Cyber risk quantification
Cyber risk in dollars. Controls with a return.
Every analysis here ends in a loss exceedance curve and a funding decision you can defend.
Loss exceedance
Ransomware takes a core service offline
0 trials
- Average year
- $0
- 1 in 10 year
- $0
- 1 in 100 year
- $0
- Control cost
- $0
- Risk reduced
- $0
- Return on spend
- 0%
Illustrative scenario. Move the inputs; every debrief publishes its real ones.
The flagship tool
FAIR Workbench
What a security investment is worth, on one page: the loss exceedance curve for the scenario, the annualized loss it carries today, and the return on the control that reduces it. Every figure comes from a Monte Carlo simulation over stated assumptions, so a CFO reads it the same way they read any other capital request.
Executive summary
This analysis quantified 3 loss event scenarios for a mid-size healthcare provider using the FAIR model. Combined, they carry an expected loss of about $1.4M a year. In a bad year, 1 in 10, losses could reach $4.6M, and in a severe 1-in-100 year, $14M. The recommended plan of 3 controls costs about $410K a year and reduces expected loss by $820K, a 100% return on security spend, bringing the 1-in-10 year to $2.9M.
Recommended treatment
| Control | Annualized cost | Risk reduced a year | ROSI |
|---|---|---|---|
| MFA on remote access and email | $60K | $310K | 417% |
| Tested, isolated backups | $140K | $380K | 171% |
| Endpoint detection and response | $210K | $230K | 10% |
| Combined plan | $410K | $820K | 100% |
Combined reduction accounts for overlapping controls on the same scenario. Prepared with FAIR Workbench by Bailey GRC.
One post per incident
CISO Debrief
One post per public incident. Each takes the breach as reported, models the loss for an organization in the same position, and names the controls that would have cleared the hurdle rate. The inputs are listed, so you can swap in your own figures and see where your exposure lands.
Every debrief, in order
- Incident facts, cited
- Scenario and threat community
- Loss drivers
- Loss exceedance curve
- Modeled scope of loss
- Recommended controls with ROI
- Three takeaways
The person behind it
About
Jonathan Bailey is a security practitioner who leads a vulnerability management program at a public company and designed its FAIR risk quantification program from the first scenario to the executive dashboard. Bailey GRC is where he does the same work in public, on incidents anyone can read about.