<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Enterprise Risk Assessment — API Reference

## Risk Assessment Methodologies

| Methodology | Type | Standard | Use Case |
|------------|------|----------|----------|
| NIST 800-30 | Qualitative | NIST | Federal/regulated entities |
| FAIR | Quantitative | OpenFAIR | Financial impact analysis |
| ISO 31000 | Framework | ISO | Enterprise risk management |
| OCTAVE | Hybrid | SEI/CMU | Operational risk assessment |

## Agent Commands

```bash
# Qualitative assessment from threat catalog
node agent.js --action assess --input threats.json

# FAIR quantitative analysis
node agent.js --action quantify --input scenario.json

# Generate executive risk report
node agent.js --action report --input assessment.json --output report.json
```

## Risk Matrix Reference

| Likelihood \\ Impact | Negligible (1) | Minor (2) | Moderate (3) | Major (4) | Severe (5) |
|----------------------|---------------|-----------|--------------|-----------|------------|
| Almost Certain (5) | 5 | 10 | 15 | 20 | 25 |
| Likely (4) | 4 | 8 | 12 | 16 | 20 |
| Possible (3) | 3 | 6 | 9 | 12 | 15 |
| Unlikely (2) | 2 | 4 | 6 | 8 | 10 |
| Rare (1) | 1 | 2 | 3 | 4 | 5 |
