MSc, CISSP, CISM

James Webb

I am a working CISO, a cybersecurity educator, and an independent researcher. I edit the weekly brief, design and run the Blue benchmark, and write the guidance. The reading, the measurement, and the advice are one person's work, and the site says so rather than hiding behind a masthead plural.

My day job is defending an organization. Views expressed here are my own. My employer is deliberately not named, and nothing published here is written on their behalf.

I argued this publication's thesis in 2022, four years ahead of the consensus now forming: AI attacks “leverage unique inherent design characteristics of artificial intelligence systems” and differ enough from traditional threats to warrant independent policy attention.

The teaching happens elsewhere. Shellgrounds is a free command-line training ground for high school and university programs: students learn bash and Windows CMD in a browser, with nothing to install and no student data beyond a handle they pick.

Contact LinkedIn GitHub

The newsletter · weekly

The product is the subtraction

Thousands of items read, a couple of dozen kept, and the reason for every cut published beside the survivors. Three actions per issue, each addressed to a named role and linked to its evidence. No instruction with nowhere to check it.

The research · HarmSurface Blue

Measuring the defensive half

Almost every public AI-security benchmark measures the attack. Blue measures whether a model can recognize, reconstruct, and investigate an intrusion. Staged in the open: D1 published, D2 in validation, D3 planned.

The guidance · one question

Tested, not tabletopped

One question a security leader is actually asking that week, worked until the checklist holds up under a real incident rather than a tabletop.

Corrections Annotated, never applied

Corrections are published in the next issue and annotated on the original item. Nothing is silently edited. None have been issued yet: the record is young, and this line will update honestly when that changes.

The Harm Surface is an independent publication of Rational Mystic LLC, written in a personal capacity. What it promises, and what it will never do, is on the commitments page. Corrections and tips: james.webb@harmsurface.com.
jamesthomaswebb.com · Advisory enquiries →