Cyber Risk FAIR Quantitative Loss & ALE Engine

Cybersecurity Economics & Information Risk: The FAIR Framework

Developed by Jack Jones and standardized by The Open Group, Factor Analysis of Information Risk (FAIR) is the premier quantitative standard for translating cybersecurity technical vulnerabilities into financial dollars:

• The Flaw of Qualitative Risk Matrices: Heat maps that label risks as "High/Medium/Low" or "Red/Yellow/Green" lack mathematical rigor and prevent CFOs from making rational capital allocation decisions.

• The 2 Core Pillars of FAIR:

• Loss Event Frequency (LEF): How often will a bad event happen?.

• Loss Magnitude: How much will it cost when it happens?.

• Annualized Loss Exposure (ALE): Allows CISOs to demonstrate cybersecurity ROI (e.g. spending 200k on EDR that reduces ALE by 1.5M delivers a 7.5x return).

How to Use This Calculator

Enter your Threat Event Frequency (TEF [Targeted Attack Attempts / year]) (e.g. 12 (12 serious phishing/ransomware attempts/year)), Threat Actor Capability Level (TCap % [Sophistication]) (e.g. 65 (65% advanced persistent threat capability)), Internal Security Control Strength (CS % [EDR, MFA, WAF]) (e.g. 75 (75% defense-in-depth resistance)), Primary Incident Response, Forensics & Recovery () (e.g. 250,000 (Incident response retainers & system rebuilds)), Primary Business Interruption & Outage Loss () (e.g. 850,000 (Lost transaction revenue & idle payroll)), Secondary Regulatory Fines (GDPR/HIPAA/SEC) & Legal () (e.g. 500,000 (Regulatory penalties & class-action defense)), and Exposed Customer PII Records Count (e.g. 25,000 (Credit monitoring & notification costs)). Results update instantly as you type — adjust any value to compare scenarios.

The Formula

Open Group Factor Analysis of Information Risk (FAIR) equations:

Vulnerability (V) = (Threat Capability (TCap)) / (Threat Capability + Control Strength (CS))

Loss Event Frequency (LEF) = Threat Event Frequency (TEF) × V

Single Loss Expectancy (SLE) = Primary Loss (Forensics + Downtime) + Secondary Loss (Fines + Legal + Records)

Annualized Loss Exposure (ALE) = Loss Event Frequency (LEF) × Single Loss Expectancy (SLE)

Worked Example

For example, analyzing an enterprise experiencing \ against threat actors with 65\% capability and 75\% internal control strength, with \250,000 incident response, \850,000 business downtime, and 25,000 compromised PII records (\375,000 notification): Vulnerability is . Loss Event Frequency is . Single Loss Expectancy (SLE) is \, resulting in an Annualized Loss Exposure (ALE) of \.

Understanding Your Result

Compare your result against industry benchmarks for your specific sector — significant variation exists across industries, business stages, and geographic markets. Use this calculation as one data point alongside your unit economics, cash flow, and competitive positioning. For decisions involving significant capital allocation, validate your model assumptions with historical actuals from at least 6–12 months of operating data before projecting forward.