2024 has been a watershed year for the FAIR Institute and the broader cyber risk management community. From remarkable growth in membership to the emergence of cyber risk automation, this year has not only advanced the practice of quantitative risk management but also addressed some of the most pressing challenges in cybersecurity.
Todd Tucker is Managing Director of the FAIR Institute
Here’s a look at the milestones and key developments that defined 2024:
Unprecedented Membership Growth
The FAIR Institute community reached a new milestone in 2024, growing to over 16,000 members across 150 countries. This surge reflects the increasing recognition of FAIR (Factor Analysis of Information Risk) as an industry standard for quantifying and managing cyber risk. We have seen a significant uptick in membership from CISOs, CIOs and board members who are increasingly turning to quantitative approaches to cyber risk management to address governance, compliance and other strategic business requirements.
The launch of new FAIR Chapters —both domestic and international—has helped foster vibrant local communities. Practitioners from industries as diverse as healthcare, financial services, and manufacturing are now leveraging FAIR to align cyber risk management with business strategy.
FAIRCON24 and the European FAIR Summit
2024 Europe Summit panel discussion on FAIR for regulatory compliance
This year’s FAIR Conference (FAIRCON24) shattered records for attendance and engagement. Sessions featured cutting-edge case studies, including the use of FAIR in board-level discussions, integration with SOC operations, and applications for ESG risk reporting. The conference also debuted hands-on workshops on automating FAIR analyses, reflecting the growing importance of real-time risk quantification.
The inaugural European FAIR Summit in Paris brought the FAIR community closer to regional regulatory discussions and cross-border risk challenges. Topics like GDPR-driven risk quantification, supply chain vulnerabilities, and digital sovereignty took center stage, highlighting the model’s relevance to European organizations.
Expansion of Executive Education: Cyber Risk Management for Executives
John Chambers, Chairman Emeritus, Cisco, one of the presenters in our executive education program
In August, the FAIR Institute expanded its educational offerings with the launch of the “Cyber Risk Management for Executives” specialization, a four-course program available through Coursera and the FAIR Academy. This online, self-paced curriculum is tailored for senior business leaders, equipping them to govern cyber risk effectively within their organizations and align cyber risk with business objectives, build consensus, and make data-driven decisions.
The course features 22 industry experts including:
- John Chambers, Chairman Emeritus and Former CEO of Cisco
- Joe Sullivan, Former CSO of Facebook, Uber, and Cloudflare
- Jennifer Buckner, SVP Technology Risk Management of Mastercard
- Lakshmi Hanspal, Chief Trust Officer of DigiCert
- Daniel Dobrygowski, Head of Governance and Trust of World Economic Forum
- Brian Walker, Board Officer and Director Advisor of The CAP Group
- Michael Siegel, Director Cybersecurity of MIT Sloan School of Management
- Joe Grunfest, Professor Emeritus of Stanford Law School
The program provides actionable strategies and real-world case studies to enhance executives’ ability to integrate FAIR into risk management frameworks and communicate risks to boards and stakeholders. This initiative reflects the FAIR Institute’s commitment to advancing cyber risk management through accessible, high-quality education for leaders shaping organizational strategy.
Stay tuned for more: a new course built specifically for board directors (especially members of audit, risk and technology committees) is being added to the specialization in the coming days!
Automating FAIR and Real-Time Risk Analysis
The vision of real-time FAIR analysis became a reality in 2024. Organizations are now deploying automated solutions that integrate FAIR-based methodologies into security operations. FAIR Institute founder and technical advisor Safe Security demonstrated its automation at FAIRCON24, providing a valuable example of how cyber risk quantification can be automated. Tools that automate cyber risk management aggregate data, simulate risk scenarios, and deliver actionable insights for both analysts and their stakeholders—transforming how organizations manage cyber risk at the speed of business (the theme of FAIRCON24).
Automation has also enabled organizations to conduct dynamic risk assessments, empowering them to recalibrate their strategies in response to emerging threats or business changes. For many, this represents a quantum leap in operational resilience.
FAIR and Artificial Intelligence: A Two-Way Street
From the FAIR-AIR playbook
AI emerged as both a powerful tool for FAIR practitioners and a significant area of risk in 2024. The release of FAIR-AIR, a specialized approach for quantifying risks associated with artificial intelligence systems, was a significant milestone. From mitigating data biases in machine learning models to evaluating the financial impact of AI-driven automation failures, FAIR-AIR equips organizations to address these emerging challenges with rigor.
At the same time, AI-powered tools are revolutionizing the execution of FAIR analyses. Machine learning algorithms are being used to process vast amounts of data, automate simulations, and predict potential risk scenarios—delivering insights with unprecedented speed and accuracy.
Third-Party Risk Management Begins to Evolve
In 2024, the FAIR model solidified its role as a critical tool for managing third-party risks, a growing concern for organizations facing an increase in supply chain attacks and vendor-related vulnerabilities. Traditional approaches to third-party risk management often rely on subjective or checklist-based assessments, which can leave organizations blind to the true financial implications of these risks. FAIR offers a structured, quantitative framework to evaluate the potential financial impact of third-party disruptions, enabling organizations to prioritize mitigation efforts based on measurable outcomes.
By using FAIR, organizations can move beyond generic risk ratings to understand the specific costs of third-party cyberattacks, data breaches, or operational failures. This insight empowers risk professionals to allocate resources more effectively, make informed decisions about vendor relationships, and communicate the value of third-party risk management to stakeholders in financial terms. As the complexity of vendor ecosystems continues to grow, FAIR’s ability to provide clarity and precision makes it a vital component of any comprehensive risk management strategy.
The Evolving Regulatory Landscape
2024 was a year of significant regulatory developments in cybersecurity. New rules from the U.S. Securities and Exchange Commission (SEC) on cyber risk disclosure went into effect, requiring public companies to provide more granular reporting on material risks. FAIR, especially with the addition of FAIR-MAM, is proving instrumental in helping organizations meet these requirements by quantifying risks in financial terms and prioritizing resources accordingly. Publicly traded companies such as Emerald Holdings, Arthur J. Gallagher & Co., and Federal Home Loan Mortgage Company (Freddie Mac) have all disclosed the use of FAIR in their annual reports per the SEC disclosure requirements.
Similarly, the EU introduced new guidelines under the Digital Operational Resilience Act (DORA), emphasizing the need for robust risk management across critical sectors. Organizations in Europe are increasingly looking to FAIR to help comply with this regulation, which requires the implementation of an ICT risk management framework and ICT third-party risk management as well.
Looking Ahead to 2025
As we look to the future, it’s clear that 2024 was not just a year of growth but a year of transformation. FAIR’s integration with real-time automation and AI, coupled with its increasing adoption across industries and geographies, is reshaping the cyber risk management landscape.
I will share more about the year to come in an upcoming blog post. Meantime, I want to extend my deepest gratitude to our members, partners, and chapter leaders on behalf of the FAIR Institute. Your dedication and innovation have made this year one for the history books. Let’s carry this momentum into 2025 as we continue to drive a global shift toward data-driven, quantitative approaches to risk management.
