Ian Murphy
Ian Murphy is a cybersecurity architect and speaker with over 30 years in the industry, a Fellow of the British Computer Society and Chartered IT Professional (FBCS CITP), and the founder of CyberOff — the UK’s first independent AI security architecture practice. He is also, somewhat improbably, a stand-up comedian.
A Liverpudlian born and bred, now living in Devon after a brief detour via the rest of the country, Ian’s security career began at the Ministry of Defence in the early 1990s. He navigated the dot-com bubble, spent years in vendor land and pre-sales, and eventually took the entrepreneurial path that led to CyberOff. Today he works with boards, CISOs, and risk leaders on the challenges that define AI security right now: governance frameworks, risk assessments, and threat modelling for AI systems — including the agentic AI risks that most organisations haven’t heard of yet.
He is possibly best known outside the industry for being the first person in the UK to lose £1 million live on television. A 50/50 decision on ITV’s Red or Black. It went the wrong way. He has been mining that moment ever since — both as a framework for talking about high-stakes decision-making under uncertainty, and as the opening line of most of his sets.
Since stepping onto the comedy circuit at 54, Ian has moved quickly. Devon Comedian of the Year 2023. A spot at the famous Altitude Comedy Festival 2024. Appearances at the Hot Water Comedy Club and Just the Tonic in Leicester. Tour support for Emmanuel Sonubi and Ignacio Lopez. And a place on the Glee Club pro roster. His comedy draws on 80s cynicism, recovering Scouseness, and the kind of material that only comes from thirty years of watching humans make catastrophically bad decisions — online and off.
For conference and keynote audiences, Ian occupies a rare space: he has the technical depth to be genuinely credible with security and AI professionals, and the communication craft to make a room of non-technical executives actually engage with material that would normally send them to their phones. The result is a speaker who can shift a board’s understanding of AI risk without losing them in acronyms — and make them laugh while doing it.
His comedy influences — Morecambe and Wise, Tommy Cooper, Billy Connolly — show in the warmth underneath the edge. He is sharp, but he’s not mean. And he understands that the best way to get an audience to absorb something difficult is to make them laugh
SPEAKING TOPICS
Ian speaks across three categories: AI and cybersecurity for professional and board audiences; the human and cultural factors that underpin security failures; and after-dinner and comedy keynotes that combine genuine expertise with stand-up craft. All talks can be adapted in length and tone for the specific event.
AI Security & Governance
Red or Black: How Boards Should Make AI Decisions
Fourteen years ago, Ian stood on the set of ITV’s Red or Black and lost £1 million on a 50/50 decision. He had no information, no framework, and no way to know which was right. He made a call. It was wrong. Most organisations are making their AI security decisions the same way. This talk uses that moment as the entry point into a genuinely practical framework for board-level AI risk decision-making — covering what good AI governance looks like, what the EU AI Act actually requires, and how to make defensible decisions in a landscape where nobody has all the information. Delivered with the kind of self-deprecating honesty that only comes from having been on television in that situation
AI Security Without the Acronyms
AI is now a board-level concern, but most boards are being briefed by people who can’t explain it without a slide deck full of acronyms and a 45-minute preamble. This talk gives non-technical executives a clear, honest, and occasionally alarming picture of what AI security actually means in practice — covering governance, risk, threat modelling, and the specific dangers of agentic AI that most frameworks have not yet caught up with. Ian has built the UK’s first independent AI security architecture practice. He knows what good looks like and, more usefully, what the gap between good and where most organisations currently sit actually looks like.
Human Factors in Security
Are We Stupid or What
The security industry has spent thirty years blaming humans for every breach. Ian argues this is not only wrong but counterproductive — and that the anthropological reasons why people make bad security decisions are far more interesting, and far more actionable, than the industry gives them credit for. This talk dives into the cognitive biases, social dynamics, and cultural failures that sit behind ‘the human is the weakest link’ narrative — and makes a compelling, evidence-based case for why humour is more effective than fear as a security awareness tool. Built from three decades of watching organisations try, and largely fail, to change human behaviour through PowerPoint.
The Logs Don’t Work (They Just Make It Worse)
The cybersecurity industry has developed a crippling addiction to data. More logs. More correlation. More storage. More dashboards. This talk takes an honest look at the reality of what all that data actually produces — and why the ‘needle in a haystack’ attacker that security operations teams are hunting for is usually found in the movies, not in the SIEM. It covers the economics of cybercrime, the genuine purpose of the dark web (which started life as a US Navy programme for protecting operatives abroad — a detail that tends to surprise audiences), and what a more honest approach to security detection actually looks like.
Do You Really Want to Hurt Me?
A talk about NSFW tags, cancel culture, adult learning, and why the security industry’s instinct to sanitise its communications is actively working against it. Ian looks at the research behind humour as an educational tool, why treating colleagues as adults rather than liability risks produces better security outcomes, and why being ‘offended’ is a less productive response than it might feel. Light-touch on controversy, heavy on evidence, and delivered with enough self-awareness that the people most likely to disagree with it tend to enjoy it most.
After Dinner & Comedy Keynote
The Three P’s: People, Passwords and Phishing
Ian’s signature comedy keynote for corporate and conference audiences. Built around the three things that cause almost every security incident and almost every security headache — the people doing the wrong thing, the passwords they chose, and the phishing emails they clicked. Delivered as stand-up, structured as a keynote, and calibrated to leave a room both entertained and genuinely better informed. Works as a standalone after-dinner set or as a closing session that wraps a day of more serious content. The set can be tailored to the specific sector or organisation.
Stand-Up Spot
Ian is available for stand-up spots from 10 to 30 minutes for corporate events, awards evenings, and conference socials. His material covers the Red or Black television moment, recovering Scouseness, middle age, and the absurdity of thirty years in tech. He has provided tour support for Emmanuel Sonubi and Ignacio Lopez, appeared at the Hot Water Comedy Club, Just the Tonic Leicester, and the Altitude Comedy Festival 2024, and holds a place on the Glee Club pro roster. Quotes available on request.
