What Is the FAIR Risk Model and How Does It Work?

The FAIR risk model, short for Factor Analysis of Information Risk, is a framework for measuring cybersecurity and operational risk in dollars rather than in labels like “high” or “medium.” It works by breaking a risk scenario into a tree of variables covering how often losses happen and how much they cost, feeding calibrated estimates into a Monte Carlo simulation, and producing a distribution of probable annual loss. The framework is maintained by The Open Group as an open standard.¹

What makes FAIR different from most risk methods is the output. Instead of a color on a heat map, you get a number the CFO recognizes: an expected annualized loss, a probability of exceeding any given dollar threshold, and a documented set of assumptions behind both.

How FAIR Defines Risk

FAIR defines risk as the probable frequency and probable magnitude of future loss.² That definition splits into two branches that run through the entire taxonomy: loss event frequency on one side, loss magnitude on the other. Every variable in a FAIR analysis sits somewhere under one of those branches.

Keeping frequency and magnitude separate prevents a common mistake. A likely-but-cheap risk and a rare-but-catastrophic risk can produce similar averages, but they call for very different responses. FAIR forces the analyst to look at both dimensions before combining them.

Loss Event Frequency: How Often Losses Happen

The frequency side answers one question: in a given year, how many times will a specific threat actually cause a loss? It decomposes into two layers.

Threat Event Frequency

Threat event frequency is how often a threat agent acts against an asset. It splits into contact frequency (how often the threat comes into proximity with the asset, physically or over a network) and probability of action (the chance that contact leads to an actual attempt). A tornado that reaches a data center always acts, so its probability of action is essentially 100%. An automated port scan that finds nothing interesting might never escalate to a real attack, and its probability of action is much lower.

Vulnerability

Not every threat action produces a loss. In FAIR, vulnerability is specifically the probability that a threat event becomes a loss event, between 0% and 100%.³ It depends on threat capability (the force a threat agent can bring to bear) and resistance strength (how well the organization’s controls hold up).

The FAIR Institute uses the image of a weight hanging from a rope. Threat capability is the weight; resistance strength is the tensile strength of the rope. If the weight exceeds what the rope can carry, the rope breaks. A commodity exploit kit against a fully patched system with multi-factor authentication is low weight on a strong rope, so vulnerability is low. A skilled attacker targeting an unpatched legacy application flips the picture, and vulnerability climbs toward certainty.

Loss Magnitude: What Losses Cost

The magnitude side measures financial damage when a loss event actually materializes. FAIR splits this into primary and secondary losses, each evaluated across six specific forms.⁴

The Six Forms of Loss

Productivity: revenue or output lost when operations stall, including wages paid to workers who cannot do their jobs during an outage.
Response: the cost of managing the incident itself, including forensic investigators, legal counsel, crisis communications, and overtime.
Replacement: expenses for repairing or replacing damaged assets, whether physical servers or corrupted databases.
Fines and judgments: penalties imposed through regulatory action, civil litigation, or contractual breach.
Competitive advantage: losses from compromised intellectual property or strategic information that erodes market position.
Reputation: the financial fallout when customers, partners, or investors lose confidence and take their business elsewhere.⁴

Primary Versus Secondary Loss

Primary losses hit the organization directly from the event itself. If ransomware takes down a production line for three days, the lost output and recovery costs are primary. The organization bears them whether or not anyone outside the company ever finds out.

Secondary losses come from the reactions of external parties, called secondary stakeholders. A data breach might produce no secondary loss if the exposed data was encrypted and the keys stayed secure. If attackers obtain plaintext personal information, the probability of lawsuits, regulatory fines, and mandatory credit monitoring rises sharply. Fines and judgments almost always sit on the secondary side because they are imposed by outside parties in reaction to the event.⁵

Secondary Loss Event Frequency

Not every primary loss event triggers secondary consequences, and FAIR handles that with an explicit probability called secondary loss event frequency. An encrypted database breach where the keys remain intact might have a secondary loss event frequency near zero. The same breach with compromised keys pushes that probability toward certainty.⁵ Many informal risk analyses either assume secondary losses always follow or ignore them entirely; FAIR forces the estimate.

Building the Inputs

Before any math happens, the scenario needs a tight scope. “We might get hacked” produces useless numbers. A workable scenario names the specific asset (a customer database with 50,000 records, a payment processing application), the threat community (organized cybercriminals, disgruntled insiders, nation-state actors), and the loss event type (unauthorized data exfiltration, denial of service, data corruption).

Data Sources

Inputs come from several places. Internal incident logs and security monitoring data provide organization-specific history. Industry reports such as the Verizon Data Breach Investigations Report offer benchmarks on breach frequency and attack patterns across sectors. Subject matter experts fill the gaps where hard data does not exist.

Every input is recorded as a range with a minimum, most likely, and maximum value, not a single number. A security engineer might estimate the organization sees between 500 and 5,000 external scanning attempts per month, with 2,000 as the most likely. Ranges keep the analysis honest about what is known and what is guessed.

Calibrated Estimation

Human estimators tend toward overconfidence. Someone who says they are 90% sure the answer falls in their range is often right only 50 to 60% of the time. FAIR addresses this with calibrated estimation, a structured technique for improving subjective inputs.⁶

The process runs in four steps. Start with absurdly wide bounds to break the anchoring instinct. Eliminate values that are clearly impossible. Reference known data points to narrow the range. Then apply the equivalent bet method: compare betting on your range against spinning a wheel with a 90% chance of winning. If the wheel feels safer, widen the range. If your range feels obvious, narrow it. The target is a range that reflects roughly 90% confidence.⁶

Running the Monte Carlo Simulation

With calibrated ranges populating every variable, FAIR uses Monte Carlo simulation to run the scenario thousands of times.⁷ Each iteration randomly samples from the input ranges, calculates the resulting loss, and records the outcome.

The output is not a single number but a distribution. The annualized loss exposure is the expected value, the average loss you would see over many years. The distribution also reveals the tail: scenarios where losses spike well past the average. A scenario might show an average annualized loss of $2 million with a 10% chance of exceeding $8 million. For executive decisions, the tail often matters more than the average, because it is the scenario that threatens financial stability.

Reading a Loss Exceedance Curve

The loss exceedance curve is one of the most practical outputs. It plots dollar thresholds on the horizontal axis against the probability of losses exceeding each threshold on the vertical axis.⁸ Pick a dollar amount, find where it meets the curve, read across for the probability.

That turns abstract debates into concrete ones. If cyber insurance covers incidents up to $3.5 million, the curve might show a 52% probability of losses exceeding that limit.⁸ That number supports a request for higher coverage more effectively than “our risk is rated high.” Overlaying the exceedance curves for the current state and a proposed control investment shows the financial value of that investment as the gap between them.

Mapping Results to Risk Appetite

Quantitative results become actionable when compared against the organization’s stated tolerance. The FAIR Institute recommends a three-step mapping.⁹

Identify the relevant loss types for each scenario, usually organized around confidentiality, integrity, and availability. Define thresholds for each. A threshold might allow no more than one availability event per year affecting revenue-generating applications, or declare any confidentiality breach over 10,000 records unacceptable. Then run the FAIR analysis on the top risks and compare the quantified exposure to those thresholds.⁹

When a risk exceeds its threshold, you have a documented, financially grounded case for remediation spending. When it sits within tolerance, you avoid spending on problems that do not warrant it.

How FAIR Fits With Control Frameworks

FAIR does not replace frameworks like NIST CSF, ISO 27001, or CIS Controls. Those frameworks tell you what controls to implement. FAIR tells you which of those controls matter most in your environment by attaching dollars to the risk each control addresses.¹⁰

An organization working through NIST CSF 2.0 can use FAIR to quantify the financial exposure of each identified gap and prioritize remediation by expected loss reduction.¹¹ Without that layer, security teams tend to treat every gap as equally urgent, which spreads budgets thin.

Tools and Certification

A well-structured spreadsheet with a Monte Carlo add-in can handle simple FAIR scenarios. FAIR-U is a free training application from the FAIR Institute that walks users through scoping, data collection, and simulation for a single scenario at a time.¹² Commercial platforms provide portfolio-level views and integration with asset inventories when an enterprise needs to aggregate many scenarios at once.

The Open Group administers the Open FAIR certification program. The Part 1 exam has no prerequisites, no minimum work experience, and no mandatory training hours. Candidates can prepare through self-study using the published O-RA and O-RT standards or by taking an accredited course. Exam fees vary by region; The Open Group advises contacting your regional test center for current pricing.¹³

Relevance to SEC Cybersecurity Disclosure

Public companies face SEC rules that make quantitative risk analysis increasingly useful. The SEC’s 2023 final rule on cybersecurity risk management requires registrants to describe their processes for assessing, identifying, and managing material cybersecurity risks in annual filings, and to disclose whether cybersecurity risks have materially affected or are reasonably likely to affect their business strategy, operations, or financial condition.¹⁴

The rule does not mandate any specific methodology.¹⁴ Producing annualized loss exposure figures and loss exceedance probabilities with documented assumptions gives an organization something concrete to show when regulators or auditors ask how the board actually oversees cyber risk.

1
FAIR Institute. What is Open FAIR and Who is The Open Group
2
FAIR Institute. FAIR Terminology 101 – Risk, Threat Event Frequency and Vulnerability
3
FAIR Institute. Threat Capability and Resistance Strength – A Weight on a Rope
4
FAIR Institute. FAIR Risk Basics – What Is Loss Magnitude
5
FAIR Institute. Primary vs. Secondary Loss in FAIR Analysis – Whats the Difference and Why It Matters
6
FAIR Institute. Calibrated Estimation for FAIR Cyber Risk Quantitative Analysis
7
The FAIR Institute. 7 Basic Tools for FAIR Cyber Risk Analysis
8
FAIR Institute. Announcing Loss Exceedance Charts in the FAIR-U Training App
9
FAIR Institute. Define Your Companys Appetite for Risk with FAIR Analysis
10
FAIR Institute. 10 Reasons Why FAIR Is Winning as the Standard Risk Analysis Model
11
FAIR Institute. Use FAIR to Build a NIST CSF 2.0-Based Cyber Risk Management Program
12
FAIR Institute. Now Available – Practice FAIR with Our Free Training App
13
The Open Group. Open FAIR Certification – How to Get Started with Individual Certification
14
U.S. Securities and Exchange Commission. Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure