About
Research on how security organizations measure, prove, and communicate the value they deliver.
Research is the product. This platform documents research in progress, not just final outputs. Working theories, raw observations, literature frameworks, and the reasoning behind decisions are published as they develop.
Research Focus
The current research, Project 002, asks: How can security organizations consistently measure and communicate the realized business value they deliver? The study is role-neutral: it does not assume or test any specific security role.
Research Questions
- RQ1What does published evidence say makes a cybersecurity value claim credible to business executives?
- RQ2What lightweight, repeatable mechanism can capture and communicate realized value without adding governance overhead?
- RQ3What capabilities do validation and communication of security value require, based on published evidence?
Earlier research examined the BISO as a governance intermediary (paused).
About the Researcher
I help organizations make clear, risk-informed security decisions. I am a director-level security leader in the medical technology industry, with 20+ years in the field. I started in software and web development and now work on enterprise security strategy. Based in New York.
I am completing a Master of Science in Cybersecurity at Georgia Tech. My graduate research develops and evaluates a framework for measuring and communicating the realized business value of cybersecurity, using Design Science Research.
Credentials
- CISSP
- M.S. Cybersecurity student, Georgia Institute of Technology
- Mentor and coach, ISC2 NJ Chapter
Speaking and Writing
- ISC2 Think Tank panelist, neurodiversity in the cyber workforce (2025)
- Guest editorial, THINK Digital Partners, how embracing autism strengthened a cybersecurity career (2025)
- "Burnout Is Part of the Risk Model" (LinkedIn post)
Elsewhere
For research inquiries or collaboration, reach out via LinkedIn.