Risk Analysis (Open FAIR)
Risk Analysis in Open FAIR
This domain tests whether you can decompose risk into FAIR factors and reason quantitatively about frequency and magnitude. Open FAIR defines risk as the probable frequency and probable magnitude of future loss - not as a threat, a vulnerability, or a control gap.
Core rules and concepts
- Risk = f(LEF, LM). Loss Event Frequency (LEF) is the probable frequency of loss events per timeframe; Loss Magnitude (LM) is the probable loss per event.
- LEF = TEF × Vulnerability. Threat Event Frequency (TEF) is how often a threat agent acts against the asset; Vulnerability is the probability that an action becomes a loss event.
- TEF = Contact Frequency × Probability of Action.
- Vulnerability = P(Threat Capability > Resistance Strength). Resistance Strength is the asset's control strength against the threat's capability.
- LM = Primary Loss + Secondary Loss. Primary loss falls on the asset owner; secondary loss falls on other stakeholders, such as response costs, fines and judgments, reputation, and competitive advantage.
- FAIR analysis uses calibrated estimates and simulation to produce ranges and loss exceedance curves; qualitative labels are not risk values.
Worked example
A customer database receives 24 contact attempts per year. Probability of action is 0.25, so TEF = 24 × 0.25 = 6. Threat capability exceeds resistance strength in 30% of attempts, so LEF = 6 × 0.30 = 1.8 events per year. Primary loss is $20,000 per event. Secondary loss is $100,000 but occurs in only 20% of events, so expected secondary loss is $20,000. LM = $20,000 + $20,000 = $40,000. Annualized risk = 1.8 × $40,000 = $72,000.
Traps that cost marks
- Treating vulnerability as binary (present/absent) instead of a probability.
- Multiplying by the full secondary loss in every event rather than weighting it by occurrence probability.
- Reporting one risk number with no range, confidence interval, or loss exceedance curve.
- Calling a high threat capability “high risk” while ignoring resistance strength and loss magnitude.
- Confusing inherent risk with residual risk after controls.