(C) 2026 IT Security Expert Limited
Cybersecurity Expert brings together independent research, practical guidance, AI-powered tools, and more than 25 years of cybersecurity leadership experience. It is the home of AI Labs, David Whitelegg’s writing and forthcoming book, and the public development story of PENWORTHIA™.
The site connects assurance research with practical ways to test whether cybersecurity and AI controls work as claimed.
The work includes:
• Evidence-led cybersecurity assurance
• Control effectiveness and operational resilience
• AI governance and AI assurance
• Free interactive tools in AI Labs
• A forthcoming book on cybersecurity assurance
• PENWORTHIA™, the platform in private development
→ Learn more about cybersecurity control effectiveness
→ Learn more about evidence-led cybersecurity
Across each area, the aim is the same: replace inherited confidence with evidence that can withstand challenge.
Most organisations can demonstrate that controls are implemented. Far fewer can demonstrate that those controls operate reliably under stress, change, and time.
Resilience requires more than coverage. It requires verification.
The gap between reported security posture and operational reality is where risk accumulates undetected. Cybersecurity Expert examines how independent validation, measurable evidence, and structured challenge can close that gap.
These ideas are applied in practice through the interactive tools in AI Labs.
Cybersecurity Expert operates independently and is not affiliated with any vendor, commercial research sponsor, or consultancy firm. Its perspective is practitioner-led and grounded in sustained experience within complex international control environments.
Cybersecurity Expert was created by David Whitelegg, a UK cybersecurity assurance leader with more than 25 years of experience. David founded IT Security Expert, has published more than 500 articles read over 5 million times, and regularly speaks about governance, resilience, AI assurance, and cybersecurity strategy.
The IT Security Expert Blog was established in 2007 as an independent cybersecurity commentary platform. It provides practitioner-led analysis of control effectiveness, privacy engineering, and governance in operational environments.
The blog forms the historical foundation of this work and continues as a standalone publication.
→ About the IT Security Expert Blog
→ Visit the IT Security Expert Blog
Earlier technical projects and legacy platforms are preserved within the Archive section for historical reference.
→ View the Archive