When he left physics, John Breit had the choice of a job in naval intelligence or on Wall Street. "My wife said I couldn't be a spy. She hates capitalism, but said to go to Wall Street," he told me recently. "And then I ended up running a spy network."

Calvin Trillin once attributed the financial collapse to the influx of smart people on Wall Street. The physicists, computer scientists and mathematicians displaced the slow-thinking country club types. With their incomprehensibly complex models, the smart guys' hubris brought our economy low.

Mr. Breit was part of that initial incursion. A Ph.D. in physics from Columbia, he was doing postdoctoral work when he realized that he could never be as good as his contemporary Edward Witten, who went on to pioneer string theory.

So in 1986, he joined Wall Street, moving not to the trading floor, like many of his fellow rocket scientists, but into risk management. In 1990, he took his skills to Merrill Lynch, rising to become the firm's head of market risk oversight. The physicist came to understand the limits of mathematical models. He learned that his job was really psychologist, confessor and detective. He became the financial version of a counterintelligence officer, searching for the missed clues and hidden dangers in the firm's trading strategies.

Mr. Breit is retired now, studying ancient Greek in his spare time and volunteering as an adviser for New York's pension funds. He comes across as George Smiley if he were a Southerner — gracious, reluctant to talk about himself, with iconoclastic opinions just below the surface. I've been talking to him periodically over the years about how giant financial institutions should manage the aggressive traders slinging giant sums around the world in ever more complex transactions.

After the Senate issued a report last month on JPMorgan Chase's multibillion-dollar "London Whale" trading loss, an incident where the mathematical modeling went seriously wrong, I reached out to him again.

That debacle encapsulates much of what is wrong about how banks manage their risk and how the regulators oversee those efforts. At JPMorgan Chase, the risk models hid — and were used to hide — risks from the traders and top executives. Too many measures and too many numbers undid the risk managers. But ultimately, they failed because of human frailties; the risk managers lost sight of their mission and tried to protect the traders and their trades. As in all spy debacles, the counterintelligence officers got co-opted.

Early in his career, Mr. Breit figured out that models for markets aren't like those for physics. They don't come from nature. It was necessary to know the math, if only so that he couldn't be intimidated by the quantitative analysts.

But the numbers more often disguise risk than reveal it. "I went down the statistical path," he said. He built one of the first value-at-risk models, or VaR, a mathematical formula that is supposed to distill how much risk a firm is running at any given point.

The only thing from capital markets math he came to embrace was this immutable law of nature: Investors make money by taking risk. "If it's profitable and seems riskless, it's a business you don't understand," he told me.

Instead of fixating on models, risk managers need to develop what spies call "humint" — human intelligence from flesh and blood sources. They need to build networks of people who will trust them enough to report when things seem off, before they become spectacular problems. Mr. Breit, who attributes this approach to his mentor, Daniel Napoli, the former head of risk at Merrill Lynch, took people out drinking to get them to open up. He cultivated junior accountants.

"They see things first," he said. "Almost every trading debacle was sitting on some accountant's desk."

All the while, he was on the lookout for bad trades. Most traders who get into trouble, he thinks, aren't bad guys. The bad ones, who try to cover up improper trades, are relatively easy to detect. The real threat, he said, comes from the "crazy ones" who really believe they've found ways to spin flax into gold. They can blow up a firm with the best of intentions.

They don't do it suddenly. "I hate the whole Black Swan concept," he said, referring to the notion, popularized by Nassim Nicholas Taleb, that the true risks lie in unforeseeable events that occur with much more frequency than the mathematical models suggest. "It takes years of concerted effort to lose a lot."

Yes, a big market move might reveal a fatally flawed trade, but that volatility is not the root cause of an oversize loss.

The problem, as Mr. Breit sees it, is that this has nothing to do with how risk management is practiced today, or what the regulators encourage. Regulators have reduced risk managers to box checkers, making sure they take every measure of risk and report it dutifully on extensive forms. "It just consumes more and more staff, turning them into accountants and rotting brains."

Take VaR. In Mr. Breit's view, Wall Street firms, encouraged by regulators, are on a fool's mission to enhance their models to more reliably detect risky trades. Mr. Breit finds VaR, a commonly used measure, useful only as a contrary indicator. If VaR isn't flashing a warning signal for a profitable trade, that may well mean there is a hidden bomb.

He despises the concept of "risk-weighted assets," where banks put up capital based on the perceived riskiness of the assets. Inevitably, he argues, banks will "pile into" the same types of supposedly safe investments, creating bubbles that make the risks far more severe than the initial perceptions. Paradoxically, risk-weighting can leave banks setting aside the least capital to cover the biggest dangers.

"I could not be more disappointed," he said. "The cynic in me thinks this is all in the interests of senior management and regulators to avoid blame. They may not think they can prevent the next crisis, but they then can blame the statistics."

Instead, Mr. Breit believes that regulators should encourage firms when they reach different conclusions on what is risky and what is safe. That creates a diverse ecosystem, more resilient to any one pestilence.

And the regulators should empower risk managers by finding out how many times they meet with chief executives and what they have recently vetoed and by judging whether the traders respect the executive. "It's all completely unquantifiable and vague," he said, adding that a risk manager should be divorced from the profit and loss statement, the one "who throws sand in the gears."

Mr. Breit's sand-throwing days are over now. Undermined during the credit boom, as the firm's head, E. Stanley O'Neal, became isolated and paranoid, he resigned his position in the middle of 2005 (but stayed at the firm). By the summer of 2007, he realized that something was terribly wrong with Merrill Lynch's subprime mortgage exposure. He began calling in favors from junior finance staff members to find out what was going on and became alarmed. Eventually, Mr. O'Neal called him in, seemingly thinking that Mr. Breit was still his risk manager. It was too late for anyone to save the firm from billions in losses.

When he resigned his position at Merrill Lynch, did a board member or regulator call him to ask why?

"Not a one," he told me. Government overseers need to develop human sources, too.