The City of London from above, the tower cluster set against the low roofs around it and the river beyond.
About

Fifteen years breaking these systems. Now we defend yours.

FounderMatthew Carr
CredentialCISSP
Seat36-38 Cornhill, EC3V 3NG

Cornhill Cyber gives a growing company the security leadership of a CISO without the six-figure hire, and gives it one named owner who is accountable for the whole of it.

We spent that time working out how to break things. It turns out to be useful preparation for telling a board which of their risks are real.

15+Years in national security and regulated sectors
5Coordinated disclosures and published research
7Outlets that have carried the work
9Platforms, across four continents
The practitioner

One name on the work, and it is on the invoice too.

Who you actually get
Portrait to come
Matthew Carr, CISSP. Founder.

Cornhill Cyber was founded by Matthew Carr, a CISSP-certified cybersecurity leader. We work directly with executives and boards to turn technical security problems into clear business decisions, and we take the accountability that goes with them.

For more than fifteen years we have worked across national security and heavily regulated sectors. Before founding Cornhill Cyber, and co-founding Atumcell before that, we led adversary simulation and security research for large global organisations. We spent that time working out how to break things, which turns out to be useful preparation for telling a board which of their risks are real.

The research has been disclosed at DefCon and covered by the BBC, The Telegraph, The Register and Barron’s. We have spoken on four continents, from a hacker conference in Sheffield to Gitex in Dubai. None of that matters to you on its own. It matters because it means when we tell you a risk is not worth your money, we have usually seen what happens when it is.

  • CISSP
  • WCIT
  • Compliance
  • Offensive security
  • Board advisory
  • Atumcell
In the press

Carried by people who check it before they print it.

The research has been reported by 7 outlets, and what each of them covered is named under the masthead.

BBC News

Cybersecurity research

The Telegraph

Meltdown and Spectre

The Register

Physically hacking SCADA

Barron’s

Apple on-device scanning

Channel Futures

MoveIt and N-able disclosures

Datamation

Vulnerability scanning

Lifewire

Drone Wi-Fi research
Selected speaking

From a hacker conference in Sheffield to Gitex in Dubai.

9 platforms, four continents

Nobody books a stage for a practice that cannot explain itself. These are the rooms where the argument had to hold in front of people who build and run the systems.

Photograph to come
2024

Start-Up and Tech

Bali

Security as a strategic asset

2023

Industrial Cyber Security Panel

USA

IT controls against OT risk

2022

Private Equity Conference

USA

Cyber diligence in M&A

2020

Expo 2020

Dubai

Security at operational scale

2019

Gitex

Dubai

Industry 4.0 attack surface

2019

Gisec

Dubai

Cyber-physical attack chains

2019

Logistics Security Event

UK

Transport as attack surface

2018

SteelCon

UK

Why reliable ICS networks are brittle

2018

Confidence

Poland

Cyber security research

Standing

The Worshipful Company of Information Technologists

Freeman of the Company
  • The hundredth livery company of the City of London, granted livery status in January 1992.
  • Received its Royal Charter in 2010, and holds its own Hall in the City.
  • Motto: Cito — swiftly.

Freeman of the Company of the hundredth livery company of the City of London.

A livery company is one of the City of London’s historic trade bodies. Freedom of the Company places the practice inside the City’s technology institution rather than outside it — which matters most in the room where a board, its insurers and its regulators are all present at once.

It is a professional standing within the City of London, not a technical certification and not a regulatory authorisation. It is stated here because clients ask what sits behind the practice, and this is part of the honest answer.

The company

Named after the street it is registered on.

Company no. 17262195
Registered nameCornhill Cyber Ltd
Company number17262195
Registered inEngland and Wales

Cornhill runs east from the Bank junction, past the Royal Exchange. The practice took its name from the address rather than the other way round.

Registered office
International House, 36-38 Cornhill, London EC3V 3NG
Incorporated
2026
Next

Ask us a hard question about your estate.

A first conversation takes about thirty minutes and costs nothing. If we are not the right answer to your problem, we will say so.