
Fifteen years breaking these systems. Now we defend yours.
Cornhill Cyber gives a growing company the security leadership of a CISO without the six-figure hire, and gives it one named owner who is accountable for the whole of it.
We spent that time working out how to break things. It turns out to be useful preparation for telling a board which of their risks are real.
One name on the work, and it is on the invoice too.
Who you actually getCornhill Cyber was founded by Matthew Carr, a CISSP-certified cybersecurity leader. We work directly with executives and boards to turn technical security problems into clear business decisions, and we take the accountability that goes with them.
For more than fifteen years we have worked across national security and heavily regulated sectors. Before founding Cornhill Cyber, and co-founding Atumcell before that, we led adversary simulation and security research for large global organisations. We spent that time working out how to break things, which turns out to be useful preparation for telling a board which of their risks are real.
The research has been disclosed at DefCon and covered by the BBC, The Telegraph, The Register and Barron’s. We have spoken on four continents, from a hacker conference in Sheffield to Gitex in Dubai. None of that matters to you on its own. It matters because it means when we tell you a risk is not worth your money, we have usually seen what happens when it is.
- CISSP
- WCIT
- Compliance
- Offensive security
- Board advisory
- Atumcell
Carried by people who check it before they print it.
The research has been reported by 7 outlets, and what each of them covered is named under the masthead.
The Telegraph
Meltdown and SpectreThe Register
Physically hacking SCADABarron’s
Apple on-device scanningChannel Futures
MoveIt and N-able disclosuresDatamation
Vulnerability scanningLifewire
Drone Wi-Fi researchFrom a hacker conference in Sheffield to Gitex in Dubai.
9 platforms, four continentsNobody books a stage for a practice that cannot explain itself. These are the rooms where the argument had to hold in front of people who build and run the systems.
Start-Up and Tech
BaliSecurity as a strategic asset
Industrial Cyber Security Panel
USAIT controls against OT risk
Private Equity Conference
USACyber diligence in M&A
Expo 2020
DubaiSecurity at operational scale
Gitex
DubaiIndustry 4.0 attack surface
Gisec
DubaiCyber-physical attack chains
Logistics Security Event
UKTransport as attack surface
SteelCon
UKWhy reliable ICS networks are brittle
Confidence
PolandCyber security research
The Worshipful Company of Information Technologists
Freeman of the Company- The hundredth livery company of the City of London, granted livery status in January 1992.
- Received its Royal Charter in 2010, and holds its own Hall in the City.
- Motto: Cito — swiftly.
Freeman of the Company of the hundredth livery company of the City of London.
A livery company is one of the City of London’s historic trade bodies. Freedom of the Company places the practice inside the City’s technology institution rather than outside it — which matters most in the room where a board, its insurers and its regulators are all present at once.
It is a professional standing within the City of London, not a technical certification and not a regulatory authorisation. It is stated here because clients ask what sits behind the practice, and this is part of the honest answer.
Named after the street it is registered on.
Company no. 17262195Cornhill runs east from the Bank junction, past the Royal Exchange. The practice took its name from the address rather than the other way round.
- Registered office
- International House, 36-38 Cornhill, London EC3V 3NG
- Incorporated
- 2026
- The register
- Companies House entry

Ask us a hard question about your estate.
A first conversation takes about thirty minutes and costs nothing. If we are not the right answer to your problem, we will say so.