How the work fits together

Evidence Empirical Loss Data Corpus

Curated records from 200+ public sources covering enforcement actions, litigation outcomes, insurance claims, threat frequency, control effectiveness, and human factors. Private data; methodology and tooling not yet released.

Simulation Agent-Based Model of FAIR-CAM

Agent-based model implementing FAIR-CAM. Eight agent types simulate control degradation, variance management, budget-constrained remediation, and loss emergence over time. CC BY-NC-SA 4.0.

Estimation AI Loss Estimation Engine

Five LLM agents (IR Lead, Legal Counsel, Regulator, Insurer, Plaintiff) deliberate over four rounds to produce per-component FAIR loss distributions. SLEF decomposition: regulatory, litigation, reputation, competitive.

Estimation Monte Carlo Risk Engine

Monte Carlo FAIR risk quantification with IRIS 2025 benchmarks. Scenario comparison, sensitivity analysis, portfolio aggregation. The fast path for straightforward FAIR analysis.

Estimation Local Exploit Hazard Model

Turns global exploit probabilities (EPSS) into a daily exploit hazard for an organisation’s own assets. Control effectiveness is a probability distribution, seeded from expert opinion and updated from telemetry, breach-and-attack simulation, or penetration testing. Constant or age-dependent Weibull hazard; hazards sum from vulnerability to host to organisation, and candidate remediations are ranked by hazard reduction. Implemented by CIRCL in Vulnerability-Lookup. MIT.

Input Threat Frequency Estimator

Empirical threat event frequency estimation. Three-anchor triangulation, four-vector decomposition, sector and revenue multipliers from IRIS 2025.

Input Control Framework Mapper

LLM-based. Maps any control framework (NIST CSF, ISO 27001, CIS, and others) to VERIS A4 and FAIR-CAM taxonomies. Batch, real-time, and manual modes. 291+ validation tests.

Validation An LLM’s mapping is an estimate like any other, so the mapper comes with its own validator, the LLM Classification Validator. Five checks: do repeated runs agree; do the labels exist in the target framework; does the mapping match an independently derived one; can it tell near-identical controls apart; does the answer stay stable when the wording changes. Published with the Cloud Security Alliance (July 2026).

Decisions Security Decision Science

A risk estimate is only useful if it changes what someone does. Twenty-one open notebooks in four parts — prerequisites, decision frameworks, behavioural traps, causal and strategic reasoning — cover Monte Carlo, Bayesian updating, value of information, survival analysis, causal inference, and game theory, applied to security decisions. The companion decision-security library is on PyPI. MIT.