Cyber risk measurement, breach modeling, healthcare security, insurance, framework design, high-assurance architecture, and the evidence practices behind VitalSec.
01Core research
Research on risk direction, evidence quality, continuous assurance, breach modeling, framework design, high-assurance deployment, vendor evidence, and the relationship between measured security state and real-world loss outcomes.
01Lead publication
The Ford Model treats cyber risk as a bounded dynamical system. It asks whether Enforcement and Proof Continuity are strong enough to outrun Decay and Adversarial Pressure, making risk direction explicit instead of reducing the environment to one unexplained score.
02Foundational research
The Risk Floor, R_min, names the Ford Model's strictly positive lower bound of residual risk. It defines the irreducible limit toward which sustained enforcement and continuous proof drive modeled risk.
How VitalSec anchors breach modeling to defined populations and outcomes using traceable source data, prospective testing, frequency, severity, and measured time-at-risk.
A measurement discipline for healthcare technology vendors that need to support BAA diligence and prove current cybersecurity posture to hospital customers.
Why cybersecurity evidence needs freshness, completeness, provenance, conflict handling, and re-observation between formal assessments.
Where operational cyber measurement ends and actuarial cyber-loss inference begins, including frequency, severity, prospective calibration, and pricing authority.
From Shor's 1994 algorithm to ML-DSA and ML-KEM: an educational whitepaper on digital signatures, long-lived information, and practical post-quantum planning.
How provenance, freshness, completeness, conflict handling, normalization, and remediation receipts turn security telemetry into an evidence history a reviewer can inspect.
Why configuration drift, changing adversarial pressure, evidence age, and intervention history make cyber risk a temporal measurement problem.
How to separate cybersecurity control assertions from observed state, preserve evidence conflicts, govern exceptions, and verify remediation from the resulting environment.
How restricted computing enclaves and air-gapped operating constraints influenced VitalSec's design, and what those lessons mean for healthcare resilience, local authority, controlled transfer, and proof continuity.
A PatientLock research proposal to add VALIDATE as a seventh top-level NIST CSF Function so post-action state confirmation becomes explicit, continuous, measurable, and evidence-backed.
02Healthcare
Hospital recovery, continuous assurance, ransomware resilience, third-party risk, and the evidence healthcare leaders need to operate and govern security.
Why healthcare should measure the return to trusted operating state rather than ticket closure, and how to instrument recovery, verification, and proof continuity.
How hospitals can turn HHS healthcare cybersecurity goals and other frameworks into a living operating-evidence discipline without confusing checklist compliance with control effectiveness.
A hospital-focused framework for ransomware backup testing, restoration readiness, clinical service prioritization, clean recovery, and evidence-based return to service.
How hospitals can combine BAA governance, vendor attestations, current technical evidence, material-change triggers, and evidence freshness in third-party cyber risk management.
03Brokers
Renewal readiness, book triage, carrier communication, evidence-backed submissions, and claims support from the broker seat.
A broker-centered model for turning cyber renewal into a continuous evidence process rather than a last-minute reconstruction of controls, exceptions, and remediation history.
How to triage a cyber insurance book using evidence freshness, control exceptions, remediation, prior carrier concerns, and time-to-renewal without taking operational control of client environments.
How brokers can present cyber-control improvement to carriers using scope, before-and-after evidence, verification, persistence, and explicit actuarial boundaries.
How brokers can support cyber claims with pre-loss chronology, scoped evidence packages, delivery records, and client-controlled sharing instead of reconstructing control history after an incident.
04Carriers
Evidence quality, material change, continuous underwriting, policy-period state, and claims evidence for carriers.
A carrier framework for monitoring meaningful changes in control state, proof quality, exposure, and remediation during the policy period without turning every fluctuation into an underwriting event.
How freshness, completeness, provenance, conflict, and source scope improve cyber-control interpretation for insurance underwriting and later model calibration.
How insurers can supplement annual cyber questionnaires with selective policy-period evidence, material-change logic, insured authority boundaries, and renewal history.
A carrier-focused evidence model for distinguishing pre-loss state, post-loss investigation, remediation chronology, scoped claims packages, and later underwriting feedback.
What Tesla's use of driving data can teach cyber insurance about working protections, verified repairs, and a clearer record of improvement.
05Reinsurance
Treaty risk, systemic dependencies, portfolio concentration, evidence quality, and accumulation scenarios across the underlying book.
How evidence quality and shared dependency data can improve cyber accumulation review while preserving the distinction between operational telemetry, scenarios, and catastrophe modeling.
A dependency-focused approach to cyber portfolio concentration using shared cloud, identity, MSP, software, recovery, and evidence-quality dimensions alongside traditional segmentation.
How normalized operational cyber evidence can support treaty review across unlike cedant books while keeping data coverage, actuarial inference, and carrier underwriting context explicit.
How to combine shared dependencies, resilience evidence, observed facts, scenario assumptions, and portfolio change into more inspectable systemic cyber stress tests.
06Private equity
Pre-close diligence, Day 0 baselines, portfolio triage, post-close improvement, and repeatable cyber operations across unlike companies.
A private equity approach to prioritizing cyber work across unlike portfolio companies using current state, evidence quality, risk direction, and material business context.
A practical evidence model for moving cyber diligence from pre-close claims and unknowns into Day 0 baselining, prioritized intervention, and measurable post-close progress.
How sponsors can show what actually improved after close, which interventions changed the environment, and whether those gains lasted rather than ending with project completion.
Where shared services, procurement, expert capacity, minimum evidence standards, and repeatable remediation can improve cyber operations while each company keeps control of its own environment.
07MSPs
Repeatable multi-client delivery, delegated authority, remediation proof, customer separation, QBR reporting, and evidence customers can reuse.
A practical architecture for delegated cyber operations in which MSPs can work at scale without collapsing customer authority, evidence, or auditability.
A service-delivery model that measures verified customer outcomes instead of relying on ticket volume, activity reports, or provider-controlled assertions as final proof of work.
How MSPs can move beyond ticket closure using delegated-action records, resulting-state verification, governed exceptions, and remediation receipts.
A multi-tenant operating model for MSP automation using customer-specific least privilege, local policy gates, shared remediation recipes, and evidence isolation.
08MSSPs
Daily SOC work from detection through verified remediation, plus recurring customer security reviews that show material change, open risk, completed work, and supporting evidence.
How an MSSP can move from detection into approved remediation, check the environment again, and show the customer what changed without exceeding the customer's permissions.
An outcome-oriented MSSP measurement model using verified remediation, recurrence, exposure windows, evidence gaps, and control-state improvement instead of alert volume alone.
How MSSPs can combine passive observation with bounded active testing, PASS/FAIL/INCONCLUSIVE outcomes, remediation, and retesting without turning production into an uncontrolled test environment.
How to build MSSP reporting from a durable customer evidence record with material-change summaries, owned exceptions, evidence quality, verified outcomes, and role-specific sharing.
Outside sources stay distinguishable from PatientLock’s own analysis and conclusions. Every publication is also designed to print or save cleanly as a PDF.
