About

FAIR Scenario Builder helps operational risk practitioners construct well-formed risk scenarios quickly and consistently, using the vocabulary of the FAIR framework.

What is FAIR?

FAIR (Factor Analysis of Information Risk) is an international standard for quantifying information and operational risk. Rather than relying on subjective ratings, FAIR breaks risk into measurable components — who could cause harm, how they would act, what is at risk, and what losses would result.

This tool uses FAIR's core vocabulary to build narrative scenarios. The same structure supports quantitative analysis in future.

How a scenario is built

Each scenario has four components:

Threat Community

Who could cause this loss — their category, capability and motive. Examples: external attacker, malicious insider, negligent employee, third-party vendor.

Threat Event

How they act — the method or action taken. Examples: phishing, ransomware, misconfiguration, physical theft.

Asset at Risk

What is targeted. Examples: customer personal data, payment systems, operational technology, key personnel.

Loss Type

The category of harm that results. FAIR identifies six loss forms: Productivity, Response, Replacement, Fines & Judgements, Competitive Advantage, and Reputation.

Free text between components lets you add context and reasoning. The tool assembles your selections into a plain-language narrative, with each component visually distinguished so the structure stays clear.

Saving and editing

Scenarios are saved to your browser's local storage — no account or server required. You can return to any saved scenario to review or update it. Scenarios remain available as long as you use the same browser on the same device.

FAIR loss types