Risk Quantification & FAIR

"""
FAIR Monte Carlo Risk Simulation
Produces annual loss expectancy with confidence intervals.
"""
import random
from dataclasses import dataclass


@dataclass
class FairInputs:
    """PERT distribution parameters (min, most_likely, max)."""
    tef: tuple  # Threat Event Frequency
    vuln: tuple  # Vulnerability (0-1 range)
    primary_loss: tuple  # Primary Loss Magnitude
    secondary_loss: tuple  # Secondary Loss Magnitude
    secondary_loss_event_freq: tuple  # Probability secondary loss occurs


def pert_sample(low: float, mode: float, high: float, lamb: float = 4) -> float:
    """Sample from a modified PERT distribution."""
    if high == low:
        return mode
    alpha = 1 + lamb * (mode - low) / (high - low)
    beta = 1 + lamb * (high - mode) / (high - low)
    sample = random.betavariate(alpha, beta)
    return low + sample * (high - low)


def simulate_fair(inputs: FairInputs, iterations: int = 50_000) -> dict:
    """Run Monte Carlo simulation for FAIR analysis."""
    annual_losses = []

    for _ in range(iterations):
        # Sample from distributions
        tef = pert_sample(*inputs.tef)
        vuln = pert_sample(*inputs.vuln)
        primary = pert_sample(*inputs.primary_loss)
        secondary = pert_sample(*inputs.secondary_loss)
        sec_freq = pert_sample(*inputs.secondary_loss_event_freq)

        # Calculate Loss Event Frequency
        lef = tef * vuln

        # Calculate Loss Magnitude per event
        # Secondary loss occurs with probability sec_freq
        if random.random() < sec_freq:
            loss_per_event = primary + secondary
        else:
            loss_per_event = primary

        # Annual Loss = LEF * Loss per event
        annual_loss = lef * loss_per_event
        annual_losses.append(annual_loss)

    annual_losses.sort()
    n = len(annual_losses)

    return {
        "mean": sum(annual_losses) / n,
        "median": annual_losses[n // 2],
        "p10": annual_losses[int(n * 0.10)],
        "p90": annual_losses[int(n * 0.90)],
        "p95": annual_losses[int(n * 0.95)],
        "max_observed": annual_losses[-1],
    }


# Payment processing breach scenario
payment_scenario = FairInputs(
    tef=(5, 15, 50),                      # Events/year
    vuln=(0.02, 0.08, 0.20),              # Prob. of success
    primary_loss=(850_000, 2_500_000, 8_000_000),  # USD per event
    secondary_loss=(1_500_000, 8_000_000, 25_000_000),
    secondary_loss_event_freq=(0.3, 0.6, 0.9),
)

results = simulate_fair(payment_scenario)
print("=== FAIR Monte Carlo Results (Payment Breach) ===")
print(f"  Mean ALE:     ${results['mean']:>14,.0f}")
print(f"  Median ALE:   ${results['median']:>14,.0f}")
print(f"  10th %-ile:   ${results['p10']:>14,.0f}")
print(f"  90th %-ile:   ${results['p90']:>14,.0f}")
print(f"  95th %-ile:   ${results['p95']:>14,.0f}")
print(f"  Max Observed: ${results['max_observed']:>14,.0f}")
print()
print("Interpretation: There is a 90% chance annual losses")
print(f"fall between ${results['p10']:,.0f} and ${results['p90']:,.0f}.")