What the application does
FAIR QuickRisk asks eight organisation-profile questions and exactly two questions for each of five predefined scenarios, then runs a server-side Monte Carlo simulation of 5,000 iterations per scenario. It reports expected annual loss, P10/P50/P90 loss levels, threshold exceedance probabilities and a confidence indicator for each scenario.
Why these five scenarios
The five scenarios are a practical rapid-assessment set chosen for current threat evidence and broad applicability, not a mathematically exact ranking of the five most frequent cyber risks. Public threat reporting identifies phishing and social engineering as a leading initial access route, vulnerability exploitation as a major and growing vector, ransomware as the most impactful incident type, third-party involvement as a large and increasing share of breaches, and denial-of-service as the highest-volume disruption activity.
Incident frequency is not treated as business risk. A very frequent scenario such as denial-of-service is not automatically ranked highly, because the model also considers financial loss magnitude.
What is borrowed from FAIR, and what is simplified
The model borrows FAIR's core structure: frequency separated from magnitude, ranges rather than point estimates, and an explicit separation of primary and secondary loss. It uses the terms Threat Event Frequency, Loss Event Frequency, Loss Magnitude, Primary Loss and Secondary Loss, each of which is explained in plain language inside the application.
- A full FAIR analysis decomposes frequency and magnitude into many factors. This application uses a small fixed factor set.
- Only five scenarios are assessed; other material scenarios are outside the model.
- Scenario dependencies and correlations are not modelled, so no joint portfolio percentile is presented.
- Secondary loss is represented by one occurrence probability and one magnitude distribution per scenario.
- Statutory fines, regulatory penalties and specific legal liabilities are explicitly out of scope.
- One loss magnitude is sampled per simulated trial rather than once per event, so the reported values are an annualised exposure approximation and not realised annual loss totals.
- The model does not capture uncertainty about its own structure, distribution shapes, calibration or scenario correlation.
How answers become ranges
Each answer maps to a distribution stored in versioned model files rather than to a single number. The likelihood question asks how often the scenario is attempted or contacted in a typical 12-month period, before considering whether your controls would prevent it: that is a threat event frequency, and control effectiveness is applied separately and only once, as susceptibility. An impact answer maps to a range of multipliers against your organisation's disruption-cost anchor. Organisation-profile answers act as modifiers. An Unknown answer is modelled as an equal-weight mixture of the available answers, which widens the range, keeps the central estimate inside the range of the answers you could have chosen, and reduces the input-confidence rating.
What P10, P50 and P90 mean
P10 is the level that 10% of simulated trials fell below, P50 is the median, and P90 is the level that 90% of simulated trials fell below. These percentiles describe an annualised exposure approximation — loss event frequency multiplied by one sampled event magnitude per trial — and are not percentiles of realised annual loss totals. A wide P10–P90 range is a statement about uncertainty in the inputs and assumptions, not a confidence interval around a known true value.
What expected annual loss means
Expected annual loss is the arithmetic mean of the simulated annualised exposure values for a scenario: the long-run average of the modelled approximation, not the most likely outcome and not a forecast for the coming year. The total shown is the sum of the five scenario expected annual losses, which is exact for expected values. Because dependencies between scenarios are not modelled, that sum is not presented as a joint distribution percentile.
Versioning
The model identifier, model version, schema version and calibration version are shown on every result and report. Scenario definitions, questions, answer options and calibration parameters live in version-controlled model files outside the public web root. Calibration changes create a new version. Because the application retains no assessment, a calibration change cannot alter any past assessment.
Zero-retention assessment
Your answers and calculated results are processed transiently to produce this assessment. FAIR QuickRisk does not store your assessment answers or results in a database, account, browser storage, cookie or application file. No account or login is required. If you close or refresh the page before saving anything yourself, the assessment cannot be recovered by the application.
Normal web infrastructure may process technical metadata such as source IP address, timestamp, HTTP status and user-agent. Assessment answers and results are never attached to those records. The application can prohibit intentional application-level persistence, but it cannot control transient copies that may exist outside its architecture, such as browser memory, operating-system memory management, network infrastructure or security monitoring controlled by the hosting provider.
Important disclaimer
FAIR QuickRisk is provided solely as a preliminary, informational and educational risk-estimation tool. It is intended to provide an initial indication of potential cyber-risk exposure based on a limited number of user-supplied assumptions and a simplified, probabilistic methodology inspired by concepts from the FAIR risk-analysis model.
This application is not a full FAIR analysis, is not a FAIR certification or accreditation tool, and is not endorsed, approved, certified or validated by the FAIR Institute or any other standards body, regulator, government authority or third party.
The results are estimates, not facts. They are dependent on the quality, completeness and accuracy of the information entered by the user, as well as on model assumptions, calibration parameters, statistical distributions and other simplifications. Different information, assumptions, model versions or professional analyses may produce materially different results.
The application does not constitute cybersecurity advice, risk-management advice, financial advice, legal advice, regulatory advice, audit, assurance, compliance assessment, certification, insurance advice, valuation, incident-response advice or professional advice of any kind. It must not be used as the sole basis for decisions concerning cybersecurity investment, risk acceptance, business continuity, insurance, financial reporting, regulatory compliance, regulatory notification, legal action, incident response, system shutdown, service restoration or any other material business decision.
The application is provided "AS IS" and "AS AVAILABLE", without warranties or representations of any kind, to the maximum extent permitted by applicable law. The user is solely responsible for independently validating the inputs, interpreting the outputs, obtaining appropriate professional advice and making any decision arising from the assessment. A favourable result does not mean that an organisation is secure or that its cyber risk is acceptable. A high result does not, by itself, establish that the organisation is non-compliant or materially exposed.
Contextual evidence sources
The scenario set is informed by current public threat reporting. Those sources provide contextual justification only and are not used as direct model coefficients. Calibration values are documented separately and classified as externally evidenced, internally derived, heuristic, or placeholder requiring future validation.