What is FAIR risk quantification?
Glossary
The short answer |
|---|
FAIR (Factor Analysis of Information Risk) is a quantitative model for measuring cyber and operational risk in financial terms. It defines risk as the probable frequency and probable magnitude of future loss, breaks each into measurable factors, and uses ranges and simulation to estimate expected loss in dollars. FAIR is published as an open standard, Open FAIR, by The Open Group. |
How does FAIR work?
FAIR splits risk into two branches and keeps breaking them down until each factor can be estimated:
Factor | What it means |
|---|---|
Loss event frequency | How often a loss is likely to happen in a given period |
Threat event frequency | How often a threat acts against the asset |
Vulnerability | The chance a threat event becomes a loss event |
Loss magnitude | How much a single loss event costs |
Primary loss | Direct costs, such as response, recovery and lost revenue |
Secondary loss | Costs from others’ reactions, such as fines, lawsuits and lost customers |
Analysts enter ranges for each factor, then run a Monte Carlo simulation, which repeats the calculation thousands of times with random values from those ranges. The output is a distribution of possible annual losses, rather than a single number.
Why does FAIR matter for startups?
Startups have limited engineering time and must choose what to fix. A list of 50 high-severity findings does not tell you which three to fix this week. Pricing risk in dollars does: it shows which issues could actually cost the business the most, and lets founders weigh a fix against shipping a feature using the same units they use for every other decision.
Common uses of FAIR
Prioritization: rank vulnerabilities and risks by expected loss, not severity labels.
Budgeting: compare the cost of a control with the risk it removes.
Board and investor reporting: describe security risk in financial terms.
Insurance: inform decisions about cyber insurance coverage levels.
How NexusVoid handles it
Argus, NexusVoid’s application security product, prices the risk of findings in dollars using FAIR, alongside mapping them to MITRE ATT&CK with attack paths. That gives every finding a business cost and an owner, so the team can see which fixes matter most before opening the pull request Argus prepares.
Related terms
MITRE ATT&CK
ASPM (application security posture management)
Vulnerability scanning
vCISO (virtual CISO)
Autonomous CISO
Frequently asked questions
Who created FAIR and who maintains it?
FAIR was developed by Jack Jones, a former CISO, and is promoted by the FAIR Institute, a nonprofit. The model is published as an open standard by The Open Group under the name Open FAIR, made up of the Risk Taxonomy (O-RT) and Risk Analysis (O-RA) standards. Practitioners can be certified in Open FAIR through The Open Group.
How is FAIR different from a high, medium, low risk rating?
Qualitative ratings such as high, medium and low are quick but hard to compare or add up, and two people often rate the same risk differently. FAIR produces a dollar range with a likelihood, such as expected annual loss between two figures. That lets you compare risks directly, weigh them against the cost of fixing them, and explain them to executives.
Do I need a lot of data to use FAIR?
Less than most people expect. FAIR works with calibrated estimates expressed as ranges, such as a minimum, most likely and maximum value, then uses Monte Carlo simulation to combine them. Better data narrows the range, but you can start with industry data and informed estimates. The FAIR Institute notes that basic analyses can even be run in a spreadsheet.
Does FAIR replace frameworks like ISO 27001 or NIST CSF?
No. Control frameworks describe what security practices you should have. FAIR measures how much risk exists and how much a given control would reduce it, in financial terms. The two work together: frameworks tell you what to do, and FAIR helps you decide what to do first and how much to spend.
Want to know what your top security risks would cost in dollars? Book a call at /contact.
Something wrong in this post? Tell us at lakshay@nexusvoidai.com and we will fix it and say so.
More terms
ASPM
ASPM pulls the findings from all your application security tools into one prioritized view, so a small team fixes the risks that matter first.
Attack surface management
Attack surface management continuously finds everything you expose to the internet, including what you forgot about, and flags what an attacker could use.
Autonomous CISO
An autonomous CISO is software that runs the day-to-day work of a security program, so startups get continuous security, with compliance following from it.
Start with a real security program.
Tell us what you need to fix first and we will show that part live, on a stack like yours.