A FAIR-style quantification of Acme’s annual cyber loss exposure, calibrated with live security telemetry from the Ingext.
Expected annual loss
$2.2M
average across 20,000 simulated years
1-in-10 bad year
$6.6M
90th percentile annual loss
Reducible by plan
$1.4M
66% lower expected loss
Prepared by Ingext · Connector: Acme · 07 October 2026 · Method: FAIR (Open Group O-RA) with Monte Carlo simulation
Executive summary
Acme faces about $2.2M of expected cyber loss a year, and a bad year could exceed $6.5M
Using FAIR-style analysis calibrated with Acme’s own security telemetry, we estimate Acme’s expected annual cyber loss and the size of a bad year. Ransomware is the largest single exposure (about 40% of expected loss) because an attack is plausible given current control gaps (backup servers exposed to a critical flaw, 167 unprotected active devices, anti-ransomware hardening switched off) and would be expensive when it happens. Business email compromise is the most frequent loss but costs far less per event. The recommended actions, most using tools Acme already owns, cut expected loss substantially.
Expected annual loss
$2.2M
1-in-10 year
$6.6M
1-in-20 year
$8.4M
After plan (expected)
$723K
Board decision requested: accept this quantified view as the basis for cyber investment decisions, approve the backup and endpoint actions first (they carry the largest avoided loss), and set a formal cyber risk appetite (for example, a maximum tolerable 1-in-10-year loss) so future reports can show whether Acme is inside it.
Where the money is
Expected annual loss by scenario
Ransomware & operational extortion
$886K
Credential-driven data breach (cloud)
$621K
Business email compromise & payment fraud
$339K
Accidental & insider data exposure (incl. shadow AI)
$311K
TodayAfter recommended actions
Risk register
Quantified loss scenarios
Scenario
Chance in a year
Likely cost per event
Expected / yr
1-in-10 year
After plan
Ransomware & operational extortion
Encryption of servers and endpoints, with possible data theft, halting operations.
13%
$4.5M
$886K
$5.2M
$205K
Credential-driven data breach (cloud)
Theft of email, SharePoint or OneDrive data through a compromised account or OAuth app.
16%
$2.4M
$621K
$3.2M
$290K
Business email compromise & payment fraud
A compromised or spoofed mailbox redirects a payment or invoice.
60%
$170K
$339K
$918K
$81K
Accidental & insider data exposure (incl. shadow AI)
Sensitive data shared externally or pasted into unsanctioned AI tools.
45%
$200K
$311K
$933K
$147K
Range of outcomes
Loss exceedance curve
Probability that total cyber losses in a year exceed a given amount. Read across: the curve shows, for example, the chance of losing more than any dollar value on the axis. The dashed line shows the same exposure after the recommended actions.
TodayAfter recommended actions
Return on security investment
What each action is worth
Action
Owner
Timing
Expected loss avoided / yr
Annual cost
Return
Patch and isolate backup servers; immutable copies; restore test
Upgrade Veeam to 12.3.2.4165+, move backup servers out of the production domain, verify offline copies.
Infrastructure
7 days
$399K
—
Cost to be supplied
Close endpoint gaps and turn on anti-ransomware hardening
EDR on 167 unprotected devices, suspicious policy to Protect, ASR rules, LAPS, Credential Guard.
Endpoint Engineering
60 days
$477K
—
Cost to be supplied
Phishing-resistant MFA and Conditional Access
Enforce MFA for all admins and users; block single-factor sign-ins to admin portals.
Identity
30 days
$515K
—
Cost to be supplied
Payment verification and inbox-rule alerting
Out-of-band verification for bank-detail changes; alert on new forwarding and inbox rules.
Finance / SOC
30 days
$204K
—
Cost to be supplied
Stop DC log clearing; 90-day log retention
Archive instead of clear; forward all domain-controller events to the SIEM.
Security Operations
14 days
$182K
—
Cost to be supplied
DLP and AI acceptable-use controls
Purview DLP policies, AI usage policy and sanctioned AI tooling.
CISO / M365 admin
90 days
$164K
—
Cost to be supplied
Each action is valued on its own; combined savings are less than the sum because actions overlap.
Evidence
How SIEM data calibrates each scenario
Ransomware & operational extortion
What the SIEM shows
Veeam backup servers (6) on a build affected by CVE-2025-48983/48984 (CVSS 9.9) and joined to the production domain
167 active Windows devices with no EDR, including 7 servers and 9 end-of-life systems
All 18 ASR rules and LAPS absent on 617 of 617 assessed devices
Suspicious EDR detections alert-only on all 790 agents; an admin-run network scanner was not blocked
Domain-controller security logs cleared about six times per day
How it shapes the estimate
Base frequency reflects mid-market ransomware rates; the most-likely value sits above baseline because the backup, coverage and hardening gaps raise the chance that an attempt succeeds. Per-event cost is anchored to the IBM 2025 average cost of a ransomware or extortion incident ($5.08M).
Frequency (events/yr): 0.03 – 0.12 – 0.35 (min–likely–max) Loss per event: Business interruption $1.0M–$8.0M, Response, recovery & rebuild $500K–$4.0M, Extortion payment $0–$3.0M, Legal, notification & regulatory $100K–$2.5M
Credential-driven data breach (cloud)
What the SIEM shows
21% of successful sign-ins single-factor (953 users, 30 days)
565,473 file downloads by 761 users in 30 days provide ample access to data
MFA registration status not collected, so admin MFA cannot be verified
How it shapes the estimate
Frequency reflects exposure of a 1,700-account tenant with incomplete MFA. Per-event cost sits below the IBM 2025 global average breach ($4.44M) to reflect mid-market scale, with a tail toward the US average ($10.22M).
Frequency (events/yr): 0.05 – 0.15 – 0.45 (min–likely–max) Loss per event: Response & notification $300K–$3.0M, Legal & regulatory $50K–$2.5M, Lost business & reputation $200K–$5.0M
Business email compromise & payment fraud
What the SIEM shows
46,521 failed Microsoft 365 logins across 874 accounts in 30 days
102 new inbox rules created by 44 users in 30 days (a common BEC concealment step)
189 accounts triggered high-risk sign-in behaviors in 91 days
11 accounts reached admin portals with password only
How it shapes the estimate
Frequency is the highest of any scenario because credential attacks against Microsoft 365 are constant and inbox-rule activity is broad. Per-event loss uses FBI IC3 average BEC loss (about $130K) with a long tail for large wires.
Frequency (events/yr): 0.2 – 0.8 – 2.5 (min–likely–max) Loss per event: Fraudulent transfer $20K–$1.2M, Investigation & remediation $15K–$150K
Accidental & insider data exposure (incl. shadow AI)
What the SIEM shows
45 DLP rule matches by 8 users in 30 days
Generative-AI use not governed by AI-specific detections
How it shapes the estimate
Frequent, lower-severity events. The optional uplift uses IBM 2025’s finding that shadow-AI involvement added about $670K to breach costs.
Frequency (events/yr): 0.2 – 0.5 – 1.5 (min–likely–max) Loss per event: Response & containment $20K–$500K, Legal & customer impact $0–$1.0M, Shadow-AI cost uplift $0–$670K
Method & assumptions
How to read these numbers
FAIR breaks risk into how often a loss event is likely to occur (loss event frequency) and how much each event costs (loss magnitude). Each input is a calibrated range (minimum, most likely, maximum) modelled as a PERT distribution; 20,000 simulated years produce the distribution of annual loss. Results are estimates for decision-making, not accounting forecasts. Their value is in comparing scenarios and actions on one financial scale.
Assumptions to confirm with management
Business-interruption ranges assume a daily operational impact of roughly $150K–$600K. Replace with Acme’s revenue and downtime cost figures to sharpen the estimate.
Cyber insurance recoveries and deductibles are not netted off; losses are gross.
Extortion payment is modelled as usually not paid (most-likely $0), consistent with IBM 2025 reporting that 63% of victims refused to pay.
Treatment effects are expert estimates of how much each control reduces frequency or cost; annual control costs were not supplied, so return on investment is not calculated.
Telemetry reflects SentinelOne, Microsoft Defender, Entra ID, Microsoft 365 and Windows audit data as of 30 Sep 2026.
Sanitized sample — company and identity details are fictional.
Benchmarks and sources
IBM Cost of a Data Breach Report 2025: global average breach $4.44M; US average $10.22M; ransomware/extortion incident $5.08M; shadow AI adds ~$670K
FBI IC3 Internet Crime Report (BEC loss per complaint, approximate)
Veeam KB4771 (CVE-2025-48983 / CVE-2025-48984)
The Open Group Risk Taxonomy (O-RT) and Risk Analysis (O-RA) standards (FAIR)
Ingext Acme telemetry, ransomware readiness assessment of 30 Sep 2026
Ingext