Northbank: Which Number Is the Threat Event Frequency?
At Northbank, the fraud and security teams reconstructed twelve months of phishing data for the online banking platform. The secure email gateway blocked 11,520 messages; 480 reached employee inboxes; 96 recipients clicked the link; 31 submitted credentials on the lookalike page; 14 of those credentials were used through a real-time proxy to defeat SMS one-time passcodes; 9 sessions were used to attempt fraudulent transfers; 4 transfers cleared, totalling $310,000. The bank's new risk analyst proposes to set threat event frequency at 96 (clicks), vulnerability at 4/96, and loss event frequency at 4 per year, and to multiply by an average fraud loss of $77,500. The CISO wants a forward-looking figure for the next 12 months and points out that two of the nine attempted transfers were stopped by a manual review process that is being automated, and that the bank is moving from SMS to phishing-resistant FIDO2 tokens in Q3.
1. Decompose the observed chain into FAIR terms. Which figure is contact frequency, which is threat event frequency, which is vulnerability, and which is an outcome rather than a frequency? Justify each mapping and identify what is wrong with the analyst's proposal.
Read the worked answer
Contact frequency = 480. That is how many messages per year actually reached the asset. The 11,520 blocked messages never contacted the asset; that number measures control performance, not threat behaviour.
Threat event frequency = approximately 480. A delivered phishing message is an action taken by the external actor against the asset. For an automated criminal campaign, probability of action once delivered is near 1, so TEF is close to contact frequency. The 96 clicks and 31 submissions confirm the actor acted repeatedly; they do not replace TEF.
Vulnerability = 4/480 = 0.0083. Vulnerability is the probability that a threat event becomes a loss event. The whole chain from delivered message to cleared transfer is the resistance-strength story: click rate, credential submission, MFA bypass, fraud screening.
Loss event frequency = 4 observed. This is a realisation, not a forward-looking estimate, and it is the output of TEF times vulnerability, not an input.
The analyst's 96 is a susceptibility measure relabelled as threat frequency. It happens to produce the same product (96 x 4/96 = 4), which is why the error hides, but the model now responds to the wrong lever. Deploying FIDO2 changes vulnerability, not TEF, so a sensitivity test on the analyst's model would attribute the control's effect to the wrong factor and misprice it. The 4/96 denominator also mixes a human click rate with the full compromise chain.
2. The CISO asks why the four cleared transfers cannot simply be the loss event frequency for next year. Explain, using the observed data and the two planned changes, and state what the analyst should produce instead.
Read the worked answer
Four is an observation, not a frequency. FAIR defines loss event frequency as the probable frequency of future loss events over the analysis period, expressed as a distribution because the answer is uncertain.
Three problems with using 4 as a point estimate:
- Sampling. Four events in one year is consistent with a true rate of roughly 1.5 to 8 per year at 90% confidence under a simple Poisson view. The count alone implies far more precision than the data support, and it misses loss events that were never detected or recorded as transfers.
- Changing controls. Vulnerability is not constant across the next 12 months. Automating manual review raises resistance strength early in the year; FIDO2 lands in Q3 and changes vulnerability again. Estimate LEF separately for each period and sum: if FIDO2 is effective at the half-year, the annual figure is roughly 0.5 x LEF before plus 0.5 x LEF after, with the automation treated as an interim step-down.
- Loss magnitude is also a distribution. $310,000 divided by 4 is not a per-event loss estimate; four values do not characterise a tail, and the $310,000 covers only transfers that cleared.
What to produce: 5th, 50th and 95th percentile estimates for LEF and for annualised loss exposure, with the evidence and assumptions behind each, plus a sensitivity case showing the effect of FIDO2 landing on time versus slipping a quarter.
3. Threat intelligence reports that a new criminal group is selling low-cost adversary-in-the-middle phishing kits that defeat SMS one-time passcodes. Identify which FAIR factors this changes and what the analyst should do differently.
Read the worked answer
The kit affects the threat side of the model in three places and the bank's side in one:
- Contact frequency: broadly unchanged, maybe slightly higher as more actors run campaigns, but the email gateway still governs how many arrive.
- Probability of action: up. Cheap, productised tooling with a working revenue model means more actors will act on an opportunity rather than skip it. The population of capable actors grows, which increases how often contact turns into an attack.
- Threat capability versus resistance strength: up sharply, for SMS OTP. The proxy relays a live session, so a stolen one-time passcode is replayed in real time. Vulnerability rises for the pre-FIDO2 period even though nothing about the bank's email filtering changed.
- Resistance strength: FIDO2 is origin-bound and cannot be relayed through a proxy, so it restores resistance against this specific capability.
The analyst should raise the vulnerability estimate for the period before FIDO2, not raise TEF, and should shorten that exposure window by accelerating the rollout. A second consideration is the loss profile: a better-resourced actor may attempt larger transfers and cash out faster, which feeds the loss magnitude distribution rather than the frequency model. Both changes belong in the next revision with a sensitivity run showing the value of moving FIDO2 forward by one quarter.