The FAIR model — Factor Analysis of Information Risk — is the most widely adopted methodology for turning cybersecurity risk into a dollar number. It's an open standard, it's audit-defensible under NIST 800-30 and ISO 27005, and 45% of organizations either use it or plan to (FAIR Institute, 2025 State of Cyber Risk Management Report). If someone in the market is asking "what should we use for CRQ?" the honest answer is: unless you have a specific reason not to, use FAIR.
This is what FAIR actually is, how it decomposes cyber risk into six factors, how each factor gets sourced without an enterprise risk team, and what the output does that a heat map cannot.
What FAIR actually is
FAIR is a formal ontology for cyber risk. Every risk statement decomposes into the same six factors, computed in the same relationships, expressed in the same units. That standardization is the whole point: two analysts working on the same scenario should get comparable numbers, and one company's FAIR output should be legible to another company's board, auditor, or insurance underwriter without translation.
The model was published by Jack Jones in 2005, is maintained by the FAIR Institute (a nonprofit standards body), and is compatible with NIST SP 800-30 (Guide for Conducting Risk Assessments), ISO/IEC 27005 (Information Security Risk Management), and increasingly cited in cyber insurance underwriting frameworks. It is not proprietary; the standard is free to read and free to implement. Commercial platforms exist to automate parts of it (RiskLens for enterprise, Axio for impact-focused analysis, Safe Security for telemetry-driven continuous FAIR), but the methodology itself belongs to no vendor.
The six factors, in the order the math flows
FAIR's decomposition is the same for every scenario, whether the scenario is "phishing attack on a finance employee leads to wire fraud" or "ransomware encrypts our primary database and demands payment." The six factors below are computed left-to-right, each derived from the ones above it, ending at Annual Loss Expectancy — the dollar number that goes on the slide.
That's the model. Six factors, three multiplications, one summation across scenarios. The rigor is not in the math — the math is elementary — it's in the discipline of sourcing every input and refusing to estimate from feel where a published benchmark exists.
FAIR is often described as "Monte Carlo simulation for cyber risk," but the simulation is a mechanism, not the point. The point is that every input is a distribution (a range with a shape) rather than a single number, because that's what the uncertainty actually looks like. The Monte Carlo run just samples the distributions ten thousand times and reports the distribution of outcomes — median, 10th percentile (best case), 90th percentile (worst case). The output is not "the expected loss is $312,000"; it's "the expected loss is $312,000 with 90% confidence the true value is between $145,000 and $840,000." That confidence range is what makes FAIR outputs useful for decisions.
How FAIR handles uncertainty
Every FAIR input is expressed as a distribution, not a point estimate. Threat Event Frequency for "phishing attack on finance" is not "3 per year," it's "most likely 3 per year, could be as low as 1 or as high as 8, with a lognormal shape reflecting the long tail of possible activity." Vulnerability for "MFA is enforced on privileged accounts with weekly verification" is not "5%," it's "most likely 5%, could be as low as 1% or as high as 20% depending on the specific attack path and control gap." Primary Loss for "wire fraud incident at a mid-market SaaS company" is not "$130K," it's "most likely $130K, with a fat tail out to $500K reflecting the possibility of larger fraudulent wires being processed before detection."
The distributions get sampled — typically ten thousand iterations per scenario — and each iteration produces one possible Annual Loss Expectancy. The distribution of those ten thousand ALEs is the output. That distribution has a mean (the expected value), a median (the middle case), and percentiles (best and worst cases). All three are useful; the mean is what goes in the budget defense, the 90th percentile is what informs insurance procurement, and the shape of the distribution tells you whether your risk is well-behaved or tail-heavy.
What FAIR does that ordinal registers cannot
The most common cyber risk register format — high / medium / low, or red / amber / green, or a heat map with likelihood on one axis and impact on the other — cannot answer the four questions a mature security program actually needs answers to.
- "What is our total cyber loss exposure this year?": Ordinal registers cannot sum categories. Three "high" risks and four "medium" risks do not add up to any coherent aggregate — the categories are ordinal, not cardinal, and the arithmetic doesn't work. FAIR sums cleanly: the ALE of every scenario adds to the total, with the confidence bounds combining via straightforward variance addition.
- "Which control investment gives the most risk reduction per dollar?": Ordinal registers can show which risk is "biggest" but not how much smaller it becomes after a specific control investment. FAIR outputs a delta-ALE for every proposed control change (add MFA to the payment approval workflow → Vuln drops from 0.15 to 0.03 → ALE for wire fraud scenario drops from $47K to $9.4K → $37.6K risk reduction). Divide by control cost to get ROI. Rank.
- "How does our exposure change if we experience a control degradation?": Ordinal registers freeze at assessment time and don't respond to changes. FAIR outputs update when inputs update — a scan finding that reveals MFA is no longer enforced on three admin accounts changes the Vulnerability input, which changes the LEF, which changes the ALE. The response function is defined.
- "Is our cyber insurance premium proportionate to our actual exposure?": Ordinal registers produce no premium comparison. FAIR outputs an aggregate ALE that can be directly compared to premium; the ratio (premium ÷ ALE) is the number that drives the renewal decision. A premium at 5% of ALE is cheap risk transfer; a premium at 30% of ALE is expensive risk transfer that should probably be self-insured with control investment instead.
Where FAIR falls down (and what to do about it)
FAIR is excellent, not perfect. Three failure modes show up in real implementations, and each has a mitigation that keeps the methodology honest.
Failure mode 1: over-precise inputs
Analysts new to FAIR sometimes pick a single number for TEF or Vuln instead of a distribution, then report the ALE to four significant figures. The output looks precise; it's actually fictional. Mitigation: every input must be a range, and every output must be reported with its 10-90 percentile bounds. Rigor of the numbers is rigor of the uncertainty, not the false-precision of the point estimate.
Failure mode 2: garbage frequency data
The Verizon DBIR and Hiscox reports are the best sources available for sector-specific TEF, but they still smooth over enormous variation across specific business models within a sector. Mitigation: cite the source and its limitations. When your business model diverges materially from the sector average, flag that and widen the confidence range accordingly. Don't pretend to more precision than the underlying data supports.
Failure mode 3: honest vulnerability scoring
The single most common failure mode. Analysts over-rate the controls their organization has — MFA that's not fully enforced becomes "MFA," EDR that's shelfware becomes "EDR coverage," backup that's not tested becomes "backup." The ALE that comes out looks reassuring; it doesn't reflect reality. Mitigation: score controls against evidence, not against attestation. If you can't produce the artifact that proves the control operates as claimed, the vulnerability score is worse than you think.
Failure mode 4: workshops that never end
Enterprise FAIR implementations sometimes collapse under the weight of multi-stakeholder scenario-modeling workshops that produce elaborate risk registers nobody refreshes. Mitigation: at mid-market, five scenarios is the right number. Refreshed quarterly by one person, in thirty minutes per scenario. The 200-scenario enterprise register is not the target.
FAIR at mid-market scale
The enterprise reference implementation of FAIR — dedicated FAIR analyst staff, formal workshops, thousands of Monte Carlo iterations across hundreds of scenarios, integration with GRC platforms — is genuinely heavy. It's the right shape for a Fortune 500 with a mature risk function. It's the wrong shape for a 50-person SaaS company with one person doing security part-time.
The methodology, however, scales down cleanly. Five scenarios instead of two hundred. Four hours of setup instead of two quarters. Thirty minutes of quarterly refresh per scenario instead of standing workshops. Verizon DBIR + Hiscox for TEF sourcing instead of custom threat intelligence subscriptions. Structured self-assessment for Vulnerability scoring instead of red-team-derived numbers. The math is the same; the operational overhead comes down 90%. Full teardown of that pattern in Cyber Risk Quantification for Mid-Market.
The bottom line
FAIR is the standard because it is standardized. Every input has a definition, every output has units, every scenario decomposes the same way, and the whole thing is open and auditable. If you're building a cyber risk quantification practice for the first time, start with FAIR unless a specific fit reason takes you elsewhere. The alternatives (Axio, Safe Security) are legitimate but proprietary and enterprise-priced. The informal ordinal-with-dollars pattern is not an alternative; it's the pattern FAIR was invented to replace.
Apply FAIR without the enterprise overhead
vCISO Lite ships FAIR pre-configured for mid-market — five-scenario worksheets with sourced Threat Event Frequencies by sector, structured Vulnerability scoring against your actual control state, Primary and Secondary Loss Magnitudes computed from your asset register, Monte Carlo simulation on every scenario, and the per-scenario ALE with 10-90 percentile bounds that the CFO, the board, and the insurance underwriter all draw from. Same FAIR rigor, none of the enterprise weight. Built for the 33 million US small and mid-sized businesses that don't have a quantitative risk team but need FAIR-quality outputs.
If you're standing up cyber risk quantification for the first time, or replacing an ordinal register that isn't driving decisions, visit vcisolite.com to learn more and get started.