The FAIR (Factor Analysis of Information Risk) methodology was built for risk teams of twenty or more. Enterprise risk functions, dedicated quantitative analysts, six-figure platform licenses, multi-quarter implementation timelines. The methodology is excellent. The packaging assumes you're not the only person doing security at your company.
The 33 million US small and mid-sized businesses that need cyber risk quantification have one person doing security part-time. They don't have a quantitative risk team. They don't have a six-figure budget for a CRQ platform. They have a CFO who wants the security budget defended in dollars and a board that's tired of heat maps.
The FAIR methodology works perfectly for that company. The mid-market just needs a different way to apply it — full quantitative rigor, no enterprise overhead, executable in a Friday afternoon.
What is cyber risk quantification?
Cyber risk quantification (CRQ) is the practice of expressing cybersecurity risk in dollar terms — annualized loss expectancy, per-scenario probable loss, expected value under specific control assumptions — rather than in ordinal categories like "high / medium / low" or heat-map colors. The point is decision-relevance: security spending, insurance procurement, board reporting, and audit narratives all need a common unit that other functions already speak (finance, legal, insurance), and that unit is dollars.
A CRQ program answers four questions the ordinal register cannot: (1) What is our total annualized cyber loss exposure this year? (2) Which control investment reduces the most expected loss per dollar spent? (3) How does our exposure change under a specific incident scenario, at a specific control posture? (4) Is our insurance premium proportionate to our actual expected loss, or are we over- or under-insured? Each question requires numbers with real units attached; each collapses to hand-waving in a heat-map framework.
The distinguishing feature of modern CRQ is calibration — every input is either sourced (Verizon DBIR, Hiscox SME, sector reports) or estimated with an explicit confidence range, and the estimates are honest about uncertainty. A CRQ output that reports "expected annual loss = $312,000" without also reporting the 90th-percentile bound ("but could plausibly be as high as $840,000") is not CRQ, it's a false-precision spreadsheet. The good methodologies (FAIR is the largest, Axio and Safe Security are the notable alternatives) all get this right; the informal shortcuts usually don't.
Why FAIR feels heavy at mid-market scale
FAIR's reference implementation assumes you have time and people. The enterprise version of an annual FAIR program looks like this: dedicated FAIR analyst staff, scenario-modeling workshops with multiple stakeholders, Monte Carlo simulation across thousands of scenarios, formal calibration of expert judgments, peer-reviewed risk register, quarterly reassessment cycles, integration with enterprise risk management platforms.
None of that is wrong. All of it is overkill for a 50-person SaaS company.
The methodology itself is fine. The implementation pattern is what doesn't scale down. Mid-market companies that try to follow the enterprise pattern either give up at the workshop stage or produce risk assessments so elaborate that nobody can update them, which means they get done once and then sit in a folder.
A 50-person SaaS company doing CRQ "correctly" by the enterprise playbook would spend more on the CRQ program than on the security controls the program is supposed to inform. The math doesn't pencil. The mid-market needs a 90/10 implementation — 90% of the FAIR rigor with 10% of the operational overhead.
What FAIR actually requires (the core, stripped of overhead)
FAIR has six factors. That's it. Strip away the workshops, the platform, the analyst staff — what's left is six numbers you need per scenario to produce a defensible annual loss expectancy.
Six numbers. Three of them (TEF, Vuln, asset value) require thirty minutes of work per scenario, sourcing to published benchmarks. The other three are derived. That's the entire FAIR methodology, applied honestly, at mid-market scale.
CRQ methods and models: FAIR vs. Axio vs. Safe vs. the informal alternatives
FAIR is not the only CRQ methodology, and the choice matters more than most mid-market practitioners realize. Four approaches dominate the practical landscape; each has a different sweet spot and a different failure mode.
The practical mid-market answer is FAIR, done at 90/10 rigor. The methodology is open (no license), regulator-recognized (audit-defensible), portable (board members and insurance underwriters both speak FAIR), and functional at five-scenario scale. Axio and Safe Security are legitimate alternatives if the enterprise price point is affordable and the fit reasons apply. The informal approach shows up in almost every un-refreshed risk register from 2020-2022 and should be replaced, not iterated on.
The Friday afternoon implementation
The full mid-market CRQ exercise — across five scenarios, sufficient to defend a security budget — takes about four hours. Once. Then thirty minutes per scenario per quarter to refresh.
- Hour 1 — Pick the five scenarios that matter: Crown jewel inventory: which 3–5 systems support revenue, retention, or compliance within a 30-day window. For each crown jewel, identify the top one or two attack scenarios with realistic probability of materializing this year. Five scenarios total is the right number — fewer misses material risk, more diffuses focus.
- Hour 2 — Source the threat event frequencies: For each scenario, find the published TEF in sector-specific incident data. Verizon DBIR is the canonical source; Hiscox Cyber Readiness Report covers SME-specific rates; sector-specific reports (HIMSS for healthcare, FBI IC3 for fraud) fill the gaps. Document the source per scenario.
- Hour 3 — Score the vulnerability per scenario: For each scenario, list the specific controls that prevent or contain the loss event. Rate each on a 1–5 scale honestly (1 = not implemented; 5 = fully implemented and tested). The composite gives a vulnerability percentage. "We have MFA" is not 5 if MFA isn't enforced on three admin accounts.
- Hour 4 — Compute the loss magnitudes: Asset value at risk × percent affected × cost per affected unit, for primary loss. Customer-concentration-driven revenue exposure for secondary loss. Sum. Per scenario. Total across five scenarios is your annual loss expectancy headline.
Where the rigor sits
The 90% of FAIR rigor that matters at mid-market scale is in three places.
Sourced probabilities. Every TEF cites a specific report and year. Every vulnerability score lists the specific controls evaluated. No hand-waving, no "we estimated." The CFO can cross-examine every input.
Honest vulnerability scoring. The single most common failure mode in mid-market CRQ is over-rating controls. "We have MFA" is not the same as "MFA is enforced on every privileged account with no exceptions, verified weekly." The first sentence belongs to a vulnerability score of 3, not 5. Honesty here is what makes the ALE defensible later.
Per-scenario worksheets, not aggregate hand-waving. Five scenarios, each with its own worksheet showing inputs and citations. Aggregate "our cyber risk is $740K" sentences without backup don't survive board questioning. Five worksheets that sum to $740K do.
What you can skip at mid-market
Monte Carlo simulation across thousands of variations. Formal expert calibration workshops. Custom CRQ platform licenses. Quarterly multi-stakeholder review meetings. Integration with enterprise GRC suites. Peer-reviewed risk registers. The 200+ scenario register that enterprise FAIR programs maintain.
What you cannot skip
Sourced probabilities per scenario. Honest vulnerability scoring (especially for controls you think you have). Five-scenario per-worksheet structure. Quarterly refresh on the worksheets you already built. Documentation of changes between quarters. The dollar-denominated output the CFO actually uses.
What this enables, in order
The CFO budget defense, the one-page board pack, the cyber insurance renewal conversation, the enterprise security questionnaire response, the M&A diligence narrative — every one of these downstream artifacts is just a different framing of the same five-scenario ALE worksheet.
That's the operational leverage. The CRQ exercise once, the downstream artifacts forever. Mid-market companies that build this discipline produce board-ready, audit-ready, CFO-ready cyber risk artifacts on demand, with the same underlying methodology behind every one. The artifacts compound. The workshop-driven enterprise pattern produces one risk register per year and then sits.
After the four-hour exercise, you should be able to answer three questions in under sixty seconds each:
1. "What's our total annualized cyber loss exposure?" — single dollar number, sourced.
2. "Which control investment reduces the most ALE per dollar?" — top of the prioritization list.
3. "What happens to our ALE if we close the top three control gaps?" — pre-computed delta.
If any of those takes more than sixty seconds, the methodology isn't operational — it's still academic.
The bottom line
FAIR works for mid-market. The methodology is right; the implementation pattern needs adjusting. Five scenarios, six factors each, four hours once, thirty minutes per scenario per quarter. The output is a dollar-denominated risk number that defends the security budget, answers board questions, simplifies insurance renewals, and survives audit. The 33 million US small and mid-sized businesses that need this don't need to wait for an enterprise-tier CRQ program to do it.
Run mid-market CRQ without the enterprise overhead
vCISO Lite ships the five-scenario FAIR methodology pre-configured for mid-market — sourced threat event frequencies by sector, vulnerability scoring against the control profile you actually have, primary and secondary loss magnitudes computed from your asset register, and the per-scenario worksheets that the CFO, the board, and the auditor all draw from. Same FAIR rigor, none of the enterprise weight. Built for the 33 million US small and mid-sized businesses that don't have a quantitative risk team.
If you're standing up cyber risk quantification for the first time, or replacing a heat-map register that's not driving decisions, visit vcisolite.com to learn more and get started.
Where this matters next
Where this matters next
Security Metrics and KPIs That Actually Matter — Your board doesn't care about your CVSS scores. Your CEO wants to know if you're secure
How CFOs Defend the Cybersecurity Budget at the Board Table — The CFOs who get cybersecurity budgets approved without 20 follow-up questions translate security spend into dollar-denominated…
Why your KRIs stopped predicting anything — Open your last board report. Find the Key Risk Indicators page
Calibration: how we know our indicators are actually right — Anyone can build a risk dashboard. The hard part is convincing an auditor that the numbers are correct