In FAIR, risk equals loss event frequency times loss event magnitude. Frequency splits into threat event frequency and vulnerability. Magnitude splits into primary loss and secondary loss. Each box is estimated as a range, so you can reason about the parts separately and argue about the right one.
The factor tree
- Loss event frequency: how often a loss is likely to happen.
- Threat event frequency: how often a threat acts against the asset.
- Vulnerability: how likely that action is to cause a loss, given the threat's capability and the defenses in place.
- Loss event magnitude: how much the loss costs.
- Primary loss: direct costs such as repairs, lost productivity and incident response.
- Secondary loss: costs from third party reactions, such as regulatory fines, notification costs and lost revenue from reputation damage.
These definitions follow the descriptions published by the FAIR Institute and a TechTarget explainer. The formal definitions are in the Open Group's O-RT standard, which you should read if you plan to rely on exact wording.
A worked thought exercise
Take the scenario "an attacker abuses a stolen API key to download customer records".
Threat event frequency: how often do attempts like this occur against you? Maybe the team believes between one and six attempts a year.
Vulnerability: if an attempt happens, how often does it succeed? Key rotation, anomaly alerts and scoping all lower this. Perhaps ten to forty percent.
Primary loss: response hours, forensics, and customer support. A range, not a point.
Secondary loss: legal advice, notification, and contract credits. Often the larger and more uncertain half.
You now have four ranges. Combine them with a simulation or, for a first pass, with a low, likely and high calculation.
Why splitting helps
Disagreements get specific. Two people who argued "high versus medium" now find they disagree about only one box, say how often attempts occur. You can answer that with data, such as logs, instead of a debate.
It also shows where a control acts. Rotation and scoping lower vulnerability. Detection and backups reduce magnitude. Reducing attempts is mostly outside your control.
Estimating with ranges
Ask for a range the estimator is highly confident contains the true value, then narrow it with evidence. Record who estimated and what data they used. NIST SP 800-30 notes that uncertainty can be communicated by giving ranges of values rather than single values, which is the same habit.
Practice improves estimates. Give people a few questions with known answers and see how often their ranges miss. Most start overconfident.
Quick check
Which factor is hardest to estimate?
Usually secondary loss, because it depends on how outsiders react. Use ranges and note your assumptions.
Can I use the factors without running a simulation?
Yes. Even a low, likely and high estimate for each factor makes the discussion clearer than a single label.
Sources
- FAIR Institute, What is FAIR
- TechTarget, Using the FAIR model to quantify cyber risk
- NIST SP 800-30 Rev. 1
Last reviewed: 19 October 2026.
