FAIR Loss Exceedance Curve Builder

Open FAIR scenarios, Monte Carlo simulation, and your risk appetite on one chart.

OPEN FAIR · MONTE CARLO

Scenario Register: Open FAIR Inputs

Every input is a calibrated range: minimum, most likely, maximum. Money is in $K; you can also type 1.5M or 300K.

Risk Appetite

Annual loss aboveMax probabilityFocus

Each point reads: "We accept no more than this chance of losing more than this amount in a year." The focus point drives the trajectory chart and the precision check.

Control Under Evaluation

Loss prevention · changes LEF
Loss mitigation · changes loss magnitude

Step Through the Simulation

1001K10K100K
1 · Annualized loss
3 · 1-in-100 year loss
4 · Control value
2 · Risk appetite check

Monte Carlo Precision

The Calculation, Step by Step

    Loss Exceedance Curve

    Current curve 95% Monte Carlo band Earlier batches With control Risk appetite

    Annualized Loss by Scenario

    Without control With control

    Convergence as Runs Grow

    Simulation Log

    Each row adds years to the same run. Click a row to jump to it.
    YearsALE ± 95%P(> focus)1-in-201-in-100WorstAppetite

    9. Things to Try

    • Set the stepper to 100 and press Re-run with new seed a few times. Watch P(loss > $5M) jump around the 10% line. Then do the same at 100K.
    • Switch the control off and the $5M point turns red. Switch it back on and lower the Vulnerability reduction to find the smallest reduction that keeps the firm inside appetite. Watch how the return on the control changes as you go.
    • Open Customer data breach and raise the secondary loss maximum from $15,000K to $40,000K. The annualized loss rises by under a fifth (about $2.3M to $2.7M), but the 1-in-100 year loss climbs by roughly two thirds (about $13M to $22M) and the worst simulated year doubles. Maximum estimates drive the tail far more than the average.
    • Switch Ransomware outage to Estimate LEF directly. The app pre-fills a range from TEF × Vulnerability, which is the top-down route O-RA allows. The control's TEF and Vulnerability reductions then apply to LEF as a whole, because there is no longer a separate Vulnerability to act on.
    • Switch the probability axis to Log. The 1% appetite point at $20M becomes readable, along with how thin the tail estimate is at low run counts.

    Input rules

    • Each range needs minimum ≤ most likely ≤ maximum. All three can be equal, which fixes the value.
    • TEF and LEF are events per year, 0 or more, up to 500. A maximum above 50 a year gets a soft warning.
    • Vulnerability and SLEF are probabilities from 0% to 100%.
    • Losses are in $K and must be 0 or more. A maximum more than 100 times the minimum gets a soft warning, since that implies an extreme tail.
    • The register holds 1 to 10 scenarios. The appetite curve holds 1 to 5 points. Larger losses can't have a higher tolerance than smaller ones.
    • Control reductions run from 0% to 90%, and the annual cost must be 0 or more.

    10. Sources & Credits

    Open FAIR standards

    • The Open Group, Risk Taxonomy (O-RT) Standard, Version 3.0.1. Definitions of Loss Event Frequency, Threat Event Frequency, Vulnerability, and the loss magnitude factors used in the scenario register. pubs.opengroup.org
    • The Open Group, Risk Analysis (O-RA) Standard, Version 2.0.1. The five-stage analysis process, the top-down choice between estimating LEF directly or deriving it, and the control categories in the Control card. The Open FAIR Body of Knowledge
    • The Open Group, Open FAIR Risk Analysis Process Guide. Worked process steps, and the PERT convention for minimum, most likely, and maximum estimates. pubs.opengroup.org
    • John Linford (2020), "Updates to the Open FAIR Body of Knowledge, Part 2." The Open Group Blog. Explains why O-RA 2.0 dropped the confidence parameter, how secondary loss is structured, and the loss prevention and loss mitigation control groups. blog.opengroup.org

    Methods

    • Douglas W. Hubbard and Richard Seiersen (2023), How to Measure Anything in Cybersecurity Risk, 2nd ed. Wiley. Loss exceedance curves, risk-tolerance curves, and Monte Carlo simulation for cyber risk. Wiley Online Library
    • D. G. Malcolm, J. H. Roseboom, C. E. Clark, and W. Fazar (1959), "Application of a Technique for Research and Development Program Evaluation." Operations Research 7(5): 646–669. The origin of the PERT three-point estimate. DOI link

    Notes

    • Illustrative data. The fintech, its scenarios, and every estimate are made up. They don't represent any real firm, incident, or loss history.
    • No affiliation. Open FAIR is a trademark of The Open Group. This app isn't affiliated with or endorsed by The Open Group, the FAIR Institute, or any author cited above, and it isn't an official Open FAIR tool.
    • Educational use only. It's a teaching tool for cyber risk quantification, not security, insurance, or investment advice.
    • Code and fonts. All math and charts are original vanilla JavaScript and SVG, with no third-party libraries. The fonts are Inter and JetBrains Mono, used under the SIL Open Font License.