Monte Carlo Risk Simulation.

A computational technique that estimates risk by running thousands of randomized scenarios drawn from input probability distributions, producing a distribution of possible outcomes. It belongs to the Compliance & Frameworks category of cybersecurity.

A computational technique that estimates risk by running thousands of randomized scenarios drawn from input probability distributions, producing a distribution of possible outcomes.

Monte Carlo simulation underpins many quantitative risk methods, including FAIR. Instead of using single point estimates, practitioners describe inputs (event frequency, magnitude, control effectiveness, recovery cost) as probability distributions, often calibrated with historical data and expert judgement. The simulation samples these distributions thousands of times, computes the resulting loss for each iteration, and aggregates the results into metrics such as expected loss, loss exceedance curves, and Value at Risk. In cyber risk, Monte Carlo is used to model ransomware exposure, breach costs, vendor concentration risk, and to evaluate the financial benefit of new controls. It handles uncertainty and dependencies far better than spreadsheet point estimates.

Defences for Monte Carlo Risk Simulation typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Monte Carlo simulation, Stochastic risk modelling.