Dr. Lin Clark Request a briefing

Dr. Lin Clark. Cybersecurity executive, incident responder, researcher and author.

Thirty years of security leadership.
Twenty of them inside the breach.

If you're here, something's probably keeping you up: a breach that isn't over, a board that wants answers, or a security budget that isn't buying much safety. That's the work I do. I run the response when it's live, I build operations that contain attacks faster, and I give you the kind of evidence a board actually understands.

Request a briefing Three ways to work with me

It's confidential, I read every message myself, and you'll come away knowing what to fix first.

First indicator Review Adversary access Containment access ends here Detect Triage Scope Contain Eradicate Recover Time to containment: the measure that governs everything else
This is how I run an incident, from the first indicator to the review afterwards. Only one clock matters, and I'll show you which one further down.

The whole of the problem, not a slice of it.

I've run security at director level for blue-chip companies, startups, and US and allied governments at every level. Twenty of those years were hands-on, which is why what follows is specific rather than a list of buzzwords.

Need this where you work? Hire me for a role Bring me in on a problem Invite me to speak

  • Security leadership

    I run the security function as an executive and I answer for the result: a strategy your board will fund, a team that can deliver it, and reporting that tells you what's actually protected. See the Virtual CISO service.

  • Incident response

    When you've been breached, I lead the investigation from the first indicator to the final briefing, so you know what happened, what's contained, and what you need to decide next. See incident response management.

  • Security operations

    I build and run SOCs around the one measure nobody can game, time to containment, and I turn what was a monitoring cost into a response capability you can point to. See the SOC service.

  • Adversary emulation

    With ATT&CK-aligned emulation and cyber ranges, you find out what your defence misses before an attacker does. I've built the ranges and run the exercises. See penetration testing and red team engagements.

  • AI security

    If you're putting AI into production, I'll help you deploy it with controls that hold: what it can reach, what it can change, and the evidence you need to trust what it tells you.

  • Government and enterprise

    I've delivered security inside the constraints of public institutions and large enterprises, and I train senior practitioners in allied and international settings. If you need someone who knows how government actually works, that's me. See FedRAMP and CMMC.

The ground this covers

Security doesn't stay in its lane, and neither do I. These are the subjects I work in, study closely, and write about. If your problem lives in one of them, I've probably seen its cousin.

  • Incident response and forensics, down to memory and malware
  • Threat hunting and intelligence
  • Red teaming and ATT&CK-aligned adversary emulation
  • Cyber ranges: built, run, and used to train senior practitioners
  • Phishing, fraud and financial crime
  • Critical infrastructure: ICS, SCADA, IoT and 5G
  • Cloud and platform security, Linux underneath
  • Software security and the habits that prevent breaches
  • AI and machine learning: how it's built, how it's attacked
  • Cryptography, privacy and anonymity
  • OSINT, counterintelligence and deception
  • Cyber warfare, nation-state operations and the law of cyberspace

How the work is done.

A security operation measured by containment, not by alerts.

A SOC exists for one reason: to shorten the time between an attacker's first move and the moment that move no longer matters. Everything else is cost. So I design and run security operations around that loop, with telemetry that's worth collecting, detection tuned to how real adversaries behave, triage that actually reaches a decision, and response that closes the gap.

Ask me to look at your operation and tell you where the time goes

Sources Pipeline Detection Triage Response Endpoints Identity Cloud and SaaS Network Email and web Telemetry pipeline Normalise Enrich Retain Provenance only what's worthcollecting Rulesknown behaviour Analyticsanomalies, chains Threat inteladversary tradecraft Triage reach a decision Contain Isolate Revoke access Eradicate Recover Evidence: independent records of what happened and when Board Time to containment: the measure the whole operation is run against
How I build a security operation: sources feed a pipeline that keeps only what's worth keeping, detection and triage reach a decision, response contains, and the evidence reaches your board.

Defences tested against real intrusions before the real one arrives.

Adversary emulation runs an intrusion the way a capable adversary would, stage by stage, and records exactly what your defence saw and when. I build these exercises and the cyber ranges they run on, aligned to MITRE ATT&CK, so your team finds the gaps before someone else does.

Ask me to find your gaps before someone else does

emulated detected Initial access Execution Persistence Privilege escalation Lateral movement Collection Exfiltration gap gap

Here's where I can help.

You've been breached. Now what?

I've spent twenty years dealing with exactly this. Let's find out what's happening, stop what we can, and get you some answers.

Let's talk about your incident

Spending a fortune on security. Still worried?

More tools won't necessarily make you safer. I've built and run these operations. I can help you figure out what's working, what isn't, and where your money actually matters.

Let's look at your security

Your board wants answers. Yesterday.

I know what it's like when the pressure is on and nobody has the full picture. I'll help you sort through the noise and make decisions you can actually defend.

Let's work through it

Your AI is making decisions. Who's checking?

That's a question I've spent a lot of time thinking about. It's also at the heart of Boxing Einstein. AI can do extraordinary things, but somebody still needs to be accountable for what it does.

Let's talk about AI

Discretion.

Much of what I've done can't be described in public, or in some cases shared at all. It's the nature of the job, and I've had an intimate relationship with NDAs most of my adult life. What I can say here, I do; the rest we talk about in confidence.

Request a briefingThree ways to work with me
Front cover of Boxing Einstein: How to Control What You Cannot Understand, by Lin Clark. A black cube, open on two faces, holding a bright tangle of light, with one edge glowing red.

Forthcoming book

Boxing Einstein

How to Control What You Cannot Understand

The problem isn't whether the intelligence works. It's what happens when it works so well we can't afford to question it.

About the book

The hard case isn't a machine that announces hostile intent. It's one that's useful, usually right, increasingly indispensable, and too capable or opaque for the people running it to check in the domain that matters. You keep the signature and the veto. What you lose is the evidence, the time, the competence and the alternatives that make a veto real.

My argument is that control is an engineering and governance problem, not a promise of mastery. The box is a set of boundaries on what the system can decide, reach, change and keep running, and each one needs an owner, measurable evidence, a failure condition and a response that survives pressure. I set out seven such controls, and I take the case for speed seriously, because a needless delay in science, medicine, security or infrastructure costs lives too.

  • Decision authority
  • Access, tools and permissions
  • Consequences and irreversible actions
  • Independent verification and evidence
  • Retained human competence
  • Dependency, alternatives and exit
  • Tested intervention, isolation and shutdown

It's the same test I apply when you hire me: a control isn't real until it has an owner, measurable evidence, a failure condition and a response that survives pressure. That holds for a SOC, a breach, or an AI deployment.

I wrote it for national-security leaders, legislators, laboratory directors, security practitioners, insurers and technical executives, and for anyone who wants the argument rather than the alarm.

Read a short adapted from the book:

Ask about the book How I apply it for you

A library for people who have to act on it.

Fourteen collections of research, analysis and reference material on cybersecurity and AI. I write them to be used rather than skimmed, and each one ends with something you can do on Monday morning.

Every collection is open: 79 research pieces with sources you can check, and 276 shorter working pieces to get you oriented, 183 of them covering a subject from five angles on one page. Browse the articles, or if your question can't wait, ask me for a briefing.

Three ways to work with me.

If you want someone to sell you a platform, I'm not your man. If you want someone who'll tell you what's actually exposed and then stay to fix it, read on.

Start with the executive briefing.

A confidential conversation with me about where you actually stand: where the risk is, what would contain it, and what it would take to lead the response.

Request a briefing

Describe the problem in a few lines. I read every message myself, reply in confidence, and propose a time to talk it through properly. It isn't a sales call.

  • Boards and executives weighing a leader, a programme, or an incident that may not be over.
  • Recruiters and agencies with a CISO, director or principal role to fill.
  • Organisers who want a speaker who's run the response, not read about it.