DeNexus Blog - Industrial Cyber Risk Quantification

FAIR was built for IT. In OT, there are gaps to fill.

Written by DeNexus | Nov 10, 2026, 2:09:21 PM


  1. Summary

    FAIR (Factor Analysis of Information Risk) is the most widely used model for putting cyber risk in financial terms. It splits risk into two questions: how often a loss happens, and how much it costs when it does. That works well for data breaches and ransomware on office networks. In a plant, a substation or a pipeline, the same two questions have different answers, and FAIR as published doesn't reach them.

    Follow a cyber event in an industrial site from the attacker to the financial losses and it passes through eight links. FAIR has a strong framework for IT data breaches, but there are gaps to fill to more accurately estimate cyber-physical losses in OT.

    How often: the first four links

    1. Threats: who attacks, and how often? FAIR's threat community is IT-shaped. When threats are targeting OT, the effects are limited if they don’t have OT-specific skills.
    2. Assets: what do they target? FAIR's assets are data and business processes. In OT the target includes a control system or a safety system, and what it runs.
    3. Methods: how do they attack? FAIR's attack methods come from IT. OT attacks have their own goals: loss of view, and manipulation of control. MITRE ATT&CK for ICS catalogues them.
    4. Pre-incident controls: does the compromise happen? FAIR's control analysis (FAIR-CAM) has published mappings for IT frameworks only. OT controls are assessed against frameworks such as NIST SP 800-82r3 and IEC 62443, with specifics for OT systems.

    How much: the last four links

    1. Post-incident controls: does it escalate to a physical event? In OT, an engineered protection & safety layer stands between a compromise and a disaster: safety instrumented systems and protective relays. FAIR has no place for it.
    2. Perils: which physical event? Fire, explosion, a toxic release, a machine that breaks. FAIR has no concept of a physical peril.
    3. Effects: what does it damage? FAIR's loss model for disclosure (FAIR-MAM) was built for IT losses. Its only physical damage is servers and laptops. Plants lose equipment, product and, at worst, lives.
    4. Cost drivers: what does it cost? FAIR itemizes the costs of an IT incident. It doesn't itemize plant repair, cleanup or the weeks it takes to restart safely.

How much: the last four links

Why this matters now

Boards, CFOs and insurers increasingly expect cyber risk in dollars, and FAIR provides a framework to estimate expected loss. If FAIR is applied as published to an industrial site, it tends to describe the IT side of an incident well and the physical side barely at all. In real OT incidents, the physical side is usually where most of the money goes.

What extending FAIR for OT takes

  • Threat data that includes the actors and methods that target OT.
  • An inventory of the OT assets that matter, taken from the OT network.
  • Controls assessed against OT frameworks, including the protection & safety layers.
  • A loss model that names physical perils and the costs that follow them.

None of this replaces FAIR. It finishes the chain FAIR started.

 

See how DeNexus extends FAIR for OT. 

 

References:

[1] The Open Group: O-RT and O-RA (FAIR)

[2] FAIR Institute: FAIR-CAM
https://www.fairinstitute.org/resources/an-overview-of-the-fair-controls-analytics-model-fair-cam

[3] FAIR Institute: FAIR-MAM v2, April 2025
https://www.fairinstitute.org/blog/new-fair-standard-fair-materiality-assessment-model-fair-mam

[4] MITRE ATT&CK for ICS
https://attack.mitre.org/matrices/ics/

[5] NIST SP 800-82r3
https://csrc.nist.gov/pubs/sp/800/82/r3/final

[6] ISA/IEC 62443
https://www.isa.org/standards-and-publications/isa-standards/isa-iec-62443-series-of-standards
View full post