If you can't express it in dollars, you're still guessing.

“High risk, red box” is not a decision — it's a colour someone picked on a Tuesday. I spent years building probabilistic models of what could actually go wrong, running them tens of thousands of times and handing over the distribution. Then I helped build the product that does it faster, so the argument can be about numbers instead of adjectives — in rooms I'm not always standing in. A decade of probabilistic cyber risk models — named scenarios, calibrated estimates and Monte Carlo simulation — reported in financial terms that support funding, insurance and board decisions. That practice is now built into a platform other practitioners run themselves.

How the number gets built → How it became a product

Loss exceedance curve · illustrative

The honest version of a risk register: a curve, not a color. Yes, people do prefer it once they've seen it. And you can color it, if you insist.

What changes

Same risks. Different sentences.

The findings don't change much. What changes is whether anyone can act on them.

What the report usually says	What a quantified model says
“Ransomware: High risk”	“Ransomware: $1.8M expected annual loss, $6.4M at the 95th percentile.”
“Improve third-party assurance”	“The backup vendor drives 38% of modeled loss; tightening that contract is the cheapest curve movement available.”
“We need more security budget”	“These three controls cost $210k and remove $1.1M of expected annual loss. Here is the curve both ways.”
“Our premium went up 30%”	“The premium is 2.1× the modeled retained loss above your deductible. Here's what to negotiate with.”
“We're compliant”	“Compliant, and still exposed at 1-in-8 for the scenario that actually keeps you awake. Both facts are in the table.”

The work itself

Not a workshop about feelings.

Scenario construction. Named, bounded, plausible loss events — ransomware, BEC, cloud misconfiguration, third-party outage, data spill — each with a cost anatomy.
Calibration. Getting ranges out of the people who actually run the systems, with enough scepticism built in that the numbers survive the next audit.
Simulation. Monte Carlo over those ranges: expected annual loss, percentile points, and the tail where the real arguments live.
Control ROI. Which mitigations move which part of the curve, and what they cost to get there.
Insurance alignment. Modeled loss versus your limits, retention and premium — so the renewal conversation has arithmetic in it.
Board readout. One page, one curve, three decisions. Long version stays in the appendix where it belongs.

Deliverables

Quantified scenario register, owned and re-runnable
Portfolio and per-scenario exceedance curves
Ranked control set with cost / curve-movement pairs
Executive page + defensible model backing
A refresh cadence, because a 2024 number is a 2024 weather report

[i]

Every model is wrong. The job is to make yours wrong in a way that's useful — and, ideally, cheaper than the incident it's predicting.

Where the work happens

Axio360 — where the practice became a product.

I do product management at Axio and head the quantitative risk modelling team: VP of Product Management, Quantification Modeling, and product owner of the quantification capability inside Axio360. Which means I decide what the platform does with an assessment, a scenario, a model and the insurance conversation that follows — a decision engine rather than four spreadsheets with four different owners. There was a stretch when this was me, a spreadsheet and a week. It is now a team's work — product management, modelling, engineering — that lets any practitioner skip both.

The job, honestly described

Owning the quantification capability — the roadmap, the models, and the definition of good — settled before any of it ships.
Assessments against the models that matter — NIST CSF 2.0, C2M2, CIS 18 — so the control baseline is evidence, not opinion.
Scenario collections built from the catalog and shaped to the actual environment, with susceptibility set by people who know the estate.
Estimated values under the hood — server counts, forensic rates, dwell and recovery time — because a curve is only as good as the numbers feeding it.
Catalogs and bespoke models — industry-specific and AI-curated content, plus the modelling team I head, which builds the ones no catalog covers.
Impact distributions & exceedance curves, per scenario and across the whole collection.
Quadrant breakdowns: first-party versus third-party, financial versus physical. Most organisations discover their biggest exposure is in the quadrant they weren't funding.
Assessment ↔ scenario linkage, so a control gap traces to a number and a number traces back to a gap.

Read the source

Cyber Risk Quantification at Axio — what CRQ is meant to produce.
The Axio360 platform — assessment, quantification, risk transfer, board reporting.
Axio AIR — quantifying AI risk specifically, which is where my two halves meet.
Axio insights — the long-form version of most of this page.

[i]

Disclosure, deliberately kept outside the joke toggle: I am an Axio employee and I own the product this section praises. The quantification is real; the bias is disclosed. Everything else on this domain — the opinions, the side projects, the broken CSS — is mine alone.

The method survives leaving the platform; the convenience does not. Put it in a spreadsheet if the room insists — the spreadsheet will simply lie more slowly.

Ground rules

What this is not.

A 5×5 heat map with a red box in the corner. I will not be drawing one.
A fear-and-uncertainty sales deck for a product I don't sell.
A compliance exercise. Compliance is a floor, occasionally a ceiling; it is rarely a risk profile.
A false-precision parade. You'll get ranges and percentiles, not “$4,382,911.62”.

How it goes

The method, step by step.

Kick-off & asset scoping

One call, one list: what would genuinely hurt, and what it costs per day.

Calibration sessions

Structured estimation with the people who own the systems. Short, explicit, occasionally argumentative.

Model & simulate

Scenarios built and run in Axio360; sensitivities checked before anyone sees a headline.

Readout

The curve, the movement options, and what I'd fund if it were my company — which, structurally, it is.

Start here

Bring one scenario. Leave with a number.

The fastest way to find out whether quantification is worth it is to quantify the thing you already argue about every quarter.

Say something on LinkedIn Or the assessments first