MFA, EDR, or Insurance: Comparing Controls with FAIR Outputs
A 600-store retailer has completed a FAIR analysis of account-takeover risk in its customer loyalty platform. Median loss event frequency is 4 per year (90% range 2–8). Median loss magnitude per event is $650,000 (90% range $200,000–$3M), giving an ALE of about $2.6M. The annual loss exceedance curve shows a 95th percentile of $7.8M. The board's stated risk tolerance is no more than $5M at the 95th percentile. Three options are on the table. MFA costs $180,000 per year and is estimated to cut loss event frequency by 60% by blocking credential stuffing. EDR costs $95,000 per year and is estimated to reduce loss magnitude by 25% by shortening attacker dwell time, but only if the 24/7 SOC is staffed. Cyber insurance costs $300,000 per year, has a $1M deductible, and covers up to $5M per event. The CFO asks for 'the option with the best ROI.'
1. Map each option to the FAIR factor it changes, and explain why 'cut risk by 60%' is not a complete statement.
Read the worked answer
MFA changes vulnerability, specifically resistance strength, which reduces LEF by lowering the probability that a threat event becomes a loss event. It does not reduce TEF; attackers still attempt credential stuffing. EDR changes detection and response, reducing loss magnitude by shortening dwell time and lowering response and productivity costs; it may also affect secondary loss. Insurance transfers loss; it does not reduce LEF or LM, and retained loss after the deductible, limit, and exclusions may still exceed tolerance. 'Cut risk by 60%' is incomplete because it does not state the baseline, the factor changed, the scope of coverage, the timeframe, or the uncertainty in efficacy. A control effect is an input to the model, not a result. The result is a new LEF or LM distribution and a new loss exceedance curve.
2. Recommend a portfolio and justify using residual risk against the board's tolerance, not just ALE reduction per dollar.
Read the worked answer
The current 95th percentile of $7.8M exceeds the $5M tolerance, so some action is required. MFA addresses frequency and should move the distribution most: a 60 percent LEF reduction lowers the median LEF to about 1.6 and, with unchanged LM, lowers ALE to roughly $1.0M. That is likely to bring the 95th percentile nearer or below tolerance. EDR reduces LM by 25 percent but depends on SOC staffing; include that cost and treat efficacy as uncertain. Insurance covers part of the tail after a $1M deductible, but a $7.8M event still leaves retained loss and premium, and it does not reduce frequency. Recommended portfolio: MFA first, staff the SOC so EDR is real, then use insurance for residual tail after controls. Compare residual risk at the 95th percentile and net annual cost, not ALE reduction alone.
3. What evidence would make you reverse the recommendation?
Read the worked answer
Reverse or revise if MFA covers only a minority of accounts because of legacy systems, so the 60 percent LEF reduction is overstated. Revise if credential stuffing is not the dominant driver of the loss exceedance curve. Revise if EDR efficacy without a staffed SOC is near zero, or if the SOC cost makes it poor value. Revise if the insurance policy excludes account takeover, has aggregation limits, or the deductible and limit leave retained tail above tolerance. Revise if the LEF and LM estimates are uncalibrated and sensitivity shows the ranking is unstable. Also reverse if a different scenario dominates the tail. The recommendation should follow the residual loss exceedance curve and tolerance, not a fixed preference for one control type.