Josh Marker, is head of security and risk assurance at SAP, chair of the Dallas-Fort Worth FAIR Institute chapter, and one of our most experienced and thoughtful members. Josh’s first deep dive on FAIR was the 2018 FAIR Conference, and soon after he transitioned to a job doing full-time cyber risk quantification. “The quantitative aspect of FAIR just spoke to me,” he said.
If you’re facing a fresh-field opportunity to introduce FAIR to your organization, Josh gave us some persuasive talking points in this Meet a Member interview. The benefits of FAIR, he says come first not from the numbers but the language of risk management.
Watch the Meet a Member interview with Josh Marker
Key thoughts from Josh:
—“The language that we use becomes more clarified when you try to conduct a quantitative analysis. You realize very quickly that you have to have the words right.”
—“We mean so many things by ‘risk.’” We use risk in place of ‘threat actor’ or consequences of risk or control deficiencies…If we’re not careful about what we mean, it gets messy and hard to defend.”
—FAIR facilitates “productive disagreement.” If one person believes firmly that a risk is “medium” and another believes it is “high,” that’s the end of the conversation without a shared risk model. “Whoever outranks is the one who wins and that's not necessarily what we want collectively as a profession.”
—“What’s really important is, it’s not about being right. It’s about uncovering the concerns that people have and putting them in the right place…Uncovering some of these topics that we wouldn't otherwise, I think, have been some of the huge benefits of using FAIR, the terminology and the quantification.”
For more insights, watch the Meet a Member interview with Josh Marker.
Learn about the FAIR Institute local chapters.
Attend the 2025 FAIR Conference (FAIRCON25), November 4-5 in New York City.
