There are several drawbacks to using the FAIR model to quantify cyber risk:
FAIR requires extensive industry data, knowledge of its risk ontology, and a great deal of time and resources to perform a risk analysis.
FAIR relies heavily on probability estimation which can yield a false sense of certainty.
FAIR requires input from assessors which can lead to subjective and biased analysis.
FAIR does not prioritize vulnerabilities or provide actionable steps for improving cyber security posture and reducing risk.
FAIR is challenging to operationalize and scale across the organization due to its excessive implementation time and asset-based risk assessment.
FAIR does not provide remediation or workflow guidance that can be used to reduce breach risk across the entire network because it’s limited to specific threat scenarios.