I spent years putting probabilistic numbers on cyber risk and assessing the systems those numbers describe. Then I helped build the product that lets other practitioners do it without me in the room — with more help from machines than I would put in a board deck. One person, no hand-offs, no account manager — this site, at least. Twenty-seven years in security and technology, most of the last eleven quantifying cyber risk and assessing the systems behind it across insurance, legal and regulated environments — now productised: I do product management for the quantification capability at Axio and head the modelling team behind it.
Three practices, one human
Assessment tells you what's exposed. Quantification tells you what that's worth. The engineering makes both of them less manual every quarter. Doing all three from the same desk means the tooling fits the work instead of the other way round.
Convert “we're nervous about ransomware” into “expect $X this year, here's the exceedance curve, and here are the three controls that move it most.” Scenario models, calibrated ranges, Monte Carlo, an answer your CFO can defend.
Done in Axio360. Allergic to 5×5 matrices; the allergy is documented.
Go to Risk Quant →Assessments, gap analysis and roadmaps that survive contact with reality — aligned to the frameworks you actually have to answer to, written for the people who have to implement them, not for the person who signs the report.
Speaks NIST CSF 2.0 · C2M2 · CIS 18 · ISO/IEC 27001 fluently.
Go to Security →Agents, retrieval, evals and the unglamorous plumbing that decides whether a demo survives Monday. Self-hosted first: if a capability can be switched off by someone else's pricing page, it isn't a capability.
Runs on my own hardware. The projects menu is the receipts.
Go to Projects →Yes, “0 middlemen” is the pitch. It's also the risk. Both are on the invoice.
How the number gets built
What actually hurts if it goes sideways, and how much it costs when it does.
“Ransomware of the backup appliance”, not “advanced persistent threat”.
min / expected / max from the people who know the system — plus the sceptic in the room.
Tens of thousands of trials. A distribution, not a single optimistic cell.
Annualised loss, exceedance curve, and the three things worth funding first.
AI projects & other dangerous ideas
Everything below is hosted here and runs on hardware I can unplug. Some of it is serious. One of it is an arcade cabinet from 1986.
One HTML file that runs an entire campaign economy: catalog values, party spend, multiplicative scalers, and a sale price that reflects who's actually holding the coin purse.
Offline-first · IndexedDB · LLM-assisted item descriptions
Open the ledger →Namco System 86, 1986, running in your browser: MAME 0.277 compiled to WebAssembly, exact ROM match, real save states, DIP switches and all.
Built here · 56 MB of WASM · no plugins, no ads, no 1996
Insert coin →A clean chat front-end for the models running on Sork-o-Tron 6000 — the machine that makes most of this site's confidence possible. Currently a very well-dressed stub.
Self-hosted models · family access soon · wired to nothing yet, honestly
Peek at the stub →Elsewhere
The day job is at Axio, where I own the quantification product. This domain is the rest of it: the method, the opinions, and the things I build outside working hours.