The method
FAIR (Factor Analysis of Information Risk) breaks risk into two factors: loss event frequency and loss magnitude. Frequency itself depends on threat event frequency and vulnerability, the probability that an attempt succeeds.
Losses are split into primary (response, replacement, productivity) and secondary (fines, reputation, competitive advantage). Each factor is estimated as a range (minimum, most likely, maximum) and combined by Monte Carlo simulation.
The result is a distribution of annual losses in currency. The taxonomy and method are published by The Open Group as Open FAIR.
When to use it
- To compare cyber risks on a common scale that management understands.
- To assess the benefit of a security measure against its cost.
- Alongside a qualitative analysis (EBIOS RM, ISO 27005) for priority scenarios.
Watch out for
- Ranges must rest on data or calibrated experts, not round numbers.
- A poorly scoped scenario (asset or threat too broad) makes estimates useless.
- Present results as orders of magnitude, with their assumptions.
Steps
- Define the scenario: asset, threat, effect.
- Estimate loss event frequency, directly or through threat frequency and vulnerability.
- Estimate primary and secondary loss magnitude as ranges.
- Combine by simulation and read the annual loss distribution.
- Compare scenarios and the effect of proposed measures.
FAIR tools
List from the Aurorisk catalogue, links checked on 2026-09-26. Confirmed free access is listed first; unknown information is labelled.
| Tool | Source · licence · access | Scope | Description |
|---|---|---|---|
| FAIR Institute — FAIR-U ↗ | Association or foundationFree | United States | Free FAIR learning application. |
| Open FAIR (The Open Group) ↗ | Association or foundation | International | Open FAIR standard and body of knowledge. |
| Safe Security ↗ | Commercial publisher | International | Cyber risk quantification platform. |
Standards and references
- The Open Group — Open FAIR (O-RT, O-RA)