FAIR – Factor Analysis of Information Risk
FAIR helps people measure cyber risk in money.
Instead of saying a risk is “high,” “medium,” or “low,” or as “red”, “yellow”, or “green”, FAIR asks better questions:
- How often could something bad happen?
- How much money could we lose if it happens?
FAIR is useful because businesses need to make decisions. For example, should a company spend $50,000 on a new security tool? Should it hire more security staff? Should it accept the risk and do nothing?
FAIR helps answer those questions using numbers instead of guesses.
Who Created FAIR?
FAIR was created by Jack Jones.
Jack Jones worked in information security and risk management for many years. We worked together at Nationwide. He’s come to my risk events at CSAA Insurance as a speaker to get the Executive Leadership Team up to speed.
People often used vague words like:
- Critical
- Severe
- High risk
- Low risk
The problem was that these words meant different things to different people.
One person might say a cyber risk is “high” because it sounds scary. Another person might say it is “medium” because it has not happened yet. A business leader might ask, “How much money could this cost us?” and the security team might not have a clear answer.
Jack Jones wanted a better way. He developed FAIR to help organizations speak about risk in a clear, logical, and financial way. FAIR gave security teams a method to explain risk in terms that business leaders understand: dollars, probability, and impact.
Today, FAIR is widely used by companies, governments, and security professionals. It is also maintained as an open standard by The Open Group.
The Basic FAIR Formula
FAIR defines risk as the probable amount of loss from a future event.
In simple terms:
Risk = How often loss happens x How much loss costs
In FAIR language, this becomes:
Risk = Loss Event Frequency x Loss Magnitude
Let’s break that down.
Loss Event Frequency: How Often Will We Lose?
Loss Event Frequency, or LEF, means how often a loss is expected to happen during a period of time.
Usually, people measure this over one year.
For example:
- A company might expect one data breach every 10 years.
- A website might expect four outages per year.
- A person might expect one stolen password every few years.
FAIR calculates Loss Event Frequency by looking at two main things:
- Threat Event Frequency
- Vulnerability
Threat Event Frequency
Threat Event Frequency means how often a threat acts against something valuable.
A threat can be a person, a group, a system, or even nature.
Examples include:
- A hacker trying to break into an account
- An employee clicking a phishing email
- A storm damaging a data center
- A system failing
- A worker accidentally deleting a file
The key question is:
How often does the threat show up or take action?
For example, imagine a school email system gets phishing emails every day. That means the threat event frequency is high. The threat is showing up often.
Now imagine a small local business gets a serious hacking attempt only once every few years. That threat event frequency is lower.
Vulnerability
In FAIR, vulnerability does not just mean “a weakness exists.”
It means the chance that a threat event becomes a real loss event.
A threat event is when something tries to cause harm.
A loss event is when it actually succeeds and causes damage.
For example, a hacker may try to guess your password. That is a threat event.
If your password is strong and you use multi-factor authentication, the hacker probably fails. No loss happens.
If your password is “password123” and you have no extra protection, the hacker may succeed. Now it becomes a loss event.
FAIR looks at vulnerability by asking:
If the threat acts, how likely is it to succeed?
That depends on things like:
- How strong the attacker is
- How good your defenses are
- How easy the target is to attack
- How well people follow security rules
Putting Loss Event Frequency Together
Loss Event Frequency comes from combining:
Threat Event Frequency + Vulnerability
In simple terms:
- If attacks happen often and your defenses are weak, losses may happen often.
- If attacks happen often but your defenses are strong, losses may happen less often.
- If attacks almost never happen, losses may also be rare.
- If attacks are rare but your defenses are very weak, you could still have serious risk.
Here is a simple example.
A company gets 1,000 phishing emails per year. That is the threat event frequency.
Most employees report or delete them. A few people click. The company estimates that 1 percent of phishing emails might lead to a real security problem.
So:
1,000 phishing emails x 1 percent success rate = 10 loss events per year
That means the company might expect about 10 phishing-related loss events each year.
This is a simple example, but it shows how FAIR thinks.
Loss Magnitude: How Much Will It Cost?
The second major part of FAIR is Loss Magnitude.
Loss Magnitude means how much money is lost when a bad event happens.
For example, if a company has a data breach, the cost might include:
- Paying workers to fix the problem
- Hiring investigators
- Notifying customers
- Paying legal fees
- Paying fines
- Losing customers
- Losing sales
- Repairing damaged systems
- Losing trust
FAIR separates Loss Magnitude into two main types:
- Primary Loss
- Secondary Loss
Primary Loss
Primary Loss is the direct loss that happens to the organization.
This is the immediate cost of the event.
Examples include:
- Lost employee time
- Cost to repair systems
- Cost to replace hardware or software
- Cost to investigate the incident
- Lost revenue from downtime
- Emergency response costs
Imagine an online store goes down for four hours.
During that time, customers cannot buy anything. The company loses sales. Workers have to fix the issue. The IT team may work overtime.
Those are primary losses.
They happen directly because of the event.
Secondary Loss
Secondary Loss happens because other people react to the event.
This can include customers, regulators, lawyers, business partners, or the public.
Examples include:
- Government fines
- Lawsuits
- Customer refunds
- Loss of customers
- Bad news coverage
- Reputation damage
- Higher insurance costs
- Loss of business partners
For example, imagine a company loses customer data.
The primary loss includes fixing the system and investigating the breach.
The secondary loss might include customers leaving, regulators giving fines, and lawyers filing lawsuits.
Secondary loss can sometimes be much larger than primary loss.
Putting Loss Magnitude Together
FAIR calculates Loss Magnitude by adding the expected costs.
In simple terms:
Loss Magnitude = Primary Loss + Secondary Loss
However, there is one important detail.
Secondary loss does not always happen. Sometimes outside groups react strongly. Sometimes they do not.
So FAIR also considers the chance of secondary loss happening.
For example:
- There might be a 30 percent chance of a lawsuit.
- There might be a 10 percent chance of a major fine.
- There might be a 50 percent chance of losing customers.
FAIR uses these chances to estimate a realistic loss range.
A Simple FAIR Example
Let’s say a company is worried about ransomware.
Ransomware is a type of attack where criminals lock files and demand money.
The company estimates:
- Ransomware could happen once every 5 years.
- If it happens, the company could lose between $200,000 and $1,000,000.
Once every 5 years means the annual frequency is 0.2 times per year.
Now multiply frequency by magnitude.
If the average loss is about $500,000:
0.2 x $500,000 = $100,000 per year
This does not mean the company will lose exactly $100,000 every year.
It means the average yearly risk is about $100,000.
That number can help the company decide how much it should spend to reduce ransomware risk.
If a backup system costs $25,000 and greatly reduces the risk, it might be worth buying.
If a security tool costs $2,000,000 and only slightly reduces the risk, it might not be worth it.
Why FAIR Uses Ranges Instead of Exact Numbers
In real life, risk is uncertain.
You usually cannot say:
- We will have exactly 3 incidents next year.
- Each incident will cost exactly $50,000.
- Customers will react in exactly one way.
That is not realistic.
Instead, FAIR often uses ranges.
For example:
- We expect between 1 and 5 incidents per year.
- Each incident may cost between $10,000 and $100,000.
- There is a 20 percent to 40 percent chance of legal costs.
Ranges are better because they show uncertainty.
This is where Monte Carlo simulation becomes useful.
What Is a Monte Carlo Simulation?
A Monte Carlo simulation is a way to test many possible outcomes.
The name sounds advanced, but the idea is simple.
Imagine rolling dice.
If you roll one time, you get one result. That result does not tell you much.
If you roll 10,000 times, you start to see patterns. You can see what results happen often and what results are rare.
Monte Carlo simulation does something similar with risk.
A computer takes the ranges you provide and runs thousands or even millions of possible scenarios.
For example, you might tell the computer:
- Frequency could be between 1 and 5 times per year.
- Loss could be between $10,000 and $100,000 each time.
The computer then runs many trials.
In one trial, it might pick:
- 2 events
- $30,000 loss each
- Total loss of $60,000
In another trial, it might pick:
- 5 events
- $90,000 loss each
- Total loss of $450,000
After many trials, the computer creates a range of likely outcomes.
Why Monte Carlo Helps FAIR
Monte Carlo simulation helps FAIR give better answers.
Instead of saying:
“The risk is $100,000.”
FAIR can say something like:
- There is a 90 percent chance the loss will be between $40,000 and $300,000.
- The most likely loss is around $120,000.
- There is a small chance the loss could be more than $500,000.
This is much more useful.
Business leaders can see the best case, the most likely case, and the worst case.
They can also decide how much risk they are willing to accept.
Why FAIR Matters
FAIR matters because it helps people make smarter decisions.
Without FAIR, security decisions can be based on fear, opinions, or vague ratings.
With FAIR, people can ask:
- What are we protecting?
- What could happen?
- How often could it happen?
- How much could it cost?
- What can we do to reduce the risk?
- Is the solution worth the cost?
FAIR does not remove all uncertainty. No risk method can do that.
But it makes uncertainty easier to understand.
Final Thoughts
FAIR is a method for measuring information risk in a clear and practical way.
Jack Jones created FAIR because he saw that companies needed a better way to talk about cyber risk. Instead of using vague labels like high, medium, and low, FAIR uses probability and money.
The two biggest parts of FAIR are:
Loss Event Frequency: how often a loss is expected to happen
Loss Magnitude: how much money the loss could cost
Monte Carlo simulation helps by running many possible outcomes and showing a realistic range of risk.
In the simplest terms, FAIR helps answer this question:
How much money could we lose, and how likely is that loss?
That is why FAIR is so useful. It turns cyber risk from a guessing game into a decision-making tool.
