David White

Background

About David White

I’m a risk quantification evangelist and educator focused on advancing cyber resilience in the systems that matter most—energy, water, healthcare, finance, and other critical infrastructure. As President and Co-founder of Axio, I help organizations move beyond vague risk scores to understand cyber risk in financial terms. Our approach blends cybersecurity assessment with impact-centric risk modeling, enabling leaders to make smarter decisions about controls, insurance, and resilience planning. I lead Axio’s work with the U.S. Department of Energy, the Cyber Risk Institute, and other key clients and contribute to policy efforts shaping the future of cyber risk oversight. Earlier in my career, I was lead architect of the DOE’s Cybersecurity Capability Maturity Model (C2M2) v1.0, co-authored the CERT Resilience Management Model, and built tools and models still used today across the public and private sectors. Before Axio, I worked at the CERT Division of Carnegie Mellon’s Software Engineering Institute, supporting the U.S. Department of Defense, DHS, and major corporate clients. I now spend most of my time speaking, teaching, and collaborating—with boards, regulators, and cyber leaders. I also serve as faculty for Navigator, an executive education program developed by ISTARI and the University of Cambridge Judge Business School, helping CISOs become business leaders. At heart, I believe in doing well by doing good—building fair, rational, and resilient systems to protect people, infrastructure, and communities.