Matt Finan

I work at the intersection of AI security and technical delivery; outside work I run Eudaemon, a public research programme testing whether longitudinal personal data can support decisions.

At Capgemini Invent I was the security architect on 2 production GenAI services for a large UK central government department: a retrieval-augmented chatbot on Azure OpenAI and a document-generation service on AWS Bedrock, used by hundreds of staff. I threat-modelled architecture iterations, evaluated prompt-injection guardrails and PII controls, scoped 2 independent penetration tests and led remediation through production approval.

On the second service I owned the security statement of work, including scope, staffing, pricing and sign-off. With security evidence incorporated into sprint decisions, remediation and sign-off took about 3 weeks, compared with about 3 months on the first service. I now lead a 3-person data protection assurance team, a cross-department working group and the practice’s Trusted AI squad; I have also supported 14 bids, 6 involving AI.

For Eudaemon, I specified and directed the build of a data platform that has operated largely unattended since May 2026, collecting about 242 GB from roughly 70 sources. The premise is divided into 62 ranked tests with decision and failure criteria published before results. The first 2 tests are underway, and I publish the methods, criticism and resulting design decisions at eudaemon.uk.

Over the next 6 months I’m completing 3 research cycles, conducting structured user and expert interviews and externally testing one narrow capability. I’d particularly like to meet people working in applied AI security, technical deployment, N-of-1 methods, causal inference and personal AI.