Frequently asked questions about the Risk Agent

Each answer is short. The Risk Agent page gives more information.

What is the Fermi method in the Modulos Risk Agent?

Fermi estimation splits an unknown quantity into parts that you can defend one by one. The Risk Agent applies this to risk. A typical decomposition multiplies three items: structural anchors (actual figures about your business, such as users or transaction volume), cited industry benchmark assumptions, and one minus a mitigation factor that comes from your verified Controls. The result is a single monetary point estimate of residual expected loss. It is made for order-of-magnitude prioritization, not statistical precision.

Why did my Risk Agent run come back unquantified?

The supervisor applies a Go/No-Go gate. If the investigator does not find sufficient structural anchors (actual platform data or external data to ground the estimate), the run ends with the status Unquantified and does not invent a number. The run stores the value zero. The Risk Value Over Time chart leaves the run out.

The threat counts as zero in the risk totals until a new run is Quantified. To give the investigator more to anchor on, add AI System context: Evidence, Controls, a fuller threat description, or connected Sources. Then run Recalculate.

Where do the Risk Agent's industry benchmarks come from?

The quantifier fills the variables that platform data cannot supply with industry figures from its model knowledge. It must cite the source in the output (for example, published breach-cost or downtime studies). It has no web access during a run. Structural anchors are different. They come only from your platform data or connected external Sources, and not from model knowledge.

What does the mitigation factor mean in a Risk Agent result?

The mitigation factor is a value between 0.0 and 1.0. It shows how much your Controls decrease the gross impact of the threat. Most realistic assessments fall between 0.3 and 0.8. The auditor derives it in two steps: it maps the threat to your Controls, and it verifies each Control against attached Evidence and tests.

Tests weigh more, because they prove that the Control is maintained as time passes. Unverified Controls count for less. Gaps that the auditor identifies lower the factor.

Can I edit or accept the Risk Agent's output?

No. A Risk Agent run is read-only. You can examine the run. You can also run the agent again with Recalculate, or quantify the same threat with a different method, such as scenario analysis or Monte Carlo. The platform stores each run in the Quantification History. The human reviewer stays accountable for which numbers are used and reported.