Speaking

What I talk about

Nearly everything I talk about comes back to one idea: cyber risk is measurable, and the belief that it isn’t is something our industry inherited and never tested. These are the topics I’m asked about most.

• From Heatmaps to Histograms, my signature keynote on why risk matrices fail and what to use instead
• Finding, vetting, and blending the data a risk analysis needs, even when you think you have none
• Running a first quantitative risk analysis with a spreadsheet and no statistics degree
• Talking about cyber risk with boards and executives in dollars
• Deciding how much security is enough, and what the budget is buying
• Measuring AI risk in dollars and probabilities
• Using generative AI in risk analysis, and where it still needs a human check
• Calibration, and how to get good estimates out of experts
• How bad statistics spread through the security industry, and how to grade a report
• Security metrics and KRIs that inform decisions
• The economics of ransomware
• Building a risk quantification program that lasts past its first year
• The six levers that change cyber risk, of which controls are only one

Any of these can run as a keynote, a workshop, a fireside chat or a debate. Tell me what your audience is wrestling with and I’ll tell you what I’d bring. If your team wants to practice the methods together, I also run private workshops, and the book site describes the formats.