# Risk quantification

The [risk score](./risk-scoring.md) ranks risk; it doesn't price it. For
decisions that involve budgets and boards — which risks to fix first, what a
control is worth, how exposure moved this quarter — Mesh quantifies risk in
financial terms using **FAIR** (Factor Analysis of Information Risk), following
the Open FAIR v3.0 standard. This page explains the methodology: what the
model measures, how the calculation works, and how the
[risks](./risks.md) Mesh detects map into it.

## Why FAIR

FAIR is the open, industry-standard model for quantifying information risk.
Mesh uses it rather than an invented score-to-dollars formula for three
reasons:

- **It's decomposed.** A loss estimate is built from named, auditable
  factors — how often loss events happen and how much they cost — not from a
  single opaque multiplier.
- **It's probabilistic.** Every input is a range, not a point estimate, and
  the output is a distribution of outcomes — which is honest about
  uncertainty instead of hiding it.
- **It's a shared language.** Risk officers, auditors, and insurers already
  speak FAIR, so a Mesh figure can be defended outside the security team.

## The FAIR decomposition

FAIR expresses risk as **annual loss exposure (ALE)** — the probable financial
impact over a one-year period — and decomposes it into two sides:

```text
ALE  =  LEF × LM

LEF (loss event frequency)          LM (loss magnitude)
├── TEF (threat event frequency)    ├── Primary loss
│   ├── Contact frequency           │     productivity, response, replacement
│   └── Probability of action       └── Secondary loss
└── Vulnerability                         reputation, competitive advantage,
      threat capability vs                fines and judgments
      control strength
```

| Factor | What it means |
| --- | --- |
| **ALE** — annual loss exposure | The probable financial impact over one year: loss event frequency times loss magnitude. |
| **LEF** — loss event frequency | How many times per year a loss event is expected to occur. |
| **TEF** — threat event frequency | How often a threat actor comes into contact with the asset and acts against it: contact frequency times probability of action. |
| **Vulnerability** | The probability that a threat event becomes a loss event — the chance that the threat's capability exceeds the strength of your controls. |
| **LM** — loss magnitude | The total cost when a loss event occurs: primary plus secondary loss. |
| **Primary loss** | Direct costs borne by your organization — productivity, response, and replacement. |
| **Secondary loss** | Costs driven by stakeholder reaction — reputation, competitive advantage, and fines and judgments. |

This is the same factor tree the FAIR decomposition view in the product
renders, so a figure on a dashboard can always be traced back to the factors
that produced it.

## Ranges, not point estimates

No one knows exactly how often a phishing attempt will succeed next year, and
a model that pretends to know produces false precision. Every factor in the
Mesh model is therefore expressed as a calibrated three-point range — a
minimum, a most likely value, and a maximum — rather than a single number.
Ranges are calibrated from published industry research: breach-cost and
incident-frequency studies such as IBM's Cost of a Data Breach report, the
Verizon Data Breach Investigations Report, Ponemon Institute research, and
NIST risk-assessment guidance. Mesh maintains the citations behind its
assumptions, so figures are sourced rather than asserted.

## The Monte Carlo simulation

To turn ranges into a result, Mesh runs a **Monte Carlo simulation**: 10,000
simulated years, each one sampling a value from every factor's range,
multiplying the factors through the decomposition, and recording that year's
loss. The 10,000 outcomes form a loss distribution, and Mesh reports it as
percentiles rather than a single number:

| Percentile | Reading | Use it for |
| --- | --- | --- |
| **P10** | Optimistic — 90 percent of simulated years lost more than this. | Best-case framing. |
| **P50** | The median — half of simulated years fell above, half below. | Budgeting and baseline comparisons. |
| **P90** | Pessimistic — only 10 percent of simulated years lost more. | Worst-case and board-level framing. |

The full distribution is also available as a histogram, so you can see the
shape of the exposure — a long tail of rare, expensive years reads very
differently from a tight cluster, even when the medians match.

## The six loss forms

Loss magnitude is broken into the six standard Open FAIR loss forms, and the
model treats the two groups differently:

| Loss form | Group | What it covers |
| --- | --- | --- |
| **Productivity** | Primary | Lost output while people or systems are unavailable. |
| **Response** | Primary | The cost of investigating, containing, and remediating the event. |
| **Replacement** | Primary | Restoring or replacing what was affected — resets, rebuilds, reissuance. |
| **Reputation** | Secondary | Customer churn and brand damage after a public event. |
| **Competitive advantage** | Secondary | Loss of proprietary information or market position. |
| **Fines and judgments** | Secondary | Regulatory penalties and legal costs. |

**Primary loss forms scale with the number of affected identities**; secondary
loss forms apply once per breach event, not once per identity, as the Open
FAIR standard requires. And each unique identity is counted once across all
risk rules — if several findings flag the same people, those people aren't
double-counted in the loss calculation.

## How risks map to FAIR

Every family of [risk](./risks.md) Mesh detects carries its own calibrated
frequency and magnitude ranges — a dormant account and a phishable credential
are different threat scenarios with different math, not the same penalty with
different labels. The mapping follows the logic of each scenario:

| Risk family | What drives frequency | What drives magnitude |
| --- | --- | --- |
| **Phishable and weak credentials** | High contact frequency — credential attacks are constant — moderated by how often attempts succeed. | Mostly response and productivity; escalates when the account reaches regulated data. |
| **Missing or bypassed MFA** | Acts through vulnerability: without strong authentication, far more threat events become loss events. | Same loss forms as credential compromise, at higher frequency. |
| **Breach-exposed credentials** | Frequency follows the breach: exposed credentials invite credential-stuffing, and the signal decays as the exposure ages. | Scales with what the breached data included — password exposure raises both sides. |
| **Incomplete offboarding, dormant and orphaned accounts** | Lower contact frequency, but unmonitored access persists, so probability of action accumulates. | Investigation-heavy: response and replacement dominate once a quiet foothold is found. |
| **Excessive privilege** | Frequency similar to the underlying account risks. | A magnitude amplifier — the same event costs more when the account can reach more. |

Two properties keep the mapping honest:

- **The factors are per scenario, not per severity.** Two findings with the
  same severity can produce very different loss estimates if their threat
  scenarios differ — which is exactly the ranking signal a severity scale
  can't give you.
- **The portfolio is simulated together.** Your report's headline figure is a
  simulation over the whole scoped risk portfolio, not a sum of independently
  rounded per-risk numbers, so the percentiles stay statistically meaningful
  at the top level.

A report is scoped when you generate it — you can filter by department,
location, and risk type — and it records your organization profile, such as
industry and company size, captured during onboarding.

## Remediation impact

Because the model is a simulation, it can answer *what if*. Mesh computes
**remediation impact** by re-running the portfolio with a proposed fix's risks
removed and comparing the result to the current state — the difference is the
projected ALE reduction of that action, at the percentile you're planning
against. Recommended actions carry that predicted reduction with them, and
after a fix lands, Mesh compares the prediction against the reduction actually
observed. That closes the loop that makes quantification trustworthy: the
model's claims are checked against what really happened. See
[Remediation](./remediation.md) for how actions are proposed and tracked.

## Tracking exposure over time

Mesh records the loss estimate daily, so trend views show how exposure moved —
after a remediation push, a new connector, or an acquisition — without
recomputing history from changed data. The trend, the headline figure, its
change since yesterday, and the loss breakdown appear as live widgets in
[Generative UI](../user-guide/generative-ui.md) workspaces, most prominently
on the Executive View, and in the FAIR report described in
[Reports, exports, and data retrieval](../user-guide/reports-and-exports.md#fair-quantitative-risk-reporting).

## What the numbers are — and aren't

A FAIR estimate is decision support, not an invoice. The output is a
probability-weighted range grounded in cited industry research and your
environment's actual findings; it is designed to rank priorities, size
investments, and communicate movement — not to predict the exact cost of the
next incident. The calibrated constants behind your tenant's figures aren't
published in this documentation; for how they're derived for your
environment, contact your Axiad representative.

## Related concepts

- [Risks](./risks.md) — the catalog of findings the model quantifies.
- [Risk scoring](./risk-scoring.md) — the 1–100 ranking that sits alongside
  the dollar figure.
- [Remediation](./remediation.md) — acting on the ranked list, with predicted
  and observed impact.
- [Quantify risk in dollars](../use-cases/quantify-risk-in-dollars.md) — the
  use case this methodology serves.
- [Reports, exports, and data retrieval](../user-guide/reports-and-exports.md#fair-quantitative-risk-reporting) —
  generating and consuming FAIR reports.