Chuck Herrin

The short version

I have been the person who has to answer for it.

I built and ran security programs at AIG, Athene, and Texas Capital Bank. Insurance, annuities, banking: three regulated industries where the examiner shows up on a schedule and "we are working on it" is not an answer. That is where I learned what evidence has to look like before anyone will accept it.

Then I crossed over to the product side. As CTO at Wib and Field CISO at F5, I spent several years inside the API layer, which turned out to be the right place to be standing when agentic AI arrived. Agents do not have a new attack surface so much as they have unrestricted access to your old one.

Nobody has time to make every expensive mistake themselves; clients hire the scars instead. That is most of what this firm sells: judgment about which risks are real, which are theater, and what order to fix things in when the list is longer than the budget.

How I work

A small number of clients at a time, because quality of attention is the product. No vendor quota, no referral fees, no hidden agenda. If Herrin Advisory is not the right answer for what you are facing, I will tell you, and I can usually tell you who is.

Engagements are scoped and priced before they start. You will know the fee, the deliverables, and the calendar before you sign, and you will hear from me directly rather than from a delivery team you have not met.

Speaking

Sixty-five-plus keynotes and panels on API security, agentic AI, post-quantum cryptography, and geopolitical cyber risk. Conferences, board offsites, and executive briefings. Available for a limited number of dates each year.

Check availability →