Tony Martin-Vegue (left) and Zach Cossairt (right)
For many FAIR practitioners, the bottleneck is familiar. The demand for quantified risk analysis is growing—across business units, third parties, regulatory reporting, and board-level briefings.
But the capacity to perform rigorous analysis hasn’t kept pace. The result is pressure to move faster, model more scenarios, and ingest more data—without cutting corners.
“We’re at the point now where it’s adapt or die,” Zach Cossairt, Senior Director, Risk Advisory, at SAFE, told a session at the 2025 FAIR Conference, co-presented with pioneering FAIR practitioner Tony Martin-Vegue.
Watch the Session:
(FAIR Institute membership required - join now)
What Can Automation Do For You - Operationalizing Decision Support in the Age of AI
The message from Zach and Tony: AI can dramatically increase efficiency in FAIR workflows—but only if you use it in the right pressure points in your workflow
The Efficiency Problem in Mature FAIR Programs
As FAIR adoption expands, analysts face an operational scaling challenge. It’s the volume of inputs: threat intelligence feeds, breach data, control assessments, asset inventories, and scenario documentation. FAIR is structured and repeatable—but gathering and synthesizing the necessary inputs has become overwhelming.
This is where AI-driven automation comes into play.
The AI Efficiency Map: What Works
Zach and Tony presented the “AI Efficiency Map,” outlining where AI tools provide substantial leverage, where they offer moderate benefit, and where they introduce unacceptable risk.
At the high-impact end—areas with potential 10x efficiency gains—four use cases stood out:
1. Industry Research
AI can ingest threat landscape reports, breach databases, and sector-specific intelligence at scale. Instead of manually reviewing dozens of sources, analysts can use AI to extract structured summaries and identify patterns. “Remove that human component where it's not necessarily needed or not necessarily desired,” Zach said.
For FAIR analysts, this reduces time spent collecting context for threat event frequency or magnitude assumptions.
2. Literature Review
AI tools can rapidly synthesize methodologies, control effectiveness studies, and industry benchmarks. Rather than searching manually for supporting evidence, analysts can accelerate to the creative work of hypothesis formation. “What used to take me a month, I can probably do in five minutes now,” Tony said.
3. Scenario Development
Risk brainstorming is inherently creative—but refinement is often repetitive. AI can propose variations, challenge assumptions, and suggest overlooked threat actors.
4. Documentation
Report generation, stakeholder summaries, and executive-ready narratives are ideal candidates for automation. Translating quantitative results into clear prose is time-consuming but formulaic. AI tools can draft structured reports aligned with FAIR outputs, allowing analysts to refine rather than start from scratch.
Where AI Helps—But Carefully
The session also identified mid-tier areas where AI provides support but not autonomy:
In these domains, AI acts as augmentation—not replacement.
The Danger Zone: Don’t Outsource Judgment
The strongest warning from the session focused on three areas where AI should not be given decision authority:
1. Statistical Modeling
Distribution selection and parameter estimation remain expert-driven tasks. Large language models can generate plausible answers. They cannot justify modeling assumptions with statistical rigor.
2. Business Context
Risk tolerance, strategic priorities, and organizational constraints are deeply contextual. AI cannot reliably infer board-level appetite or nuanced internal politics.
3. Risk Judgment
Final risk evaluation—especially tradeoff decisions—must remain human. “There's just so much behind risk communication and risk culture that you really can't outsource that to the machines,” Tony said.
For FAIR practitioners, this distinction is critical. The goal is not to automate judgment.
A Practical Path to Scale
The takeaway was not hype, nor was it skepticism. It was structured pragmatism.
AI is most valuable when it handles:
It is least appropriate when it replaces:
Watch the full session from the FAIRCON25 and evaluate how AI might fit into your own FAIR workflow—carefully, deliberately, and effectively:
What Can Automation Do For You - Operationalizing Decision Support in the Age of AI
(FAIR Institute membership required - join now)