How We Work
Defined outcomes, fixed fees, and one practitioner from the first call to the result you came for. No open-ended hourly billing, and no hand-off to a junior team.
Built Around Outcomes
A report is not the goal. The goal is that something is different when we finish: a budget request approved, a vendor exit plan that has actually been tested, a capital number your investors accept, a single point of failure fixed before it fails. Before any modeling begins, we agree on that result and on how we will know we have reached it. The analysis is built to produce it, and nothing is added to fill pages.
Because the person you talk to is the person who does the analysis, nothing gets lost between the first conversation and the finished work. I measure each engagement against the decision it was meant to support, not against the number of pages or models delivered. The documents are the means. The measure is whether you can now act, and defend that action to your board, your regulator, or your investors.
The Result You Are Buying
Each service is aimed at a specific change in what you can do, and each engagement is scoped against it.
| Service | The result we are aiming for | How we will know we got there |
|---|---|---|
| Risk Quantification | Leadership makes the risk or security budget decision on dollar figures it trusts, instead of debating a color chart | The decision is made, and the loss estimates hold up to board or regulator questions without rework |
| Third-Party Risk | Your most dangerous single point of failure is found and addressed before an incident finds it | The top dependencies are ranked and validated, and remediation is prioritized and underway |
| Tail-Risk + Capital Modeling | You hold the capital your actual risk requires, not the capital an out-of-date model suggested | The gap between your model and the tail is quantified, and the capital decision has a documented basis that an auditor or investor accepts |
| Fractional Risk Services | One accountable owner, and one defensible number across cyber, structural, and market risk | Quarterly figures reconcile with each other, and leadership acts on them |
Three Ways to Engage
Focused assessment (typically 2 to 4 weeks) A defined decision, a fixed scope, and a fixed fee. The result is a clear answer to one question: what your top three loss scenarios would cost in dollars, which vendor or account failure would hurt most, or whether your VaR model understates the tail. This is the best starting point for most clients, because it produces a usable answer and shows how we work together before you commit to more.
Deeper engagement (typically 4 to 10 weeks) A fuller result, usually after an assessment shows where the value is: a quantified risk picture the whole organization can use, a complete view of your vendor and fourth-party dependencies, or a tail-risk capital model that stands up to review.
Ongoing advisory A recurring commitment that keeps the result current as your business changes: quarterly re-quantification, continuous review of dependency changes, model governance support, or fractional risk leadership.
How We Get to the Result
- Scoping call. A free, no-obligation conversation to understand your situation, the decision in front of you, and the result you need. If another approach or another provider is a better fit, I will say so.
- Written scope and fixed fee. A short document stating the decision, the result we are aiming for, how we will know we have reached it, the timeline, what I need from you, and the fee. Nothing starts until you approve it.
- Data and assumptions. We gather what the analysis needs. I then write the key assumptions in plain language and review them with you before modeling begins, because the assumptions drive the answer.
- Analysis. I build and test the models. You see interim findings at agreed checkpoints, so there are no surprises at the end.
- The decision. You receive the findings in the form your decision requires: a summary your board can act on, plus the documentation and working model so your team can re-run and extend the work. We confirm the decision is ready to be made, and made on numbers you can defend.
- Follow-through. Where it is useful, we check back after the decision to see whether the result held. You can then take the work in-house, or continue under an ongoing advisory arrangement. Either is a good outcome.
What I Need From You
- A decision owner who can say what the work is for and who will use it
- Access to the right data, usually exports or read-only extracts, not production system access
- A point of contact for questions, who can answer within a day or two
- Candor about constraints, such as a board date, an audit window, or data you know is imperfect
Imperfect data is normal. Quantitative methods such as FAIR were designed for thin data, and I show the uncertainty rather than hide it.
What You Can Expect
- A decision you can defend. Every material assumption is documented, with a sensitivity analysis showing which ones move the answer most, so you can explain the result to anyone who challenges it.
- Honest uncertainty. Estimates are shown as ranges and distributions, not single numbers that imply false precision.
- Methods you can verify. The approach is described in published articles and reproducible projects, so you can read how the analysis is done before you sign anything.
- Results in plain language. Your analysts get the technical detail. Your board gets a clear statement of what the numbers mean and what to do about them.
- A result you can keep. You receive the models and code, so the result can be refreshed without starting over.
Confidentiality and Data Handling
Client information is confidential by default. I am glad to sign a mutual NDA before any data is shared, to work with the minimum data needed, and to work with anonymized or aggregated extracts where possible. Data is used only for your engagement.
Questions I Am Asked
Do you guarantee the outcome? No honest advisor can promise what a board, a regulator, or a market will decide. What I commit to is the part I control: that the decision in front of you is made on numbers that are clear, documented, and defensible, and that we agree up front on how we will know the work succeeded.
Why one practitioner instead of a team? Because consistency is the product. When the same person applies FAIR, graph-theoretic, and tail-risk methods, the results reconcile with each other. The trade-off is capacity, so I take on a limited number of engagements at a time and tell you honestly when I am at capacity.
Do you charge by the hour? No. Assessments and projects are fixed-fee against a written scope, because you are paying for a result, not for hours. Ongoing advisory is a defined monthly commitment. You know the cost before the work starts.
What if we only need one of the services? That is the most common case. Each service stands alone, and nothing requires you to buy the others.
What if the answer is not what we hoped? You get it anyway. An analysis that only tells you what you want to hear is not worth paying for. The documentation shows exactly how the conclusion was reached, so you can challenge it.
How soon can we start? It depends on my current commitments and your data readiness. The scoping call gives a realistic start date.