting, a hands-on workshop where security leaders build their first loss exceedance curve: the chart that tells a board how much a bad year could cost. The workshop's tools live at learnfirstprinciples.com. I also guest lecture at Penn State and Georgetown. Curiosity is the most valuable gift anyone ever gave me. Passing it on is the second.

I take a few paid engagements each quarter and keep some unpaid slots for institutions whose mission earns the time.