November 5-8 | Las Vegan, NV

Join us at the Fair Institute...

Signup now for special pricing

What is the FAIR Institute?

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed non felis faucibus, convallis ligula sed, laoreet quam. Nulla porta lorem nec augue varius egestas.

Sed vitae purus maximus, gravida mi a, ornare felis. Sed malesuada magna in enim porttitor sollicitudin. Phasellus fringilla orci felis, nec pellentesque augue rhoncus at. In sed nisi ultricies, dignissim erat eget, convallis neque.

Fusce non risus vitae arcu dictum sagittis. Nunc iaculis risus ac semper iaculis. Etiam justo nibh, porttitor et turpis sed, elementum dignissim ligula..
5000+
Members
40%
Increase
75%
Growth

FAIR_yellow-ups_02.png

UPCOMING EVENTS

Aenean consequat aliquam metus. Donec sem tellus, luctus nec ornare sed, ultricies ac dui. Maecenas in convallis velit. Cras et maximus est. Cum sociis natoque penatibus et magnis dis parturient montes, nascetur ridiculus mus.
Enter Title
Enter Title
Enter Title
Enter Title

RECENT BLOGS

Harvard Law Article: SEC Proposed Rules a “Game Changer” for Reporting Cyber Risk in Financial Terms

May 11, 2022 2:38:01 PM

The Harvard Law School Forum on Corporate Governance recently published an article, Proposed SEC Cyber Rules: A Game Changer for Public Companies, that outlines how new SEC rules could require an in-depth understanding of the potential liabilities related to cyber risk

Read More >>

RSA Conference 2022: FAIR Training plus Jack Jones Seminar on the Future of Cyber Risk Management

May 11, 2022 8:54:28 AM

A major presence for the FAIR Institute at the upcoming RSA Conference June 6-9 with two days of training in the fundamentals of FAIR quantitative risk analysis and a morning seminar with Jack Jones, creator of Factor Analysis of Information Risk (FAIR), on the future of cyber risk measurement.

Read More >>

Jack Jones: Automating Cyber Risk Quantification (Part 5 of 5)

May 10, 2022 7:45:00 AM

In the previous post, I provided examples of some controls-related data that can’t be used to support automated cyber risk quantification (CRQ).  But the news isn’t all bad.  There are some data that can be used to support CRQ.

Read More >>

SEE ALL BLOGS

POPULAR BLOGS

Post Image
Inherent Risk vs. Residual Risk Explained in 90 Seconds

Sep 7, 2017 3:18:43 PM

I recently had a conversation with clients around a risk analysis they conducted and noticed as they walked me through it that they seemed to get hung up on the terms “inherent risk” and “residual...

Read More >>
Post Image
'Risk Appetite' vs. 'Risk Tolerance'. What’s the Difference?

May 1, 2017 8:51:54 AM

The terms “risk appetite” and its close cousin “risk tolerance” are often poorly understood, very rarely used to good effect, and commonly used interchangeably.

Similar to the word “risk,” you will...

Read More >>
Post Image
Security Exception vs. Risk Acceptance: What's the Difference?

Feb 6, 2019 2:00:00 PM

FAIR model creator Jack Jones recently answered a FAIR Institute member's question about terminology that's one of those easily confused yet critical distinctions in cyber risk management: What's the...

Read More >>