Sasha Romanosky is a senior policy researcher at RAND. He researches the economics of cyber security, privacy, insurance, cybercrime, and national security. For example, he has examined how insurance companies price cyber risk, and whether a federal reinsurance program is warranted to address catastrophic cyber risks. He examined when firms are more likely to be sued (and settle) for a data breach, and studied the cost of data breaches to understand whether corporate losses are as severe as commonly believed. He has also developed a capability to identify, collect, and apply regression and NLP analyses to federal civil and criminal cases.
Romanosky was a research fellow in the Information Law Institute at New York University, and a security professional for over 10 years. He is one of the original coauthors of the Common Vulnerability Scoring System (CVSS), an open standard for scoring computer vulnerabilities, and EPSS, the Exploit Prediction Scoring System, an industry standard for predicting software vulnerability exploitation.
Romanosky is a former member of DHS's Data Privacy and Integrity Advisory Committee (DPIAC), and a former cyber policy advisor at the Pentagon in the Office of the Secretary of Defense for Policy (OSDP). While in DoD, he oversaw two of the Department's most critical vulnerability programs, and advised on other matters related to cyber security and cyber policy.
Romanosky holds a Ph.D. in public policy and management from Carnegie Mellon University.
Ph.D. in public policy and management, Carnegie Mellon University; B.S. in electrical engineering, University of Calgary
