Lion Cipher Lab

Build a portfolio loss-exceedance curve with calibrated FAIR + Monte Carlo

• GRC / Compliance
• Advanced
• ~75 min
• Free · no account required

Why it matters

The intermediate FAIR lab got you to a defensible sentence about ONE risk: 'this ransomware exposure is worth about $600k a year.' That is a huge step up from a red square — but no organisation faces one risk, and no board decides budgets one risk at a time. The deliverable a real quantitative-risk program produces is a PORTFOLIO LOSS-EXCEEDANCE CURVE: a single picture that answers 'across everything that could hurt us this year, what is the chance we lose more than $X?' for every X. That curve is what lets a CISO say 'we have a 10% chance of a year worse than $5M, our board's stated…

What you'll learn

• moving from single-scenario FAIR to a PORTFOLIO of 5+ risk scenarios expressed as distributions, not point values
• calibrated estimation: giving 90% confidence intervals (Hubbard) so input ranges are honest instead of made up
• modelling loss-event FREQUENCY with a Poisson distribution and loss MAGNITUDE with a lognormal fit to a 90% CI (and knowing when BetaPERT is the right magnitude sampler instead)
• writing and running a real Monte Carlo simulation in Python + numpy that aggregates per-scenario annual losses into a portfolio loss distribution over 50,000+ iterations
• constructing and READING a loss-exceedance curve (the complementary CDF): 'there is an X% chance we lose >= $Y this year'
• overlaying a risk-tolerance / appetite line and deciding whether buying a control bends the curve enough to justify its cost
• running a tornado / sensitivity analysis to find which scenario drives the tail — so the roadmap spends where the money actually is
• naming the failure modes of quantitative risk (false precision, ignoring frequency vs magnitude, assumed independence, Monte Carlo error, garbage-in SMEs, quoting a single ALE to executives) and judging when a qualitative heat-map is enough

Steps in this lab

1. From one scenario to a portfolio — and why every input is a range
2. Calibrate the inputs — honest 90% confidence intervals (Hubbard)
3. Write the Monte Carlo engine (Python + numpy) — Poisson frequency, lognormal magnitude
4. Build and READ the loss-exceedance curve, with an appetite line and a control test
5. Tornado / sensitivity — which scenario drives the tail?
6. The judgment: named failure modes, and when a heat-map was the right call

Open the full interactive lab →