Insights

Insights is where the thinking behind the work gets published. Each article takes a real risk problem, such as vendor concentration, tail risk, a scoring model that cannot show its weights, or a board report that measures activity instead of exposure, and works through it with named methods and stated assumptions. The goal is to give risk, security, and finance leaders something they can use in a meeting, not a slogan.

Read by series

The Bayesian Risk Series. How Bayes’ theorem and Markov chain Monte Carlo improve risk reporting, vendor scoring, AML alert queues, and root-cause analysis. Start with The Prior Problem: Why Risk Reporting Needs Bayes’ Theorem.

The Hidden Single Points of Failure Series. Graph theory applied to vendor, fourth-party, and DORA resilience risk. Start with The Diversification Illusion.

The AI Governance Series. Model inventory, validation, monitoring, the EU AI Act, and board reporting for AI in financial services. Start with Why AI Changes Risk Management at the Foundation.

The Infrastructure of Risk Series. The statistical and data foundations underneath risk models: VaR, Expected Shortfall, time series, model risk, and where risk data lives. Start with Measuring the Tail: VaR, Expected Shortfall, and When the Math Breaks.

The GRC Engineering Series. Treating governance, risk, and compliance like an engineering discipline: policy as code, continuous controls monitoring, and quantified loss models. Start with Retiring the Risk Heat Map.

Start with your question

If you are asking…	Read
How do we put dollars on cyber risk for the board?	Retiring the Risk Heat Map; Stop Treating Cyber Risk Like IT Risk
Which vendor failure would hurt us most?	Small Contract, Critical Node; Mapping the Fourth Party; The Diversification Illusion
Is our VaR model understating the tail?	The Trap of the Bell Curve; Coding the Tail; Beyond VaR
How should the board see resilience and AI risk?	Activity Is Not Exposure; Beyond the Model Count

New articles are published weekly on The Fat Tail: Extreme Risks & the Numbers Behind Them, the Seeking Eureka newsletter. Subscribe on Substack to get one in your inbox each week.

Read by series

Start with your question

Monte Carlo Tells You What Your Assumptions Imply. Markov Chain Monte Carlo Tells You How Far to Trust Them

Show Your Weights: What a Credit Scorecard and a Bletchley Park Codebreaker Have in Common

The Tree That Can’t Learn: Why Root-Cause Analysis Needs a Bayesian Network

The Vendor Score That Never Sleeps: How to Fix the Biggest Flaw in Vendor Questionnaires

Stop When the Evidence Says Stop: What Bletchley Park’s Codebreakers Can Teach an AML Alert Queue

The Prior Problem: Why Risk Reporting Needs Bayes’ Theorem

Activity Is Not Exposure: Resilience Reporting to the Board

The Exit Plan Nobody Has Tested: Substitutability Under DORA

RTO Theater: When Every Vendor Passes and the Business Still Fails

Scenario Testing That Isn’t Theater

Small Contract, Critical Node: Betweenness Centrality for Vendor Risk

DORA’s Critical ICT Third-Party Register: Built as Code

Mapping the Fourth Party: Where Vendor Risk Registers Stop Looking

The Diversification Illusion

Beyond the Model Count: A Board’s Guide to AI Governance Reporting

The Regulatory Machine: Using AI to Manage AI Governance Obligations

The Monitoring Infrastructure: What Continuous Model Surveillance Actually Requires

High-Risk by Default: Mapping the EU AI Act onto Financial Services Use Cases

The Validation Gap: Why Independent Review Breaks Down for Machine Learning Models

Model Inventory: The Governance Program You Can’t Build Without It

Why AI Changes Risk Management at the Foundation

The Graph Problem in Risk

Model Risk and Validation Frameworks

Time Series in Practice: The Stationarity Assumption and When It Fails

Measuring the Tail - VaR, Expected Shortfall, and When the Math Breaks

The Query Layer Nobody Talks About - Why the database engine is a modeling assumption

Where Risk Data Lives - and What That Choice Costs

Governing AI with AI - Model Risk Management as Today’s Defining GRC Challenge

Third-Party Risk at Scale - The Questionnaire Is Not a Risk Management Strategy

The Regulatory Firehose - How AI Turns Change Management from a Cost Center into a Competitive Edge

Retiring the Risk Heat Map - Quantitative Loss Modeling for Board-Level Decisions

Perpetual Audit Readiness - How Engineering Eliminates the Evidence Sprint

Policy as Code - The Document Nobody Reads Is Now a Pipeline

Continuous Controls Monitoring - From Quarterly Snapshots to Real-Time Risk Intelligence

GRC Engineering - Why Your Risk Function Needs to Think Like a Software Team

When the AI Agent Approves Itself

The Wrong Probability for the Right Problem

The 99 Percent Problem - What the Mythos Red Team Report Actually Means for Fintech Risk Governance

The Square Law Advantage - What Lanchester Law Mathematics Reveals About Security Budget Allocation

Predator-Prey Dynamics and the CISO’s Dilemma -The Mathematics of Cyclical Underinvestment

Quantifying Anomaly - Triage at Scale Using Benford’s Law and R

Beyond the Spreadsheet - Managing Risk in a World of Autonomous Agents

The Fastest Code You’ve Never Read

2026 Crowdstrike Global Threat Report - Attackers now only need 29 minutes

Beyond Luck - Using Bayes’ Theorem to Value Silent Success in Cybersecurity

Stop Treating Cyber Risk Like IT Risk

Strategic Application of Survival Analysis to Cybersecurity Risk Management

Building Security Into Design - A STRIDE Implementation Roadmap for Small- to Medium-Sized Firms

For Startups, Cybersecurity Is Not a Data Problem — It’s a Solvency Problem

The Illusion of Vendor Diversification - Why Your Supply Chain Has a Single Point of Failure

Coding the Tail - Implementing Block Bootstrap and Extreme Value Theory in R

Managing the Unmanageable - Strategic Tools for Quantifying Tail Risk

The Trap of the Bell Curve - Why Your Risk Models Are Lying to You

Operational Readiness for Post-Quantum Cryptography - Three Questions Your Board Needs to Ask

The Quantum “Master Key” - Why Your Board Needs to Talk About Physics Sooner than Later

Tempo Is a Weapon - Dislocating the Adversary in Incident Response

The Speed of Trust - Why Incident Response Demands “Command Intent” Over Centralized Control

The ROI of Shifting Security Left

The Code You Didn’t Write - How Transitive Dependencies Became Your Greatest Security Liability

Understanding Bitcoin Mining Through the Lens of Dutch Disease

The Hidden Threat - Why Software Extensions Are Your Organization’s Blind Spot

The Network is the Risk - Understanding and Mitigating Eclipse Attacks in Blockchain Ecosystems

Proactive Third-Party Risk Management with Shodan Intelligence

Beyond Binary Alerts - Using Markov Switching Models to Detect Insider Threats

Simpson’s Paradox in Cybersecurity - Why Your New Security Tool May Be Less Effective Than the One It Replaced

Centralization by Stealth - Proactive Governance to Protect the Blockchain from the Majority Attack

Merkle Trees - The Engine of Bitcoin’s Scalability and Integrity

Beyond VaR - Expected Shortfall as the New Standard for Strategic Resilience

Move Fast and Don’t Break Things - Embedding Risk Awareness Without Killing Innovation

Leading Beyond the Breach - A Framework for Decisive Action in a Cyber Incident

From Anomaly to Action - A Risk Manager’s Guide to Applying Benford’s Law

Gaining the Edge - HowBayes’ Theorem Unlocks Deeper Reads in Texas Hold’em

Using Poisson Distribution Analysis to Drive Financial Risk Insight

Beyond the Patch - Leveraging Poisson Distribution to Transform Bug Reporting into Strategic Risk Insight

The Hidden Dangers of Networked Risk - A Graph Theory Approach to Systemic Vulnerability

Applying K-Means Clustering for Vulnerability Prioritization

Leveraging the Endowment Effect for Project Risk Management

Unmasking Malicious Webs - How the Bellman-Ford Algorithm Detects Threats in Social Networks