David White

About David White

I’m a risk quantification evangelist and educator focused on advancing cyber resilience in the systems that matter most—energy, water, healthcare, finance, and other critical infrastructure.As President and Co-founder of Axio, I help organizations move beyond vague risk scores to understand cyber risk in financial terms. Our approach blends cybersecurity assessment with impact-centric risk modeling, enabling leaders to make smarter decisions about controls, insurance, and resilience planning. I lead Axio’s work with the U.S. Department of Energy, the Cyber Risk Institute, and other key clients and contribute to policy efforts shaping the future of cyber risk oversight.Earlier in my career, I was lead architect of the DOE’s Cybersecurity Capability Maturity Model (C2M2) v1.0, co-authored the CERT Resilience Management Model, and built tools and models still used today across the public and private sectors. Before Axio, I worked at the CERT Division of Carnegie Mellon’s Software Engineering Institute, supporting the U.S. Department of Defense, DHS, and major corporate clients.I now spend most of my time speaking, teaching, and collaborating—with boards, regulators, and cyber leaders. I also serve as faculty for Navigator, an executive education program developed by ISTARI and the University of Cambridge Judge Business School, helping CISOs become business leaders.At heart, I believe in doing well by doing good—building fair, rational, and resilient systems to protect people, infrastructure, and communities.

Experience

1. President & Co-founder

   Axio

   Jun 2013 — Present · Atlanta, GA, US

   As President and Co-founder of Axio, I help organizations understand and manage cyber risk in financial terms—so they can make informed, strategic decisions about resilience. I lead Axio’s work with the U.S. Department of Energy, the Cyber Risk Institute, and other partners across critical infrastructure sectors, including energy, water, healthcare, and finance.My focus is on evangelizing the use of impact-centric risk quantification and shaping policy conversations around resilience. I spend most of my time speaking, teaching, and advising leaders—helping CISOs translate technical risk into the language of business, and supporting boards in their oversight responsibilities.Key highlights: • Co-developed Axio’s approach to impact-centric risk quantification and integrated cybersecurity assessment. • Lead engagements with U.S. government agencies and key industry groups to advance cyber risk practices. • Faculty for Navigator, an executive education program by ISTARI and the University of Cambridge Judge Business School.

Education

• North Carolina School of Science and Mathematics

  High School

  1981 — 1983

• Carnegie Mellon University

  MS, Civil Engineering, Robotics

  1987 — 1989

• Carnegie Mellon University

  BS, Civil Engineering, Engineering and Public Policy

  1983 — 1987