DefenseMetrics

Built a web-based security investment quantification tool, modeled after NIST CSF and FAIR frameworks. Users import a control library, build or select real-world MITRE ATT&CK-based attack path scenarios, and drag and drop controls onto attack path nodes to model defensive coverage. The platform calculates likelihood and impact reduction, factors in implementation realism (staffing, automation level), and generates board-ready financial reports.

A working tool for security and risk practitioners to translate technical controls into the financial terms a board or executive team can act on. This is active, evolving work — it already serves practitioners well, and is being refined further to be more executive-friendly.