Vsevolod (Sam) Shabad

Board-level governance and risk specialist working across regulated and public-interest systems, with particular focus on digital, cyber and AI oversight. Research focuses on why formal assurance processes systematically underperform at scale — and what boards can do differently.

Experience includes senior responsibility for large technology and security functions in regulated environments where formal assurance processes can create a misleading sense of control.

Areas of Work

Governance and risk oversight

Focus on how boards maintain visibility of emerging risk in complex organisations. Examines how reporting structures, layered controls and compliance frameworks can unintentionally delay action or mask accumulating systemic exposure.

Cyber and AI resilience

Oversight of cyber security, AI deployment and digital transformation risk in regulated environments. Addresses control limits, operational resilience, and the governance challenges that arise when technology change outpaces institutional decision cycles.

Regulated and public-interest systems

Experience in environments subject to intensive supervision and public scrutiny. Focus on how scale, regulatory pressure and organisational design shape decision timing, accountability and risk appetite at board level. Sectors include NHS and health system governance, policing and public safety, regulated financial services, and central and local government.

Research focus

A structural research programme examining why governance architectures designed to manage risk systematically reproduce the conditions for failure — even in organisations that are formally compliant, well-resourced, and operating in good faith. The programme traces a causal sequence: compliance metrics that measure the wrong thing, reporting hierarchies that suppress signal, designer assumptions that mistake transparency for accountability, and coordination costs that overwhelm capacity at scale.

Empirical work draws on cross-sectional analysis of 171 NHS trusts and Freedom of Information data across health, policing, fire and local government. A consistent finding is that resource scale does not predict security compliance — the highest-resourced trusts underperform the lowest-resourced on mandatory security assessments (p=0.88). This points to coordination costs that grow faster than defensive capability as organisations scale. A parallel strand applies the same structural logic to infrastructure investment governance under deep uncertainty.

Published in the Financial Times, HSJ, BMJ Leader Blog, Civil Service World, Public Technology, and Policing Insight. Working papers via SSRN.

Full research programme →

Board Questions

Boards often invite external challenge when governance systems appear formally sound but underlying risk exposure continues to grow. Situations where this work is particularly relevant include:

when compliance frameworks produce reassuring metrics but operational teams report persistent instability or recurring incidents;
when large or federated organisations struggle to prioritise cyber, digital or AI risk within competing regulatory obligations;
when AI or automation systems introduce accountability questions that traditional assurance structures cannot easily address;
when boards need independent assessment of whether reporting structures accurately reflect operational risk — or are filtering it out.

Forms of Engagement

Non-Executive Director roles
Board-level advisory and governance challenge
Visiting lectures and executive education
Policy and think-tank engagement

Engagement focuses on understanding governance and risk challenges within their specific organisational context, rather than providing generic or transferable recommendations.

Publications

Writing covers governance failure in digital and cyber risk, cognitive bias in board-level assurance, AI accountability, and infrastructure investment. Venues include peer-reviewed journals, NHS and public-sector practitioner media, and policy platforms.

Full writing record is available via the external profiles below.

Financial Times

https://www.ft.com/content/edb2bf1d-14ab-49bd-913a-036710cb7398

LSE Business Review

https://blogs.lse.ac.uk/businessreview/2026/03/30/when-firms-announce-redundancies-who-pays-for-the-loss-of-meaning/

Health Service Journal

https://www.hsj.co.uk/vsevolod-shabad/3009249.bio

The BMJ (Rapid Response)

https://www.google.com/search?q=site%3Awww.bmj.com+%22Vsevolod+Shabad

BMJ Leader Blog

https://blogs.bmj.com/bmjleader/?s=Vsevolod+Shabad

Civil Service World