Cyber Risk Quantification: FAIR Methodology and Software for Mid-Market Companies
What is cyber risk quantification and why does it matter for mid-market organisations?
Cyber risk quantification is the discipline of expressing cyber and information security risks in financial terms - as a range of potential loss - rather than as a qualitative label (high, medium, low) on a colour-coded heat map. The shift from qualitative to quantitative matters because it makes cyber risk comparable with other financial risks, supports investment decisions on security controls, informs cyber insurance sizing, and satisfies the risk reporting expectations of NIS2 (Directive (EU) 2022/2555) and DORA (Regulation (EU) 2022/2554) for entities in scope.
The dominant method for cyber risk quantification is the FAIR model (Factor Analysis of Information Risk), developed by Jack Jones and formalised by The Open Group. FAIR decomposes the two top-level factors - Loss Event Frequency and Loss Magnitude - into sub-factors that can each be calibrated from available data. The output is a probability distribution of loss exposure, not a single point estimate, which avoids the false precision that qualitative scales and invented averages introduce. This article explains the FAIR model, its data requirements, how to communicate results, and where software reduces the analytical burden. It links to cyber risk mapping, the starting point for quantification and to NIS2 and DORA that require quantified ICT risk assessment.
FAIR method: Loss Event Frequency and Loss Magnitude
The FAIR ontology structures cyber risk as the combination of two top-level factors: Loss Event Frequency (LEF) and Loss Magnitude (LM). Loss Event Frequency is how often a loss event is expected to occur within a defined time horizon, typically one year. Loss Magnitude is the financial impact when a loss event does occur.
LEF is itself a function of Threat Event Frequency (how often a threat agent attempts to act against the asset) and Vulnerability (the probability that an attempt succeeds given the controls in place). LM decomposes into Primary Loss (direct costs: investigation, notification, remediation, business interruption) and Secondary Loss (indirect costs: regulatory fines, litigation, reputational damage). Each sub-factor is estimated as a range rather than a point value, using expert judgement calibrated against historical data. The Monte Carlo simulation built into FAIR-compliant tools then generates a probability distribution over potential annual losses by sampling from those ranges. The resulting output is a range such as a likely loss interval at a given confidence level - derived from the model's own output, not invented.
Data sources for calibration
The accuracy of a FAIR analysis depends on the quality of the data used to calibrate each sub-factor. Four types of data source are used in practice.
Internal loss data: the organisation's own incident records, including near-misses, provide the most directly relevant input for both frequency and magnitude estimates. Many mid-market organisations underestimate the value of their incident log as a calibration source.
External loss databases: industry databases of reported cyber incidents provide frequency and magnitude benchmarks by sector, attack type, and organisation size. These databases are the primary calibration source when internal data is sparse.
Threat intelligence feeds: structured threat intelligence about the tactics, techniques, and procedures of relevant threat actors informs the Threat Event Frequency estimate by providing context on how active and capable those actors are.
Control effectiveness assessments: vulnerability scan results, penetration test findings, and maturity assessments inform the Vulnerability sub-factor by describing how well current controls resist the threat scenarios being modelled. Combining these four sources allows the analyst to build estimates that are traceable to observable inputs rather than to intuition.
Communicating results to leadership
The output of a FAIR analysis is a probability distribution, which requires translation before it is actionable for leadership. The standard communication format presents the annualised loss exposure at specific confidence levels derived from the model's output: the range within which the loss is most likely to fall, the tail risk at a higher confidence level, and the expected value. These figures allow the board and the executive committee to compare cyber risk with other financial risks using the same metric.
The most common communication failure is presenting a single number as though it were a prediction. A distribution communicates uncertainty honestly: it tells leadership that the organisation faces a range of possible outcomes, that the range has been derived from structured analysis of observable inputs, and that the width of the range reflects genuine uncertainty rather than analytical imprecision. Optivalue.ai provides reporting templates that translate FAIR model outputs into the governance reporting format that boards and audit committees can use to question and approve the investment decisions that follow from the analysis.
How software automates FAIR calculations
Running a FAIR analysis manually in a spreadsheet is possible for a single scenario. It becomes impractical when the organisation wants to quantify a portfolio of risks, run sensitivity analyses, or update the model as the threat landscape or the control environment changes. FAIR-compliant software automates the Monte Carlo simulation, manages the library of scenarios, and maintains the calibration data so that results are reproducible and updatable.
Optivalue.ai provides a platform that guides risk and security teams through the FAIR decomposition for each scenario, enforces the requirement to express sub-factor estimates as ranges rather than point values, runs the simulation, and produces the probability distribution output. The scenario library retains each analysis with its calibration sources and assumptions, creating an audit trail that demonstrates to regulators and insurers that the quantification was conducted with methodological discipline. Integration with the broader risk register allows cyber risk estimates to be presented alongside other enterprise risks in a single financial metric.
FAQ
What is the FAIR method for cyber risk? FAIR (Factor Analysis of Information Risk) is a quantitative model that expresses cyber risk as the probable financial loss arising from a specific threat scenario over a defined time horizon. It was developed by Jack Jones and formalised by The Open Group. Its two top-level factors are Loss Event Frequency and Loss Magnitude, each decomposed into sub-factors that are calibrated from data and expressed as ranges.
What is the difference between qualitative and quantitative cyber risk assessment? Qualitative assessment assigns labels such as high, medium, or low to risks using subjective scales. Quantitative assessment, as in FAIR, expresses risk as a range of probable financial loss derived from structured analysis of threat frequency, vulnerability, and loss magnitude. The quantitative approach makes cyber risk comparable with other financial risks and supports investment decisions that a label-based approach cannot.
Does FAIR require historical loss data? FAIR can be calibrated using a combination of internal incident data, external loss databases, threat intelligence, and control effectiveness assessments. Organisations with limited internal data use external benchmarks as the primary calibration source. The absence of internal data increases the width of the estimated range; it does not make the analysis invalid.
How does cyber risk quantification support cyber insurance decisions? A FAIR analysis provides the probable loss range for the scenarios the organisation faces, which directly informs the attachment point, coverage limit, and deductible decisions in a cyber insurance programme. Insurers increasingly request quantified risk assessments from policyholders in lieu of, or in addition to, qualitative risk questionnaires.
Which regulations require quantified cyber risk assessment? NIS2 (Directive (EU) 2022/2555) and DORA (Regulation (EU) 2022/2554) require entities in scope to assess and manage ICT and cybersecurity risks in a manner that enables comparison and reporting to management bodies. Both texts establish an expectation of rigour in risk assessment that qualitative scales alone may not satisfy for complex organisations.
Book a demonstration of Optivalue.ai
<!-- JSON-LD -->
Back to top