Security, systems, and the people who run them under pressure. The technical part is usually the easier half. Most of what is here is about the other half.

Services

Architecture review, security consulting, training, and the simulation environments that go with them. Aimed at IT, OT, and the awkward space between, particularly at startups and scale-ups where the operating reality tends to outpace the documentation.

About

Technically fluent, organisationally alert, situationally paranoid; partial to cats, Pratchett, Nature walks, and CTFs. The work shifted over time toward the human friction around technical fixes, where the harder problems mostly sit.

Projects

Simulation environments with vulnerabilities baked into the systems. Notes from labs, CTFs, research, and the thinking that follows, organised by colourful domain. Audit notes for post-work checks on security already in place, and a small attic of code worth keeping.

The Process

An OT/ICS bureaucracy simulator. File a security concern and watch it pass through five mandatory stages, each producing the appropriate documentation.

The Incident’s Trial

An incident report translator. Type plain notes; it matches them against governance-compliant phrasing drawn from real post-incident reports.

The Situation, Clarified

Twelve familiar security claims, each held against four other perspectives: operational reality, how it fails, why it persists, and the impact when it does.

Broomstick

Occasional writing on security, governance, and the politics of practice. Hosted separately at broomstick.tymyrddin.dev.