About

I’ve worked in security and risk for more than 25 years. I spent six years at Netflix, where I built the company’s cyber risk quantification program, and in 2025 I started 95 Risk Advisory to help other companies build their own. Recent clients include some of the biggest companies in AI and finance, and engagements run from peer benchmarks that take almost none of a client’s time to fully custom risk assessments.

My book, From Heatmaps to Histograms (Apress, 2026), is a practical guide for anyone who wants to start measuring cyber risk in dollars. Six of its chapters cover finding, vetting, and using data. Most analysts tell me that’s the part that trips them up. I also started CRQ Bootcamp, where Apolonio Garcia and I teach the book’s methods in live classes.

I chair the FAIR Institute’s San Francisco chapter, and I’m an Executive Fellow at the Cyentia Institute and a contributor to the 2026 Verizon Data Breach Investigations Report. The FAIR Institute gave me its FAIR Ambassador Award in 2020. I’ve given talks at RSA, DEF CON, FAIRcon, and several BSides and ISACA conferences, and I’ve been part of the SIRA community for years.

I live in the San Francisco Bay Area.

For consulting, start with 95 Risk Advisory, and for a talk, start with the Speaking page. Training runs through CRQ Bootcamp, and anything else can come through the contact page.