# Identity Mesh — May 4, 2026

**Release Date**: May 4, 2026\
**Release Type**: Bug Fix

------------------------------------------------------------------------

## Overview

This release recalibrates the FAIR (Factor Analysis of Information Risk) calculation engine. Two critical defects were inflating Annualized Loss Expectancy (ALE) by 3–10 times for organizations with several risk rules and multiple loss forms. With both fixes in place, ALE values now land in the expected range — for a representative environment of about 450 identities, roughly \$1M–\$5M instead of over \$800M. The recalibrated engine is now ready for production use.

------------------------------------------------------------------------

## Bug fixes

### Secondary loss forms were scaled by the number of affected identities

Secondary loss forms — competitive advantage, fines and judgments, and reputation — were multiplied by the number of affected identities. Under the Open FAIR standard, these losses apply once per breach event, not once per identity.

**What changed:**

- Primary loss forms continue to scale with the number of affected identities.

- Secondary loss forms are now applied once per event, as the standard requires.

- FAIR constants and loss-form percentages are unchanged.

**Impact:** removes a 30–65% inflation of ALE on any risk rule that uses multiple loss forms.

------------------------------------------------------------------------

### Identities were double-counted across overlapping risk rules

When several risk rules flagged the same people, each person was counted once per rule instead of once overall. This inflated the identity count 2–4 times and every loss estimate built on it.

**What changed:**

- The engine now counts each unique identity once across all risk rules.

**Impact:** if three risk rules each flag the same 450 people, the report now counts 450 identities, not 1,350. This removes a roughly threefold inflation from the loss calculation.

------------------------------------------------------------------------

## Combined outcome

| Scenario | Before | After |
|----|----|----|
| Representative environment of about 450 identities with three overlapping risk rules | \$810M–\$835M ALE | \$1M–\$5M ALE |
| FAIR report generation with the recalibrated engine | Not available | Available |