Trusted by leaders. Proven in practice. Hired for clarity.
I’m an author, consultant, and long-time practitioner in cyber risk quantification. I write about modern cyber risk, measurement, and decision-making — and I share that thinking with organizations and the broader community through advisory work, workshops, and keynote talks.
My Approach
My work focuses on modern cyber risk, quantitative analysis, and better decision-making. I write extensively about these topics in essays, in my newsletter, and in my book From Heatmaps to Histograms. If you want to understand how I approach cyber risk, measurement, and uncertainty, or how I teach and advise through keynotes and consulting, start here.
Essays on cyber risk, risk quantification, and better decision-making. Practical insights for practitioners and leaders.
From Heatmaps to Histograms is a practical guide to modern cyber risk quantification and better decisions.
Keynotes, workshops, and advisory work rooted in clear thinking and real-world experience.
Speaking & Advisory
I work with organizations and events that want clear, practical guidance on modern cyber risk and decision-making.
Speaking
Keynotes and talks for conferences, leadership teams, and security organizations. I focus on modern cyber risk, uncertainty, and clearer decision-making. My talks introduce practical ideas and frameworks that help teams think differently.
Advisory
Expert guidance on cyber risk quantification, program design, and decision-making frameworks. I work with leaders who want clarity, defensible analysis, and a practical approach grounded in real experience.
Latest Essays
Stay in the Loop
I often write about cyber risk, measurement, and how we make decisions. If you want updates on new essays, book news, and early ideas I am working through, you can join here.
When stakeholders say your quantitative risk numbers don't "feel right," there are three main reasons: you missed something they know, cognitive bias is affecting their judgment, or you failed to communicate the numbers clearly. The key is to listen first and diagnose which reason applies, because their discomfort often contains the most valuable feedback for improving your risk analysis.