Featured guide
Create and assess a risk
Learn how to complete CIA and FAIR assessments, add controls, assign treatment actions and manage risk exceptions.
Read the guideComplete a FAIR quantitative assessment
Model the financial impact of a specific threat using frequency, vulnerability, loss magnitude and Monte Carlo simulation.
Purpose
FAIR quantifies a specific threat scenario in financial terms. It uses ranges and Monte Carlo simulation to estimate annualised loss exposure and support treatment decisions.
Assess one threat scenario at a time. Do not combine unrelated threats into one FAIR scenario. Create an additional scenario for each distinct threat and consequence.
1. Create the scenario
Select one threat identified for the asset and create a FAIR scenario. Confirm the organisation's financial appetite and tolerance displayed for the assessment.
2. Estimate frequency and vulnerability
Threat Event FrequencyHow often the threat is expected to act against the asset during the selected period.
VulnerabilityThe probability that the threat action results in a successful loss event, considering threat capability and control strength.
Loss Event FrequencyThe derived frequency of successful loss events. For example, four threat events per year at 70% vulnerability produces 2.8 expected loss events per year.
Loss MagnitudeThe plausible financial impact of one loss event, entered as a range rather than a false single-point estimate.
Use the guided helpers when reliable direct estimates are unavailable. Advanced users can enter detailed vulnerability values directly.
3. Run Monte Carlo simulation
Run the simulation after confirming the scenario inputs. PurpleWASP produces a distribution of annual losses rather than one deterministic outcome.
Read the management interpretation and loss exceedance curve to understand how often annual losses may exceed particular amounts.
4. Treat the financial exposure
Compare expected loss with financial appetite and tolerance. Choose a response such as mitigate, transfer, avoid, accept or escalate.
For transfer, identify the vendor or insurer and enter the retained factor. Add mitigation where controls are expected to reduce frequency, vulnerability or loss magnitude.
5. Complete and review
Complete the FAIR evaluation when the residual exposure complies with the decision rules or follow the exception workflow. The overview retains baseline, residual, distribution and treatment information.
Common problems
Expected annual loss looks unrealistically high
Recheck frequency, vulnerability and loss magnitude ranges. Confirm that annual and per-event values have not been confused.
The model shows no-loss years
This is normal where loss event frequency is below certainty. A probability distribution can include years with no event and years with several losses.