The Independent, Member-Governed Standards Body for Cyber, AI and Technology Risk
Today at FAIR Forward, Jack Jones and I shared what I believe is the most important update in the FAIR Institute’s ten-year history. We revealed it first to our members, in a more intimate setting, because they have journeyed with us for years and deserved to hear it first. Now I want to share it with everyone.
Jack described the moment the way any parent would. When a child stands on their own for the first time, it is both exciting and a little scary, but mostly exciting. That is where the Institute is today.
With FAIR Institute 2.0, the FAIR Institute becomes the independent, member-governed standards body for measuring and managing cyber, AI and technology risk in economic terms. Not a vendor community. Not a training company. A standards body, owned by the profession.
FAIR began with two questions Jack couldn’t answer. As CISO at Nationwide Insurance, presenting his strategy and budget, an executive asked him how much risk the company had, and how much less it would have if it spent the millions he was requesting. Once Jack started answering those questions quantitatively, the conversation changed. Executives who had tuned out heat maps leaned in, challenged the numbers and assumptions, and treated security as a deliverer of value.
Over the past decade, the Institute set out to prove that cyber risk can be quantified and managed in financial terms. That case is made. Today FAIR is the leading model for quantifying cyber and technology risk, our community counts 20,000 members, including practitioners at half of the Fortune 1000, and more than 10,000 people have been trained on FAIR.
But let’s be honest about two gaps:
AI raises the stakes. As Jack put it, AI is not fundamentally different from earlier shifts like cloud and SaaS, but it is arriving faster and accelerating everything else. Organizations that struggled to keep up before now face a broader landscape that moves faster. AI can also help us do more, and do it better, but only if it learns from sound risk practice. Today’s models are trained on yesterday’s common practice, and that won’t be enough for what’s coming.
So the goal of FAIR Institute 2.0 is to turn our discipline into a true science: analysis and decision-making processes so well defined and consistently applied that they resemble public accounting, can be independently audited, and rest on transparent logic and assumptions. Not every organization needs to operate at that level of rigor on day one. It is a maturity journey, and each organization can choose the level that meets its needs. Our job is to make every level achievable.
For FAIR to become the reference that boards, auditors, insurers and regulators rely on, one thing has to be true: it can’t be controlled by any single company. Not a vendor, not a consultancy, not us. It has to belong to our members. FAIR Institute 2.0 rests on three commitments.
Independent. When Jack and I started the Institute ten years ago, we put special provisions in place so nobody could tamper with FAIR. Those provisions gave governance rights to the companies we worked for at the time, RiskLens and then SAFE. Without their support, people and funding, we wouldn’t be here as an industry, and we are deeply grateful. But to grow as a truly independent standards organization, we needed to hand those keys to our members. Under our newly adopted bylaws, nobody owns the Institute. We are a nonprofit corporation and governed by our members. Voting rights are spread across a board of 16 directors today, up to 24 under the bylaws, drawn from industries ranging from financial services to retail, manufacturing and technology. Vendors are welcome as members and contributors, but they cannot control the outcome. Vendors contribute; members govern.
Authoritative. Our job is to set the standard: the reference practitioners use, boards expect, and regulators, government and academia can rely on. That means rigor, transparency and clear ownership of every standard we publish.
Expanding. We proved ourselves in cyber. AI is now the defining risk of the decade, and the same economic discipline applies to AI and technology risk, over time to operational risk, and to the next wave of emerging risks such as quantum.
Our starting point is 20,000 members. Our ambition is ten times that, not because it sounds good, but because the need is more than ten times bigger. Every organization adopting AI needs to know how much risk it is taking on, and every board, regulator and insurer is asking. We will get there the way FAIR has always grown: by being useful.
We reset every working group under the new bylaws. Each is led by a chair and overseen by the Standards Committee, chaired by Jack, which ensures consistency and reliability across all work products. These groups will evolve as the risk landscape changes.
You’ll learn more about each workgroup’s mission and first deliverables in subsequent blog posts.
What it means for you
For practitioners. Individual and contributing memberships continue, with more value. We are reorganizing the Resource Center to make it easier to search, and it is where the new playbooks and best practices will surface as the working groups deliver. Our refreshed courses and certifications focus on practical skills, which should make FAIR credentials even more valued in the industry. If you already hold a FAIR certification, it remains valid; the new training is an addition, not a replacement. And local chapters, one of Jack’s favorite parts of the Institute, will get a clearer structure that chapter leaders can replicate and sustain.
For organizations. Corporate membership is a new class of membership. For the first time, organizations can get a vote. Corporate Voting Members help govern the Institute, vote on its strategy and direction, and chair working groups, bringing real-world practice, loss experience and data into the standards. They can train and certify their teams, access the full Resource Center, and assess the maturity of their programs and their conformity to FAIR standards through audit firms and certified partners. Tiers are sized so that regional players and multinationals alike can participate. This matters because no single organization bankrolls the Institute anymore: our members fund the mission.
For solution providers. Software vendors, service firms and data providers have been essential to FAIR’s success; most organizations put FAIR to work through the tools and services you built. As Solution Provider Members, you help fund the mission, your experts contribute to working groups alongside practitioners, you gain early insight into where the standards are heading, and you are the only organizations eligible to sponsor our chapters and events. FAIR standards remain free for non-commercial use. For commercial use, we listened to your feedback and introduced tiered commercial licenses based on company size, at a much more affordable cost.
For the industry. A trusted, vendor-neutral reference that regulators, government and academia can lean on, and a place where practitioners, organizations, auditors and regulators can agree on the rules of the game.
FAIR Institute 2.0 only works if you make it yours. Here is how to start:
Jack closed our session with a reminder that this opportunity is also a responsibility. In his view, it is a foregone conclusion that the profession will embrace cyber risk quantification. The real question is how long it takes, and we have the chance to accelerate it. His hope is that CRQ becomes the expectation rather than the exception, and that the professionals who practice it are the ones organizations compete to hire. In his words: “Think of this as day one.”
Ten years ago, I sat on two different benches, one with Jack and one with Tony, talking about how to give people who wanted to measure and manage risk better a common language and a home. That is why we started the Institute. With everything we announced today, that home now belongs to you. AI is the defining risk of our time, and the world needs a standard it can trust. Let’s build it together.
FAIR Institute Contributing Members will be able watch the full FAIR Institute 2.0 opening session from FAIR Forward in the Resource Center. Not a Contributing Member yet? Get started at https://www.fairinstitute.org/get-involved-apply-today.