About
A vanity site, with receipts attached.
The Sorklin Group sounds like at least four people and a meeting room. It has been one person most of its life: first a motion-graphics edit suite, later an address for the things that never fit inside a job title. The actual job is at Axio. Brendan Fitzpatrick, CISSP, CRISC — Vice President of Product Management, Quantification Modeling at Axio, product owner of the Axio quantification capability and head of its quantitative risk modelling team. This site is personal and independent of my employer.
The short version
Three trades that keep running into each other.
The assessment work keeps turning up numbers that need modelling. The modelling keeps turning up work that should be automated. The automation keeps needing a security review before it's allowed near production. Doing all three means the lessons stop arriving second-hand.
Cyber risk quantification is the discipline I keep coming back to, because it's the one where being wrong is expensive and visible. If you can't say what a risk costs, you can't prioritise it — you can only out-shout whoever is loudest in the meeting (and i'm pretty good at shouting).
Security work keeps the numbers honest. Models built by someone who has never had to implement a control produce beautiful curves and useless roadmaps, so the assessments stay in the portfolio.
Applied AI is where the last three years went. Agents, retrieval, evaluation, and now self-hosted inference — mostly because the packaged versions of these tools wanted to hold my data, and I'd rather own the failure mode.
Career, abridged
- 2018 → now · Axio. Director of Cyber Risk Engineering, then VP of Cyber Risk Quantification, now VP of Product Management & Quantification Modeling. I do product management for the quantification capability and head the quantitative risk modelling team that builds the models underneath it — which is to say: I helped turn the practice into a product, alongside a team that did considerably more of the turning than one person could.
- 2015 → 2018 · TSC/Secure Halo. Ran the assessment program behind the Critical Asset Protection vehicle at Lloyd's of London — on the order of half a billion in risk a year priced on the strength of those assessments.
- 2005 → 2015 · Linklaters, and freelancing. Nine years in a global law firm's technology group, with a development habit on the side that has stubbornly never gone away.
- Before any of it. A stint on a cable soap opera in the nineties — an actor's line on the résumé, and the best available training for how to handle a meeting or webinar. Then post-production: editing and motion graphics, for a few years. That was the first business ever filed under the name Sorklin Group.
- 2025 → now · Enterprise Risk Quantification Institute. Founding member. Advancing the discipline, not only shipping the output of it.
- On paper. CISSP, CRISC, and a handful of others. Twenty-seven years, give or take a few weekends.
Contact
LinkedIn is the mailbox. Enquiries are welcome via LinkedIn.
It carries my name, it delivers messages, and no scraper is circling it. There is no contact form, no newsletter and no funnel behind this domain — a personal site has no business needing one.
[ no form · no tracking · no funnel · one link that goes somewhere real ]
No trackers
No analytics, no cookies, no third-party scripts except the font files. Nobody is learning anything about you here.
Corporate mode
The footer switch hides every joke and swaps in board-safe copy, without changing a single fact on the page. Useful at 4pm before a steering committee.
Hand-built
Plain HTML and CSS, deployed by pushing to a git remote. If something's broken, it's broken in a file you can read.