Purpose
Turn a described cyber threat scenario into a defensible financial exposure range — using FAIR decomposition and the ALE model — so a security leader can prioritize investments, justify budget, and communicate risk to non-technical executives in the language of dollars, not CVSS scores.
When to Use
Invoke this skill when the user asks to:
- Estimate the financial impact or dollar exposure of a specific cyber threat
- Quantify risk for ransomware, data breach, business email compromise, insider threat, or a similar scenario
- Justify a security investment or compare the cost of a control to the risk it reduces
- Build a FAIR analysis or calculate Annualized Loss Expectancy (ALE)
- Prioritize a set of risks or controls by financial impact
- Prepare a risk figure for a board deck, budget request, or cyber insurance discussion
Inputs Required
Before starting, collect:
- Threat scenario: What could happen — the threat actor, method, and asset affected (e.g., "ransomware encrypts our production ERP")
- Asset value / impact drivers: Revenue at risk, records held, systems affected, or replacement cost
- Threat frequency context: How often this has happened to the org or peers, industry incident rates, or a qualitative sense (rare / occasional / frequent)
- Existing controls: What's already in place that reduces likelihood or impact (backups, MFA, EDR, segmentation)
- Organization profile: Industry, approximate revenue or size, and regulatory regime (HIPAA, PCI-DSS, GDPR, etc.)
- Decision context: What the number is for — budget request, control comparison, insurance, or board briefing
- Control under consideration (if comparing): The proposed investment and its annual cost
If frequency or loss data is missing, use published industry benchmarks (e.g., IBM Cost of a Data Breach, Verizon DBIR ranges) and state every assumption explicitly.
Instructions
Step 1: Frame the Risk Scenario
Restate the scenario in FAIR terms so the math is auditable:
- Asset at risk: The specific asset (data, system, revenue stream)
- Threat community: Who or what triggers the loss (external cybercriminal, malicious insider, nation-state, accidental)
- Threat effect: Confidentiality, integrity, or availability
- Loss event: The single event being quantified (one scenario per analysis — do not blend ransomware and data breach into one number)
If the user described a broad concern, narrow it to one discrete loss event and note that other scenarios should be run separately.
Step 2: Estimate Loss Event Frequency (LEF)
Decompose how often the loss occurs per year:
- Threat Event Frequency (TEF): How often the threat actor attempts this — anchor to industry base rates and the org's exposure
- Vulnerability: The probability an attempt succeeds given current controls (0–100%)
- LEF = TEF × Vulnerability
For ALE, express this as Annualized Rate of Occurrence (ARO) — the expected number of successful events per year (e.g., 0.25 = once every four years). State the reasoning: which controls lowered vulnerability, which benchmarks set frequency.
Step 3: Estimate Loss Magnitude (Three-Point Estimate)
Estimate the Single Loss Expectancy (SLE) — the dollar loss per event — as a Low / Most Likely / High range, not a single point. Break loss into FAIR's six loss forms and include only those that apply:
- Productivity loss: Downtime × loaded cost per hour × affected headcount or revenue/hour
- Response costs: Incident response, forensics, legal, overtime
- Replacement costs: Rebuilding systems, restoring data, hardware
- Fines & judgments: Regulatory penalties (scale to the applicable regime and record count)
- Competitive advantage loss: Lost IP or market position (where relevant)
- Reputation damage: Churn, lost deals, customer notification, credit monitoring
Sum the applicable forms at each of the three points to produce Low / Most Likely / High SLE.
Step 4: Calculate Annualized Loss Expectancy
Compute the headline figure:
- ALE = ARO × SLE
- Produce three ALE figures — Low, Most Likely, High — by applying ARO to each SLE point
- Present the range as the primary output; the "Most Likely" figure is the recommended planning number
- Show the arithmetic explicitly so any reviewer can reproduce it
Step 5: Control ROI Comparison (if a control is under consideration)
Quantify the risk reduction of the proposed control:
- Residual ALE: Recalculate ARO or SLE assuming the control is in place (state which factor it reduces and by how much)
- Risk reduction = Current ALE − Residual ALE
- Control ROI = (Risk reduction − Annual control cost) ÷ Annual control cost, expressed as a percentage
- Flag whether the control is justified: risk reduction should meaningfully exceed its cost, and note when a control is over-engineered relative to the exposure
Step 6: Prioritization & Recommendation
Close with a clear position:
- State the recommended planning figure and the confidence level (High / Medium / Low) based on data quality
- If multiple risks or controls were provided, rank them by ALE or by risk-reduction-per-dollar
- Give one direct recommendation on where to spend next — do not hedge
Output Format
- Structure: Scenario framing → LEF/ARO → Loss magnitude table → ALE calculation → Control ROI (if applicable) → Recommendation
- Length: 700–1,000 words
- Format: Prose reasoning with a three-point loss magnitude table and a clearly boxed ALE range; calculations shown inline
- Sections: Risk Scenario → Frequency Estimate (ARO) → Loss Magnitude (Low/Likely/High) → Annualized Loss Expectancy → Control ROI Analysis → Recommendation & Confidence
- Tone: Risk quantification analyst briefing an executive — precise, assumption-transparent, financially literate; no fear-mongering
Quality Checklist
Before delivering output, verify:
- [ ] Exactly one discrete loss event is quantified — scenarios are not blended
- [ ] ARO and SLE are both stated as numbers, and ALE = ARO × SLE is shown with visible arithmetic
- [ ] Loss magnitude is a three-point estimate (Low / Most Likely / High), not a single figure
- [ ] Every assumption and benchmark source is stated explicitly — no unsourced numbers
- [ ] If a control was provided, Control ROI is calculated as a percentage with residual ALE shown
- [ ] A single recommended planning figure and confidence level are named, and the recommendation does not hedge
Notes
- FAIR is an estimation model, not a precision instrument — the value is a defensible, reproducible range that ranks risks against each other, not a guarantee of the loss.
- Ranges beat point estimates with executives: showing Low/Likely/High signals rigor and prevents the number from being challenged as false precision.
- Anchor frequency to real base rates where possible (DBIR, sector ISAC data, the org's own incident history) — the frequency estimate is where most FAIR analyses go wrong.
- Run separate analyses for materially different scenarios (ransomware vs. insider data theft) rather than forcing one blended number; then rank the resulting ALEs to drive the investment conversation.
How to use this skill
This file is a Claude Code skill in Anthropic's standard format — markdown with YAML frontmatter at the top.
Installing in Claude Code:
~/.claude/skills/<folder-name>/SKILL.md— auto-loads in every session anywhere on your machine (recommended for skills you'll use across multiple projects)<your-project>/.claude/skills/<folder-name>/SKILL.md— auto-loads only when working in that project (recommended for project-specific skills)
Restart Claude Code or open a new session to register.
Using in Claude.ai, ChatGPT, Gemini, or other AI tools:
- Drag this file into a new chat, or copy and paste its contents
- Send your task or request as your next message — the AI will apply the skill where it fits
For Claude Code skill details: https://docs.anthropic.com/en/docs/claude-code/skills