Inside the episode: What I learned from speaking with Ash Hunt
A few weeks ago, I sat down with Ash Hunt for an episode of Communicating Cyber. Ash has been an outspoken advocate of cyber risk quantification (CRQ) for years, having deployed it in the trenches as a global CISO. But what made our conversation particularly compelling is that Ash has come somewhat full circle.
Rather than cheerleading the discipline unconditionally, he has developed a sharp, pragmatic critique of the very movement he helped pioneer. Having ridden the arc from early adopter to battle-scarred practitioner, he has watched the quantification community run the risk of becoming an echo chamber.
Our discussion covered substantial ground, wandering through manufacturing philosophy, military targeting techniques, and the psychological art of board communication. Reflecting on it afterwards, several clear lessons emerged about how we, as cyber security professionals, need to rethink risk, measurement, and the stories we tell.
When a discipline eats itself
Ash’s opening observation struck an immediate chord: CRQ has developed an almost religious zealotry, with practitioners retreating into dogmatic camps squabbling over distributions and formulas.
As Ash put it, “The end goal, the objective, is not CRQ in and of itself, and I think in many ways has completely eaten itself as a discipline. The goal is effective, robust measurement of problems.”
Lost in mathematical scaffolding, teams forget what the business actually cares about. Every organisation exists to do two things: build and sell. It creates a product, service, or good, and shifts it to market. Cyber security is not an expensive loss function or a standalone tax; its role is simply to accelerate the efficiency and growth of those two core functions.
Ground truth versus colour coding
Fewer than a third of UK organisations have ever conducted a cyber risk assessment of any flavour. Yet Ash argued that starting with an arbitrary risk assessment is often the wrong move. Download a generic threat taxonomy, and stakeholders will reflexively point to nation states and ransomware.
In reality, what drags down a business day-to-day is far more mundane: accidental data disclosure, flaky failovers, and routine cloud outages. Ash recalled running a data centre in a hurricane region where outages were entirely predictable. The empirical data was clear, yet organisations routinely ignore this reality in favour of hypothetical drama.
Dressing up that data in qualitative language solves nothing. Whether you use a Monte Carlo simulation or rank past incidents, slapping a red, amber, or green label on the output changes nothing. As Ash noted, “I can call something green. If you don’t like the idea that there is a potential loss exposure statistically to, let’s say, up to $10 million a year, and you want to call that red, the red doesn’t change the reality of the variables that were used to make that calculation.” Ground truth matters far more than the colour palette of your risk matrix.
The beer keg and everyday losses
Risk and incidents are two sides of the same coin: an incident is simply a risk made manifest. Yet enterprises keep them in separate silos—incidents in the SOC, risk in GRC—breaking the feedback loop of continual improvement.
Working behind a bar in my youth taught me a simple lesson: when you tap a 72-pint keg, you expect some spillage. But if a tap pours pure foam, you do not keep pouring; you adjust the pressure. In cyber security, we routinely keep pouring and accept operational drag as inevitable. Ash pointed to Elon Musk’s early lesson at Tesla: automation magnifies efficiency and inefficiency with equal power. If a process is broken at root, automating it only accelerates waste.
To bridge this gap with executives, Ash abandoned the term threat landscape. Board members do not know Scattered Spider from APT27. Instead, he introduced an event landscape, mapping the observable, everyday disruptions dragging on commercial acceleration. By speaking in terms of operational impact rather than adversary tradecraft, he could sit beside the CFO and speak a common language of exposure management.
Maths or story? The case for story selling
When I asked Ash what matters more—the maths or the story—his answer was immediate: “The story, every single day.”
Coming from an actuarial modelling background, that is quite an admission. Mathematics provides discipline and checks cognitive bias, but having the right number means nothing if nobody listens. Early in his career, Ash presented a $10 million breach loss projection to an executive committee, only to be practically laughed out of the room because the figure felt entirely detached from their operational reality.
That failure prompted a pivot towards decision engineering and story selling. Drawing on target audience analysis from his military days, Ash began profiling key stakeholders before board meetings: what motivates the general counsel, the CRO, or the CFO this quarter? If the board wanted an extra 5% in revenue, he showed how mitigating specific operational friction protected that exact goal.
He credited this shift to reading outside the security canon—Pixar storyteller Matthew Luhn, measurement expert Sam Savage, and David McCandless’s Information Is Beautiful. He turned to intuitive ratios, operational hours saved, and clear visuals.
Borrowing from Toyota: Cyber security as quality control
Looking ahead, Ash argues that enterprise cyber security will mirror modern software factories rather than traditional SecOps.
He drew directly on Toyota’s total quality management revolution from the 1960s. Instead of treating quality as an inspection stage at the end of an assembly line, Toyota made it an intrinsic, collective responsibility using Kaizen (continuous feedback) and Muda (ruthless elimination of process waste).
Cyber security has done the opposite: we excel at detection while remaining inept at remediation. As Ash put it, you cannot bring observability into an environment, 100x the visibility of problems, and offer no viable means of remediating them at scale. True resilience is not about thicker perimeter walls; it is about shrinking the time between detecting a defect and fixing it at root through automation and continuous, machine-readable assurance.
Stepping out of the security bubble
For practitioners looking to mature their approach without drowning in theory, Ash offered four practical rules:
1. Master measurement fundamentals. Read Doug Hubbard’s How to Measure Anything in Cybersecurity Risk and explore Sam Savage’s work. Understand why you measure before building complex models.
2. Read outside technical disciplines. Study communication, narrative structure, and data visualisation. If you cannot sell your narrative to the board, your data is useless.
3. Stop conference navel-gazing. The industry echo chamber helps no one. Attend the events your commercial frontline goes to, sit with sales and client services, and learn how the business actually makes money.
4. Anchor to first principles. Strip the organisation back to build and sell. Target process waste (Muda). Removing operational drag for colleagues builds the corporate capital needed to deliver meaningful security change.
The ultimate goal of cyber risk management is not to build the cleverest model in the room. It is to understand your business so intimately that you can engineer better decisions and tell stories that genuinely move the needle.
