Carl Heaton

Carl has spent over 22 years working across security, web infrastructure, data, and AI. He has served as CTO, CISO, and DPO for a web hosting company working in regulated sectors including fintech, edtech, healthcare, and SaaS. He built Steelwise because he kept seeing the same problem: businesses getting complexity instead of clarity.

That breadth is unusual. Most advisors specialise in one lane. Carl deals with all of it, because that is what running a real technology business actually requires. The security industry defaults to jargon and fear, MSPs want to sell a contract, and consultancies send juniors. Steelwise exists to be the alternative to all three.

Experience

Twenty two years in technology, spanning hands-on delivery and board-level responsibility:

• Chief Technology Officer, setting technical direction and platform strategy for a web hosting company.
• Chief Information Security Officer, accountable for security posture in regulated environments.
• Data Protection Officer, responsible for data protection compliance and practice.
• Founder of Steelwise, a vendor-neutral technology advisory practice in Sheffield.

Sectors worked in include fintech, edtech, healthcare, and SaaS, all of which carry regulatory obligations that shape how technology decisions get made.

Areas of expertise

• Information security, including Cyber Essentials and ISO 27001 readiness
• Security posture assessment and incident preparedness
• Web and hosting infrastructure, architecture, and reliability
• AI strategy, readiness, risk, and governance
• Data protection and technology governance

How he works

Steelwise runs on a partnership model: a small, trusted team backed by a network of specialists. Clients get senior people who have done the work. No juniors, no handoffs, no learning on the client's time.

Steelwise is not tied to any product or vendor, takes no commissions, and everything it delivers belongs to the client. If you want a second opinion on what your IT provider is telling you, that is exactly the kind of conversation Carl is there for.

Elsewhere

• Carl Heaton on LinkedIn
• Steelwise on LinkedIn
• Steelwise on Bluesky
• Technical Director Ltd at Companies House (company number 08512222)

Recent filings

• 123 Reg lost customer data. Expect convincing emails about your domain. 29 October 2026 · Security

  UK registrar 123 Reg has told customers an intruder read their names, phone numbers, VAT numbers, and which products they hold. None of that unlocks an account on its own. It does make a fake renewal or verification email look real. What to do if your domains are with 123 Reg, and what every business should check with its registrar.

• Your AI coding agent can read everything you can 29 October 2026 · AI Security

  An AI coding agent runs as you. It can open the files you can open, reach the servers you can reach, and use the keys on your machine. Three reports in one week, on GitHub Copilot CLI, OpenAI's Codex Cloud, and an npm worm, show what that means in practice. None needs the agent to be broken. Here is how to give it less.

• Who is allowed to send email as you? 28 October 2026 · Security Infrastructure

  Anyone can put your business name in the From line of an email unless you have published three records saying who is allowed to. SPF, DKIM, and DMARC in plain English, why your invoices land in spam without them, and how to check yours for free.

• CISA has stopped sending the weekly vulnerability list. Read this one instead. 27 October 2026 · Security

  The US security agency has ended its weekly round-up of every new vulnerability. Nobody could have read it anyway: 15,074 were published in September alone. The list that matters is far shorter, and half of it would never show up in a search for critical flaws.

• The ICO is asking how businesses control AI agents. Can you answer? 26 October 2026 · AI

  If your business uses AI that acts on its own, booking, emailing, or looking things up for staff, you are responsible for what it does with personal data. The UK data protection regulator has opened a call for evidence on exactly that, closing 20 November. Its six themes are a ready-made checklist, whether or not you respond.

All filings

Get in touch

The first conversation is always free. Email [email protected], call 0114 376 7987, or see the contact page for more ways to reach us.