Introducing FAIR Institute 2.0.

The Independent, Member-Governed Standards Body for Cyber, AI and Technology Risk

Today at FAIR Forward, Jack Jones and I shared what I believe is the most important update in the FAIR Institute’s ten-year history. We revealed it first to our members, in a more intimate setting, because they have journeyed with us for years and deserved to hear it first. Now I want to share it with everyone.

Jack described the moment the way any parent would. When a child stands on their own for the first time, it is both exciting and a little scary, but mostly exciting. That is where the Institute is today.

With FAIR Institute 2.0, the FAIR Institute becomes the independent, member-governed standards body for measuring and managing cyber, AI and technology risk in economic terms. Not a vendor community. Not a training company. A standards body, owned by the profession.

Why this moment matters

FAIR began with two questions Jack couldn’t answer. As CISO at Nationwide Insurance, presenting his strategy and budget, an executive asked him how much risk the company had, and how much less it would have if it spent the millions he was requesting. Once Jack started answering those questions quantitatively, the conversation changed. Executives who had tuned out heat maps leaned in, challenged the numbers and assumptions, and treated security as a deliverer of value.

Over the past decade, the Institute set out to prove that cyber risk can be quantified and managed in financial terms. That case is made. Today FAIR is the leading model for quantifying cyber and technology risk, our community counts 20,000 members, including practitioners at half of the Fortune 1000, and more than 10,000 people have been trained on FAIR.

But let’s be honest about two gaps:

• We haven’t reached enough decision makers. Our work has centered on CISOs and technology risk leaders. CFOs, CIOs, business leaders and board directors need to factor risk into their decisions too.
• Too much of the work isn’t codified yet. Too many blanks are left for smart individuals to fill in on their own. That doesn’t scale.

AI raises the stakes. As Jack put it, AI is not fundamentally different from earlier shifts like cloud and SaaS, but it is arriving faster and accelerating everything else. Organizations that struggled to keep up before now face a broader landscape that moves faster. AI can also help us do more, and do it better, but only if it learns from sound risk practice. Today’s models are trained on yesterday’s common practice, and that won’t be enough for what’s coming.

So the goal of FAIR Institute 2.0 is to turn our discipline into a true science: analysis and decision-making processes so well defined and consistently applied that they resemble public accounting, can be independently audited, and rest on transparent logic and assumptions. Not every organization needs to operate at that level of rigor on day one. It is a maturity journey, and each organization can choose the level that meets its needs. Our job is to make every level achievable.

What FAIR Institute 2.0 is

For FAIR to become the reference that boards, auditors, insurers and regulators rely on, one thing has to be true: it can’t be controlled by any single company. Not a vendor, not a consultancy, not us. It has to belong to our members. FAIR Institute 2.0 rests on three commitments.

Independent. When Jack and I started the Institute ten years ago, we put special provisions in place so nobody could tamper with FAIR. Those provisions gave governance rights to the companies we worked for at the time, RiskLens and then SAFE. Without their support, people and funding, we wouldn’t be here as an industry, and we are deeply grateful. But to grow as a truly independent standards organization, we needed to hand those keys to our members. Under our newly adopted bylaws, nobody owns the Institute. We are a nonprofit corporation and governed by our members. Voting rights are spread across a board of 16 directors today, up to 24 under the bylaws, drawn from industries ranging from financial services to retail, manufacturing and technology. Vendors are welcome as members and contributors, but they cannot control the outcome. Vendors contribute; members govern.

Authoritative. Our job is to set the standard: the reference practitioners use, boards expect, and regulators, government and academia can rely on. That means rigor, transparency and clear ownership of every standard we publish.

Expanding. We proved ourselves in cyber. AI is now the defining risk of the decade, and the same economic discipline applies to AI and technology risk, over time to operational risk, and to the next wave of emerging risks such as quantum.

Four pillars of our mission

1. Standards and playbooks. FAIR, FAIR-CAM and their companion standards remain the heart of the Institute, developed by working groups and approved by a Standards Committee chaired by Jack Jones. What’s new are actionable playbooks published alongside every standard. Standards tell you what good looks like; playbooks show you how to do it, step by step, in real situations.
2. Education. We are refreshing every course and moving to a new learning platform, with self-paced online courses plus remote and in-person instructor-led options delivered with certified training partners. The emphasis shifts from terminology to practical application.
3. Certification. Credentials for professionals that certify proficiency, not memorization: you will show that you can conduct an analysis and defend it to stakeholders. For organizations, maturity assessments delivered with audit firms and certified partners, so leaders can show their boards measurable progress from the outside in.
4. Collaboration. Working groups, local chapters under a new chapter charter, and an open community where practitioners learn from one another.

Our starting point is 20,000 members. Our ambition is ten times that, not because it sounds good, but because the need is more than ten times bigger. Every organization adopting AI needs to know how much risk it is taking on, and every board, regulator and insurer is asking. We will get there the way FAIR has always grown: by being useful.

Six working groups, one Standards Committee

We reset every working group under the new bylaws. Each is led by a chair and overseen by the Standards Committee, chaired by Jack, which ensures consistency and reliability across all work products. These groups will evolve as the risk landscape changes.

You’ll learn more about each workgroup’s mission and first deliverables in subsequent blog posts.

What it means for you

For practitioners. Individual and contributing memberships continue, with more value. We are reorganizing the Resource Center to make it easier to search, and it is where the new playbooks and best practices will surface as the working groups deliver. Our refreshed courses and certifications focus on practical skills, which should make FAIR credentials even more valued in the industry. If you already hold a FAIR certification, it remains valid; the new training is an addition, not a replacement. And local chapters, one of Jack’s favorite parts of the Institute, will get a clearer structure that chapter leaders can replicate and sustain.

For organizations. Corporate membership is a new class of membership. For the first time, organizations can get a vote. Corporate Voting Members help govern the Institute, vote on its strategy and direction, and chair working groups, bringing real-world practice, loss experience and data into the standards. They can train and certify their teams, access the full Resource Center, and assess the maturity of their programs and their conformity to FAIR standards through audit firms and certified partners. Tiers are sized so that regional players and multinationals alike can participate. This matters because no single organization bankrolls the Institute anymore: our members fund the mission.

For solution providers. Software vendors, service firms and data providers have been essential to FAIR’s success; most organizations put FAIR to work through the tools and services you built. As Solution Provider Members, you help fund the mission, your experts contribute to working groups alongside practitioners, you gain early insight into where the standards are heading, and you are the only organizations eligible to sponsor our chapters and events. FAIR standards remain free for non-commercial use. For commercial use, we listened to your feedback and introduced tiered commercial licenses based on company size, at a much more affordable cost.

For the industry. A trusted, vendor-neutral reference that regulators, government and academia can lean on, and a place where practitioners, organizations, auditors and regulators can agree on the rules of the game.

Five ways to engage, starting today

FAIR Institute 2.0 only works if you make it yours. Here is how to start:

1. Join or renew as a Contributing Member. As a thank-you, every Contributing Member will receive a copy of Tony Martin-Vegue’s new book, From Heatmaps to Histograms, over the next few months: a physical copy in North America and an e-book elsewhere.
2. Bring your company in as a Corporate Member. Corporate Voting Members govern the Institute and shape the standards that your board, auditors and insurers rely on. Your help making the case inside your organization matters.
3. Join a working group. If you have relevant expertise and time to give, pick the group closest to your experience and raise your hand through the Contact Us page under About Us on FAIRInstitute.org.
4. Get certified. Our refreshed courses and certifications will be rich in applied material and will certify your proficiency, not just your knowledge of terms.
5. Share your expertise. Propose a blog post, present at a chapter meeting or webinar, or speak at FAIRCON 2027.

Day one

Jack closed our session with a reminder that this opportunity is also a responsibility. In his view, it is a foregone conclusion that the profession will embrace cyber risk quantification. The real question is how long it takes, and we have the chance to accelerate it. His hope is that CRQ becomes the expectation rather than the exception, and that the professionals who practice it are the ones organizations compete to hire. In his words: “Think of this as day one.”

Ten years ago, I sat on two different benches, one with Jack and one with Tony, talking about how to give people who wanted to measure and manage risk better a common language and a home. That is why we started the Institute. With everything we announced today, that home now belongs to you. AI is the defining risk of our time, and the world needs a standard it can trust. Let’s build it together.

FAIR Institute Contributing Members will be able watch the full FAIR Institute 2.0 opening session from FAIR Forward in the Resource Center. Not a Contributing Member yet? Get started at https://www.fairinstitute.org/get-involved-apply-today.