About The Decision Layer™

Difficult decisions should become clearer as the stakes rise.

The Decision Layer™ helps boards and executive leaders turn competing interpretations into decisions that are clear enough to make, owned enough to move, evidenced enough to defend, and explicit enough to revisit when something changes.

Risk sees exposure.
Technology sees architecture.
Security sees threat.
Finance sees cost.
Legal sees liability.
Internal Audit sees evidence.
Why The Decision Layer exists

The problem is rarely a lack of information.

Most organisations already have policies, dashboards, committees, risk assessments, audit reports and subject-matter experts.

Yet important AI, cyber and technology decisions still become difficult to move.

Not because nobody understands the issue.

Because different functions understand different parts of it.

Boards are rarely short of information. They are short of a reliable way to turn information into an owned decision.

The Decision Layer exists to close that gap.

It turns fragmented intelligence into a position leadership can understand, challenge and act on.

The aim is not more governance. It is less ambiguity at the point where somebody must decide.

What changes for the people using it
Audit Chair / NED

Know what to challenge without becoming the technical expert.

See the assumptions, evidence, unresolved questions and consequences that matter before the meeting.

Chief Audit Executive

Turn findings into decisions management cannot leave unresolved.

Connect control weaknesses to consequence, ownership, action and evidence of closure.

Chief Risk Officer

Turn fragmented risk views into one enterprise position.

Know what risk is being taken, who can take it, what supports the conclusion and what would change the position.

CISO

Get the business to own the cyber decision.

Move from technical exposure to a response executives can understand, fund and own.

CIO

Turn governance uncertainty into permission to move.

Know what can proceed, what condition must be met, what evidence should exist and who can authorise the remaining exposure.

AI Governance

Prove that governance worked on the real decision.

Show who classified, challenged, approved, monitored and reconsidered a material AI use case.

One operating logic

From signal to action.

Signal What changed?
Consequence Why does it matter?
Decision What choice now has to be made?
Evidence What should exist?
Challenge What assumption should be tested?
Horizon When does this become urgent?
Action What is the smallest defensible next step?
From information to decision infrastructure

Four connected forms of support.

Intelligence

Know what changed and why it matters.

Board AI Risk Intelligence™, Decision Signals™, Board Case Study™ and Regulatory Radar™ translate emerging developments into decision implications.

Instruments

Test what the position actually means.

Practical tools help leaders challenge assumptions, examine evidence, clarify ownership and test governance.

Assurance

Know whether the decision will survive scrutiny.

Decision assurance examines the claims, evidence, dependencies, controls and unresolved judgement behind material decisions.

Advisory

Move what the evidence exposes.

Advisory helps leadership clarify governance, strengthen assurance, resolve decision rights and turn exposure into action.

The question behind the work

Can you defend the decision, not just describe the process around it?

A policy is not evidence that governance works.

A dashboard is not evidence that risk is understood.

A committee discussing something is not the same as somebody owning the decision.

A recommendation is not evidence that anything will change.

And a control that cannot be evidenced becomes surprisingly fragile the moment somebody asks:

How do you know?

The Decision Layer is designed around that moment.

How the intelligence is built

Make uncertainty visible rather than hiding it behind confidence.

Reported fact

What credible sources establish.

Primary and authoritative information is distinguished from interpretation.

Third-party research

What external evidence adds.

Research from institutions, regulators and credible expert sources is identified separately.

Editorial interpretation

What The Decision Layer thinks it means.

Editorial judgement translates developments into leadership and decision implications.

Firm-specific assessment

What the evidence says about one organisation.

Organisation-specific conclusions are only presented where evidence from that organisation has actually been assessed.

Composite and illustrative cases are identified as such. Decision scores and editorial positions are not represented as assessments of a specific organisation unless they are derived from that organisation's evidence.

About Maman Ibrahim

His work sits where technology risk becomes a leadership decision.

Maman Ibrahim is a board-facing advisor working across cybersecurity, AI governance, assurance, technology risk and operational resilience.

Over more than two decades, his work has spanned global industrial, pharmaceutical, consumer-health, financial-services and technology environments, including senior roles at Michelin, GSK and Haleon.

Across those environments, the same pattern kept appearing.

Organisations were rarely short of intelligent people, frameworks or information.

What was often missing was a reliable mechanism for turning different interpretations into one decision with clear ownership and sufficient evidence behind it.

That observation became The Decision Layer.

Experience across the operating model

Governance usually breaks at the interfaces.

AI governance and assurance
Cybersecurity strategy and governance
Internal audit and independent assurance
Technology and enterprise risk
Data ethics and privacy
Third-party and supply-chain risk
Operational resilience
Executive and board governance

Maman has worked across all three lines of an organisation and with boards, audit committees, executives and operational teams.

That range matters because governance often fails between policy and delivery, technology and risk, supplier contract and operational dependency, or the person presenting a recommendation and the person expected to own its consequences.

Contributing to emerging practice

Helping shape the profession as well as practise it.

Maman contributes practitioner experience to organisations and initiatives shaping cyber and responsible AI practice.

Ethos Institute
Global Council for Responsible AI
OWASP Top 10 Agentic AI Security Risks
World Economic Forum Cyber Resilience Compass
Cloud Security Alliance
ISACA
(ISC)²
CIISec
UK Cyber Security Council
PMI

Principles become valuable when somebody can turn them into a decision, a control, a piece of evidence or an action.

His professional contribution has also included supporting CISSP and CCSP examination development, professional capability building, cyber-resilience initiatives and emerging responsible-AI practice.

Ideas tested in public

The thinking behind The Decision Layer has also been developed in public.

Maman's writing, commentary and interviews have appeared across Forbes, ISACA, CIO, CSO Online, Senior Executive, InformationWeek and other business and technology publications, alongside podcast and broadcast appearances.

The subjects vary, but the underlying question is remarkably consistent:

How do leaders turn technology risk into a decision the organisation can actually make?

AI governance and assurance

Cyber risk and resilience

Board-level risk reporting

Third-party and supply-chain exposure

Audit and assurance

Leadership and executive accountability

Recent work has examined why stronger reporting does not automatically create board confidence, why regulatory complexity often exposes decision-infrastructure weaknesses, why AI assurance must test the evidence behind management claims, and why emerging technology risks become dangerous when ownership remains implicit.

The value of writing publicly is not simply visibility. It forces an argument to survive outside the room in which it was created.

Make the claim clear. Show the evidence. Expose the assumption. Then ask what decision follows.

Books and longer-form thinking

Some questions deserve more room than an article can give them.

The same questions behind The Decision Layer extend into longer-form work.

Published

The AI Advantage: Thriving Within Civilization's Next Big Disruption

Maman is a contributing author to this collaborative book bringing together AI experts from fields including business, healthcare, education, cybersecurity and the creative arts.

Its purpose is practical: helping readers understand and navigate a world increasingly shaped by intelligent systems.

Essay

Making Decisions Defensible

An exploration of what makes consequential decisions withstand scrutiny, particularly when evidence is incomplete, stakeholders disagree, and leaders must still act.

Coming Soon

AI Risk: Proven Detection and Governance Strategies

A practical examination of how organisations can identify emerging AI risk, distinguish meaningful exposure from noise, build governance that works in practice, and create evidence strong enough to support executive and board decisions.

The book extends many of the ideas behind The Decision Layer into a deeper operating question:

How do you detect AI risk early enough to act, govern it proportionately, and prove that the decisions made around it were reasonable?

Technology changes quickly.

The harder question lasts longer:

What did we know, what did we decide, what evidence supported that judgement, and would the decision still make sense when challenged later?

That is the territory where risk becomes governance, governance becomes judgement, and judgement has to leave a record.

Building leaders as well as governance

Repeatable performance rather than repeated rescue.

Maman is also the founder of DiamondSoul, where he works with senior cyber, risk, audit and technology leaders operating under board and regulatory scrutiny.

The work focuses on what happens when frameworks stop providing easy answers.

Communicate

Explain risk without hiding behind technical language.

Challenge

Create useful tension without unnecessary friction.

Decide

Move before every unknown has disappeared.

Fund

Connect risk to business outcomes, investment and resilience.

The objective is to leave behind stronger decision capability rather than repeated dependence on the adviser.

Advisory and consulting

Did the organisation become clearer on what to decide, why, who owns the consequence and what happens next?

Maman is Principal Partner at EugeneZonda and founder of Ginkgo Resilience Ltd.

Through these roles, he advises organisations on cybersecurity, AI risk, governance, assurance and resilience.

The work moves away from compliance-heavy activity for its own sake and toward decisions, controls and investments that improve business outcomes.

One issue. Many interpretations. One decision.

The Decision Layer brings the work together.

Intelligence tells you what changed. Instruments help you test what it means. Assurance determines whether the position can be defended. Advisory moves what the evidence exposes.

The aim is not certainty. It is a decision you can explain, evidence, challenge and defend.
Navigate complexity. Decide with confidence.