Independent judgement.
Already up to speed.
Less time rebuilding context. More useful advice.
Proper Tools is my independent consulting practice.
I am most useful when a question is clear enough to matter but not yet clear enough to answer. Usually that means the knowledge is scattered, the assumptions are unnamed, and reasonable accounts disagree.
I distinguish what is known from what is inferred, make the important assumptions and dependencies visible, and help the people responsible decide what follows.
My work draws on more than two decades across cybersecurity operations, infrastructure, standards, and policy.
Continuing advisory relationships
You are not buying hours. You are buying continuity of context, independent judgement, and an established first call.
A retainer reserves roughly two days of direct work each month, averaged across the quarter, together with standing access for questions between scheduled sessions.
I already understand the people, systems, history, and decisions involved. We spend less time reconstructing context and more time working on what matters now.
The point of continuity is to preserve enough context that conclusions can evolve without reconstructing the whole problem space.
The reserved time is used wherever it is most useful within the agreed scope: analysis, advice, preparation, briefings, or conversations with colleagues and suppliers.
Substantial new work is scoped separately. A trial quarter gives both sides a practical way to test the relationship before making a longer commitment.
A straightforward first conversation
I would rather tell you plainly whether this is a fit than sell you something that is not.
Focused assignments
Not every question needs a continuing relationship.
I also take on bounded pieces of work with a clear purpose, timetable, and fee agreed in advance.
That may include:
- focused analysis of a technical, organisational, or supplier question;
- an executive or board briefing;
- a facilitated working session;
- advice on standards, policy, regulation, or institutional coordination;
- a concise written account of what an issue means and what might follow.
Questions arising from obligations under NIS2, DORA, or the Cyber Resilience Act are one common reason a bounded piece of work lands on someone’s desk.
Some assignments stand alone. Others provide a practical way to begin working together before deciding whether continuing advice would be useful.
Discuss a piece of work →Current work: time and timestamp resilience
A significant part of my current public-interest work concerns the 2036–2038 timestamp rollovers: a family of known date failures embedded across software, devices, infrastructure, and supply chains.
7 Feb 2036
NTP 32-bit counter rollover
19 Jan 2038
Signed 32-bit
time_t rollover
I am the primary drafter and a co-editor of the ITU-T Technical Paper XSTP.epoch, and co-chair of the FIRST Time Security SIG.
The work includes technical analysis, standards coordination, public explanation, and helping institutions understand what practical preparation requires.
It is one example of how Proper Tools works: go deep enough to understand the technical reality, then make it useful to the people who must plan, decide, coordinate, or explain.
Research and the Commons
Some of the work belongs to everyone.
Open frameworks, protocols, working papers, and civic texts, released for inspection, criticism, adaptation, and reuse.
Current work includes The Hippocratic Oath of the Cybersecurity Practitioner , the Meridian Protocol for durable web preservation, and XSTP.epoch.
Proper Tools is being built so that paid consulting, standards participation, public-interest research, and work released into the Commons strengthen one another.
The public work keeps the practice close to emerging questions, makes the reasoning available for inspection, and improves the advice clients receive.
Latest Field Note
Start here
Bring me the question as it currently exists.
You do not need a finished brief or a neatly classified problem.
A useful first note says what is happening, who is involved, what decision or deadline is approaching, and what kind of help might be useful.
Introductions are welcome. So are half-formed questions.
Start a conversation →