---
# === IDENTITY ===
id: business/governance/cyber-risk-quantification/2026
canonical_question: "How do I quantify cyber risk in financial terms — FAIR model, loss exceedance, and insurance sizing?"
aliases:
  - "cyber risk quantification"
  - "CRQ"
  - "FAIR model"
  - "loss exceedance curve"
  - "cyber insurance sizing"
entity_type: concept
domain: business > governance > Cyber Risk Quantification
region: global
jurisdiction: global
temporal_scope: 2005-2026

# === VERIFICATION ===
last_verified: 2026-02-28
confidence: 0.90
version: 1.0
first_published: 2026-02-28

# === TEMPORAL VALIDITY ===
temporal_validity:
  status: stable
  last_breaking_change: 2024-12-01
  next_review: 2026-08-27
  change_sensitivity: low

# === CONSTRAINTS ===
constraints:
  - "FAIR requires calibrated inputs — garbage-in-garbage-out applies more acutely to risk quantification than qualitative approaches; Monte Carlo simulations amplify poorly estimated frequency/magnitude ranges"
  - "Loss exceedance curves express probability, not certainty — boards and executives frequently misinterpret the output as precise predictions rather than probabilistic ranges"
  - "Cyber insurance sizing based on CRQ models depends on availability and pricing in the insurance market — a model may recommend $50M coverage that the market will not write at acceptable premiums"
  - "FAIR quantifies individual risk scenarios, not aggregate portfolio risk — organizations must run multiple scenarios and aggregate results to understand total cyber exposure"
  - "Prerequisite: the organization must have a basic inventory of critical assets and threat scenarios before meaningful quantification is possible"

skip_this_unit_if:
  - condition: "User needs a broad enterprise risk management framework, not cyber-specific quantification"
    use_instead: "business/governance/erm-framework/2026"
  - condition: "User needs a business continuity plan for operational disruptions"
    use_instead: "business/governance/business-continuity-planning/2026"

inputs_needed:
  - key: "crq_objective"
    question: "What is the user's cyber risk quantification objective?"
    type: choice
    options:
      - "Understanding the FAIR model and how to apply it"
      - "Building loss exceedance curves for board reporting"
      - "Sizing cyber insurance coverage based on quantified risk"
      - "Comparing CRQ approaches (FAIR vs. alternatives)"

# === DISTRIBUTION ===
canonical_source: "https://knowledgelib.io/business/governance/cyber-risk-quantification/2026"
suggested_citation: "Source: knowledgelib.io — AI Knowledge Library (verified 2026-02-28)"

# === RELATED UNITS ===
related_kos:
  related_to:
    - id: "business/governance/erm-framework/2026"
      label: "Enterprise Risk Management Framework"
    - id: "business/governance/business-continuity-planning/2026"
      label: "Business Continuity Planning"
  often_confused_with:
    - id: "business/governance/erm-framework/2026"
      label: "ERM (qualitative risk assessment vs. quantitative CRQ)"
  depends_on: []
  solves: []
  alternative_to: []

# === SOURCES ===
sources:
  - id: src1
    title: "What is FAIR — The Importance and Effectiveness of Cyber Risk Quantification"
    author: FAIR Institute
    url: https://www.fairinstitute.org/what-is-fair
    type: official_docs
    published: 2025-01-01
    reliability: authoritative
  - id: src2
    title: "Loss Exceedance Curves for Cyber Risk Management"
    author: Kovrr
    url: https://www.kovrr.com/blog-post/deciphering-the-loss-exceedance-curve-in-cyber-risk-quantification
    type: industry_report
    published: 2025-01-01
    reliability: high
  - id: src3
    title: "Using the FAIR Model to Quantify Cyber Risk"
    author: TechTarget
    url: https://www.techtarget.com/searchsecurity/tip/Using-the-FAIR-model-to-quantify-cyber-risk
    type: technical_blog
    published: 2025-01-01
    reliability: moderate_high
  - id: src4
    title: "The FAIR Risk Model: A Practical Guide for Organizations"
    author: CyberSaint
    url: https://www.cybersaint.io/blog/the-fair-risk-model-a-practical-guide-for-organizations
    type: technical_blog
    published: 2025-01-01
    reliability: moderate_high
  - id: src5
    title: "Factor Analysis of Information Risk"
    author: Wikipedia / Open Group
    url: https://en.wikipedia.org/wiki/Factor_analysis_of_information_risk
    type: technical_blog
    published: 2025-01-01
    reliability: moderate_high
---

# Cyber Risk Quantification

## Definition

Cyber risk quantification (CRQ) is the practice of expressing cybersecurity risk in financial terms — probability of loss events and their expected monetary impact — rather than qualitative labels (high/medium/low). The dominant model is FAIR (Factor Analysis of Information Risk), created by Jack Jones in 2005 and adopted by The Open Group as the international standard (O-RT and O-RA). [src1] FAIR decomposes risk into two primary factors: Loss Event Frequency (how often) and Loss Magnitude (how much), which are combined through Monte Carlo simulation to produce Loss Exceedance Curves — graphs showing the probability that losses will exceed any given dollar amount. [src2]

## Key Properties

- **FAIR taxonomy**: Risk = f(Loss Event Frequency, Loss Magnitude); LEF decomposes into Threat Event Frequency and Vulnerability; LM decomposes into Primary and Secondary loss [src5]
- **Monte Carlo simulation**: FAIR uses calibrated probability distributions as inputs and runs thousands of simulations to generate probabilistic loss ranges rather than point estimates [src1]
- **Loss Exceedance Curve (LEC)**: Visualizes the probability of losses exceeding a given threshold — e.g., "there is a 10% chance annual cyber losses exceed $15M" [src2]
- **Open FAIR standards**: O-RT (Risk Taxonomy Standard) and O-RA (Risk Analysis Standard) published by The Open Group [src5]
- **Extended models**: FAIR-CAM (Controls Analytics Model) measures control effectiveness; FAIR-MAM (Materiality Assessment Model) provides detailed loss taxonomy [src1]

## Constraints

- FAIR requires calibrated inputs — poorly estimated frequency and magnitude ranges produce misleading results. Use calibrated estimation techniques (e.g., Hubbard's Applied Information Economics) to reduce bias. [src3]
- Loss exceedance curves express probability, not certainty — boards frequently misinterpret output as precise predictions. Always present results as probability ranges with explicit confidence levels. [src2]
- Cyber insurance sizing depends on market availability — CRQ may recommend coverage the market will not write at acceptable premiums. Cross-reference model output with broker intelligence. [src2]
- FAIR quantifies individual scenarios, not aggregate portfolio risk — running a single scenario does not capture the organization's total cyber exposure. Aggregate multiple scenarios. [src4]
- The model is only as current as its inputs — threat landscape changes, new vulnerabilities, and business changes require quarterly scenario refresh. [src1]

## Framework Selection Decision Tree

```
START — User needs to assess cyber risk
├── What is the primary goal?
│   ├── Express cyber risk in financial terms for board/CFO
│   │   └── ✅ Cyber Risk Quantification / FAIR (this unit)
│   ├── Qualitative risk assessment (high/medium/low)
│   │   └── → ERM Framework (risk heat maps)
│   ├── Compliance framework mapping (NIST CSF, ISO 27001)
│   │   └── → Cybersecurity compliance standards
│   ├── Business continuity for cyber incidents
│   │   └── → Business Continuity Planning
│   └── Cyber insurance purchase decision
│       └── ✅ FAIR + Loss Exceedance Curves (this unit)
├── Does the organization have asset inventory and threat scenarios?
│   ├── YES → Proceed with FAIR analysis
│   └── NO → Build asset inventory and threat model first
└── Audience for the output?
    ├── Board/CFO → Loss exceedance curves with dollar values
    ├── CISO/Security team → Detailed scenario analysis
    └── Insurance broker → Aggregate loss distribution for coverage sizing
```

## Application Checklist

### Step 1: Define risk scenarios
- **Inputs needed**: Critical asset inventory, threat actor profiles, attack vectors, historical incident data
- **Output**: 5-15 prioritized risk scenarios (e.g., "ransomware attack on ERP system," "data breach of customer PII")
- **Constraint**: Scenarios must be specific enough to estimate frequency and magnitude — "cyber attack" is not a valid scenario [src1]

### Step 2: Calibrate frequency and magnitude inputs
- **Inputs needed**: Historical loss data, industry benchmarks, SME interviews, threat intelligence
- **Output**: Calibrated probability distributions for Loss Event Frequency and Loss Magnitude per scenario
- **Constraint**: Use calibrated estimation techniques — uncalibrated expert judgment introduces systematic biases (typically underestimating tail risk) [src3]

### Step 3: Run Monte Carlo simulation and generate LECs
- **Inputs needed**: Calibrated inputs from Step 2, FAIR-compatible tool or spreadsheet
- **Output**: Loss Exceedance Curves per scenario and aggregated across scenarios
- **Constraint**: Present results as probability ranges, not point estimates — "10% probability of exceeding $15M" not "we will lose $15M" [src2]

### Step 4: Inform decisions (insurance sizing, control investment, risk acceptance)
- **Inputs needed**: Loss exceedance curves, current insurance coverage, control investment options
- **Output**: Insurance coverage recommendation, ROI analysis for proposed security controls, risk acceptance decisions
- **Constraint**: Insurance sizing must account for market availability — broker input is essential alongside model output [src2]

## Anti-Patterns

### Wrong: Using qualitative risk labels for financial decisions
Board receives a red/yellow/green heat map and is asked to approve a $5M security investment. There is no way to evaluate ROI because risk is not expressed in dollars. [src3]

### Correct: Quantify risk to enable financial comparison
Use FAIR to express risk in dollar terms, then compare the cost of controls against the expected loss reduction. This enables apples-to-apples comparison. [src1]

### Wrong: Running a single FAIR scenario and calling it "total cyber risk"
Organization quantifies ransomware risk and uses that single number to size insurance, ignoring data breaches, business email compromise, and third-party incidents. [src4]

### Correct: Build a portfolio of 5-15 scenarios
Quantify the top risk scenarios individually, then aggregate to understand total cyber exposure. Use the aggregate loss exceedance curve for insurance sizing. [src2]

### Wrong: Treating FAIR output as precise predictions
CRQ analysis shows a 5% probability of $20M+ loss, and the board treats this as a firm forecast, leading to shock when actual losses differ. [src2]

### Correct: Communicate probabilistic ranges with context
Present FAIR output as what it is — a probability distribution. Explain confidence levels, key assumptions, and sensitivity to input changes. [src1]

## Common Misconceptions

- **Misconception**: Cyber risk cannot be quantified because there is too much uncertainty.
  **Reality**: All risk assessment involves uncertainty. FAIR explicitly models uncertainty through probability distributions. Quantitative estimates with known confidence levels are more useful than qualitative labels that hide uncertainty behind vague words. [src1]

- **Misconception**: You need perfect data to run FAIR.
  **Reality**: FAIR works with calibrated estimates from subject matter experts. Perfect historical data is not required — the model is designed to work with ranges and probabilities, not point values. [src3]

- **Misconception**: Loss exceedance curves tell you how much you will lose.
  **Reality**: LECs show the probability of losses exceeding given thresholds. They are tools for decision-making under uncertainty, not forecasts. [src2]

## Comparison with Similar Concepts

| Concept | Key Difference | When to Use |
|---|---|---|
| FAIR / CRQ | Quantifies cyber risk in dollar terms | Financial decisions: insurance, control ROI, risk acceptance |
| Risk Heat Maps | Qualitative likelihood/impact visualization | Communication and prioritization (not financial decisions) |
| NIST CSF / ISO 27001 | Control frameworks for cybersecurity maturity | Compliance, gap analysis, capability assessment |
| Penetration Testing | Technical vulnerability identification | Finding specific exploitable weaknesses |

## When This Matters

Fetch this when a user asks about quantifying cyber risk in financial terms, the FAIR model, loss exceedance curves, cyber insurance sizing, or justifying security investment to the board with financial data. Also relevant when someone wants to move beyond qualitative risk heat maps to quantitative risk analysis.

## Related Units

- [Enterprise Risk Management Framework](/business/governance/erm-framework/2026)
- [Business Continuity Planning](/business/governance/business-continuity-planning/2026)