FAIR Model Risk Calculator
Threat Event Frequency (per year)
50%
Primary Loss ($)
$
$
$
30%
Secondary Loss ($)
$
$
$
Simulation Count
Annualized Loss Expectancy (50th Percentile)$552,556.00
ALE 10th Percentile$207,891.00
ALE 90th Percentile$1,261,957.00
SLE Mean$347,588.00
Risk Levelhigh
Confidence Intervals
P5$153.2K
P25$335.7K
P50$552.6K
P75$867K
P95$1.6M
Risk Breakdown: Primary vs Secondary Loss
Primary89.7%
Avg Primary Loss$308,098.00
Avg Secondary Loss$35,300.00
Loss Distribution Histogram
Sensitivity Analysis (Tornado Diagram)
Each input varied +/-20% — shows deviation from base ALE
Loss Exceedance Curve
$30,978.00
100%
$426,485.00
63%
$821,992.00
28%
$1,217,498.00
11%
$1,613,005.00
4%
$2,008,511.00
1%
$2,404,018.00
0%
$2,799,525.00
0%
$3,195,031.00
0%
$3,590,538.00
0%
$3,986,044.00
0%
FAIR (Factor Analysis of Information Risk) replaces vague red-yellow-green heat maps with dollar figures by decomposing risk into loss event frequency and loss magnitude. This calculator runs a Monte Carlo simulation over your three-point estimates (minimum, most likely, maximum) for threat frequency and losses, producing an annualized loss expectancy distribution at the 10th, 50th, and 90th percentiles.
Formula
ALE = LEF × (PrimaryLoss + SecondaryLoss), where LEF = TEF × Vulnerability
- TEF
- Threat event frequency per year, sampled from a PERT distribution of your min/most-likely/max
- Vulnerability
- Probability (0-1) that a threat event becomes a loss event
- LEF
- Loss event frequency — how often a loss actually occurs per year
- ALE
- Annualized loss expectancy in dollars, reported at the 10th, 50th, and 90th percentiles
How it works
- Enter three-point (min / most-likely / max) estimates for threat event frequency, a vulnerability percentage (the chance a threat event becomes a loss event), and primary and secondary loss magnitudes, plus a secondary-loss probability and simulation count.
- Each simulation iteration samples a PERT distribution for frequency and losses, computes loss event frequency as threat frequency × vulnerability, and multiplies by the sampled loss to get one annualized loss value.
- After thousands of iterations the results are sorted into a distribution, reporting ALE at the 10th, 50th (median), and 90th percentiles plus a loss-exceedance curve, with a risk level keyed off the median (under $50k low, under $500k medium, under $5M high, otherwise critical).
Worked example
A threat event occurs about 2 times per year with a 50% vulnerability, and each loss event costs roughly $200,000.
- Compute loss event frequency: LEF = 2 × 0.50 = 1.0 loss event per year.
- Multiply by the per-event loss magnitude: 1.0 × $200,000 = $200,000.
- Across many simulated iterations the median (P50) ALE clusters near this central estimate, with P10 and P90 spreading below and above it.
A median annualized loss expectancy of roughly $200,000, which falls in the Medium risk band ($50k-$500k). The full simulation reports the P10 and P90 bounds around that median.
Frequently asked questions
- What is the difference between threat event frequency and loss event frequency?
- Threat event frequency (TEF) is how often an attacker attempts something; loss event frequency (LEF) is how often those attempts actually cause loss. LEF equals TEF multiplied by the vulnerability — the probability that an attempt succeeds.
- Why does FAIR use Monte Carlo simulation instead of a single number?
- Risk inputs are uncertain ranges, not exact values. Sampling thousands of scenarios across those ranges produces a distribution of outcomes, so you can report a most-likely (P50) loss alongside realistic best-case (P10) and worst-case (P90) figures.
- What are the P10, P50, and P90 values?
- They are percentiles of the simulated annualized loss. P50 is the median expected loss, P10 is the value exceeded 90% of the time (an optimistic floor), and P90 is exceeded only 10% of the time (a pessimistic but plausible ceiling for planning reserves).
- What is primary versus secondary loss in FAIR?
- Primary loss is the direct, immediate cost of an event (response, replacement, lost productivity). Secondary loss is fallout from other parties — fines, lawsuits, and reputation damage — which occurs only with some probability, so the model gates it behind a secondary-loss probability.