Risk quantification
The risk score ranks risk; it doesn't price it. For decisions that involve budgets and boards — which risks to fix first, what a control is worth, how exposure moved this quarter — Mesh quantifies risk in financial terms using FAIR (Factor Analysis of Information Risk), following the Open FAIR v3.0 standard. This page explains the methodology: what the model measures, how the calculation works, and how the risks Mesh detects map into it.
Why FAIR
FAIR is the open, industry-standard model for quantifying information risk. Mesh uses it rather than an invented score-to-dollars formula for three reasons:
- It's decomposed. A loss estimate is built from named, auditable factors — how often loss events happen and how much they cost — not from a single opaque multiplier.
- It's probabilistic. Every input is a range, not a point estimate, and the output is a distribution of outcomes — which is honest about uncertainty instead of hiding it.
- It's a shared language. Risk officers, auditors, and insurers already speak FAIR, so a Mesh figure can be defended outside the security team.
The FAIR decomposition
FAIR expresses risk as annual loss exposure (ALE) — the probable financial impact over a one-year period — and decomposes it into two sides:
ALE = LEF × LM
LEF (loss event frequency) LM (loss magnitude)
├── TEF (threat event frequency) ├── Primary loss
│ ├── Contact frequency │ productivity, response, replacement
│ └── Probability of action └── Secondary loss
└── Vulnerability reputation, competitive advantage,
threat capability vs fines and judgments
control strength
| Factor | What it means |
|---|---|
| ALE — annual loss exposure | The probable financial impact over one year: loss event frequency times loss magnitude. |
| LEF — loss event frequency | How many times per year a loss event is expected to occur. |
| TEF — threat event frequency | How often a threat actor comes into contact with the asset and acts against it: contact frequency times probability of action. |
| Vulnerability | The probability that a threat event becomes a loss event — the chance that the threat's capability exceeds the strength of your controls. |
| LM — loss magnitude | The total cost when a loss event occurs: primary plus secondary loss. |
| Primary loss | Direct costs borne by your organization — productivity, response, and replacement. |
| Secondary loss | Costs driven by stakeholder reaction — reputation, competitive advantage, and fines and judgments. |
This is the same factor tree the FAIR decomposition view in the product renders, so a figure on a dashboard can always be traced back to the factors that produced it.
Ranges, not point estimates
No one knows exactly how often a phishing attempt will succeed next year, and a model that pretends to know produces false precision. Every factor in the Mesh model is therefore expressed as a calibrated three-point range — a minimum, a most likely value, and a maximum — rather than a single number. Ranges are calibrated from published industry research: breach-cost and incident-frequency studies such as IBM's Cost of a Data Breach report, the Verizon Data Breach Investigations Report, Ponemon Institute research, and NIST risk-assessment guidance. Mesh maintains the citations behind its assumptions, so figures are sourced rather than asserted.
The Monte Carlo simulation
To turn ranges into a result, Mesh runs a Monte Carlo simulation: 10,000 simulated years, each one sampling a value from every factor's range, multiplying the factors through the decomposition, and recording that year's loss. The 10,000 outcomes form a loss distribution, and Mesh reports it as percentiles rather than a single number:
| Percentile | Reading | Use it for |
|---|---|---|
| P10 | Optimistic — 90 percent of simulated years lost more than this. | Best-case framing. |
| P50 | The median — half of simulated years fell above, half below. | Budgeting and baseline comparisons. |
| P90 | Pessimistic — only 10 percent of simulated years lost more. | Worst-case and board-level framing. |
The full distribution is also available as a histogram, so you can see the shape of the exposure — a long tail of rare, expensive years reads very differently from a tight cluster, even when the medians match.
The six loss forms
Loss magnitude is broken into the six standard Open FAIR loss forms, and the model treats the two groups differently:
| Loss form | Group | What it covers |
|---|---|---|
| Productivity | Primary | Lost output while people or systems are unavailable. |
| Response | Primary | The cost of investigating, containing, and remediating the event. |
| Replacement | Primary | Restoring or replacing what was affected — resets, rebuilds, reissuance. |
| Reputation | Secondary | Customer churn and brand damage after a public event. |
| Competitive advantage | Secondary | Loss of proprietary information or market position. |
| Fines and judgments | Secondary | Regulatory penalties and legal costs. |
Primary loss forms scale with the number of affected identities; secondary loss forms apply once per breach event, not once per identity, as the Open FAIR standard requires. And each unique identity is counted once across all risk rules — if several findings flag the same people, those people aren't double-counted in the loss calculation.
How risks map to FAIR
Every family of risk Mesh detects carries its own calibrated frequency and magnitude ranges — a dormant account and a phishable credential are different threat scenarios with different math, not the same penalty with different labels. The mapping follows the logic of each scenario:
| Risk family | What drives frequency | What drives magnitude |
|---|---|---|
| Phishable and weak credentials | High contact frequency — credential attacks are constant — moderated by how often attempts succeed. | Mostly response and productivity; escalates when the account reaches regulated data. |
| Missing or bypassed MFA | Acts through vulnerability: without strong authentication, far more threat events become loss events. | Same loss forms as credential compromise, at higher frequency. |
| Breach-exposed credentials | Frequency follows the breach: exposed credentials invite credential-stuffing, and the signal decays as the exposure ages. | Scales with what the breached data included — password exposure raises both sides. |
| Incomplete offboarding, dormant and orphaned accounts | Lower contact frequency, but unmonitored access persists, so probability of action accumulates. | Investigation-heavy: response and replacement dominate once a quiet foothold is found. |
| Excessive privilege | Frequency similar to the underlying account risks. | A magnitude amplifier — the same event costs more when the account can reach more. |
Two properties keep the mapping honest:
- The factors are per scenario, not per severity. Two findings with the same severity can produce very different loss estimates if their threat scenarios differ — which is exactly the ranking signal a severity scale can't give you.
- The portfolio is simulated together. Your report's headline figure is a simulation over the whole scoped risk portfolio, not a sum of independently rounded per-risk numbers, so the percentiles stay statistically meaningful at the top level.
A report is scoped when you generate it — you can filter by department, location, and risk type — and it records your organization profile, such as industry and company size, captured during onboarding.
Remediation impact
Because the model is a simulation, it can answer what if. Mesh computes remediation impact by re-running the portfolio with a proposed fix's risks removed and comparing the result to the current state — the difference is the projected ALE reduction of that action, at the percentile you're planning against. Recommended actions carry that predicted reduction with them, and after a fix lands, Mesh compares the prediction against the reduction actually observed. That closes the loop that makes quantification trustworthy: the model's claims are checked against what really happened. See Remediation for how actions are proposed and tracked.
Tracking exposure over time
Mesh records the loss estimate daily, so trend views show how exposure moved — after a remediation push, a new connector, or an acquisition — without recomputing history from changed data. The trend, the headline figure, its change since yesterday, and the loss breakdown appear as live widgets in Generative UI workspaces, most prominently on the Executive View, and in the FAIR report described in Reports, exports, and data retrieval.
What the numbers are — and aren't
A FAIR estimate is decision support, not an invoice. The output is a probability-weighted range grounded in cited industry research and your environment's actual findings; it is designed to rank priorities, size investments, and communicate movement — not to predict the exact cost of the next incident. The calibrated constants behind your tenant's figures aren't published in this documentation; for how they're derived for your environment, contact your Axiad representative.
Related concepts
- Risks — the catalog of findings the model quantifies.
- Risk scoring — the 1–100 ranking that sits alongside the dollar figure.
- Remediation — acting on the ranked list, with predicted and observed impact.
- Quantify risk in dollars — the use case this methodology serves.
- Reports, exports, and data retrieval — generating and consuming FAIR reports.