Quantitative risk analysis

The classic textbook model, familiar from CISSP material, uses point estimates. Single loss expectancy is asset value times exposure factor (SLE = AV × EF), the share of the value lost in one event; annualised loss expectancy is SLE times the annualised rate of occurrence (ALE = SLE × ARO). A control is justified when ALE before minus ALE after, minus the control's annual cost, is positive. The arithmetic is simple, but a single ALE figure hides the shape of the loss: an event expected once in a hundred years that costs 50 million has an ALE of 500,000, the same as a frequent 50,000 nuisance occurring ten times a year, yet only the first can threaten the organisation's survival.

Modern practice replaces points with distributions. FAIR (Factor Analysis of Information Risk), published by The Open Group as the Open FAIR standards O-RT (risk taxonomy) and O-RA (risk analysis), decomposes risk into loss event frequency and loss magnitude. Loss event frequency is threat event frequency times vulnerability, meaning the probability that a threat event becomes a loss event; loss magnitude is split into primary loss, borne directly, and secondary loss arising from stakeholder reactions such as fines, lawsuits and customer churn. Each factor is estimated as a range, typically minimum, most likely and maximum fed into a PERT or lognormal distribution, and Monte Carlo simulation produces a loss exceedance curve showing the probability that annual loss exceeds any given amount.

The loss exceedance curve is what makes the method useful for decisions: it can be compared with a risk appetite curve set by leadership, used to compare controls by how much they shift the curve, and read at the tail to choose insurance limits and retentions. Hubbard and Seiersen's How to Measure Anything in Cybersecurity Risk argues that calibrated expert estimates, expressed as 90% confidence intervals by people trained to be neither over- nor underconfident, outperform ordinal scoring even with sparse data.

Weaknesses are practical rather than theoretical. Good frequency data is scarce, so estimates lean on incident history, industry loss studies and insurance claims data that may not fit the organisation; results can look authoritative while resting on weak inputs; correlated losses, such as a single cloud provider outage hitting many processes at once, are easy to model as independent by mistake; and the effort means most organisations quantify only a few top risks. The output is a model of uncertainty, not a forecast, and should be reported with its ranges and key assumptions.