Risk Agent

The Risk Agent quantifies a risk threat with the Fermi method. It gives a monetary expected loss, the reasoning behind it, and a trail of references to the Controls, Evidence, and data that it used. The agent shows all assumptions. A reviewer can then examine and challenge each one before the value goes into a report.

What this is

A run on a threat gives these results:

• A proposed monetary expected loss. It is a single point estimate, not a range.
• Structured references — the frameworks, Requirements, Controls, Evidence, tests, and external Sources that the agent used.
• The reasoning of each role that contributed. It shows the assessed mitigation factor, the formula, and all variables and values that the formula uses.

The platform saves the run as a risk_agent_fermi quantification next to the other methods. The run shows in the Quantification History table and in the run drawer. A Quantified run also shows in the Risk Value Over Time chart.

Where in Modulos

You run the Risk Agent from the quantification wizard for a risk threat:

• AI System → Risks → select a risk → select a threat → Quantify → Select Method → Risk Agent

The Risk Agent is the first card in Select Method. The Configure Parameters step takes no input for this method. The agent assembles its own context from the threat, the AI System, and your organization. Runs are asynchronous. A run for a complex threat can last some minutes. The page updates automatically when the results are available.

12

Select the Risk Agent card to quantify a threat with the Risk Agent.

1. 1
   Risk Agent

   Quantifies the threat with the Fermi method.
2. 2
   Configure Parameters

   Takes no input for the Risk Agent.

Who can do what

The agent needs a person who can start quantification runs. Everyone with access to the AI System can read the saved runs.

Permissions: can run the agent and save runs

• Organization Admin, Risk Manager, or Policy Manager: these organization-level roles have full access to each AI System in the organization.
• AI System Owner on the AI System.

Permissions: can read saved runs

All of the above, plus AI System Editor and AI System Viewer on the AI System. These AI System roles can open the Quantification History and the Risk Value Over Time chart, but they cannot start a new run.

Run the agent

Before you start, make sure that the AI System has the risk and the threat to quantify. The agent works on one risk threat. See AI System Risks for how to add risks and threat vectors. You must also be able to start runs (see Who can do what).

1. Open AI System → Risks.
2. Select a risk, then select a threat.
3. Select Quantify.
4. In Select Method, select the Risk Agent card, then select Next.
5. In Configure Parameters, select Quantify. This step takes no input.

The run starts and the Threat Quantification Detail page opens. While the run works, its status is In Progress. The page updates when the result is available.

Read the output

The result opens with the Quantified Value in the header and, when the agent made one, an Executive Summary that names the most material driver. Below these, up to three expandable sections hold the full analysis. A section appears only when the run made its content. An Unquantified or Failed run shows fewer. Each section maps to the step that made it. The flow diagram in How the agent works is a map of the report.

How to read the number

The Quantified Value is one monetary point estimate in the currency of your organization. It is the monetary impact of the threat after your Controls decrease it. The agent makes the formula for each run, so read the formula in the reasoning to see the time basis, for example each year. The agent gives no range. Use the value as an order-of-magnitude figure. Check the assumptions in the reasoning before you use it.

Unquantified means that the agent found no sufficient structural anchors and gave no number. The platform stores zero. The charts leave the run out, and the totals count the threat as zero until a new run is Quantified. Do not read this zero as an estimate of no loss.

123

The Risk Agent result on a threat. The value and the executive summary are at the top, and the full analysis is in expandable sections below.

1. 1
   Quantified Value

   The current value of the threat from the latest run.
2. 2
   Executive Summary

   The most material driver of the value.
3. 3
   Recalculate

   Runs the agent again and adds a new run to the history.

Analysis Breakdown

This section shows the Analysis Status, the Methodology, and the analysis date (Analyzed) of the run. It also shows a written Estimation Justification. The justification gives the formula that the supervisor designed, the structural anchors found, the assessed mitigation factor, and how the value compares with prior runs.

12

Analysis Breakdown: the status and method of the run, with a written justification of the value.

1. 1
   Analysis Breakdown

   The status, method, and date of the run.
2. 2
   Estimation Justification

   The formula, the anchors, the mitigation factor, and a comparison with earlier runs.

References & Methodology

This section holds the Estimation Source, which describes how the inputs were combined, and the References. The References are chips that connect to each framework, Requirement, Control, Evidence item, test, or external Source that the agent used. The platform checks references to platform entities against your current data. A reviewer can then see when a cited item no longer exists.

12

References & Methodology: the estimation source and the references that the agent used.

1. 1
   Estimation Source

   How the agent combined the inputs.
2. 2
   References

   The frameworks, Requirements, Controls, Evidence, and Sources that the agent used.

AI Agent Reasoning

This section shows the reasoning of the agent, with one subsection for each role that contributed. Supervisor Reasoning shows how the run was framed and why the Evidence was sufficient. Investigator Findings shows the anchors and where they came from. Auditor Findings shows the mapped Controls, their Evidence, and the remaining gaps. Quantifier Math shows the formula, the inputs, and the step-by-step math.

These summaries hold the mitigation factor, the variables, and the benchmark citations. A reviewer can follow each assumption in the headline value back to its source here.

1

Supervisor Reasoning: how the run was framed, and why the evidence was sufficient to continue.

1. 1
   Supervisor Reasoning

   How the supervisor framed the run and why the evidence was sufficient.

12

Investigator and Auditor Findings: the structural anchors, the mapped Controls with their Evidence, and the remaining gaps.

1. 1
   Investigator Findings

   The structural anchors and where they come from.
2. 2
   Auditor Findings

   The mapped Controls, their Evidence, and the gaps that lower the mitigation factor.

1

Quantifier Math: the formula that the quantifier calculated, the input values, and each step of the calculation.

1. 1
   Quantifier Math

   The formula, the inputs, and each step of the calculation.

Run the agent again: stable values

Each run creates a new entry in the Quantification History with its own value and reasoning, as a Monte Carlo or scenario run does. The platform does not overwrite earlier runs.

The supervisor can read up to five prior runs before it starts. When your anchors and Controls are materially unchanged since the last quantified run, it aims to keep the same formula structure and benchmark assumptions. The value then stays approximately the same from run to run. This is agent judgment, not a deterministic guarantee. When something actually changed (new Evidence, added Controls, a different threat description), the estimate moves with it. Use the Risk Value Over Time chart to compare runs.

How it works

The agent applies the Fermi method with a team of four roles. This section tells how it reaches the value that you read in the output.

What a Fermi estimate is

The method is named for the estimation style of Enrico Fermi: divide a number that nobody knows into parts that somebody can defend. Nobody knows your annual loss from a backdoor attack. But your platform knows how many systems you run. Your Controls show which defenses you have. Published industry studies give a price for a typical incident. Multiply these defensible parts to get an order-of-magnitude estimate with all assumptions exposed.

The piano tuners of Chicago

Fermi asked this classic question in class: how many piano tuners work in Chicago? Nobody knows the number, but you can estimate it in steps.

Chicago has about 3 million households. Then make three assumptions:

• One household in twenty owns a piano.
• A piano gets a tuning about one time each year.
• A tuner does about 1,000 tunings each year.

The result is 3,000,000 × 1/20 ÷ 1,000 ≈ 150 tuners.

Each assumption can be incorrect by a small factor, but not by more. The errors cancel each other in part. Anyone who disagrees can challenge one number and does not have to challenge the result. The estimate of the Risk Agent has the same property. It states all parts. An incorrect number then starts a productive argument, and does not end it.

This is the same discipline as the manual Fermi decomposition that the Risk Quantification page recommends. The Risk Agent automates the decomposition and shows its work.

Fermi estimate

An example decomposition: every term traces to its agent.

Structural anchors

Users, transactions, revenue: platform and connected-source data, not model guesses

Investigator + Scout

×

Benchmark assumptions

Industry figures, cited by source

Quantifier

×

( 1 − mitigation factor )

0.0–1.0, from controls verified against evidence and tests

Auditor

=

Residual expected loss

A single monetary point estimate

Quantified value

The supervisor designs the decomposition per run, keeping the prior structure when nothing material changed. This is an example shape, not a fixed platform formula.

The value is useful for prioritization at the order-of-magnitude level. It does not replace modeling that is based on incident data. The agent gives the value with its assumptions attached. A reviewer can then challenge them.

How the agent works

The Risk Agent is a team of specialized AI agents. It is not one request to one model. A supervisor orchestrates the run from start to finish. Each step makes one artifact, and the next step uses that artifact.

Risk agent

One run, one gate, no invented numbers.

Supervisor

Frame the run

Threat context, prior runs (up to 5)

▼

Investigator (+ Scout)

Investigate

Platform data; external sources via Scout when needed · emits structural anchors

▼

Supervisor · Go / No-Go

Sufficient structural anchors?

No

Run ends

Unquantified

No number invented; zero recorded, excluded from charts

Yes

▼

Auditor

Audit the defenses

Controls verified against evidence and tests · emits mitigation factor 0.0–1.0

▼

Supervisor

Design the Fermi formula

For this threat; structure kept when nothing material changed

▼

Quantifier

Execute the formula

Example: anchors × benchmarks × (1 − mitigation) · emits the monetary estimate

▼

Run ends

Quantified

Becomes the threat's current value

A run that errors ends as Failed, with the reason shown on the run. Only Quantified runs contribute to charts and rollups.

Supervisor: frames, gates, designs

The supervisor owns the run. It reviews the threat context (the threat and risk descriptions, your AI System, and your organization). It can also check up to five prior runs on the same threat. It then decides what the estimate needs.

After the investigation, the supervisor makes the Go/No-Go decision. Without sufficient structural anchors to ground the estimate, it stops the run as Unquantified and does not give a number from nothing. If the run continues, the supervisor designs the Fermi formula for this threat and gives it to the quantifier. The platform does not apply a fixed equation. When a prior quantified run exists and nothing material changed, the supervisor aims to keep the same formula structure, to keep the values comparable.

Investigator: finds the anchors

The investigator searches your platform data (frameworks, Requirements, Controls, Evidence) for structural anchors. These are actual figures, such as active users, transaction volume, or revenue, that can ground the impact estimate. The investigator follows a strict rule: anchors come from data, not from guesses. When platform data is not sufficient, it delegates to Scout. Scout examines the active Sources of the AI System that it can read (Source types). It tags what it finds as external data.

Auditor: prices your defenses

The auditor determines the mitigation factor. This is a value between 0.0 and 1.0 that shows how much your Controls decrease the gross impact. The auditor maps the threat to semantically related Controls. It then verifies each Control. It does not trust a Control that is marked as executed unless Evidence is attached.

Tests weigh more than documents, because tests prove that the Control is maintained as time passes. Remaining gaps (for example, encryption of stored data but not of data in transit) lower the factor. Most realistic assessments are between 0.3 and 0.8.

Quantifier: does the math

The quantifier calculates the formula of the supervisor. It uses the anchors of the investigator and the mitigation factor of the auditor. Platform data cannot supply some variables. The quantifier fills these with industry benchmarks from the knowledge of the model, and it must cite the source of each benchmark in the output.

The quantifier has no tools and no web access. If it cannot complete the math honestly, the run fails. The quantifier does not pad the gaps.

Three ways a run can end

Status	Meaning	Value
Quantified	The estimate is complete and passed the checks of the supervisor	The monetary estimate. It becomes the current value of the threat
Unquantified	The Go/No-Go gate stopped the run because structural anchors were not sufficient	Recorded as zero. Left out of charts. Counts as zero in the totals
Failed	The run had an error. The run shows the cause	Recorded as zero. Left out of charts. Counts as zero in the totals

While a run works, its status is In Progress. Only Quantified runs add a value to the Risk Value Over Time chart and to the risk totals. The totals use the latest run of each threat. A threat counts as zero in the totals while a new run is In Progress, and after a run that is not Quantified. Risk Quantification tells how the chart and the totals use the runs.

What the agent does and does not do

• It does not invent anchors. Structural figures come from your platform data or connected Sources. No anchors means no number, and the run ends Unquantified.
• It does not give ranges. The output is a single point estimate with its assumptions exposed. For distributions and confidence limits, use Monte Carlo.
• It cites its benchmarks. The output gives the source of each industry figure that replaces missing data. A reviewer can then judge if the analogy holds for your business.
• It does not trust unverified Controls. A Control without Evidence or tests gives less mitigation than a Control that is proven to run.
• There is no approval gate. A Quantified result immediately becomes the current value of the threat and feeds rollups. Nothing waits for a person to accept it. The output itself is read-only. You can examine it. You can supersede it with Recalculate or with a different quantification method. The human reviewer stays accountable for what is used and reported.

Important considerations

Read the reasoning before you use the value. When you need stronger statistical grounding, use scenario analysis or Monte Carlo.

Related pages

Risk Quantification

Conceptual model, workflow, and guardrails

Quantification Methods

Details of all quantification methods, with the Risk Agent

AI Agents Overview

Where the Risk Agent fits next to Scout, Evidence Agent, and Control Assessment Agent

Human in the Loop

Where a person makes the decisions

Risk Agent FAQ

Short answers about the Fermi method, unquantified runs, benchmarks, and the mitigation factor