Factor Analysis of Information Risk (OpenFAIR™)
Scenario
Reference Data Loaded
Please adjust values based on your organization's industry, size, and existing security controls.
Min/Most Likely/Max inputs create a smooth probability curve (Lambda=4) to account for uncertainty.
Risk = Frequency × Magnitude. Uses Poisson Distribution for frequency modeling.
LEF = TEF × Vuln
LM = Prim + (Sec × Prob)
AAL = Σ(LEF × LM) / Runs
Vuln' = Vuln × (1 - Eff%)
ROSI = (ΔRisk - Cost) / Cost
How often do bad things happen?
Frequency of threat attempts per year.
💡 Industry benchmarks: Ransomware 0.5-2/yr, Data Breach 1-5/yr, DDoS 2-10/yr
TEF = Contact Frequency × Probability of Action. This decomposition allows more precise modeling of threat behavior.
How often threat actors contact/interact with the asset per year.
Probability that threat actor takes action upon contact (0-100%).
0.5
5
20
Probability (%) that threat overwhelms defense.
💡 Industry benchmarks: Well-protected 10-30%, Average 30-60%, Weak defenses 60-90%
Vulnerability = Susceptibility × (1 - Control Effectiveness). Susceptibility is derived from Threat Capability vs Resistance Strength comparison.
Threat actor's capability level on a 1-10 scale.
Organization's defense capability level on a 1-10 scale.
25
60
85
Note: Control Effectiveness from Mitigating Controls section will be applied during simulation.
Select Currency: USD
Direct financial impact (Incident Response, Fines, etc).
💡 Industry benchmarks: SMB $50K-$500K, Enterprise $500K-$5M (IBM Cost of Data Breach 2024)
Probability that secondary loss occurs GIVEN a primary loss event (0-100%).
Total secondary loss amount when it occurs.
Break down secondary losses by category. Each category has its own probability and magnitude. Total secondary loss = sum of (probability × magnitude) for each enabled category.
Sum of (probability × magnitude) for each enabled category.
$0
$0
$0
Annualized cost of the security control.
How much vulnerability is reduced.
Monte Carlo simulation runs. More runs = more stable results. 1K for quick preview, 10K recommended, 50K for formal reports.
AAL (Mean Risk)
-
VaR (90%)
-
10% chance to lose more
Max Loss
-
Min Loss
-
AAL Std Error
-
-
VaR 90% Std Error
-
-
Status
-
Runs
-
-
Standard error indicates estimation precision. Lower is better. Results converge when relative error < 5%.
AAL (After Control)
-
Risk Reduction
-
Control Cost
-
ROSI
-
Return on Security Investment
📊 How to Read This Chart
Identify which parameters have the greatest impact on risk
🎯 Key Risk Drivers
💡 Recommendations