Deep-dive on Cyber Risk Quantification and GRC w/ Tony Martin-Vegue from Netflix

In this episode of the GRC Engineer podcast, Ayoub interviews Tony Martin-Vegue, a seasoned risk quantification expert from Netflix, about his career journey and insights on cyber risk management. Tony shares his background in IT and economics, leading him to risk management and quantitative risk analysis using the FAIR framework. The discussion covers the importance of viewing GRC as a business enabler, the distinction between CRQ and FAIR, and the benefits of quantified risk assessments for various stakeholders, including executives and risk owners. Tony emphasizes the need for flexibility in risk management, considering options beyond mitigation, and leveraging AI to streamline data collection for CRQ. He also provides practical tips for beginners interested in CRQ, recommending Doug Hubbard's book and the IRIS report, and shares his contrarian view on security awareness training.