You work with me
There is no account manager and no rotating consultant. Atumcell's specialists support delivery behind me when the work needs hands, and I stay accountable for everything they produce.
Matthew Carr
I'm Matthew Carr, a CISSP-certified cybersecurity leader specialising in operational technology, critical infrastructure and offensive security. I work directly with executives and boards to turn technical security problems into clear business decisions.
CISSPWCITAtumcellOT and ICSOffensive securityBoard advisory
For more than fifteen years I have worked across critical infrastructure, national security and heavily regulated sectors. Before co-founding Atumcell I led adversary simulation and cyber-physical security research for large global organisations. I spent that time working out how to break industrial systems, which turns out to be useful preparation for telling a board which of their risks are real.
The research has been disclosed at DefCon and covered by the BBC, The Telegraph, The Register and Barron's. I have spoken on four continents, from a hacker conference in Sheffield to Gitex in Dubai. None of that matters to you on its own. It matters because it means when I tell you a risk is not worth your money, I have usually seen what happens when it is.
Disclosures and research
| 2024 | Progress MoveIt Transfer | Coordinated with the vendor and reported in the trade press. |
| 2024 | Zoho Desk | Coordinated with Zoho. Covered alongside the MoveIt finding. |
| 2023 | N-able workgroup guidelines | Vendor defaults that quietly exposed managed service providers. |
| 2018 | Physically hacking SCADA | Cyber-physical attack chains against industrial control systems. |
| 2017 | ICS killswitch | Multi-vendor industrial control research, disclosed at DefCon. |
Selected speaking
Keynotes, panels and technical briefings across Europe, the Gulf, the United States and Asia-Pacific.
| 2024 | Start-Up and Tech, Bali | Security as a strategic asset |
| 2023 | Industrial Cyber Security Panel, USA | IT controls against OT risk |
| 2022 | Private Equity Conference, USA | Cyber diligence in M&A |
| 2020 | Expo 2020, Dubai | Security at operational scale |
| 2019 | Gitex, Dubai | Industry 4.0 attack surface |
| 2019 | Gisec, Dubai | Cyber-physical attack chains |
| 2019 | Logistics Security Event, UK | Transport as attack surface |
| 2018 | SteelCon, UK | Why reliable ICS networks are brittle |
| 2018 | Confidence, Poland | Cyber security research |
Press and commentary
| BBC News | Cybersecurity research |
| The Telegraph | Meltdown and Spectre |
| The Register | Physically hacking SCADA |
| Barron's | Apple on-device scanning |
| Channel Futures | MoveIt and N-able disclosures |
| Datamation | Vulnerability scanning |
| Lifewire | Drone Wi-Fi research |
Four things you can hold me to.
I bring a recommendation
A list of findings just moves the risk onto your desk. I bring the finding, the options, what each one costs and what I would do, so a decision can be taken in the room.
The scope holds
The retainer has a boundary and I keep to it. Work outside it gets quoted separately, so your monthly cost stays at £4,950 and you are never surprised by an invoice.
I will tell you when to stop spending
Most of my career was spent attacking these systems. That makes it easy to say when a control is worth buying, and easier still to say when it is theatre.
CISO-as-a-Service is delivered by Matthew Carr and supported by Atumcell's cybersecurity specialists.
Start with a call.
Thirty minutes, confidential, and no obligation on either side. If the retainer is wrong for you I will say so on the call.
£4,950 per month. £5,000 onboarding assessment, waived on a twelve-month commitment.