Skip to Content
WhyThat.ai
WhyThat.ai
FAIR × Ladder of Causation
Bayesian Risk Modeling | FAIR Framework

See. Do. Imagine.
A Causal FAIR Network

Counterfactual use cases for Factor Analysis of Information Risk,
by Pearl's Ladder of Causation.

From passive observation to interventional policy to full counterfactual reasoning — 11 use cases across the three rungs.

1 Association · Seeing
2 Intervention · Doing
3 Counterfactual · Imagining
The same model that diagnoses a breach should tell you whether your investment would have prevented it.

Contents

1. The FAIR Model

FAIR (Factor Analysis of Information Risk) is a quantitative methodology that measures cyber risk in financial terms. Developed by Jack Jones and commercialized through RiskLens, FAIR breaks down risk into measurable components: how often threats occur, how likely they succeed, and what losses result.1

Risk Decomposition

Risk = Loss Event Frequency × Loss Magnitude

Total Primary Loss (TPL)

Direct, immediate losses from security incidents: emergency response, system restoration, forensic investigation, hardware/software replacement.

Total Secondary Loss (TSL)

Cascading, indirect costs that follow: reputation damage, regulatory fines, customer churn, long-term productivity loss.

Key Components

Component Formula Example Value Meaning
Contact Frequency (CF) CF 4.02 ± 1.9 How often threat agents make contact with assets
Probability of Action (PoA) PoA 0.617 ± 0.21 Given contact, probability threat agent takes action
Threat Event Frequency (TEF) CF × PoA 3.88 ± 3.1 Actual threat events per period
Threat Capability (TC) TC 0.606 ± 0.21 Attacker skill and resources (0–1)
Resistance Strength (RS) RS 0.635 ± 0.21 Defensive capability (0–1)
Vulnerability (Vul) TC > RS 43.2% Probability of successful exploitation
Loss Event Frequency (LEF) TEF × Vul 1.27 ± 1.5 Actual loss events per period
Risk LEF × LM 372 ± 290 Annual risk exposure ($K)
FAIR+BN: Why Bayesian?

Traditional FAIR uses point estimates or simple ranges. FAIR+BN extends this with Bayesian networks that model uncertainty explicitly, update beliefs as new evidence arrives, and capture dependencies between factors. Instead of a single risk estimate, you get probability distributions with confidence intervals — and a model that automatically refines itself with each observed incident.

Key Capabilities

Financial Quantification
Risk expressed in dollars, not scores
Uncertainty Modeling
Full probability distributions
Bayesian Updates
Automatic refinement with evidence
Causal Networks
Explicit factor dependencies
Scenario Analysis
What-if testing for controls
Cascading Risk
Model interdependencies
↑ Back to Top
2. Network Structure

The FAIR+BN model represents risk factors as a Bayesian network — a directed acyclic graph where nodes are risk factors and edges are causal relationships.

FAIR Causal Network Diagram

The Bayesian FAIR network: nodes represent risk factors, edges show causal relationships.

Cascade Effects

Models how TEF flows through vulnerability to create losses. See the complete causal chain from threat to financial impact.

Uncertainty at Every Step

Every parameter has a probability distribution, not just a point estimate. Know how confident you are.

Probabilistic Queries

Ask questions like: "What's P(Risk > $500K | observed breach)?" Get instant answers.

↑ Back to Top
1

Association — Seeing

"What does observing X tell me about Y?"
P(Y | X)

Pure observational queries. You set evidence and read updated beliefs using Bayes' rule over the existing joint distribution. No causal manipulation — just conditioning.

Example: "When I see Resistance Strength = Low, how does my belief about Risk change?"

Use Case 1a
Post-Breach Forensics (Backward Inference)
"A loss event occurred (LEF = High). What is the most likely root cause — weak controls or a sophisticated attacker?"
Set evidence on LEF = High and read the posteriors on Threat Capability and Resistance Strength. This is diagnostic reasoning — observing an outcome and updating beliefs about upstream causes. The "explaining away" pattern is classic Rung 1: seeing that LEF is High makes Resistance Strength = Low more probable, especially if Threat Capability is already known to be Low.
Use Case 1b
Sensitivity / Tornado Analysis
"Which root node is most correlated with P(Risk = High)?"
Sweep each root node across its states and record the change in Risk. This is still observational — you're asking "when I see Resistance Strength = Low, how much does my belief about Risk change?" There's no causal manipulation, just conditioning on evidence.
Use Case 1c
Threat Profiling
"Given that we've observed high Contact Frequency, what should we expect for TEF, LEF, and Risk?"
Set Contact Frequency = High as observed evidence. Read the propagated beliefs. You're characterizing the risk landscape conditional on an observation about your environment, not intervening on it.
2

Intervention — Doing

"What happens if I actively change X?"
P(Y | do(X))

Beyond observation. You're asking what happens if you force a variable to a particular state — Pearl's do-operator — severing incoming edges to the intervened node. This is the domain of policy decisions and deliberate action.

Example: "If we spend $2M on endpoint detection — do(RS = High) — does P(Risk = High) drop below 20%?"

Use Case 2a
Control Investment Justification
"If we upgrade Resistance Strength from Low → High, how much does Risk drop?"
This is do(Resistance Strength = High). You're not observing that controls happen to be strong — you're making them strong by investing. The intervention cuts the node free from whatever normally determines Resistance Strength (budget, maturity, staffing) and forces it to High. Compare P(Risk | do(RS=High)) vs. P(Risk | do(RS=Low)) to quantify the causal effect — e.g., "investing $2M in endpoint detection shifts Risk from 55% High to 18% High."
Quantitative Example
do(RS = Low) → P(Risk = High) = 55%  ·  Annual exposure: $612K
do(RS = High) → P(Risk = High) = 18%  ·  Annual exposure: $198K
Causal effect: −37 percentage points  ·  $414K saved/year vs. $2M investment

But where exactly does the $2M go? Resistance Strength isn't a single lever — it decomposes into multiple control dimensions2, each of which can be independently intervened on:

Extended Vulnerability Assessment

Extended vulnerability model: attacker types, multiple attack vectors, and control dimensions.

Each control has three intervention surfaces: Design Effectiveness (is the control well-designed?), Extent of Deployment (does it cover all assets?), and Operational Effectiveness (is it maintained?). Running do() on each dimension separately reveals which has the highest ROI — e.g., improving Control A's deployment extent may reduce risk more than redesigning Control B.

2 Wang, J., Neil, M., & Fenton, N. (2020). A Bayesian Network Approach for Cybersecurity Risk Assessment Implementing and Extending the FAIR Model. Computers & Security, 89.

Use Case 2b
Regulatory / Compliance Scenario
"If a new regulation increases fines — do(Primary Loss Magnitude = High) — how does Risk change, holding the threat side constant?"
The regulation is an exogenous intervention on the loss side. You force PLM = High (it's no longer determined by its natural prior) and observe the causal downstream effect on Loss Magnitude and Risk. This isolates the pure causal impact of the regulatory change.
Use Case 2c
Insider vs. External Threat Comparison
"If we model an insider threat — do(CF=High, PA=High, TC=Medium) — vs. an external attacker — do(CF=Low, PA=Low, TC=High) — which causes more risk?"
You're constructing hypothetical threat scenarios by intervening on multiple root nodes. Each profile produces a different causal downstream distribution on Risk. Because the root nodes have no parents in this network, do(X=x) and P(Y|X=x) coincide numerically — but the interpretation is interventional: you're asking about consequences, not conditioning on data.
Use Case 2d
Secondary Loss Amplification
"If we force Secondary Loss Magnitude = High (e.g., we now handle PII), how does overall Risk respond across different LEF levels?"
Set do(SLM = High) and sweep LEF. This reveals the causal amplification path: a high-profile data context causally increases Loss Magnitude and Risk, and you can see how this interacts with breach frequency.
3

Counterfactual — Imagining

"Given that Y happened, would Y have been different if X had been different?"
P(Y'ₓ | X, Y)

The most powerful queries. Condition on what actually happened, then ask what would have happened in an alternate world. Requires the three-step process: abduction → action → prediction.

Example: "We were breached with RS = Low. Would better controls have prevented it — or was the attacker too strong regardless?"

Use Case 3a
Post-Breach Counterfactual
"We suffered a high-severity loss event. Our Resistance Strength was Low. Would the loss still have occurred had we invested in strong controls?"
Abduct Condition on LEF=High, Risk=High, RS=Low to infer the most likely state of all latent factors (e.g., Threat Capability was probably High).
Act In this inferred world, surgically set do(RS = High), cutting its incoming edges.
Predict Compute P(Risk=High) in the counterfactual world. If it drops sharply, weak controls were a necessary cause. If it barely moves, the threat was so overwhelming that better controls wouldn't have mattered.
Counterfactual Result
Actual world: RS=Low, LEF=High, Risk=High  ·  Loss: $840K
Counterfactual: RS=High → P(Risk=High) drops from 92% to 31%
Verdict: Weak controls were a necessary cause — investment was justified
Use Case 3b
The Road Not Taken — Missed Investment
"We didn't suffer a breach this quarter. But what if our controls had been weak — would we have been breached?"
Abduct Condition on the good outcome: Risk=Low, RS=High. Infer the threat landscape.
Act Counterfactually set do(RS = Low).
Predict If P(Risk=High) jumps dramatically, the controls were a sufficient preventive cause — justifying continued investment. This combats the "why pay for security when nothing goes wrong?" argument.
Use Case 3c
Cascading Failure Counterfactual
"A breach occurred with high secondary losses. If it had been a one-off rather than recurring, would the secondary losses still have been severe?"
Abduct Condition on LEF=High, Secondary Loss=High, Risk=High. Infer the full state.
Act Counterfactually set LEF = Low.
Predict If Secondary Loss drops → frequency was the driver (death by a thousand cuts). If it stays High → a single event was bad enough on its own.
Use Case 3d
Risk Appetite Boundary Counterfactual
"We're at P(Risk=High) = 40%. If Threat Capability had been Low instead of Medium, would we be within our 10% appetite?"
Abduct Condition on the current state to infer all factors.
Act Counterfactually set TC = Low.
Predict Check whether P(Risk=High) falls below the 10% threshold. This tells leadership exactly which factor is responsible for exceeding appetite — and whether changing one thing is enough.
6. Summary

All eleven use cases mapped across the three rungs of causal reasoning.

Rung Operation FAIR Use Case Key Question
1 · Seeing P(Y | X) Post-breach forensics What caused this?
1 · Seeing P(Y | X) Tornado sensitivity What's most correlated with risk?
1 · Seeing P(Y | X) Threat profiling What should we expect?
2 · Doing P(Y | do(X)) Control investment What happens if we upgrade?
2 · Doing P(Y | do(X)) Regulatory change What if fines increase?
2 · Doing P(Y | do(X)) Threat scenario modeling Which profile causes more risk?
2 · Doing P(Y | do(X)) Secondary loss amplification How does context change risk?
3 · Imagining P(Y'ₓ | X, Y) Post-breach counterfactual Would better controls have prevented it?
3 · Imagining P(Y'ₓ | X, Y) Missed investment Did our controls actually save us?
3 · Imagining P(Y'ₓ | X, Y) Cascading failure analysis Was it frequency or severity?
3 · Imagining P(Y'ₓ | X, Y) Risk appetite boundary What single change puts us in tolerance?

These 11 use cases are ready to run. Download the FAIR network, open it in Bayes Server, and start querying.

Download FAIR.bayes Learn more at WhyThat.ai →
↑ Back to Top
7. Implementation

FAIR vs. FAIR+BN: Which Approach?

Aspect Traditional FAIR FAIR+BN
Uncertainty Point estimates or simple ranges Full probability distributions with confidence intervals
Updates Manual recalculation Automatic Bayesian updating with new evidence
Dependencies Limited modeling of factor interactions Explicit causal relationships in Bayesian network
Complexity Simpler, more accessible More sophisticated, requires probabilistic expertise
Scenario Analysis Recalculate entire model Instant probabilistic queries and what-if testing
Start with FAIR, Upgrade to FAIR+BN

Start with basic FAIR to build expertise. Upgrade to FAIR+BN when your organization has matured data practices, statistical capability, and complex risk scenarios requiring sophisticated modeling.

Software & Tools

  • Bayesian Network Software: Bayes Server, GeNIe, Hugin (commercial), or PyMC3/Stan (open-source)
  • Programming Environment: Python or R for data preprocessing and model integration
  • Spreadsheet Tools: Excel/Google Sheets for basic FAIR calculations
  • Visualization: Tableau, Power BI, or Python libraries for presenting results

Data Requirements

Level Data Needed Purpose
Minimum Viable 10–20 historical incidents Estimate initial distributions
Recommended 50+ incidents Robust probability estimates
Ideal Continuous SIEM/scanner data Real-time updating
External VERIS, Advisen, threat intel Industry benchmarks

Team Expertise

Essential

  • Risk analyst familiar with FAIR methodology
  • Basic statistics knowledge (distributions, probability)

Recommended

  • Data scientist or statistician for Bayesian model development

Helpful

  • Security operations for threat validation
  • Finance for loss magnitude estimates

Timeline & Budget

Item Basic FAIR FAIR+BN
Implementation 2–4 weeks 2–3 months
Ongoing Maintenance 4–8 hours/month 4–8 hours/month
Software $0–5K/year $5K–50K/year (or $0 open-source)
Training $2K–5K $5K–10K
Consulting (optional) $10K–30K $15K–100K

Implementation Roadmap

1

Month 1–2: Foundation

Complete FAIR Fundamentals certification. Conduct first FAIR analysis on a single, well-understood risk scenario. Present results to leadership.

2

Month 3–4: Scale

Systematize data collection. Expand to 5–10 key risk scenarios. Refine estimates as you gather more data.

3

Month 5–6: Advance

Assess readiness for FAIR+BN. Build Bayesian capability. Pilot on one critical system, then expand.

↑ Back to Top
8. Glossary
Threat Event Frequency (TEF)
Rate at which threat actors attempt to exploit assets. TEF = Contact Frequency × Probability of Action.
Vulnerability (Vul)
Probability that a threat event successfully exploits a weakness. Determined by Threat Capability vs. Resistance Strength.
Loss Event Frequency (LEF)
How often losses actually occur. LEF = TEF × P(Vulnerability = True).
Loss Magnitude (LM)
Financial impact when a loss event occurs. Combines primary losses (direct) and secondary losses (cascading).
Resistance Strength (RS)
Defensive capability on a 0–1 scale. The target of most control investment decisions.
Threat Capability (TC)
Attacker's skill and resources on a 0–1 scale. When TC > RS, exploitation succeeds.
do-Operator
Pearl's notation for intervention. do(X=x) means "force X to value x" — severs incoming causal edges. Fundamentally different from observing X=x.
Bayesian Network (BN)
A directed acyclic graph encoding conditional dependencies between variables. Enables probabilistic inference in both directions.
Counterfactual
A query about what would have happened under different conditions. Requires the three-step process: abduction → action → prediction.
Conditional Probability Table (CPT)
Mathematical relationships defining how parent nodes influence children in a Bayesian network.
↑ Back to Top

1 The original FAIR model (Jones et al., 2006) is a factor decomposition framework — not a probabilistic model. Here, we've encoded the FAIR taxonomy as a discrete Bayesian network with explicit conditional probability tables, which extends its capabilities from Rung 1 (association) into Rungs 2 (intervention) and 3 (counterfactual) of Pearl's Ladder of Causation.

FAIR Network Diagram Pearl's Ladder of Causation