Fourteen years ago I lost a million pounds on live television. Nine million people watched me do it.

I have thought about risk every single day since. Most consultants read about it. I've felt it — in front of an audience the size of a small country.

That's the difference. CyberOff treats your AI risk like there are nine million people watching. Because one day, there might be.

Every framework tells your team what to do. None of them answer what the board actually asks.

NIST AI RMF, ISO 42001, the OWASP LLM Top 10 — all control-centric. They describe what to do. The board asks something different: what must be true about our AI for this organisation to be safe, compliant and trusted? CASAM answers that — 44 business attributes across six domains, the connective tissue between technical controls and board-level risk language. GRM — Governance, Risk, Modelling — is the lens that sequences those domains for the board.

A three-pillar sequencing model for AI security — Governance first, then Risk, then Modelling — so organisations address AI risk in the right order and at the right level of the business. Each pillar maps to CASAM domains beneath it and to the engagement it leads to.

Business-attribute traceability. Control to board. Board to control.

CASAM inverts the conventional assessment direction. It starts with the business attributes that characterise a well-governed AI system — and traces down to the controls that enable them. Any control gap traces forward to the business risk it creates. Any board concern traces back to the control that addresses it.

Thirty years at the sharp end. Now pointed at the hardest problem in security.

"AI governance without business-attribute traceability is governance theatre. It satisfies the auditor and leaves the board flying blind."

Ian Murphy FBCS CITP has spent thirty years in senior UK cybersecurity roles — central government, defence, critical national infrastructure, large enterprise. Former CLAS-accredited consultant. Account-CISO work with Fujitsu, enterprise architecture with Symantec. The kind of depth clients verify in thirty seconds.

CyberOff focuses that experience exclusively on AI security architecture. CASAM is the methodological expression of that focus — a framework that didn't exist, built because the gap was real.

Ian is also a working stand-up comedian on the professional circuit. The consultant is a better communicator because the comedian has to earn the room. Based in Barnstaple, Devon; working across the UK and internationally.

The same voice. Different rooms.

Ian speaks at industry events, MCs awards nights and gala dinners, and runs Clocking Off — sponsored cyber comedy nights that put real stand-up at the centre of what is otherwise the same vendor marketing cycle.