Ninety — cyber risk quantification

90% sure is enough to price the risk.

Ninety is a free tool for the people who have to put a number on cyber risk. You describe a loss scenario the way FAIR decomposes one — how often the event happens, and what it costs when it does — give a 90% confidence interval for each factor rather than a single figure, and the page runs a Monte Carlo simulation over a hundred thousand simulated years. Out of it come an annualised loss distribution and a loss exceedance curve: the probability, for each level of loss, that a year is at least that bad.

It needs JavaScript, and that is the whole design. The simulation is the page. It runs in a Web Worker in this browser because there is no backend to run it anywhere else, and that is what makes the promise underneath it keepable: no account, no telemetry, no analytics, and nothing you type ever leaves this tab. Scenarios are kept in this browser's local storage and exported as JSON when you want to move them or keep them. Enable JavaScript for this site and the tool is here.

What it models:

Loss event frequency as an annual rate, or decomposed into threat events a year and the share of them that lands, with the count of events in a simulated year drawn from a Poisson distribution.
Loss magnitude split into the six FAIR loss forms, each holding as many line items as the situation has separate costs, with caps and with probabilities for the costs that only sometimes arise.
Every estimate said one of three ways: a fixed amount, a 90% interval sampled lognormal, or three points sampled beta-PERT.
Costs that move together, through a Gaussian copula, and whole scenarios related to each other across a collection.
A ranking of what each estimate is worth arguing about, a summary dashboard over every scenario at once, and JSON import and export.

For risk managers, security architects, auditors, and anyone who has been asked in a board meeting what a breach would actually cost. The method is FAIR-style; the reading behind it is Freund & Jones and Hubbard & Seiersen.