<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: building-risk-quantification-models
description: >-
  Quantitative risk analysis with FAIR modeling and Monte Carlo simulation.
domain: cybersecurity
subdomain: threat-modeling
tags:
  - risk-quantification
  - fair
  - monte-carlo
  - ale
  - business-risk
  - cyber-risk-metrics
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack:
  - "T1485"
  - "T1486"
  - "T1498"
---

# Building Risk Quantification Models

## Overview

Qualitative risk ratings (High/Medium/Low) lack precision for business decision-making.
This technique applies quantitative methods — FAIR analysis, Monte Carlo simulation, and
Annualized Loss Expectancy (ALE) — to translate threat model findings into dollar-denominated
risk metrics that executives and boards can act on.

Mode: `[MODE: ARCHITECT]` — Quantitative risk modeling and financial impact analysis.

## Prerequisites

- Threat model with identified risks and severity ratings
- Business impact data (revenue, customer count, regulatory fines)
- Python 3.10+
- `numpy` for Monte Carlo simulation: `pip install numpy`

## Key Concepts

### FAIR Model Components

| Component | Description | Unit |
|-----------|-------------|------|
| **TEF** | Threat Event Frequency | Events/year |
| **Vulnerability** | Probability threat succeeds | 0.0 – 1.0 |
| **LEF** | Loss Event Frequency (TEF x Vuln) | Events/year |
| **Primary Loss** | Direct cost of incident | USD |
| **Secondary Loss** | Indirect cost (reputation, fines) | USD |
| **ALE** | Annualized Loss Expectancy (LEF x Loss) | USD/year |

### Monte Carlo Simulation

Uses probability distributions (PERT, lognormal) instead of point estimates:
- **Minimum** — best-case scenario
- **Most Likely** — expected outcome
- **Maximum** — worst-case scenario
- Run 10,000+ iterations to produce confidence intervals

### Risk Decision Thresholds

| ALE Range | Decision | Action |
|-----------|----------|--------|
| > $1M | Accept, transfer, or invest | Board-level decision required |
| $100K - $1M | Mitigate or transfer | CISO approval for acceptance |
| $10K - $100K | Mitigate if cost-effective | Risk-owner decision |
| < $10K | Accept with documentation | Standard acceptance |

## Workflow

### Step 1: Define Risk Scenarios

```bash
node scripts/agent.js --action model --input scenario.json
node scripts/agent.js --action simulate --input scenario.json --query 10000
```

### Step 2: Calculate ALE

```bash
node scripts/agent.js --action ale --input scenarios.json
```

### Step 3: Generate Executive Report

```bash
node scripts/agent.js --action report --input scenarios.json --output report.json
```

## Verification

- [ ] Risk scenarios defined with FAIR components (TEF, vulnerability, loss magnitude)
- [ ] Monte Carlo simulation run with 10,000+ iterations
- [ ] ALE calculated with confidence intervals (P10, P50, P90)
- [ ] Results validated against industry benchmarks
- [ ] Executive summary translates technical risks to financial impact
- [ ] Risk treatment decisions documented with cost-benefit analysis

## References

- [FAIR Institute](https://www.fairinstitute.org/)
- [Open FAIR Standard (O-RA)](https://publications.opengroup.org/standards/risk-analysis)
- [NIST SP 800-30 — Risk Assessment](https://csrc.nist.gov/publications/detail/sp/800-30/rev-1/final)
- [Hubbard — How to Measure Anything in Cybersecurity Risk](https://www.howtomeasureanything.com/cybersecurity/)
