Risk

Managing a quarterly security review

I like an approach that combines my favorite quarterly review practices I’ve been exposed to…

Talking about risk with thresholds 🔥

Imagine you encounter a fire in the woods. You’d instinctively decide to do one of two things:

A key performance indicator for infosec organizations

Using probabilistic risk KPIs to direct complex…

Measuring “In the Wild” Exploitation

Exploring our security expectations across browsers.

Forecasting NPM Advisories

This forecasting essay describes the likelihood of a malicious NPM package…

Forecasting a headline risk: NetSpectre

Understanding short term likelihood of an in-the-wild attack.

On Attribution: Avoiding “We Got ‘Em”

Consensus and quantitative rigor for complex intelligence…

The “five factors” used to secure systems.

Common patterns that security teams use to mitigate risk.

Communicating risk across complex teams

Using threat modeling techniques for organizational risk…