Outside the Perimeter

A former GCHQ operator on what real security testing actually looks like

Most organisations have pen testing on their security checklist. They scope it, budget for it, sign it off, and file the report. Job done.

But what if most of what gets sold as pen testing isn't actually pen testing at all?

In this episode of Outside the Perimeter, David is joined by Nathan Jones, co-founder of SecuraNova and a former member of the active cyber team at GCHQ. Nathan has spent his career at the sharp end of offensive security, and he has seen the same story play out more times than he can count. A business pays for a pen test, receives a report full of scan output, and files it away believing they are covered. They are not.

Nathan breaks down what separates genuine security testing from a glorified vulnerability scan, why the rise of AI in this space has made the problem worse rather than better, and what the shift toward proper security assurance actually means for organisations trying to make their budgets work harder.

If you have signed off a pen test in the last two years and assumed the job was done, this one is worth 30 minutes of your time.

No waffle. No jargon. Just the stuff you actually need to know.

Most organisations think their biggest cyber security risk is the next attack. Louis Holt thinks it's something much closer to home.

Louis spent years in cyber forensics, counter-terrorism and high-tech policing before founding ESprofiler - a platform built to answer a question almost nobody can: what security tools do you actually have, what are they costing you, and are they even switched on properly?

In this episode of Outside the Perimeter, David is joined by Louis to talk about the millions of pounds enterprises are quietly wasting on overlapping, underused, or completely forgotten security tools - including one organisation that was still paying storage fees on hardware that had reached end of life and was never deployed. Louis explains why this happens, why "nobody gets fired for buying the big name" thinking makes it worse, and what genuinely good security spend actually looks like.

This isn't about more tools. It's about knowing what you've already got.

No waffle. No jargon. Just the stuff you actually need to know.

Most organisations have spent serious money on cybersecurity tools. EDRs, next-gen SIEMs, vulnerability management platforms. The prevention and detection stack has never been better.

But when something gets through (and it will) what happens next?

In this episode of Outside the Perimeter, David is joined by Will Poole and Ollie Fletcher, co-founders of Strand Intelligence, an AI-powered platform built to automate the digital forensics and incident response that most organisations are completely unprepared for.

Will spent years as a technical director of an insurance-backed incident response company - parachuted into businesses at their worst moments. Ollie has seen the same story play out from the commercial side. Together they have a clear-eyed view of where the industry is falling short, and what needs to change.

In this episode we will cover:
• Why incident response has barely changed in a decade despite the explosion in tooling
• What your cyber insurer actually expects when you make a claim
• How AI is finally closing the gap between getting breached and getting back on your feet - without destroying your evidence in the process.

Straight talk. No hype. Just the stuff you actually need to know.

Luke Collinson is a Royal Academy of Engineering Enterprise fellow, former Head of Cyber, and founder of Cybersecurity Stack - and he's got some things to say that most people in this industry won't.

In this episode, Luke breaks down why the perimeter-based tooling most organisations are relying on is fundamentally flawed, how CISO pack mentality is creating dangerous blind spots, and why the compliance frameworks designed to protect you might actually be slowing down the innovation that would.

No fluff, no vendor pitches. Just a practitioner who's been on both sides of the table telling it like it is.

What you'll take away:
1. Why "nobody gets fired for buying CrowdStrike" is a security problem - the herd mentality shaping CISO buying decisions, and why it's leaving gaps that attackers are actively exploiting

2. How ransomware actually spreads inside your network - and why most current solutions are addressing the wrong part of the problem, causing operational downtime when it matters most (yes, think M&S)

3. A practical framework for evaluating newer, smaller security vendors - without compromising your baseline compliance requirements or taking on unacceptable risk