Dr. Mahmoud Alminawi

For most of my career I've done cybersecurity governance for organizations with budgets a small business can't imagine — the work of deciding what gets protected, who signs off on it, and how you prove it happened. Assessly exists because those methods don't require that budget. They require someone who knows which twenty percent of the work does eighty percent of the good.

The background

My experience spans federal- and state-level cybersecurity governance: risk programs, policy, vendor review, and the control-coverage work that tells leadership whether they're actually protected. Specifics stay off this site by design. What matters is that the method travels — from a large agency down to a fifteen-person company, the question is the same: which controls genuinely reduce risk, and which are just there to be pointed at.

I also hold a doctorate focused on explainable AI — why a security system flags what it flags. It's the reason I'm wary of AI that gives confident answers no one can verify, and why the tools I build cite their sources.

Why small businesses

A large company has a security team, a compliance function, and a firm on retainer. A growing company has an owner who just got a 200-question security questionnaire from their biggest customer and nowhere to start. The usual options are a six-figure enterprise engagement scaled down badly, or a $49 template that falls apart the moment anyone reads it. The real answer sits in between — and that's who Assessly is for.

How I work

Plain language. If a policy needs a translator, it isn't finished. Your team has to be able to follow it.

Fixed price, fixed scope. You know the number before I start. No hourly billing, no open-ended retainer.

Straight answers. If the fix is a two-week internal change or a $60-a-month tool, I'll say so. And I decline any work that would conflict with my obligations, which keeps the advice you get independent.

I build what I recommend. If the answer is a small tool, I'd rather build it than write a memo about the one you should go find.