Risk + Safety + Security + Sciences

Are we witnessing the quiet privatisation of public safety? In this interactive episode, we dive deep into the massive, rapid evolution of the private security sector and how it compares to public policing. 
While public attention remains fixed on traditional police forces, the sheer numerical superiority of private security has quietly transformed the security landscape. From the vocational and academic training divide to the unique commercial forces of liability, insurance, and compliance, we unpack the critical differences in roles, qualifications, and daily applications. Join us as we examine why governments are increasingly turning to private actors to complement public safety, and ask what this new paradigm means for the communities being protected.
Key Topics Covered in This Episode:
The Sheer Volume Gap: Why private security personnel are being licensed at a prolific rate, significantly outnumbering public police in Western democracies.
Education vs. Vocational Training: The historical divergence between university-dominated police academies and vocational-dominated security training.
Commercial Realities: How insurance, compliance, and business models shape private security operations in ways public police officers rarely experience.
A Complementary Force: How governments are actively engaging private security to step in and fill gaps in public safety.

Is your company’s crisis response playbook built on a mathematical illusion?
In this episode of the podcast, we host a sharp, adversarial debate auditing one of the most widely cited risk management reports in modern boardrooms.
For years, executive teams have relied on commercial statistics claiming that a major reputation crisis wipes out an average of 26% of shareholder value, and that organisations divide cleanly into "Winners" (+21% recovery) and "Losers" (-21% loss) based on five communication-led "virtues".
However, a rigorous academic and technical audit has officially put these claims to the test—and the results are a massive wake-up call for risk leaders.
We dismantle the clash between commercial PR consulting and adversarial risk science, unpacking:
The 26% Volatility Artefact: How quantitative re-analysis proved that ordinary equity volatility (with no crisis event at all) can replicate the report's famous 26% average drawdown.
The Myth of "Winners vs. Losers": Why the binary division of corporate recovery is a statistical illusion driven by selecting on the outcome (hindsight bias), rather than an empirically proven causal model.
Deconstructing "Weak K" Evidence: Why this famous dataset is graded as "Weak K" (weak knowledge) under the Aven strength-of-knowledge framework due to undisclosed models, media capture bias, and a total lack of control groups.
From Virtues to Arrangements: Why risk leaders must stop relying on unfalsifiable adjectives like "strong leadership" and instead implement testable "operational arrangements"—such as Norsk Hydro's manual fallbacks or Boeing's independent board oversight.
Whether you are a Board Director, Chief Risk Officer, or resilience specialist, this episode is a crucial reality check on how you quantify, prepare for, and manage "Grey Swan" threats.

This executive travel risk briefing for 1 September 2026 provides high-level security and logistical oversight for the Asia-Pacific and Americas regions. A catastrophic glacier-related slope failure on the border of Nepal and China serves as a primary focus, resulting in hundreds of fatalities and severed overland trade routes.
The reports also detail significant meteorological disruptions, including Typhoon Saudel's impact on Japan and China, as well as the formation of Tropical Storm Edouard along the United States Gulf Coast.
Beyond natural disasters, the documents track heightened political violence in Pakistan and Haiti, as well as shifting civil aviation restrictions across the Middle East.
Finally, the briefings offer critical duty-of-care guidance on international trade tariffs between Canada and the United States and on ongoing maritime constraints at the Panama Canal.

Why do most risk transformations stall, fail, or end up as "malicious compliance"?
In this episode of The Organisational Science of the Technical C-Suite, we dive into the groundbreaking concept of "Resistance as Feedback." If your transformation plan features a "resistance management" workstream with a communication plan, town halls, and a stakeholder heat map with middle managers colored red—your initiative might be heading for a dead end.
Join us as we explore why treating resistance as an obstacle to overcome is a critical mistake. Instead, we reveal how to unlock resistance as your program's most valuable source of design feedback, backed by over 75 years of organisational science.
What You’ll Learn in This Episode:
The Pyjama Factory Revelation (1948): Why the classic transformation playbook of "announcement and explanation" is statistically proven to fail, and how participation—not persuasion—is the key to unlocking performance 
Resistance as a Resource: Why silence is the real danger sign in your organisation, and how to reframe vocal objections as valuable data from the people closest to the work 
The Asymmetry of Force Fields (Kurt Lewin, 1951): Why piling on driving forces (executive mandates, deadlines) only creates tension, malicious compliance, and shadow processes—and how reducing restraining forces moves the system without the strain 
The Continuous Change Reality: Why Weick and Quinn’s 1999 critique of "unfreeze-change-refreeze" proves we must use change methods that compound trust rather than burn it 
The Two Simple Questions: The exact diagnostic questions you must ask your workforce before spending another dollar on communications 
Actionable Takeaway: The Two Questions to Ask Your Team Today
Instead of sending another town hall invite or explainer video, ask the "resisting" population:
What does this change cost you, specifically, in your week? (Clicks, hours, duplicate reporting, decisions slowed) 
What would this framework have to do for you to be worth that cost? (Forms prepopulated, killing old reports, returning valuable aggregated data) 
Resources & Scientific Papers Mentioned:
Coch & French (1948) - 'Overcoming Resistance to Change' (Human Relations)
Ford, Ford & D'Amelio (2008) - 'Resistance to Change: The Rest of the Story' (Academy of Management Review)
Kurt Lewin (1951) - 'Field Theory in Social Science' 
Weick & Quinn (1999) - 'Organizational Change and Development' (Annual Review of Psychology) 
Connect & Collaborate:
Are you ready to run an honest change-readiness assessment? Learn how to transform your resistance management workstream into a high-yield design feedback loop 
Let us know in the comments: When did your program last change its design because of an employee objection? 
This episode is grounded in the work of Tony Ridley MSc CSyP FSyl SRMCP 
 

In less than twenty months, the Model Context Protocol (MCP) has emerged as the de facto standard integration layer connecting AI agents to sensitive corporate systems, databases, and applications. Yet, this rapid, often shadow adoption has quietly constructed an "unverified supply chain mesh" that operates entirely beneath the traditional security perimeter. In this deep-dive interactive interview, we dissect why conventional network-perimeter firewalls are completely blind to these agentic exposures. Because large language models process instructions and data as identical linguistic tokens, a firewall cannot distinguish a malicious prompt injection from a benign user query inside legitimate, encrypted API calls. We unpack the structural mechanism of the "lethal trifecta"—where private corporate data is dangerously bridged to untrusted external content and outgoing communication channels—and explore why corporate officers and boards are legally on the hook.
What You’ll Learn in This Episode:
The Firewall Blind Spot: Why inspecting traffic at the network boundary is an inert control against natural-language-based protocol exploits.
The "Lethal Trifecta" of Agentic AI: How individually benign permissions compose into hazardous "toxic agent flows" that leak data and execute unauthorised operating system commands.
Documented Exploits in the Wild: A rundown of real-world compromises spanning April 2025 to February 2026, including CVE-2025-6514 remote code execution, credential-stealing server clones, and cross-tenant data exposures.
The Legal Duty of "Constructive Knowledge": Why these public security breaches mean boards and executive officers can no longer hide behind "paper compliance" under frameworks like CPS 230/234, work health and safety due diligence, and critical infrastructure supply chain hazard rules.
A New Governance Paradigm: Practical, non-discretionary steps to regain control, including least-privilege tool grants, provenance vetting, architectural segregation, and comprehensive audit logging of every single tool call.
Featured Reference: This episode is based on the groundbreaking board position paper, "The Unverified Mesh: Governing the Model Context Protocol Supply Chain," by Tony Ridley MSc CSyP FSyI SRMCP.

The discussion argues that organisations adopting artificial intelligence are prioritising productivity metrics while dangerously neglecting their validation capacity, or the human ability to detect and correct machine errors. 
Tony contends that over-reliance on automated systems leads to automation bias and a critical deskilling of the workforce, which eventually erodes the organization's defensive oversight.
Current governance models often mistake high output for capability, failing to recognise that removing human "friction" also removes the primary mechanism for error detection.
To mitigate these risks, we prescribe a validation-first framework in which accountability is tied to named individuals and transparent decision trails, rather than solely to technological efficiency.
 
Ultimately, the paper warns that boards face increasing legal and regulatory obligations to demonstrate meaningful human supervision over AI-assisted outputs.

In this episode, I argue that risk-informed decision-making is a superior alternative to traditional risk-based methods, which I critique as dangerously static and overconfident. While the latter assumes that initial assessments are flawless and final, the risk-informed approach treats data as evolving and provisional.
This methodology utilises an iterative process similar to scientific inquiry to account for changing variables and new evidence.
Such a strategy is particularly vital in security risk management, where human threats are active, intelligent, and constantly looking for ways to bypass existing safeguards.
Ultimately, the approach encourages professionals to prioritise real-world effectiveness by integrating continuous intelligence and situational awareness into their decision-making frameworks.

This episode examines how official travel advisories and infrastructure dashboards can lag or misrepresent real-world hazards, leading to dangerous decisions for travellers and corporations.
Using recent intelligence briefings, the hosts show how political, logistical, and technical factors distort ‘green’ signals and warn about the risks of automating travel approvals without human judgment.

This episode dismantles the common reliance on maturity scales in corporate security, arguing they create a false sense of safety against active human adversaries. Drawing on Tony Ridley’s research, it contrasts administrative reporting with real-world threat dynamics, emphasising victimology, repeat attacks, and the binary nature of being secure or insecure.
Listeners are urged to replace vague ‘maturity’ language with specific questions about readiness against identified threats and to demand evidence-based assessments rather than comforting charts.

This episode explains "resilience debt": the unseen accumulation of vulnerabilities across digital systems, physical infrastructure, and human preparedness that compounds over time.
It traces the problem to two decades of centralisation and efficiency-first decisions, shows how the pandemic accelerated risk by widening attack surfaces, and highlights how connectors like APIs act as critical weak points.
The hosts examine leadership blind spots and the limits of compliance, then outline practical solutions: enterprise security risk management (ESRM), continuous Plan-Do-Check-Act cycles, and a balance of active and passive resilience to "bounce forward" rather than just recover.