Quantifies risk through the frequency and magnitude of future loss. It establishes the economic baseline and makes uncertainty explicit.
RISK MEASUREMENTThe CISO value problem
The work is real. The value is hard to prove.
Security teams report controls deployed, findings closed, and incidents handled—while leadership still cannot see how those capabilities changed probable loss or whether the investment was worth it.
A connected FAIR model family
Risk, controls, and materiality become one coherent economic story. Marcriis preserves the role of each model rather than blending their terminology.
Describes how controls operate individually and as systems, enabling analysis of capability efficacy and its effect on risk factors.
CONTROL + CAPABILITY EFFECTDeepens loss-magnitude analysis to support financial materiality, incident impact, and comparable multi-year cost estimates.
MATERIAL LOSS ECONOMICSA visible value case
Show the movement in the curve.
FAIR establishes the baseline. FAIR-CAM connects capability performance to risk factors. FAIR-MAM strengthens the loss view. The resulting change in exposure becomes the foundation for the value case.
What the organization can defend
The result is a transparent value case, not a single-point ROI claim detached from uncertainty or operational reality.
Compare alternatives on expected risk change, cost, feasibility, and timing.
Show which capabilities change exposure and which merely add activity.
Connect the security program to business resilience and material outcomes.
Direct engineering attention toward controls with measurable scenario effects.
Structure credible estimates of cyber incident financial consequences.
Teach teams to maintain and explain the model as conditions change.
Turn technical performance into enterprise value
Bring the capability or investment leadership must understand.
Marcriis can quantify the value case and build your team’s ability to repeat it.