About

I am a security practitioner at a public company. I lead the vulnerability management program, authored its standard against NIST CSF 2.0, and cut the aging backlog across 5,000+ assets by more than half in six months. I designed the FAIR risk quantification program: the analysis practices, the process flows, a citation library of 284 sourced industry data points, and the Monte Carlo model behind a loss dashboard presented to the CISO. I set the design, a cross-functional team built it under an executive-sponsored initiative, and the process was adopted. Before that I spent three years running completeness and accuracy testing on SOX access review controls across six applications, including a zero-cost application that avoided a six-figure commercial purchase.

I quantify cyber risk in dollars because dollars are how every other decision in a business gets made. Managerial accounting taught me that a proposal with positive net present value earns funding and one without it does not, and I saw no reason security should be exempt. A heat map cannot be ranked against a new product line or a plant expansion. A loss exceedance curve can, and when it is, the best investment on the table wins, whether or not it is a security control.

Bailey GRC exists to put that math in front of the people who sign budgets. FAIR Workbench produces the loss curves and treatment returns. CISO Debrief applies them to public incidents so a board member or CISO can take the same scenario, replace the inputs with their own, and know both what their exposure is and what it would cost to reduce it.

Everything here is my own work and my own view. Nothing on this site draws on, describes, or speaks for any organization I have worked with. Analyses use public sources only, cited in full.