Lesson 1.10: Monte Carlo: risk as a distribution, not a number
A single expected loss (ALE) hides the question boards actually ask: how bad could a bad year be? Monte Carlo simulation answers it by playing out thousands of possible years from ranges instead of point estimates, as in the FAIR model: how often an event could happen, and how much each one could cost. The result is a distribution: most years nothing happens, some years cost a little, a few cost a lot. In the lab you read 1,000 simulated years for Northwind's ransomware scenario, compute the mean, the 90th and 99th percentiles and the chance of losing more than a million, and compare them with last year's single number.
20 min
You will learn to
- Explain why a single ALE hides tail risk
- Describe a Monte Carlo risk simulation (FAIR-style frequency and magnitude)
- Compute mean and percentiles from simulated years
- Compute an exceedance probability
- Report risk as a range with its tail
Key terms
- FAIR
- Factor Analysis of Information Risk: an open model splitting risk into loss event frequency and loss magnitude.
- Monte Carlo simulation
- Running a model thousands of times with random draws from input ranges to get a distribution of outcomes.
- Percentile (P90, P99)
- The value below which 90% (99%) of simulated outcomes fall.
- Exceedance probability
- The chance that annual loss is greater than a given amount.
- Lognormal distribution
- A skewed distribution common for losses: most small, a few very large.
← Zero trust in practice · All lessons · A security strategy that follows the business →