book

From Heatmaps to Histograms: A Practical Guide to Cyber Risk Quantification

Name: From Heatmaps to Histograms: A Practical Guide to Cyber Risk Quantification
Author: Tony Martin-Vegue
ISBN: 9798868823008

by Tony Martin-Vegue

March 2026

Intermediate

449 pages

9h 28m

English

Apress

Read now

Unlock full access

From Heatmaps to Histograms
Praise for From Heatmaps to Histograms
Prologue: Risky Business
Cold Open: My Origin StoryWhy I Wrote This BookWho This Book Is ForHandle with Simplicity: Why This Book Won’t Melt Your BrainSmall Steps, Huge Gains: Everyday Wins in Risk AnalysisOrganizational LevelTeam LevelPersonal Level
Acknowledgments
Table of Contents
About the Author
About the Technical Reviewer
PART I: Foundations
1. Welcome to the Rebellion
What the Great Hanoi Rat Massacre of 1902 and Modern Risk Practices Have in CommonModern Cyber Risk’s Rat ProblemThe Risk Ecosystem Is Built on Circular IncentivesWhere the Loop Starts to BreakBreaking the CycleRisk and Uncertainty: The Foundation of Our RebellionWe’ve Always Done It This WayEmbracing UncertaintyBreaking Free: What’s the Alternative?What This Book Is (and Isn’t)How to Use This BookChapter SummaryWhat’s Coming Next
2. Probability’s Plot Twist: After 300 Years, We Colored It Red
Qualitative vs. Quantitative: The Two Methods ExplainedUnderstanding Qualitative Risk AnalysisUnderstanding Quantitative Risk AnalysisHow Did We Get Here?From Ancient Ships to Modern Algorithms: Risk’s Scientific JourneyThe Great Divergence: We Have Two Separate Disciplines Operating Under the Same NameThe Legends Mixtape: Greatest Hits of Cyber Risk QuantificationChapter SummaryWhat’s Coming Next

3. GenAI Needs Adult Supervision
Jack Sparrow, Not Data from Star TrekThe Future of Risk Analysis and the Risk AnalystWhy AI Changes Your Work (but Won’t Replace You)Three Simple Rules for AI in Risk WorkRule 1: Use AI to Accelerate, Not Replace, Your ThinkingRule 2: Always Verify What AI Tells YouRule 3: Keep Humans in Charge of the Final CallHow to Use GenAI in This BookFrom Code Boxes to “Vibe Coding”Chapter SummaryWhat’s Coming Next
PART II: Getting Your Risk Muscles Working
4. Foundations
Foundations First: Why We Always Use RangesWhat Ranges Actually MeanConfidence and Other Types of IntervalsWhen Executives Demand the NumberWhen to Use Ranges and Confidence IntervalsMode vs. Median: What Analysts Really Need to KnowFrequency and MagnitudeBuilding Block 1: Understanding FrequencyBuilding Block 2: Understanding MagnitudeHow They Combine: The Risk EquationEssential Vocabulary: Concepts You Need to KnowRisk Analysis vs. Risk AssessmentUncertaintyTwo Types of UncertaintyWhy This Distinction MattersWhen to Reduce Uncertainty vs. When to Live with ItAdopting a “Less Wrong” MindsetWhat This Looks Like in PracticeStarting Small: You Don’t Need to Revolutionize EverythingChapter SummaryWhat’s Coming Next
5. Your First Quantitative Risk Assessment
What Is Monte Carlo Simulation?How Monte Carlo Works in Risk AnalysisYour First Monte Carlo SimulationForecasting FrequencySetting Up the ProblemGathering Historical DataVerifying the DataForecasting Future ScenariosAdding Monte Carlo SimulationForecasting MagnitudeCongratulations, Your First Quantitative Risk Analysis!What Do All These Numbers Mean?A Note on Terminology: Why We Use FAIR LanguageFrom Numbers to DecisionsChapter SummaryWhat’s Coming Next
6. Interpreting and Communicating Quantitative Risk Results
Show Your Work: Turning Numbers into NarrativesThe Shape of RiskThe Five-Number SummaryA Quick Word on Average, Mode, and MedianWhen Risk Distributions Behave StrangelyKey Visualizations That MatterHistogram: The Shape of RiskLoss Exceedance Curve, a.k.a. the “What Are the Chances?” ChartWhy This Chart Is Difficult (and Why That’s OK)The Power of This VisualizationAnchoring a Loss Exceedance Curve to Real DecisionsCreating Loss Exceedance StatementsThe Risk Heatmap: When You Have No ChoicePutting It All TogetherWhat I Learned About Executive Risk CommunicationChapter SummaryWhat’s Coming Next
7. From Risk Statements to Assessment Scope
Where This Fits in the CRQ ProcessIntroducing Risk Statements and Risk Assessment ScopeThe Progression: From Worry to AnalysisThe A-T-E FramingPutting It TogetherAdding Method (Optional)The Mad Libs ApproachWhere to Find Risk Statement InspirationQuick Quality FilterScoping Your Risk AssessmentFrom Scope to Data Collection: Your Translation GuideComplete Worked Example: From Statement to Data Road MapScoping the AssessmentThe Data Collection Road Map EmergesWhat You’ve AccomplishedChapter SummaryWhat’s Coming Next
8. Understanding Loss: The Six Forms
When to Decompose (and When Not To)Why Breaking Down Loss MattersThe Six Forms of LossUnderstanding Measurement Approaches1. Productivity Loss2. Response Cost3. Replacement Cost4. Fines and Judgments5. Reputation Damage6. Competitive Advantage LossAddressing Executive Questions About Opportunity CostApplying the Six Forms to Your Risk ScenarioStep 1: Triage Which Loss Forms ApplyStep 2: Prioritize Your EffortStep 3: Define What Each Loss Form Means for Your ScenarioStep 4: Estimate and AggregateStep 5: Validate Your WorkYou’re Done with Magnitude!Chapter SummaryWhat’s Coming Next
Part III: Solving the Data Problem
9. Getting Unstuck with Data
Before You Search: Seeing the Problem ClearlyBreaking the Data Myths That Keep You StuckFrom Myths to Method: The Three-Source SolutionExternal Data: Context from the Outside WorldInternal Data: Your Organizational RealitySubject Matter Expert (SME) Estimation: Forward-Looking InsightHow These Sources Work Together: Real-World ExamplesExample 1: Ransomware Risk AssessmentExample 2: Phishing Success RateExample 3: Cloud Outage Business ImpactWhy Multiple Sources Work BetterWhen You Have Limited Sources: A Practical FrameworkWhen You Have Only External DataWhen You Have External + Internal DataWhen You Have All Three SourcesUnderstanding the Data SpectrumQualitative vs. Quantitative DataSubjective vs. Objective DataThe Data Type MatrixAddressing AI-Generated and Synthetic DataHow AI Can Support Real Data SourcesYou Can Start Right NowChapter SummaryWhat’s Coming Next
10. How to Vet and Believe Your Data
A Simple Three-Step EvaluationStep 1: Screen Your DataStep 2: Basic Data CollectionWhat If I Can’t Find a Range?Step 3: Assess Quality and Adjust for UncertaintyThe Simplified Quality ChecklistRange Adjustment ExamplesCreating Ranges from Point EstimatesWhy Range Widening Works: The Scientific FoundationThe Ten-Minute Assessment Method“Good Enough” Decision-MakingChapter SummaryWhat’s Coming Next
11. Finding and Using External Data
Why Your Organization’s Data Only Tells Half the StoryWhy I Reach for External Data EarlyThe Five Types of External Data: A Taxonomy1. Event-Based Data | What Happened?2. Measurement and Exposure Data | How Exposed Are We?3. Opinion, Perception, and Benchmark Data | What Do People Say?4. Research and Analysis Data | What Do Deep Dives Reveal?5. Legal and Enforcement Data | What Are the Consequences?How to Use External DataMethod 1: Building Risk Scenarios and StatementsMethod 2: Creating Quantitative Model InputsMethod 3: Validating and Stress-Testing ResultsMethod 4: Transforming Raw StatisticsMethod 5: Extracting Magnitude DataChapter SummaryWhat’s Coming Next
12. Your Best Evidence: Finding and Using Internal Data
Why Internal Data MattersTypes of Internal Data SourcesWhere to Find It (and Who to Ask)Who to AskStarter Questions and ScriptsCoverage RatesFrom Raw to Useful: Prepping Internal Data for CRQMethod 1: Use Timestamped Records to Estimate FrequencyMethod 2: Extract Event Durations to Estimate Downtime, Incident Response, and Recovery WindowsMethod 3: Define Scenarios Based on Repeating PatternsMethod 4: Model Control Conditions from Exceptions and Audit FindingsEthical Considerations and PrivacyProtecting Results As They CirculateChapter SummaryWhat’s Coming Next
13. Your Secret Weapon: Subject Matter Experts
Experts Are Not a MonolithThe Five Types of SME InputExpert Calibration and Why Cyber Risk Is DifferentThree Practical Strategies for Working with Uncalibrated ExpertsStrategy 1: Ask Multiple ExpertsStrategy 2: Structure the Elicitation ProcessStrategy 3: Prime Them QuicklyThe Ten-Minute Calibration PrimerHow to Run ItSelecting the Right SMEsHow Many Experts Do You Need?What Makes a Good SME for CRQRunning Effective SME WorkshopsStructured Workshops: The Mini-Delphi MethodThe Mini-Delphi FormatControlling for Group BiasCapture Rationale, Not Just NumbersDistributed Elicitation Best Practices (Work with What You Have)Aggregating Expert OpinionAggregation ExampleWhen Simple Aggregation Doesn’t WorkThree Applications of SME InputApplication 1: When Data Doesn’t ExistApplication 2: When Data Needs ContextApplication 3: When Modeling Future ChangesChapter SummaryWhat’s Coming Next
14. How to Blend Data
The Problem Every Analyst FacesWhat an Eighteenth-Century Minister Can Teach Us About Risk AnalysisThe Reality of Data CollectionWhen to Use Bayesian ReasoningBayesian Thinking As a Mental ModelWhy Bayes Matters for Data BlendingThe Four-Step Bayesian Blending ProcessStep 1: Choose Your Strongest Available Baseline (Your Prior)Step 2: Ask What Your Internal Data Says (First Update)Step 3: Get the SME Reality Check (Second Update)Step 4: Document Your Bayesian ReasoningWorked Example: Phishing FrequencyStep 1: Establish Your Prior (External Baseline)Step 2: First Update (Internal Evidence)Step 3: Second Update (SME Input)Step 4: Document Your Bayesian ReasoningWhat You Just DidBuilding Confidence over TimeChapter SummaryWhat’s Coming Next
Part IV: Risk Assessment in Action
15. Extending This to CRQ
The Baby-Steps MapRunning a What-If AnalysisReturn on Security Investment (ROSI)How ROSI WorksWhy We Use the MeanA Simple ExampleUnderstanding the ROSI RatioAccount for Control Success ProbabilityROSI vs. Risk ReductionClosing the LoopWhere to Go from Here: The Bigger FieldBooks That Build Judgment and IntuitionFields That Share DNA with CRQCommunities Worth FollowingChapter SummaryWhat’s Coming Next
16. Extending to FAIR
What FAIR Is (and Isn’t)The Open FAIR StandardThe Rise of the FAIR Institute and the New Family of ModelsThe State of Risk Management Before FAIRJack Jones’ Three Big Contributions1. Precise Definitions2. A Framework for Critical Thinking3. Measurement and Actuarial LogicHow FAIR Works (in Plain English)Decomposing Loss Event FrequencyDecomposing Loss MagnitudeUsing Only As Much FAIR As You NeedExample 1: Use Top-Level Inputs OnlyExample 2: Fully Decomposed MagnitudeExample 3: Decompose Threat Frequency Using Control DataPractical Tips for Using FAIR Depth WiselyMapping Data to the FAIR OntologyMapping This Book to FAIRCommon Missteps and Overuse1. Confusing Taxonomy with Analysis2. FAIR As Religion3. Using FAIR to Debate DefinitionsHow to Get Started with FAIR1. Pick One Scenario2. Translate Your Work into FAIR Language3. Reuse What You Built in Earlier Chapters4. Estimate Ranges and Simulate5. Add Depth Only When Needed6. Document and IterateBeyond FAIRChapter SummaryWhat’s Coming Next
17. How to Run a Complete CRQ Assessment (A Full Walkthrough)
Could It Happen Here? Modeling a Ransomware EventStep 1: Framing the ScenarioStep 2: Setting the Stage—From Headline to HypothesisWhat Data We Need for This ScenarioStep 3: Collecting and Vetting the DataEstimating FrequencyEstimating Magnitude: The Six Forms of LossBlending the Evidence for MagnitudeConsolidating Loss Forms into a Single Magnitude InputStep 4: Building the ModelSummary Statistics from the ModelLoss Exceedance Curve (LEC)Turning the Analysis into a DecisionChapter SummaryWhat’s Coming Next
Part V: Making It Stick
18. CRQ in the Org
A Tale of Two CRQ ProgramsWhy CRQ Programs Fail (and How to Avoid It)The Individual LevelThe Team LevelThe Organizational LevelSeeing the Whole PatternHow to Make CRQ Work Inside an Organization1. Start with a Single Decision2. Speak the Language of the Business3. Build Allies Before Infrastructure4. Integrate Gently with Existing Processes5. Normalize Uncertainty6. Show Progress, Not PerfectionKeeping It GoingThe Six Levers That Quietly Change Your Risk1. Internal Security Posture and Control Effectiveness2. Business and Operating Model Changes3. External Threat and Regulatory Landscape4. Incident and Near-Miss Learnings5. Improved Visibility6. Risk Appetite, Governance, and Insurance TermsA Quick Check As You ReassessKeeping CRQ AliveChapter SummaryWhat’s Coming Next
19. Making Better Decisions with CRQ
Clearing the FogThe True Purpose of Risk AssessmentWhat Makes a Decision?ChoicePreferenceInformationThe Decision CheckAlternatives to the Risk AssessmentUse Cases for Quantitative RiskOperational Decision-MakingRisk Ranking and PrioritizationIdentifying and Prioritizing Control GapsInvestment and Budget DecisionsAdding or Removing ControlsProject ROI and Budget JustificationStrategic Decision-MakingInsurance AnalysisThird-Party Risk and M&AEmerging Risk AnalysisExotic and Low-Probability/High-Impact RisksRisk Appetite and Board-Level ReportingFast vs. Focused vs. Deep-Dive AssessmentsAssessment GranularityResults into Action: Risk Treatment OptionsWhat to Present to Executives: The Decision Support PackageChapter SummaryWhat’s Coming Next
20. The Future of CRQ (And Yours Too)
The AI Revolution and Why This Is Our MomentThe Skill ShiftAdapting at Three Levels1. The Organizational Level2. The Team Level3. The Individual LevelWhat This MeansThe Long ViewPassing the TorchThe Final Word
Appendix A: Jargon-less Risk Glossary
Quant BasicsData and SourcesDecision and Modeling ConceptsFAIR TermsAnalysis and VisualizationApproaches and Mindsets
Appendix B: Six Forms of Loss—Detailed Reference Guide
1. Productivity LossCore Calculation FrameworkSpecific Measurement ProxiesAdvanced Considerations2. Response CostInternal Labor CostsExternal Service CostsNotification and Communication CostsOngoing Response Activities3. Replacement CostPhysical Asset ReplacementData and System RestorationCredential and Access Management4. Fines and JudgmentsCivil Litigation CostsContractual Penalties5. Reputation DamageCustomer Impact MetricsMarket Valuation ImpactEmployee and Talent ImpactBrand Repair Investments6. Competitive Advantage LossIntellectual Property ValuationMarket Position ImpactStrategic Information Value
Appendix C: Data Types Quick Reference
Appendix D: Data Source Evaluation Framework
Index

Content preview from From Heatmaps to Histograms: A Practical Guide to Cyber Risk Quantification

T. Martin-VegueFrom Heatmaps to Histogramshttps://doi.org/10.1007/979-8-8688-2300-8_19

19. Making Better Decisions with CRQ

Tony Martin-Vegue¹

(1)

San Francisco, CA, USA

Tony Martin-Vegue

Email: tony.martinvegue@gmail.com

The quality of a decision cannot be judged by its outcome, but only by the process by which it was made.
—Ron Howard

Back in Chapter 4, we learned that the goal of quantification is not to be perfectly right. It is to be less wrong. Everything you have learned since then gives you permission to iterate. You have modeled data, blended evidence, and turned a big, messy ball of uncertainty about the future into something tangible: numbers, ranges, and curves.

This chapter shows you what all that effort was for. ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

CompTIA® SecurityX® CAS-005 Certification Guide - Second Edition

Publisher Resources

ISBN: 9798868823008Purchase Link Publisher Website

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

From Heatmaps to Histograms: A Practical Guide to Cyber Risk Quantification

by Tony Martin-Vegue

19. Making Better Decisions with CRQ

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.