Step 1
Scope the scenario
One asset, one threat community, one effect. Numbers only mean something once the loss event is pinned down.
Step 2
Loss event frequency
How often the loss event is likely to happen. For each input, give a range you’d be comfortable defending: the lowest value you’d believe, your best guess, and the highest you’d believe.
Step 3
Loss magnitude
What each loss event costs. Primary loss always happens; secondary loss only when outside parties react.
Which costs go where
| Form of loss | Usually | Examples |
|---|---|---|
| Productivity | Primary | Revenue or output lost while operations are down |
| Response | Primary Secondary | Incident handling, forensics, legal advice, customer notification |
| Replacement | Primary | Repairing or replacing systems and equipment |
| Fines and judgements | Secondary | Regulator fines, lawsuits, contractual penalties |
| Competitive advantage | Secondary | Trade secrets or IP used by competitors |
| Reputation | Secondary | Lost customers, harder sales, higher cost of capital |
Reference
Estimating good ranges
- Start with a range so wide it is obviously true, then pull each end in until you would bet you are about 90% likely to be right.
- Begin with what you do know: incident tickets, audit findings, insurance claims, published breach reports.
- Break hard numbers into parts. Notification cost, for example, is records affected × cost per record.
- Write the reasoning behind each range in the scope, so you can defend or revise it later.
- Ask the people closest to the data: security operations, finance, legal.
- A range that is right beats a single number that only looks precise.
Results · annual loss exposure
Untitled scenario
Annual loss by percentile · CHF
Loss exceedance curve
Chance that the year's total loss is higher than a given amount. Hover or drag across the chart to read values.
Loss events per simulated year
Where the expected loss comes from
Model settings
Counting events draws how many loss events happen in each simulated year, so quiet years show up as zero loss. The average method multiplies frequency by loss every year, the way simpler FAIR tools do. Both give the same expected loss; they differ in the tail.
The same seed replays the same random draws, so results only move when your inputs do. Try another seed to see how much comes from sampling noise alone.