AI Doesn't Give Us Judgmen

Is AI helping us make better decisions or just giving us more data to misinterpret? In this episode of The Watchtower, Ash Hunt speaks with Tony Martin-Vegue, founder of NinetyFive Risk Advisory and author of From Heat Maps to Histograms, about cyber risk, decision-making, and the role of AI in risk analysis. Tony explains why security teams often have more data than they realize, but still need the judgment to evaluate that data, understand its quality, and use it responsibly. Highlights -Why AI can supercharge risk analysis without replacing human judgment -How LLM outputs should earn their way into a risk model -Why red/yellow/green heat maps limit executive risk conversations -How cyber risk quantification helps security leaders speak in business terms -What cybersecurity can learn from meteorology, epidemiology, actuarial science, and financial risk management Connect Tony Martin-Vegue on LinkedIn: https://www.linkedin.com/in/tonymartinvegue/ 95 Risk Advisory: https://www.95riskadvisory.com/ Chapters 0:00 The judgment problem AI can't solve 1:24 From IT janitor to risk analyst with Tony Martin-Vegue 5:19 Explaining risk in dollars vs colors 9:35 Not enough data is not an excuse 13:50 The DBIR, data quality, and the 500-report flood 16:46 Industry reports or Twitter polls 17:39 Decision engineering: operating under uncertainty 20:35 The CISO's real job isn't stopping attacks 21:31 The most influential cybersecurity book 28:41 AI launders bias 31:49 Decision engineering at scale: agentic context across the business 39:43 Cyber risk math was invented by 18th-century gamblers 41:20 What cybersecurity needs to steal from other fields 43:44 Toyota, Taylorism, and why your heat map has to die 45:53 Where to find Tony and the book