One of the first questions I ask when working with an organization is “Why are you interested in making FAIR (Factor Analysis of Information Risk) a part of your standard risk management practice?”

The answer is different for every client, and that truly highlights the value of risk quantification.

We can apply risk quantification to a number of areas in major industry sectors. Your organization may want to assess the risks associated with a vendor through your third-party risk management program, or maybe you want to understand the impact of recently identified compliance or regulatory gaps. Or possibly there is a need to justify the cost of a new security investment or process improvement. Whatever your ‘why’, risk quantification could be part of the solution. You may also find that your risk quantification journey starts with your most critical use case but, over time, scales to meet additional needs across the business.

Making investments and prioritization of project decisions can be challenging for businesses large and small. With competing priorities and goals, it can feel impossible to gain alignment across the organization. But what if your goals and understanding were aligned? How would that change the conversation?

By speaking a common language, dollars and cents, you are able to bridge the gap and bring alignment across the organization. Risk quantification can also be leveraged in organizations at all levels of risk maturity. Because of these factors, it becomes a universally accessible way to assess and understand risks across the business.

It’s also important to understand that the ‘why’ is often different within different levels of the same organization. If you’re speaking with IT security professionals, they may be more concerned with which tool or software will help them best protect the environment. But if you’re working with a chief information security officer (CISO) or other C-level executives, they may be focused on the larger picture of protecting the brand and business value.

I recall a previous client engagement where the ‘why’ differed across the organization. The CISO needed to understand how to communicate financial risk information to the board and leadership as part of strategic and budget planning, but the IT security team wanted information around prioritizing risks so they could determine where to make improvements. The scenarios that were analyzed for this client allowed us to meet the needs of both parties. We quantified risks and prioritized the results so that the IT security team could create a proposal, and we provided reporting tools for the CISO to share the results with the board and leadership.

Because the FAIR methodology takes into account both threat event frequency and loss magnitude when quantifying risk, it provides the business with valuable information that can be used to make informed decisions. When working with FAIR, we are looking to answer the question: “How often do we think this will happen and, when it does, how big will the loss be?” Once we can answer these questions, we are able to make better decisions on how to mitigate risks. This also provides a level of understanding that resonates across all levels of the organization.

Understanding your client’s ‘why’ and goals before you get started will give way to clarity and direction to your FAIR engagement.

More from Intelligence & Analytics

The 13 Costliest Cyberattacks of 2022: Looking Back

2022 has shaped up to be a pricey year for victims of cyberattacks. Cyberattacks continue to target critical infrastructures such as health systems, small government agencies and educational institutions. Ransomware remains a popular attack method for large and small targets alike. While organizations may choose not to disclose the costs associated with a cyberattack, the loss of consumer trust will always be a risk after any significant attack. Let’s look at the 13 costliest cyberattacks of the past year and…

What Can We Learn From Recent Cyber History?

The Center for Strategic and International Studies compiled a list of significant cyber incidents dating back to 2003. Compiling attacks on government agencies, defense and high-tech companies or economic crimes with losses of more than a million dollars, this list reveals broader trends in cybersecurity for the past two decades. And, of course, there are the headline breaches and supply chain attacks to consider. Over recent years, what lessons can we learn from our recent history — and what projections…

When Logs Are Out, Enhanced Analytics Stay In

I was talking to an analyst firm the other day. They told me that a lot of organizations purchase a security information and event management (SIEM) solution and then “place it on the shelf.” “Why would they do that?” I asked. I spent the majority of my career in hardware — enterprise hardware, cloud hardware, and just recently made the jump to security software, hence my question. “Because SIEMs are hard to use. A SIEM purchase is just a checked…

4 Most Common Cyberattack Patterns from 2022

As 2022 comes to an end, cybersecurity teams globally are taking the opportunity to reflect on the past 12 months and draw whatever conclusions and insights they can about the threat landscape. It has been a challenging year for security teams. A major conflict in Europe, a persistently remote workforce and a series of large-scale cyberattacks have all but guaranteed that 2022 was far from uneventful. In this article, we’ll round up some of the most common cyberattack patterns we…