Lion Cipher Lab
Put a dollar figure on cyber risk with the FAIR model
- GRC / Compliance
- Intermediate
- ~45 min
- Free · no account required
Why it matters
"High/Medium/Low" cannot be added, compared, or budgeted on — two risks both rated "High" can differ 100x in real dollar exposure, and a CISO cannot defend a spend with a colour. Quantifying risk in dollars is what turns a heat-map into a business case: it lets you rank controls by dollars-of-risk-reduced-per-dollar-spent, price a cyber-insurance decision, and answer the board's real question — "how much money is this actually costing us, and does the fix pay for itself?" FAIR is the most widely adopted open standard for doing exactly that, and this lab is the hands-on bridge from qualitative…
What you'll learn
- Quantitative risk analysis
- FAIR model / risk taxonomy
- ALE / SLE / ARO estimation
- Three-point (PERT) range estimation
- Monte Carlo loss simulation (optional)
- Writing a board-ready risk statement
Steps in this lab
- The problem with "High / Medium / Low"
- The FAIR taxonomy in plain words
- The bridge every analyst learns first: SLE, ARO, ALE
- Why a single number lies — use ranges, not point estimates
- OPTIONAL — simulate the loss distribution with Monte Carlo (Python)
- Your turn — fill the worksheet and write the board statement
- Reality check — FAIR's limits and where it fits