Essays
Essays on cyber risk, measurement, and decisions, going back to 2015. I publish new essays semi-regularly, and I welcome readers who are curious, skeptical, or just trying to make sense of risk in a practical way.
- All58
- Risk Quantification19
- Judgment & Decisions15
- Data & Research7
- Security & Tech7
- Metrics & Measurement6
- Security Economics4
2026
2025
- The Risk Riddle: Why False Precision Breaks Risk Management
- “That Feels Too High”: A Risk Analyst's Survival Guide
- Six Levers That Change Your Risk and How to Spot Them
- AGI Dreams: What Keeps a Risk Professional Up at Night
- The Economics of Ransomware: Why the Incentives Don’t Line Up
- Vendor Sales Tactics: The Good, The Bad, and the Bathroom
- What the Great Hanoi Rat Massacre of 1902 and Modern Risk Practices Have in Common
- Zines, Blogs, Bots: A Love Story
2022
2021
- How to write good risk scenarios and statements
- Optimizing Risk Response, Unfiltered
- ISACA’s Risk Response Whitepaper Released
- SIRAcon 2021 Talk | Baby Steps: Easing your company into a quantitative cyber risk program
- The Elephant in the Risk Governance Room
- When the Experts Disagree in Risk Analysis
- My 2020 Predictions, Graded
- Using Risk Assessment to Support Decision Making
- The Sweet Spot of Risk Governance
- Risk modeling the vulnerability du jour, part 2: Forward-looking risk registers
- Risk modeling the vulnerability du jour, part 1: Framing
- Black Swans and risk blindness
- The 2021 Security Outcomes report and better research methods
2020
- Risk Mythbusters: We need actuarial tables to quantify cyber risk
- Better Security Metrics with Biff Tannen
- Better Security Metrics with the Clairvoyant Test
- Probability & the words we use: why it matters
- Recipe for passing the OpenFAIR exam
- No, COVID-19 is not a Black Swan event*
- Book Review | The Failure of Risk Management: Why It's Broken and How to Fix It, 2nd Edition
- Exploit Prediction Scoring System (EPSS): Good news for risk analysts
- San Francisco's poop statistics: Are we measuring the wrong thing?
2019
- My 2020 Cyber Predictions -- with Skin in the Game!
- The Most Basic Thanksgiving Turkey Recipe -- with Metrics!
- Improve Your Estimations with the Equivalent Bet Test
- Aggregating Expert Opinion: Simple Averaging Method in Excel
- The Downstream Effects of Cyberextortion
- Aggregating Expert Opinion in Risk Analysis: An Overview of Methods
2018
- Should I buy mobile phone insurance? A Quantitative Risk Analysis
- Book Chapter: Cyber Risk Quantification of Financial Technology
- Bring Uncertainty Back
- What do paying cyber extortionists and dumping toxic sludge into the Chicago River have in common?
- How Many Lottery Tickets Should I Buy?
- An Evening with Doug Hubbard: The Failure of Risk Management: Why it's *Still* Broken and How to Fix It
- The Semi-Attached Figure: How to spot manipulative security advertising claims
- The Mad Men of Cyber Security Advertising
- GDPR, Ragnarok Online and Decision Analysis
- Black Swans in Risk: Myth, Reality and Bad Metaphors
- Will the Real “Year of the Data Breach” Please Stand Up?
2017
2015
Heatmaps to Histograms: Field Notes
It’s a free newsletter for risk and security professionals, and each issue brings a practical CRQ technique, a case study from the field, and a tool or prompt you can use the same day.
Your welcome email includes Chapter 5 of the book, Your First Quantitative Risk Assessment, where you build a Monte Carlo simulation in Excel and run a complete risk analysis, free.
Delivered by Substack. No spam, and you can leave with one click.