Evidence over assumption.

David Whitelegg is a cybersecurity leader, author and builder. He writes about whether security and resilience actually hold under pressure, and builds tools that test it.

Why Cybersecurity Control Effectiveness Matters

Cybersecurity reporting has never been more sophisticated. Dashboards are richer, maturity models are more detailed, and compliance frameworks continue to expand. Yet major breaches persist.
→ Learn more about cybersecurity control effectiveness
→ Learn more about evidence-led cybersecurity

The problem is not visibility. It is proof.

Many organisations measure what is declared rather than what is independently tested. Controls are assumed to be effective because policies exist, tools are deployed, or metrics appear stable. Real resilience, however, is only demonstrated under operational stress.

This platform focuses on a critical cybersecurity assurance question:
‍Do these controls actually work during real operational conditions, cyber attacks, and service disruption?

It shows how cybersecurity assurance moves beyond reported posture to measurable, defensible performance across real services, supporting systems, and critical dependencies.

Explore featured articles in our Blog and Articles sections, and learn more about Cybersecurity Expert.

Put Cybersecurity to the Test

The AI Labs transform cybersecurity theory into practical, interactive assessments, enabling you to test, simulate, and measure cybersecurity performance under realistic conditions. Rather than relying on reported compliance or assumed control effectiveness, these tools reveal how controls perform in practice, where assurance breaks down, and how risk propagates across services, dependencies, and critical business operations.

‍Explore AI Labs→
‍Discover a growing collection of AI-powered cybersecurity tools that help security leaders validate controls, strengthen operational resilience, and generate evidence-based assurance. Whether you’re assessing threat exposure, simulating control failures, or mapping service resilience, AI Labs provides practical capabilities to support better cybersecurity decisions.

Invisible Risks, the book →
Why organisations so often believe their security works without being able to show it, and what evidence-led assurance looks like in practice.

Explore PENWORTHIA™ →
PENWORTHIA is an AI-assisted business resilience platform in private development. It is being built to help organisations show, with evidence, that their critical services will stay within acceptable limits during disruption.

Augmented intelligence research →
Early research into personal AI that remembers what matters to you over time and works as an extension of your own memory and knowledge, with privacy and user control as the starting point.