Andy Latham

From code to boardroom

Andy’s career began with software and engineering rather than security governance. That foundation has remained important as his roles have expanded through technology leadership, CTO and CISO positions.

It means board-level cyber decisions can be challenged against the technical reality underneath them: architecture, software, cloud, identity, infrastructure, product, engineering practices and the way systems actually operate.

Today, his work spans Fractional CISO leadership, board and investor advisory, cyber due diligence, incident and resilience readiness, secure technology decisions and AI governance.

Senior judgement without losing the technical detail

Andy works from board and investment discussions through to the technical detail needed to challenge assumptions credibly. The objective is not to drag executives into engineering detail, or engineers into board language, but to connect the two when the decision depends on both.

Twice recognised as a UK Top 30 CISO, his approach combines independent judgement, commercial context and technical depth rather than treating cybersecurity as a separate compliance function.

Pragmatic by design

Andy is known for looking at problems from different angles and challenging the obvious answer. He brings ideas, alternatives and practical ways forward rather than defaulting to established patterns simply because they are familiar.

That same mindset shapes his approach to security. The security team should not be the team that says “no”. Its job is to understand what the business is trying to achieve and help find a way to achieve it without losing the security standards that matter.

Security should support innovation, productivity and growth rather than become compliance theatre that slows them down. Good governance creates clear boundaries, evidence and accountability so that teams can move with confidence.

Andy’s approach is pragmatic rather than permissive: enable the objective where it can be done safely, challenge it where the risk is not understood, and be clear when the answer genuinely does need to be no.

Security should help the business move safely, not stop it moving.

Security across the business

Cybersecurity rarely belongs to one team. Decisions about customers, sales, marketing, finance, operations, product, software development, cloud, suppliers and acquisitions can all create or reduce cyber risk.

Andy’s role is often to connect those decisions: helping leaders understand the business significance while being able to challenge the technology and evidence underneath them.

CISO first. AI leadership where it fits.

CISO leadership remains Andy’s core discipline. As AI becomes a material part of business strategy, product development and engineering, that work increasingly extends into AI governance and, where appropriate, Fractional Chief AI Officer leadership.

The focus is practical: identify where AI can improve innovation and productivity, then put the security, privacy, governance and human accountability around it so the organisation can move with confidence.

Independent, but collaborative

Andy works alongside boards, executives, technology leaders, security teams and specialist partners rather than trying to replace them.

The role is to bring senior judgement, constructive challenge and practical support while accountability remains with the people who own the business and its risks.

Breadth without losing depth

Experience spans engineering, software development, SaaS, cloud, infrastructure, product, CTO and CISO leadership, cybersecurity, compliance, board advisory, investment contexts, acquisitions, incident readiness and AI.

The breadth matters because cyber decisions rarely stay within one discipline. Technical architecture, commercial priorities, customer expectations, governance and risk often meet in the same decision.