Financial Exposure (FAIR)
The FAIR tab on Security posture turns your security posture into an annual loss range in money. It is an estimate for planning and conversations with finance and the board. It is not a prediction.
The tab is headed "Financial exposure (FAIR)" with the line "Annualized loss ranges from your posture and loss profile". FAIR stands for Factor Analysis of Information Risk.
When the tab shows something
The tab shows one of these:
| You see | What it means |
|---|---|
| "Loss estimates need your organization's profile (revenueBand, recordVolumeBand)" | Your loss profile is incomplete. The estimate needs your revenue band and your record volume band. Nothing is estimated until they are set. |
| A range and scenario cards | The estimate was computed |
| Nothing (the card is hidden) | Money display is switched off for your organisation, or Hunto could not derive the risk factors from your posture |
Hunto never shows a made-up number. Without the inputs it asks for them.
The loss profile
An administrator provides four inputs:
| Input | Values |
|---|---|
| Revenue band | under $10M, $10M to $100M, over $100M |
| Record volume | under 100k, 100k to 1M, over 1M records |
| Sector | Healthcare and financial services carry higher per-event costs (multipliers of 1.5 and 1.3). All other sectors use 1.0. |
| Currency | The currency the amounts are shown in (default USD) |
Tip: choose the bands that match your last financial year, and revisit them when you cross a band.
Reading the estimate
Headline. A range such as "Annualized loss exposure (10th to 90th percentile)": in nine of ten simulated years, the loss falls below the upper figure, and in one of ten below the lower. Under it you see the simulated mean and the number of trials.
Scenario cards. Each scenario has its own card:
- Breach via internet-facing vulnerability
- Customer-facing fraud (phishing / impersonation)
Each card shows:
- Annualized: the yearly range for that scenario.
- Per event: the cost range of one event.
- Chance of one or more events per year, as a percentage.
- A chip for how often events are expected, and a line "Driven by ... (factor load N%)": the part of your posture that drives the frequency.
- A bar for each form of loss, so you can see where the money goes.
Inputs and disclaimers. The strip "Inputs: ..." shows the bands used. Open Methodology, sources and disclaimers for the sources, the method and the attribution. The tab also shows the version of the cost tables.
How it is worked out, briefly
- Your posture sets how likely a loss event is. A poorer score in the relevant sections moves frequency up within a calibrated band.
- Your loss profile sets how much an event costs, from published industry cost ranges.
- Hunto runs a seeded simulation (thousands of trials) and reports the 10th and 90th percentiles and the mean.
The same inputs always give the same answer.
Note: estimates are ranges derived from published industry research and inputs your administrator provided. They are not predictions, valuations, insurance assessments, audit opinions or financial advice. Actual losses may fall outside the range shown.
Why the FAIR figure may lag your grade
FAIR is calculated from the periodic score snapshot, not from every run. After a big change, the estimate can lag the grades shown on Overview until the next snapshot. Do not compare the two to the minute.
Use cases and wiring tips
- Board report: put the headline range beside the grade trend, with the disclaimer line. Explain the range as a planning band.
- Prioritise by money: each scenario names what drives it. Fix those sections first from the Action plan.
- Budget conversation: run the estimate before and after a remediation programme. The difference in the range is the case for the spend.
- Insurance and audit: do not present this as an actuarial or audit figure.