Advisory

The same desk, on your problem.

The Harm Surface exists because AI, cyber, and autonomy have become one threat surface. Advisory work applies the same method to a single organization instead of a week of news: deterministic, inspectable, stated plainly.

Engagement shapes

Posture AI threat posture review. Where agents, models and autonomous systems actually touch your estate, what that changes about your threat model, and what to do before the guidance exists. Written output your board can read. Briefing Executive and board briefings. The quarter's developments in this domain, graded the way the brief grades them: what changed, how much to care, what to do about it. No vendor deck has an incentive to tell you this straight. Review Independent review. A second opinion on an AI-security plan, product claim or incident readback, from someone whose published record shows exactly how they weigh evidence.

Who you get

James Webb is a CISO, cybersecurity educator and independent researcher. Every issue of the brief is a public, checkable record of judgment under uncertainty. Read the issues before you write; that is what it is for.

How it starts

One email describing the problem. If it is not work this desk should do, you will be told so plainly. That is the same de-escalation promise the brief makes every week.

james.webb@harmsurface.com →

Advisory work never influences the brief: no client is covered more softly, and no engagement buys an item's score or placement. Published by Rational Mystic LLC, in a personal capacity. This work speaks for no employer.