Key Metrics Explained
Value at Risk (VaR): A statistical threshold predicting the maximum probable loss. However, VaR is indifferent to the severity of losses beyond its threshold. If risk is volatile, VaR may not reveal the full picture of extreme scenarios.
Conditional VaR (CVaR): Addresses VaR's limitations by quantifying the expected loss if the VaR threshold is crossed. While VaR sets the breakpoint (e.g., "1 in 10 years"), CVaR tells you how bad the disaster actually is when it happens.
Mean Loss (95% CI): The weighted average loss over time, with a confident range. Use this for annual budget planning.
Risk Scenario Examples
Ransomware Attack:
Frequency: 0.1 (1 in 10 years)
Magnitude: $2M - $5M
Data Breach:
Frequency: 0.2 (1 in 5 years)
Magnitude: $500k - $2M
About FAIR Method
Factor Analysis of Information Risk (FAIR) decomposes risk into:
• Loss Event Frequency: How often bad things happen.
• Loss Magnitude: How much it costs when they do.
Confidence Levels
Adjusting confidence changes the "shape" of the probability curve (Beta-PERT):
• Low: Flatter curve. We are unsure, so extreme outcomes are more possible.
• Medium (Default): Standard weighting.
• High: Peaked curve. We are very confident the value will be close to the "Most Likely" estimate.