AM

Alex Morgan

Cyber Risk Quantification Consultant

London, UK
hello@alexmorganconsulting.com

Hello — I'm Alex.

I'm an independent consultant helping security and business leaders make better decisions about cyber risk. My work sits at the intersection of information security strategy and actuarial science: I translate the vague language of threats and vulnerabilities into the precise language of probable financial loss.

After spending [X] years inside [industry/organisations — add your background here], I realised that most security programmes were being run on intuition, compliance pressure, and heat maps — tools that feel rigorous but rarely tell decision-makers what they most need to know: how much is this risk likely to cost us, and what's the smartest pound we can spend to reduce it?

Open FAIR changed how I answer that question. It's the same probabilistic thinking that actuaries and insurers have used for decades — applied to information risk. I now build these models for clients across [sectors], helping them present cyber risk to boards, prioritise security investments, and justify budgets with evidence rather than gut feel.

Credentials & training

My practice is built on a combination of formal qualifications and practical experience in both strategy consulting and technical security.

Open FAIR Certification
The Open Group — FAIR Institute
CISSP / CISM
Placeholder — add your certifications
MBA / MSc [Field]
Placeholder — add your degree
FAIR Institute Member
Active community member & contributor

Career highlights

2024–
Independent Consultant
Alex Morgan Consulting
20XX–24
Previous Role — add your title
Previous Organisation
20XX–XX
Earlier Role
Organisation

What I believe

Measurement over maturity
Maturity frameworks tell you how you compare. Financial models tell you what risk costs. I believe boards need the second, not the first.
Transparency in models
A model you can't inspect is one you can't trust. I build open, auditable models — and I teach clients to run them independently.
Business first
Security exists to protect business value, not to achieve security for its own sake. Every recommendation I make flows from a business case.

Want to work together?

Start with a free 45-minute scoping call — no obligation.

Get in touch