|

Risk Management guide

Complete a FAIR quantitative assessment

Model the financial impact of a specific threat using frequency, vulnerability, loss magnitude and Monte Carlo simulation.

Risk Manager or quantitative risk assessor Approximately 30–60 minutes Updated 9 September 2026

Purpose

FAIR quantifies a specific threat scenario in financial terms. It uses ranges and Monte Carlo simulation to estimate annualised loss exposure and support treatment decisions.

Assess one threat scenario at a time. Do not combine unrelated threats into one FAIR scenario. Create an additional scenario for each distinct threat and consequence.

1. Create the scenario

Select one threat identified for the asset and create a FAIR scenario. Confirm the organisation's financial appetite and tolerance displayed for the assessment.

The FAIR workflow captures threat event frequency, vulnerability, loss event frequency and loss magnitude before simulation.

2. Estimate frequency and vulnerability

Threat Event FrequencyHow often the threat is expected to act against the asset during the selected period.
VulnerabilityThe probability that the threat action results in a successful loss event, considering threat capability and control strength.
Loss Event FrequencyThe derived frequency of successful loss events. For example, four threat events per year at 70% vulnerability produces 2.8 expected loss events per year.
Loss MagnitudeThe plausible financial impact of one loss event, entered as a range rather than a false single-point estimate.

Use the guided helpers when reliable direct estimates are unavailable. Advanced users can enter detailed vulnerability values directly.

3. Run Monte Carlo simulation

Run the simulation after confirming the scenario inputs. PurpleWASP produces a distribution of annual losses rather than one deterministic outcome.

Simulation results include expected annual loss, minimum and largest observed loss, the distribution and a management interpretation.

Read the management interpretation and loss exceedance curve to understand how often annual losses may exceed particular amounts.

4. Treat the financial exposure

Compare expected loss with financial appetite and tolerance. Choose a response such as mitigate, transfer, avoid, accept or escalate.

Risk transfer can model the retained factor left with the organisation after insurance or another third party absorbs part of the exposure.

For transfer, identify the vendor or insurer and enter the retained factor. Add mitigation where controls are expected to reduce frequency, vulnerability or loss magnitude.

5. Complete and review

Complete the FAIR evaluation when the residual exposure complies with the decision rules or follow the exception workflow. The overview retains baseline, residual, distribution and treatment information.

The completed scenario overview summarises baseline and residual financial exposure and keeps the simulation outputs available for decision-makers.

Common problems

Expected annual loss looks unrealistically high

Recheck frequency, vulnerability and loss magnitude ranges. Confirm that annual and per-event values have not been confused.

The model shows no-loss years

This is normal where loss event frequency is below certainty. A probability distribution can include years with no event and years with several losses.