FAIR, short for Factor Analysis of Information Risk, is a method that expresses cyber risk in money. You estimate how often a loss event could happen and how much it would cost, using ranges, then combine them to get a spread of likely annual losses instead of a color on a chart.
Where it comes from
The FAIR Institute describes FAIR as an international standard quantitative model for information security and operational risk. The Open Group adopted it as Open FAIR, published as two standards: O-RT, the risk taxonomy, and O-RA, the risk analysis standard. One industry article credits Jack Jones with developing the model in 2005.
The core idea
Risk is treated as two things multiplied together:
- Loss event frequency: how often a loss is likely to occur.
- Loss event magnitude: how bad it is when it does, in money.
Frequency breaks down into how often a threat acts against the asset and how likely it is to succeed. Magnitude breaks into primary loss, the direct costs such as response and lost productivity, and secondary loss, the costs that come from other parties reacting, such as regulators or customers.
The four step flow
- Identify the scenario: the asset at risk and the threat that could harm it.
- Estimate loss event frequency as a range.
- Estimate loss event magnitude as a range.
- Combine them and describe the result.
The combination step usually uses simulation. The FAIR Institute treats Monte Carlo simulation as part of the final stage: it samples your input ranges thousands of times and gives a spread of outcomes with probabilities.
What you get that a matrix cannot give
You can say "we estimate a range of annual loss for this scenario, with this likelihood of exceeding a given amount". You can then compare that with the cost of a control. That supports a budget conversation in a way that "high" does not.
Honest limits
The same industry article lists the limits plainly. FAIR can be time consuming and costly, results are only as good as the input data, and users need some expertise. Some factors, such as reputational harm, rely on judgment because they cannot be measured directly.
NIST SP 800-30 says something similar about all quantitative work: rigor drops when subjective judgments are buried inside the numbers or when uncertainty is high. The fix is to show assumptions and ranges, not a single figure.
When to try it
Use it on a few decisions that carry real money, such as whether to fund a large control, how much insurance to buy, or which of two big projects to do first. Do not try to quantify a long tail of small risks. A qualitative pass is quicker for those, and the two approaches work well together.
Quick check
Is FAIR a replacement for a risk register?
No. It is an analysis method. Its results can be recorded as the rating for entries in your register.
Do I need to buy software?
Not to learn it. A spreadsheet can run a simple version. Tools add simulation and reporting once you do this regularly.
Sources
- FAIR Institute, What is FAIR
- TechTarget, Using the FAIR model to quantify cyber risk
- NIST SP 800-30 Rev. 1
Last reviewed: 19 October 2026.
