> For the complete documentation index, see [llms.txt](https://docs.securemetrics.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.securemetrics.io/crq-pro/core-concepts/fair-model.md).

# The FAIR model

CRQ Pro quantifies risk with the **Open FAIR** approach:

> **Risk = Loss Event Frequency (LEF) x Loss Magnitude (LM)**

Every scenario has these two factors. Each factor can be **estimated directly** as a distribution, or **decomposed** into its FAIR sub-factors when you have better data one level down. You choose the depth per factor, per scenario.

## The taxonomy

| Factor                           | Estimate directly, or decompose into                      |
| -------------------------------- | --------------------------------------------------------- |
| **Loss Event Frequency (LEF)**   | Threat Event Frequency x Vulnerability                    |
| **Threat Event Frequency (TEF)** | Contact Frequency x Probability of Action                 |
| **Vulnerability**                | Derived from Threat Capability vs Resistance Strength     |
| **Loss Magnitude (LM)**          | Primary Loss + Secondary Risk                             |
| **Secondary Risk**               | Secondary Loss Event Frequency x Secondary Loss Magnitude |

* **LEF**: how many times per year the loss event occurs.
* **TEF**: how many times per year a threat agent acts against the asset. Multiplied by **Vulnerability** (the probability a threat event becomes a loss event) to get LEF.
* **Vulnerability**: set it as a probability directly, or derive it from **Threat Capability** vs **Resistance Strength**, both on the FAIR 0-100 scale. Vulnerability is then the probability that the threat's capability exceeds your resistance.
* **Loss Magnitude**: the cost of one loss event. **Primary Loss** is the direct cost; **Secondary Risk** covers follow-on losses (for example regulatory action or customer churn) that only happen some of the time.
* **Forms of loss**: any loss amount can be split across the six FAIR forms: productivity, response, replacement, fines, competitive advantage, and reputation. The simulation sums them per event.

## Distributions

Every leaf estimate is a distribution, not a point value (though a Point option exists when you truly have a fixed number). Available distributions depend on what you are estimating:

{% tabs %}
{% tab title="Frequency" %}

| Distribution | Use when                                                                         |
| ------------ | -------------------------------------------------------------------------------- |
| **PERT**     | You can give min, most likely, and max. The default choice for expert estimates. |
| **Poisson**  | You know the average annual rate.                                                |
| **Gamma**    | You want a skewed rate with a long right tail.                                   |
| {% endtab %} |                                                                                  |

{% tab title="Magnitude" %}

| Distribution                 | Use when                                                                                 |
| ---------------------------- | ---------------------------------------------------------------------------------------- |
| **PERT**                     | Min, most likely, max cost per event.                                                    |
| **Lognormal (p10/p90)**      | You can bound the cost: "90% chance it is between X and Y." A natural fit for loss data. |
| **Triangle**                 | Like PERT but with more weight on the extremes.                                          |
| **Modified PERT**            | PERT with a confidence parameter (gamma) to sharpen or flatten the peak.                 |
| **Uniform**                  | Any value in the range is equally likely.                                                |
| **Point**                    | A fixed cost.                                                                            |
| **Generalized Pareto (GPD)** | Heavy-tailed losses where extreme outcomes matter.                                       |
| {% endtab %}                 |                                                                                          |

{% tab title="Probability" %}

| Distribution | Use when                                                              |
| ------------ | --------------------------------------------------------------------- |
| **PERT**     | Min, most likely, max probability.                                    |
| **Point**    | A fixed probability.                                                  |
| **Beta**     | You want to express uncertainty from observed successes and failures. |
| {% endtab %} |                                                                       |

{% tab title="Capability (0-100)" %}

| Distribution  | Use when                                  |
| ------------- | ----------------------------------------- |
| **PERT**      | Min, most likely, max on the 0-100 scale. |
| **Triangle**  | Same inputs, heavier extremes.            |
| **Uniform**   | Any value in the range is equally likely. |
| {% endtab %}  |                                           |
| {% endtabs %} |                                           |

{% hint style="info" %}
**How deep should you decompose?** Only as deep as your data supports. A well-reasoned direct LEF estimate beats a four-level decomposition built on guesses. Decompose when the sub-factors are genuinely easier to estimate, for example when you have log data for contact frequency or control assessments for resistance strength.
{% endhint %}

## How the simulation uses your model

For each simulated year, CRQ Pro samples an annual event rate from your LEF model, draws the number of loss events from a Poisson distribution with that rate, samples a Loss Magnitude for each event, and sums them into an annual loss. Repeated tens of thousands of times, this produces the full annual loss distribution you see in the [Results dock](/crq-pro/guides/simulation-results.md).