Key Takeaways
-
Cyber risk quantification (CRQ) for endpoint security converts control gaps such as incomplete endpoint detection and response (EDR) coverage, unpatched vulnerabilities, and missing multifactor authentication (MFA) into a probabilistic financial loss range using the Factor Analysis of Information Risk (FAIR) model.
-
Common Vulnerability Scoring System (CVSS) scores and qualitative ratings measure technical severity but do not express dollar exposure, so they fall short for board-level budget decisions.
-
The FAIR model breaks endpoint risk into threat event frequency, susceptibility from control coverage, loss event frequency, and loss magnitude, then uses Monte Carlo simulation to produce an annualized loss exposure distribution.
-
Key inputs include EDR coverage percentage, unpatched critical vulnerabilities weighted by Exploit Prediction Scoring System (EPSS) scores, local administrator prevalence, unsupported operating system (OS) share, disk encryption, and MFA coverage, all expressed as distributions when data is incomplete.
-
Cyble applies the FAIR model to live telemetry and provides artificial intelligence (AI) native endpoint detection and response to close the control gaps that drive quantified risk.
See how Cyble quantifies your endpoint risk.
Why CVSS And Qualitative Ratings Miss Endpoint Financial Risk
CVSS scores and qualitative “high/medium/low” endpoint ratings measure the intrinsic technical severity of a vulnerability, including attack vector, complexity, and potential impact, independent of whether exploitation is observed in the wild or how many endpoints in a fleet are actually exposed.
The Exploit Prediction Scoring System (EPSS), maintained by the Forum of Incident Response and Security Teams (FIRST) and updated to version 5 in May 2026 with a reported 23% improvement in model accuracy, estimates the probability that a given Common Vulnerabilities and Exposures (CVE) identifier will be exploited in the wild within the next 30 days. EPSS, combined with CVE data from the National Vulnerability Database (NVD), provides a materially better prioritization input than CVSS alone.
Neither CVSS nor EPSS produces a dollar figure. They answer “how severe?” and “how likely to be exploited?” A financial model answers the third question: what a successful attack across the fleet is likely to cost the organization.
The FAIR Model Applied To Endpoint Security
The FAIR model is a standard quantitative framework that breaks cyber risk into frequency and loss magnitude, then expresses that risk as a distribution of financial loss. Each variable has a precise definition and a clear endpoint-specific application.
Threat event frequency (TEF) is the number of attack attempts a given scenario can generate over a period, typically a year. For an endpoint fleet, TEF covers attempted exploitation of unpatched critical vulnerabilities, credential-stuffing attempts against endpoint logins, and phishing campaigns targeting endpoint users. TEF measures the intensity of the threat and sets the starting point for estimating how many attempts might succeed.
Susceptibility is the probability that an attack attempt actually succeeds by breaching defenses and producing an event that results in losses. For endpoints, susceptibility is estimated from control coverage: the share of endpoints without EDR, the share without least privilege enforcement, and the share running unpatched critical vulnerabilities. Susceptibility is derived from control coverage data and, when combined with TEF, produces loss event frequency.
Loss event frequency (LEF) is the expected frequency of events that actually lead to a loss, calculated as LEF = TEF × Susceptibility. If a fleet faces 200 credible ransomware attempts per year and 4% of those attempts succeed given current controls, LEF is eight loss events per year.
Loss magnitude (LM) is the financial cost of a single loss event, covering both primary losses (ransomware payments, response costs, lost productivity, recovery labor) and secondary losses (regulatory penalties, customer notification, reputational damage, and litigation). LM turns a technical incident into a business-impact number for each event.
Annualized loss exposure (ALE) is the probable annual financial loss, expressed as a distribution rather than a single point estimate. Monte Carlo simulation is a common method for producing that distribution. It runs thousands of simulated years, each time sampling from probability distributions for frequency and loss. The result is a probabilistic picture of financial risk. The output is a range, for example “90% of simulated years fall between $400,000 and $3.2 million,” and leadership should see that range rather than a single midpoint.
Put the FAIR model to work on your telemetry.
Endpoint Data Inputs That Power The FAIR Model
The most common gap in endpoint CRQ implementations sits in data collection rather than in the model itself. Each FAIR input needs a clear, named source.
EDR coverage percentage comes from the EDR console. The gap between enrolled devices and the total asset inventory in the directory is the uncovered share. Industry research indicates that a significant share of devices registered in Active Directory lack proper EDR coverage, so this input often becomes one of the largest susceptibility drivers in enterprise fleets.
Unpatched critical vulnerabilities come from patch management tooling and vulnerability scan outputs cross-referenced against CVE and NVD data. Industry research indicates that between 38 and 45% of known critical vulnerabilities remain unpatched across enterprise environments at any given time. EPSS scores, refreshed daily by FIRST, identify which of those unpatched CVEs carry the highest exploitation probability and should be weighted most heavily in the susceptibility estimate.
Local admin prevalence comes from identity and access management (IAM) records and endpoint configuration management data. The share of endpoints where users hold local administrator rights directly affects susceptibility, because privilege escalation is easier, and also affects loss magnitude, because the blast radius grows.
Unsupported OS share comes from the asset inventory. Endpoints running end-of-life operating systems receive no security patches and contribute directly to the unpatched vulnerability count.
Disk encryption coverage and MFA coverage come from device management tooling and IAM records respectively. Both appear as binary values at the device level and roll up to a fleet-wide percentage that feeds the model.
Where data is incomplete, inputs should be expressed as distributions with minimum, most likely, and maximum values instead of a single point estimate. The FAIR Institute states that the goal of CRQ is to reduce uncertainty to a level that supports informed decision-making, and that informed, calibrated estimates can match empirical data in usefulness when sources and assumptions are documented transparently.
Mapping Endpoint Controls To Loss Frequency And Loss Magnitude
Endpoint controls influence different parts of the FAIR model. Some controls reduce how often a threat event becomes a loss event, so they act on susceptibility and therefore on loss event frequency (LEF). Other controls limit what happens after a loss event occurs, so they act on loss magnitude (LM). Understanding which lever a control pulls clarifies how to model its effect and how to rank it against competing investments. The table below maps each common endpoint control to the FAIR factor it primarily affects, so you can see which controls compress loss frequency and which limit loss magnitude.
|
Endpoint control |
Primary FAIR factor affected |
Effect on the model |
|---|---|---|
|
EDR coverage |
Susceptibility |
Lowers the probability a threat event becomes a loss event, reducing loss event frequency |
|
Patch compliance |
Susceptibility |
Reduces exploitable attack surface, lowering loss event frequency |
|
Least privilege |
Susceptibility and loss magnitude |
Lowers the probability of successful escalation and limits blast radius |
|
Disk encryption |
Loss magnitude |
Limits data exposure and downstream regulatory and notification cost |
|
MFA coverage |
Susceptibility |
Reduces credential-based loss events, lowering loss event frequency |
The logic follows directly from the FAIR structure. Controls that reduce the probability a threat event becomes a loss event act on susceptibility and compress LEF. Controls that limit blast radius or data exposure act on LM. The 2026 Sophos Active Adversary Report found that MFA was missing where it mattered in 59% of cases investigated, and that 79% of ransomware attacks started with an identity-based approach, which maps directly to MFA coverage as a susceptibility control in the FAIR model.
Worked Endpoint Ransomware Scenario
The following scenario uses illustrative values to demonstrate the FAIR mechanics. These figures are not benchmarks and should not be treated as independently verified data points. Organizations should calibrate inputs against their own telemetry, incident history, and external sources such as the Verizon Data Breach Investigations Report (DBIR) and the IBM Cost of a Data Breach Report.
Scenario: Ransomware targeting a 10,000-device enterprise fleet with a 30% EDR coverage gap and 35% of endpoints carrying at least one unpatched critical vulnerability.
-
TEF (illustrative): 150 credible ransomware attempts per year against the fleet, calibrated against industry frequency data for organizations of comparable size and sector.
-
Susceptibility (illustrative): 5% derived from the EDR coverage gap, unpatched vulnerability rate, and partial MFA deployment. This means approximately one in 20 attempts succeeds given current controls.
-
LEF (illustrative): TEF × Susceptibility = 150 × 0.05 = 7.5 loss events per year, expressed as a distribution rather than a single point.
-
LM (illustrative): Primary losses of $300,000–$800,000 per event for response, recovery, and downtime plus secondary losses of $200,000–$1,200,000 for regulatory notification, legal work, and reputational impact, for a most-likely total of approximately $700,000 per event. Sophos’s 2026 State of Ransomware report recorded an average recovery cost of $1.7 million per incident, which provides an external calibration reference for the upper end of this range.
-
ALE (illustrative): A Monte Carlo simulation drawing from these input distributions produces an annualized loss exposure range. In this illustrative scenario, 90% of simulated years fall between $1.8 million and $9.5 million, with a mean of approximately $5.2 million.
The output is a distribution, and presenting the mean alone understates tail risk. The range and the probability of exceeding specific thresholds form the defensible figure for a board conversation.
Using The Output To Prioritize Patching And EDR Investment
With an annualized loss exposure (ALE) distribution in hand, remediation actions can be ranked by the dollar risk they remove. This replaces CVSS score as the primary ranking criterion. In the illustrative scenario above, closing the EDR coverage gap from 30% to 5% reduces susceptibility materially. That change compresses LEF and shifts the ALE distribution downward. Patching the unpatched critical vulnerabilities, prioritized by EPSS score to address the highest exploitation-probability CVEs first, produces a further reduction. Each action has a modeled effect on ALE that can be compared against the cost of the control to build a return-on-security-investment (RoSI) case for leadership.
Cyble Vision applies the FAIR model to live telemetry, translating technical exposure into financial terms and ranking vulnerabilities by business impact and current threat activity instead of by CVSS score alone. Cyble Titan provides AI native endpoint detection and response with automated containment that closes the endpoint control gaps the model quantifies. This reduces susceptibility in the FAIR model by raising the share of the fleet with active behavioral detection and response coverage. Capabilities, coverage, and service levels vary by subscription tier and region. Whether you run the model with Cyble or in-house, the process follows the same eight steps described below.
Rank your remediation by dollar risk removed.
How To Quantify Endpoint Security Risk: Step-By-Step
-
Define the endpoint scope and asset inventory. Establish the total device count, operating system distribution, and business criticality of the fleet before modeling begins.
-
Collect control-coverage inputs from internal telemetry and the EDR console. Capture EDR enrollment percentage, patch compliance rate, local admin prevalence, unsupported OS share, disk encryption coverage, and MFA coverage as fleet-wide percentages.
-
Estimate threat event frequency for the fleet. Draw on internal incident logs, sector-specific threat intelligence, and external sources such as the Verizon DBIR to calibrate how often the fleet faces credible attack attempts for the scenario in scope.
-
Estimate susceptibility from control coverage. Combine EDR gap, patch gap, and identity control gaps into a probability that a threat event becomes a loss event, expressed as a range rather than a point estimate.
-
Derive loss event frequency. Multiply the TEF distribution by the susceptibility distribution to produce an LEF distribution.
-
Build loss magnitude components. Decompose primary losses such as response, recovery, downtime, and ransom and secondary losses such as regulatory penalties, notification, legal work, and reputational impact using internal financial records and external benchmarks.
-
Run a Monte Carlo simulation to produce an annualized loss exposure distribution. Sample from the input distributions across thousands of simulated years to produce a loss range with percentile outputs.
-
Rank remediation actions by dollar risk removed. Model the ALE reduction each control produces and order investments by financial impact instead of by CVSS score.
FAQ
What does cyber risk quantification for endpoint security mean?
Cyber risk quantification for endpoint security converts endpoint control gaps, such as incomplete EDR coverage, unpatched critical vulnerabilities, local admin prevalence, and missing MFA, into a probabilistic financial range using a named framework such as FAIR. The output is an annualized loss exposure distribution that expresses endpoint risk in dollar terms instead of qualitative severity ratings.
How does it differ from CVSS-based prioritization?
As covered earlier, CVSS measures intrinsic technical severity while FAIR-based CRQ produces a dollar figure by combining attack frequency, control effectiveness, and loss magnitude. CVSS is a severity signal, and FAIR-based CRQ is a financial risk estimate. EPSS adds exploitation-likelihood data that improves prioritization but still does not produce a loss figure on its own.
What data is needed to build an endpoint CRQ model?
The core inputs are EDR coverage percentage from the EDR console, unpatched critical vulnerability rate from patch management tooling and vulnerability scans cross-referenced against CVE and NVD data, local admin prevalence from IAM records, unsupported OS share from the asset inventory, disk encryption coverage, and MFA coverage. External calibration sources include the Verizon DBIR, the IBM Cost of a Data Breach Report, and EPSS scores from FIRST for exploitation-likelihood weighting. Where data is incomplete, inputs are expressed as distributions rather than point estimates.
Is the output a single number or a range?
The output is a distribution. Monte Carlo simulation samples from the input distributions across thousands of simulated years to produce a range of annualized loss exposure values with associated probabilities, for example “90% of simulated years fall between $X and $Y, with a Z% probability of exceeding $W.” Presenting only the mean hides tail risk. The range and the probability of exceeding specific thresholds are the defensible figures for board and audit conversations.
How often should the model be refreshed?
The model should be refreshed whenever the control environment changes materially, such as after a significant patching cycle, an EDR deployment expansion, or a change in MFA coverage, and at minimum quarterly. Threat event frequency inputs should be updated as new sector-specific threat intelligence becomes available. Because EPSS scores refresh daily, vulnerability prioritization inputs within the model should reflect current exploitation-likelihood data rather than a static snapshot.
How should the output be presented to a board?
Present the annualized loss exposure as a range with a probability statement, for example “there is a 10% chance of losing more than $X from endpoint ransomware events in the next year,” instead of a single point estimate. Map the range against the organization’s stated risk appetite. Show how proposed control investments shift the distribution downward and what dollar risk each investment removes. This frames the budget conversation as a financial tradeoff rather than a generic request for security spending.
When is human expertise still necessary?
Human expertise is required at every stage where judgment replaces data. Estimating threat event frequency for a specific fleet and sector requires calibrated expert input when internal incident history is thin. Decomposing loss magnitude into primary and secondary components requires input from legal, finance, and compliance functions that understand the organization’s specific regulatory exposure and contractual obligations. The model structures that judgment and turns it into a repeatable process.
Conclusion And Next Steps
A FAIR-based endpoint CRQ model produces a defensible annualized loss exposure range by combining named inputs such as threat event frequency, susceptibility derived from control coverage, loss event frequency, and loss magnitude with Monte Carlo simulation. The model expresses uncertainty as a distribution instead of a false-precision point estimate. The control-to-loss-magnitude mapping clarifies which remediation actions compress frequency and which limit blast radius, so teams can prioritize by dollar risk removed instead of by CVSS score.
Practical next steps include scoping the endpoint fleet and establishing the asset inventory, collecting control-coverage data from the EDR console, patch management tooling, and IAM records, running a first model with illustrative values calibrated against external benchmarks, and aligning stakeholders on the remediation order the model produces. Results depend on the organization’s environment, asset scope, and configuration and should be validated against them.
See what Cyble finds in your environment.