Chief Information Security Officer

Andrew Jaquith is the Chief Information Security Officer for Scotiabank US. Andrew’s 25-year career as a CISO, CTO, executive, and cyber practitioner spans startups (with two successful exits), Fortune 100s, and global financial services firms. He founded Markerbench, a boutique consultancy specializing in cybersecurity. Through 2023, he served as the CISO of Covington & Burling LLP. He has served as a Managing Director in technology risk and cybersecurity for Goldman Sachs and JP Morgan Chase, respectively. He serves as a Board Advisor to SecurityScorecard, as an Advisor to Anetac, and as a member of the Technical Advisory Board of Panaseer. Andrew graduated from Yale University.

Prior to Scotiabank, Andrew was most recently the CISO of Covington & Burling LLP, a $1.5B AMLAW 50 firm with 14 offices in the US, EMEA, Asia Pacific and China. At Covington, Andrew was responsible for cyber and physical security globally. During his tenure, his focus areas included shrinking the firm’s external perimeter, implementing new security tools, expanding and upskilling the security team, de-risking Active Directory, shifting security services to the cloud, and speeding up the firm’s IT operating tempo to reduce risk.

Andrew’s prior experience includes serving as the CISO of QOMPLX, Inc, a cyber-security startup focused on critical enterprise infrastructure. He was the global Cyber Security Operational Risk Officer for JP Morgan Chase, and was a Managing Director for Technology Risk Measurement and Analytics at Goldman Sachs. Andy’s earlier roles include as Chief Technology Officer (CTO) of the managed security services provider SilverSky. He has held senior security analyst roles at Forrester Research and Yankee Group, and was a co-founder of @stake, a pioneering cyber-security consultancy. Andrew wrote the best-selling and definitive book on security metrics (“Security Metrics: Replacing Fear, Uncertainty and Doubt”), used by a generation of risk professionals to connect security to the corner office.

Andrew graduated from Yale University with a BA in Economics and Political Science. He lives with his family in New York.

This website does not reflect the opinions of my current or prior employers. All views expressed on this site are my own.

For technical details about how this website was made, see the Colophon.

Andrew Jaquith

Good Metrics

This essay is adapted from “Chapter 2: Defining Security Metrics” of my forthcoming book, Security Metrics: Replacing Fear, Uncertainty and Doubt from Addison-Wesley and Symantec Press, expected in early 2007. Small portions of this appeared in “The Future Belongs to the Quants,” an IEEE article co-authored by me, Dan Geer and Kevin Soo Hoo.

Information security is one of the few management disciplines that has yet to submit itself to serious analytic scrutiny. In security, business leaders ask:

9 min read ∙ October 15, 2006

Andrew Jaquith

Good Patch Management Metrics

Earlier today I stumbled across the NIST patch management pub; it was released in November 2005.

There’s lots of goodness in this document. What I like best are the recommended program metrics, which I reprint here, lightly edited:

2 min read ∙ March 3, 2006

Andrew Jaquith

Charging for Guaranteed Spam: Better Than It Sounds?

Much ink has been spilled over the recent AOL and Yahoo announcements that they will charge marketers five cents per e-mail to guarantee delivery of their mail, thus bypassing their spam filters.

Lots of people been rendered spitting mad by the plan. Three things seem obvious to me about how and why these plans came about:

3 min read ∙ February 12, 2006

Andrew Jaquith

Blended Threats == Hemlock Smoothies

An open letter to all anti-virus software makers: February 2, 2006 Dear Antivirus Industry, Why are you so addicted to the term “blended threat”? It seems to mean something special to you… but it means nothing to anybody else.

2 min read ∙ February 11, 2006

Andrew Jaquith

The Vulnerability Supply Chain

Yankee Group research may not be as well-subscribed as say, Gartner’s, but I like to think that it compares favorably with it. Earlier this year I wrote a research note titled Fear and Loathing in Las Vegas: the Hackers Turn Pro about the increasing number of vulnerabilities found in security products.

7 min read ∙ December 7, 2005

Andrew Jaquith

The Natives are Restless

Many readers know that my day job is as a security technology analyst for Yankee Group. Well, it’s about that time of year where we start to wind down our research calendar.

2 min read ∙ November 29, 2005