Quantify your exposure to five common cyber-risk scenarios in under 20 minutes
FAIR QuickRisk asks eight organisation-profile questions and two questions for each of five cyber-risk scenarios, then runs a server-side Monte Carlo simulation of 5,000 iterations per scenario to estimate a distribution of possible annual loss exposure. Results show expected annual loss, P10, P50 and P90 loss levels and threshold exceedance probabilities for each scenario.
The five assessed scenarios
- Ransomware / destructive extortion
- Identity, phishing, social-engineering or business-account compromise
- Exploitation of a public-facing vulnerability
- Third-party / supplier / managed-service compromise
- DDoS / denial-of-service / externally driven service disruption
Methodology in brief
FAIR QuickRisk uses a simplified probabilistic model. Answers are translated into ranges rather than single values, and thousands of simulated trials are used to estimate an annualised exposure approximation. Reported P10, P50 and P90 values describe that approximation under the stated assumptions; they are not percentiles of realised annual loss totals, not guarantees and not precise forecasts. Scenario dependencies are not modelled, so the total shown is the sum of scenario expected values and not a joint distribution percentile. Read the full methodology.
Zero-retention assessment
Your answers and calculated results are processed transiently to produce the assessment. FAIR QuickRisk does not store your answers or results in a database, account, browser storage, cookie or application file. No account or login is required. If you close or refresh the page, the assessment cannot be recovered.
Important disclaimer
FAIR QuickRisk is provided solely as a preliminary, informational and educational risk-estimation tool. It is not a full FAIR analysis, is not a FAIR certification or accreditation tool, and is not endorsed, approved, certified or validated by the FAIR Institute or any other standards body, regulator, government authority or third party. The results are estimates, not facts, and do not constitute professional advice of any kind. This application must not be used as the sole basis for material business decisions.