Managing risks with FAIR scoring

The risk register is where you track what could go wrong and how much it matters. CybAura supports both qualitative scoring and FAIR (Factor Analysis of Information Risk), which expresses risk in financial terms your board will understand.

Adding a risk

1. Go to Risk → Register and select Add risk.
2. Give it a clear title and description.
3. Link it to affected assets, controls, and threats where relevant — this keeps your risk picture connected rather than siloed.
4. Set an owner and a review date.

Inherent vs residual risk

• Inherent risk is the exposure before any controls.
• Residual risk is what remains after your controls are applied.

CybAura calculates residual risk automatically as you implement linked controls, so you can see the effect of your security work.

FAIR scoring

For risks that need a financial view, switch to FAIR mode and provide estimates for:

• Loss Event Frequency — how often the event is likely to occur per year.
• Loss Magnitude — the expected cost when it does occur (primary and secondary losses).

CybAura produces an Annualised Loss Expectancy (ALE) — a single monetary figure (e.g. "£120,000 estimated annual loss exposure"). This makes it easy to prioritise and to justify security spend.

Prioritisation

The register sorts risks by impact to your business, not generic severity. Use the heat map view to focus on the high-likelihood, high-impact quadrant first.

Reporting

Top risks flow straight into your board report with their FAIR figures, so executive reporting takes minutes rather than days.

Tip: FAIR estimates don't need to be perfect to be useful. A reasoned range is far more valuable to decision-makers than a colour with no number behind it.