Tony Martin-Vegue is a cyber risk consultant, speaker, and author with more than 25 years in security and risk. He’s spent most of them asking the same two questions about every risk: how much money is on the table, and how sure are we about the number?
He wrote From Heatmaps to Histograms. He’s built cyber risk quantification programs at Netflix and for some of the largest companies in the Fortune 100, and helped their leaders put dollar figures behind security decisions.
He also works on the data side of the field. As an Executive Fellow at the Cyentia Institute and a contributor to the 2026 Verizon Data Breach Investigations Report, he spends much of his time on where cyber risk numbers come from and whether they hold up.
He started CRQ Bootcamp, where he and Apolonio Garcia teach the book’s methods in live classes. He chairs the San Francisco chapter of the FAIR Institute, which named him a FAIR Ambassador in 2020, and he speaks regularly at FAIRCON, SIRAcon, and RSA.
Through 95 Risk Advisory, the consultancy he founded, he works with security teams on quantified assessments, program design, and how to present results to the people who control the budget.
He writes Field Notes, a free newsletter on cyber risk quantification, and longer essays at tonym-v.com. He lives in the San Francisco Bay Area.
Work with Tony
Consulting engagements and private workshops go through 95 Risk Advisory, and the training page has the workshop formats. CRQ Bootcamp starts with a free session. To book a talk, see the Speaking page on tonym-v.com, which has the topics, recordings, and a speaker kit.
From Heatmaps to Histograms