Free Engineering Workbench calculator
FAIR loss simulation (with ranges)
Quantify a cyber risk as a range of yearly losses from estimated ranges, not single guesses.
Cybersecurity & cyber assuranceHow it's worked out
- Events per year ~ Poisson(λ), λ ~ PERT(min, likely, max). Loss per event ~ PERT(min, likely, max). Annual loss = sum of event losses
- PERT shape 4; independent events; 10,000 trials
NoteResults come from 10,000 simulated years with a fixed seed, so the same inputs give the same answer. Ranges should be calibrated estimates, ideally from people trained to estimate. This is a simplified FAIR model: it does not split frequency or magnitude into their sub-factors.
Source: The FAIR Institute, Open FAIR (The Open Group O-RA/O-RT); Hubbard and Seiersen, How to Measure Anything in Cybersecurity Risk
Need help acting on this number?
VVnT SeQuor's Cybersecurity & Cyber Assurance practice helps teams turn this metric into a plan.