Michael Johnson Joins the FAIR Institute Board: A Lov-a-FAIR Story

Some people date FAIR. Michael Johnson has married it four times.

The FAIR Institute is delighted to welcome Michael Johnson, former CISO at Meta Financial Technologies and Capital One, to its Board of Directors. Michael has led cyber, IT and digital transformation in industry and in the US Government, and has implemented the FAIR model at four different organizations.

We sat down with Michael to hear his lov-a-FAIR story. Here is our conversation, with small edits for readability purposes. .

The meet-cute: a government job and a hard question

FAIR Institute: Every great lov-a-FAIR starts somewhere. When did you first cross paths with FAIR? Was it love at first quantification, or did it take a few dates to win you over?

Michael Johnson: I first became aware of FAIR in the mid-2000s, when I was still working in the US Government. I was looking for a best-practice way to translate cybersecurity and operational risk into mission impact and dollars. Starting in the late 2000s, I used security risk quantification and FAIR to manage IT and cybersecurity for a government organization with a $200M+ operating budget, a multi-billion-dollar execution budget and more than 500 government employees and contractors.

I later brought security risk quantification and FAIR into executive roles at commercial institutions, including a Fortune 60 bank and a Fortune 15 big tech company. Like so many others who have put FAIR to work, I was able to talk with CEOs, Department Secretaries, CFOs, other business executives and boards in terms of mission and business impact, financial exposure and investment tradeoffs, rather than merely technical severity.

The road to here: from nuclear weapons to social media

FAIR Institute: Walk us through the career journey that brought you here. What were the defining turns, and maybe a detour or two, that shaped how you think about risk?

Michael Johnson: Security risk quantification, prioritization and management have been part of my entire career leading cyber, IT and digital transformation in large, complex, information-intensive global enterprises. I've held leadership roles in industry at Hewlett-Packard, Capital One and Meta, and in the US Government at ODNI, the Executive Office of the President (OSTP), DHS and DOE. The work has covered the safety and security of everything from medical equipment to nuclear weapons, financial systems and global-scale social media services.

The key has always been creating a common quantitative foundation across cybersecurity and operational risk, and making risk appetite and tolerance explicit. FAIR helps organizations move from vague statements like "we have low tolerance for cyber risk" toward a real understanding of how risk is managed and what exposure is acceptable.

Making it official: four implementations, one conviction

FAIR Institute: Plenty of people admire FAIR from afar. What made you decide to put a ring on it and join the Institute's Board, and what do you hope to bring to the relationship?

Michael Johnson: As a security risk quantification practitioner, operator and organizational leader, I've implemented the FAIR model four separate times in my career. FAIR doesn't just quantify cyber risk; it makes risk decisions more defensible and transparent. It gives risk executives, whether CSOs, CISOs, CIOs, CROs or CFOs, a common conversation with operators, business executives, board directors, auditors and regulators about financial exposure, business impact and investment tradeoffs.

That helps organizations improve, and it also protects the company and the risk professionals' own careers. On a "bad day," like a major cyber event, that common view protects everyone's interests, because all parties were bought into the risk posture and the program decisions behind it.

Happily ever after: quantification becomes the norm

FAIR Institute: Fast-forward five years. How do you hope our industry will have evolved in the way it understands and manages risk, and what role should FAIR and the Institute play in getting there?

Michael Johnson: Even five years ago, there was a large divide between CISOs who understood and practiced security risk quantification, using it to run their programs and inform stakeholders like the board, and CISOs who did not. Today, in the post-Claude Mythos world, we're facing an extreme compression of time-to-exploit, a huge gap between discovery volume and remediation capacity, and new AI-based attack vectors. CISOs must prioritize based on real analytics.

That means prioritizing the risks that matter most, replacing subjective high/medium/low ratings with quantitative analysis, making better cybersecurity investment decisions, understanding whether controls actually reduce risk, and making risk appetite and tolerance explicit. That's no longer optional. It's required.

FAIR unlocks a language for cybersecurity, and for all operational risk, that boards and executives already understand and use to make every other business decision. My hope is that five years from now, using FAIR will be commonplace in how every company manages cybersecurity risk.

Welcome to the family, Michael

Michael joins the Board at a pivotal moment for the Institute as we build the next chapter of our mission. His mix of government and Fortune-scale experience, and his record of putting FAIR to work four times over, will help us make quantified risk management the standard rather than the exception.

Want to hear more about where the Institute is headed? Join us for FAIR Forward, our virtual event on November 10, 2026, where we'll unveil the strategy for FAIR Institute 2.0.

Please join us in welcoming Michael to the FAIR Institute Board of Directors. It's a match made in quantification.