In today’s digital age, organizations face ever-evolving threats to their information and data security. From cyberattacks to data breaches, the risks associated with managing and protecting sensitive information are more significant than ever before. To effectively address these challenges, organizations need a robust and systematic approach to risk management. 

 

In recent years, there has been an increasing emphasis on cyber risk quantification. There are two methodologies today:

• the FAIR (Factor Analysis of Information Risk) and
• the Digital Asset Approach.

 

We conducted a competitive analysis between FAIR and Digital Asset approach and here are our findings:  

 

• • The FAIR model is not quantitative – it estimates the frequency of cyber-attack (or event likelihood) but it is not a specific quantification related to how a cybercriminal causes financial harm.
  • It relies on a SME with formal training to try to implement it – small or resource-constrained organizations may find it challenging to allocate the necessary resources to fully leverage the benefits of FAIR.
  • Data is highly subjective – there is a high element of subjectivity involved in assessing and assigning values to factors and variables. Different analysts or stakeholders may have varying interpretations or biases when evaluating risk factors, leading to potential inconsistencies in risk assessments.
  • The Process is complex, time consuming and highly theoretical – employed model involves complex calculations and requires a solid understanding of risk analysis principles.

 

Overall conclusion: The FAIR model does not fit today’s business needs. Only the Digital Asset model does.