Dr. Mahmoud Alminawi
I've spent my career on the governance side of cybersecurity — the part that decides what gets protected, who signs off, and how you prove any of it happened. At the federal level, at the state level, and now for a major city.
Roles listed as career history. Assessly is independent and is not offered on behalf of any employer.
Most of that work has been for organizations with budgets a small business can't imagine. This practice exists because the methods don't actually require that budget. They require someone who knows which parts matter and which parts are enterprise theater.
Where I've worked
The short version is in the ladder above: cyber governance at the federal and state level, and currently a citywide risk program in local government. Names and specifics stay off this site on purpose — the part that matters is the method, and the method travels. What doesn't change from a government agency to a fifteen-person company is knowing which controls actually reduce risk and which are just there to be pointed at.
Somewhere in the middle of all that I finished a doctorate at George Washington University on explainable AI — specifically, why an intrusion detection system flags what it flags. It's the reason I'm careful about AI tools that produce confident answers nobody can verify, and it's why the ones I build cite their sources.
Why small businesses
Because the gap is enormous and mostly unserved. A large company has a security team, a compliance function, and a firm on retainer. A 40-person company has an owner who just got a 200-question security questionnaire from their biggest customer and no idea where to start.
The advice available to that owner is usually one of two bad options: a $150,000 enterprise engagement scaled down badly, or a $49 policy template that falls apart the moment anyone reads it. The actual answer is in between, and it's mostly a matter of knowing which twenty percent of the work does eighty percent of the good.
How I work
Plain language. If a policy needs a translator, it isn't finished. Your staff have to follow this, and they're not going to read forty pages.
Fixed price, fixed scope. You know the number before I start. I don't bill hourly and I don't sell retainers, because a retainer creates a quiet incentive for your problem to never quite get solved.
I'll tell you when you don't need me. Some problems are a two-week internal fix or a $60-a-month tool. Saying so costs me a project and earns the referral, and I'll take that trade every time.
I build what I recommend. If the answer is a small tool, I'd rather build it than write a memo describing the tool you should go find.
The disclosure
I hold a full-time position, and this practice runs alongside it — deliberately and openly. Two things follow from that.
First, I'm selective about scope. I take work I can finish properly, which is why every service on this site has a real week count instead of “it depends.”
Second, I decline anything that conflicts with my public-sector work — no exceptions, even when the project would be interesting. The upside for you is that I'm not desperate for your business, so you'll get an honest read on whether you actually need me.
Outside the work
I serve on a nonprofit board, which taught me that governance problems and technology problems are usually the same problem wearing different clothes. I run a 3D printer that produces more custom pieces than any reasonable person needs. And I still write code most weeks, which is why the tools on this site work rather than merely existing.
Still reading? Let's talk.
Thirty minutes, free, and I'll tell you honestly whether I'm the right person for what you're dealing with.
Get in touch