The Calculus of Cyber Risk

From Risk to Resilience: A Modern Approach to Cybersecurity Leadership

Build Your Strategy on Solid Foundations

Elevate Your Leadership: Make smarter security decisions, influence business strategy, and drive meaningful change.

Partnering with the Business

Move beyond gatekeeping. Align security with business goals to drive growth, resilience, and trust.

Reducing Friction and Accelerating Innovation

Security should empower, not hinder. Learn how to build resilience while driving speed and innovation.

Managing Uncertainty and Complexity

Thrive in uncertainty. Master cyber risk navigation, strategic decision-making, and build resilience in a complex threat landscape.

Advanced Practices

Go beyond the fundamentals. Explore cutting-edge strategies to lead security at the highest level.

Latest Insights

View all posts »

The Probability Behind the Finding: Calibrated Exploit Estimates Beyond CVEs

CVSS severity is not exploit probability. EPSS proved that prioritizing by real-world abuse probability delivers 12x better prioritization precision than chasing CVSS 9.8 scores. But EPSS has a fatal structural limit: it only works on CVEs. Secrets in code, over-permissioned service accounts, and dependencies without published advisories sit in the dark with zero math behind them. Here is the principled 3-layer framework to calculate calibrated exploit probabilities for every non-CVE weakness on your risk register.

Security Investment as Board Strategy: Pricing Protection on Both Sides of the Boom.

Beyond the Boom gave every security control two scores: TMP for preventing loss events, LMAP for limiting the damage when they happen. This sequel prices them, scenario by scenario: two closed-form Bayesian updates - one for how often loss events happen, one for what they cost - feeding a per-control return calculation, credited across every scenario a control covers, that a board risk committee can follow line by line. The board conversation shifts from whether security spend is justified to which priced option gets funded first - with the board owning the loss threshold, the price of tail risk, and the review cadence. An interactive calculator runs the method on your own numbers.

Beyond the Boom: How Controls Attenuate Loss Magnitude

Can your security program tell the difference between a control that stops the bullet and one that stops the bleeding? Most can't: and that blind spot is costing you more than you think.

Cyber Risk in Financial Terms: Empowering Your CFO with Strategic Cyber Risk Insight.

CISOs today must communicate cyber risk in terms CFOs and boards understand: cash flow, revenue disruption, and enterprise value. This article outlines a two-phase model for communicating cyber loss: Immediate Treasury Impact and Future Value Exposure, which aligns with how CFOs think about liquidity, treasury, cash reserves and growth risk. The approach allows CISOS to translate technical incidents into a financial narrative that supports strategic planning and investment.