Projects

Projects are the working analyses behind the articles. Each one asks a specific risk question, builds a model to answer it, tests the result, and reports what it does and does not show. The code is open, mostly in R with some Python, and the data are synthetic or public and labeled as such, so you can see how a method behaves before it is applied to your own environment.

What every project includes

  • The question: the decision the analysis is meant to support
  • The data: where it came from and why it is appropriate
  • The method: the model, and why it was chosen over simpler alternatives
  • Validation: how we checked that the model behaves as expected
  • The business translation: what the result means in dollars, time, or exposure
  • Limits: where the result should not be trusted

Projects by service

Risk Quantification. Bayesian Cybersecurity Loss Forecasting replaces a qualitative ransomware rating with an annual loss curve in dollars. Multi-Stage Attack Graph Simulation via Markov Chains quantifies dwell time and containment odds under baseline and hardened defenses.

Third-Party Risk. Quantifying the Blast Radius ranks structural risk in a 90-node fintech topology. Mapping the Invisible finds hidden privilege escalation paths in Active Directory. Operational Resilience: Quantifying Third-Party ICT Concentration Risk Under DORA shows eight ICT vendor entries collapsing to five failure domains.

Tail-Risk + Capital Modeling. Extreme Value Theory and Operational Loss Capital Estimation measures how much a log-normal model understates the tail. The Diversification Question quantifies the capital benefit of modeling dependence with copulas. Coding the Tail implements block bootstrap and EVT in R.

Fractional Risk Services. Auditing a Pre-Trained Hugging Face Financial Risk Model and Policy as Code show how model governance and compliance controls can be made reproducible.

If a project resembles a problem you are facing, get in touch. Any of these can serve as the starting point for an engagement on your own data.

Listing of all projects continues below.


The Mechanics of Markov Chain Monte Carlo
Markov Chain
Monte Carlo

R Metropolis sampler for 10-factor portfolio VaR/ES, benchmarked against the exact posterior to show how poor mixing understates parameter risk.

Sep 24, 2026

Time-to-KEV: Where Uniform Patch SLAs Spend Effort and Where Listings Actually Concentrate
Survival Analysis
CVSS
Kaggle

Survival analysis of CISA KEV listings: how likely and how fast CVEs are listed, and which patch SLA design leaves least exposure.

Sep 10, 2026

Multi-Stage Attack Graph Simulation Via Markov Chains
Markov Chain
MITRE ATT&CK Transition

An absorbing Markov chain model of the cyber kill chain in R, quantifying dwell time and containment odds under baseline and hardened defenses.

Aug 27, 2026

High-Dimensional Cyber Anomaly Detection & Systemic Risk Modeling
PageRank
Markov Transition Matrices

A pure-R detection system pairs PageRank-based structural risk mapping with an unsupervised autoencoder and Extreme Value Theory thresholds to catch stealth cyber attacks.

Aug 13, 2026

Quantitative Cyber Risk Analysis: Structural Vulnerability & Criticality Scoring via PageRank
PageRank
Vulnerability

Applies Google’s PageRank algorithm to a 25-node enterprise IT dependency graph, ranking structural single points of failure for board-level risk budgeting.

Jul 30, 2026

ATLAS Threshold Detection Rules Analysis
ATLAS
Incident Detection

ATLAS-based FRR/FAR/EER threshold calibration for detection rule: framing SOC alert tuning as a documented risk decision for cybersecurity leaders.

Jul 16, 2026

Quantifying the Blast Radius - Centrality-Based Criticality Modeling for Infrastructure Risk
Graph Theory
Blast Radius

Which node’s failure breaks the most? Graph centrality and node-removal simulation applied to a 90-node fintech infrastructure topology to rank structural risk and surface the failures that conventional inventories miss.

Jul 2, 2026

The Diversification Question - Copula-Based Aggregation of Operational Risk Losses
Copulas
Operational Risk Modeling

Finds a ~30% capital benefit from modeling operational risk dependence with copulas, and shows the result barely depends on which copula is chosen.

Jun 24, 2026

Extreme Value Theory and Operational Loss Capital Estimation
Extreme Value Theory

Quantifies how much a log-normal capital model understates operational loss tail risk versus a Generalized Pareto fit, using NexaCore’s loss register.

Jun 17, 2026

Mapping the Invisible - Active Directory Privilege Escalation Through Graph Theory Analysis
Graph Theory
Active Directory

An identity governance case study demonstrating how graph theory surfaces hidden privilege escalation paths in enterprise Active Directory environments that static access reviews cannot detect.

Jun 3, 2026

Operational Resilience - Quantifying Third-Party ICT Concentration Risk Under DORA
DORA
risk quantification

A dependency graph model showing 8 ICT vendor entries in a DORA Register of Information collapse to 5 failure domains for a EU asset manager. Calibrated to the ESAs’ 19 designated CTPPs, a discrete-event simulation produces an annualized business interruption loss distribution.

May 27, 2026

Bayesian Cybersecurity Loss Forecasting
FAIR
EVT
risk quantification

Most fintech risk registers treat ransomware as a qualitative category. This model replaces the label with a loss curve — a full distribution of probable annual financial outcomes, expressed in dollars, with Value-at-Risk figures a CFO can act on.

May 18, 2026

Auditing a Pre-Trained Hugging Face Financial Risk Model
hugging face
LLM

This project introduces two R packages — hfhub and tok — and applies them to a structured metadata audit of FinBERT (ProsusAI/finbert), a BERT-based sentiment classifier widely deployed in fintech AI pipelines.

May 11, 2026

Policy as Code - A Simple Introduction
policy as code

This project introduces the Policy as Code concept through the simplest possible worked example — a six-condition password complexity validator — to make the pattern legible to both compliance professionals and engineers.

Apr 30, 2026

When the Clock Starts Ticking - A Survival Analysis of Business Continuity Recovery Times
survival analysis
kaplan-meier
pyQuarto

Survival analysis exposes where RTO targets break down — and why your mean recovery time is lying.

Apr 14, 2026

Infrastructure-Based, Machine-Learning Phishing Detection
Machine Learning
LightGBM
rQuarto

Analyzing the digital fingerprints of URLs through machine learning and the lightGBM model to detect incoming phishing emails.

Mar 31, 2026

Bayesian Kelly Criterion - From Point Estimate to Probability Distribution
Bayes' Theorym
Kelly Criterion
rQuarto

Bayesian Kelly position sizing: replaces the point estimate with a Beta posterior, derives the full Kelly distribution across four scenarios, and builds a staking policy from estimation uncertainty.

Mar 17, 2026

Bayesian Inference in Lending Risk
Bayes' Theorym
Quarto
Credit Risk

Bayesian lending risk analysis in R using rstanarm & bayestestR — posterior distributions, credible intervals, ROPE, and pd applied to real-world Lending Club interest rate data.

Mar 3, 2026

Machine Learning and Survival Analysis - Predicting customer churn using complex statistical modeling
Quarto
Machine Learning
Survival Analysis

A comprehensive data science framework leveraging machine learning and survival analysis for identifying, analyzing, and predicting customer attrition within a consumer credit card division.

Feb 17, 2026

Predicting Vulnerability Exploitation - A Machine Learning Approach
Quarto
Vulnerability Management
Machine Learning

Prediction analysis of CVE exploitation using Machine Learning. Integrates NVD, EPSS, and CISA KEV data to forecast active threats. Features Random Forest modeling, SMOTE balancing, and executive risk visualization to enable proactive vulnerability prioritization.

Feb 3, 2026

Coding the Tail - Implementing Block Bootstrap & Extreme Value Theory in R
Quarto
Extreme Value Theory
Monte-Carlo Simulation

A technical framework and narrative summary project for implementing Block Bootstrap and EVT in R. It provides a practical demonstration of how to quantify tail risk in high-volatility assets (specifically Bitcoin) using advanced statistical methods that outperform standard Gaussian models.

Jan 15, 2026

Modeling Defender’s Dilemma
Shiny
Markov Chain
Monte-Carlo Simulation

An interactive R Shiny app modeling the Defender’s Dilemma via Markov Chains & Monte Carlo simulations. Visualizes the stochastic nature of resource depletion (SOC fatigue, budget) vs. infinite attacks, calculating a specific “Probability of Ruin” to guide risk management.

Jan 5, 2026

Modeling Gamblers’ Ruin
Shiny
Markov Chain
Monte-Carlo Simulation

An Interactive R Shiny app simulating Gambler’s Ruin via Monte Carlo methods. Visualizes Markov Chain dynamics to demonstrate how finite resources face inevitable ruin against infinite odds. Features dynamic inputs for capital & win rates to illustrate risk in trading & cybersecurity.

Dec 18, 2025
No matching items