What does it take for a risk number to support a real decision?
Session 1 · ERQI Global Virtual Risk Summit
Opening remarks: making uncertainty something we can decide on
Andrew Shea & David White
Overview
Andrew Shea and David White opened the inaugural Enterprise Risk Quantification Institute (ERQI) Global Virtual Risk Summit with one argument running through the institute's origins, its purpose, and a read of the major 2026 risk reports. Quantification earns its place when its output is trustworthy, defensible, and used in a decision someone has to make. Heat maps and risk registers still have a role, but they cannot tell a board how much capital to hold against a scenario.
Shea traced ERQI to a meeting in which a CISO's team presented cyber risk quantification to enterprise risk management colleagues, who filed it under operational risk and thanked them. That sent him to NIST IR 8286, a webinar series on integrating cyber and enterprise risk, and eventually a conversation with White. A little over a year later, the institute has more than 200 members, over a dozen distinguished fellows, and thirty-some co-founders, all volunteers with day jobs, as White noted. Registration for the summit stood at 217 people from 34 countries.
Session 1 recording, ERQI Global Virtual Risk Summit 2026
Trust, defensibility, and guidance
ERQI chose to publish guidance, not a standard. Shea cited Chris Patteson: "You use the right risk analysis approach for the right risk." Human judgment stays in the work. White put trust at the center of the purpose statement: numbers rigorous enough that an organization can bet on them.
Shea added defensibility, drawn from years of helping CISOs justify budget requests, and wants the output to inform capital allocation and budgeting, even to treat cybersecurity and technology as a cost of goods sold instead of an expense line. Seven work products are published, with about a dozen more due by year end, followed by open-source toolkits on GitHub and a member community on the Circle platform. Membership is free through 2026; Shea said 2027 is undecided.
What the 2026 reports say, and what replaces the heat map
Shea combined reports from the World Economic Forum, the United Nations, IRM Risk Trends and AICPA-CIMA. Geoeconomic and geopolitical conflict ranked first. He argued that every risk should be tied to a scenario, with geopolitical and climate factors modeled in, and that third-party risk belongs inside the main framework because nearly every scenario involves a third party. He called time and velocity of impact under-discussed and described AI sovereignty as a strategic concern. Cyber insecurity appeared at 3% as a material global crisis, a figure he asked cyber practitioners to read against the other percentages. White added that the pace of change is outrunning organizational response, that structure does not guarantee strategic value, and that quantification can help governance keep up.
Shea was careful to say that risk registers and heat maps have been valuable and remain widely used. His question was what a dot on a heat map tells anyone about capital to hold in reserve. He pointed to financial risk tools such as risk-adjusted return on capital and value at risk, and to Monte Carlo output read as a loss exceedance curve at P10, P50 and P90 instead of a single annual loss expectancy, then compared with appetite and tolerance. White agreed that color scales can remain a starting place ("all are welcome") and gave his own test for resilience, whether an organization will live to fight another day.
“That answer is financial, 100%.”
David White, on whether an organization will live to fight another day
Key takeaways
1
Guidance, not a standard
ERQI will publish practitioner guidance and tools, and keeps human judgment inside the analysis. The right approach depends on the risk.
Watch at 7:562
Defensible numbers
Shea and White tied the purpose of quantification to trust and defensibility, especially when a CISO has to justify a budget or the business has to allocate capital.
Watch at 11:323
Scenarios first
Shea argued that risks should be tied to scenarios, with macro factors such as geopolitics and climate modeled in. Third-party risk belongs in the same analysis.
Watch at 27:114
Distributions over dots
Loss exceedance curves read at P10, P50 and P90 support comparison with appetite and tolerance in ways a single number or a heat map cannot.
Watch at 50:445
Start with five
Shea scaled the slide's 10 to 20 enterprise scenarios down to five and challenged attendees to operationalize what they learn over the two days.
Watch at 56:48
