Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces an agent-based model to simulate the dynamics of the FAIR Controls Analytics Model (FAIR-CAM), enabling computational observation of control physiology in security risk analysis. The model incorporates eight agent types, a defense-in-depth susceptibility formula, a variance model, budget-constrained remediation, and a narrative causation engine. Results from a hospital ransomware scenario reveal emergent operational efficacy divergence, remediation pipeline queueing transitions, and cascading monitoring failures, demonstrating dynamics that static analysis cannot capture.
Static security risk analysis misses crucial organizational dynamics: control efficacy diverges by 17% due to correlated variance, remediation bottlenecks can triple expected loss, and single monitoring failures silently amplify undetected variance.
Security risk analysis typically treats control effectiveness as a static input, yet controls degrade through configuration drift, depend on monitoring systems that may themselves be degraded, and compete for finite remediation budgets. The FAIR Controls Analytics Model (FAIR-CAM) provides the theoretical framework for these dynamics but has so far remained theoretical. We present the first agent-based model to operationalize the core FAIR-CAM dynamics, making control physiology computationally observable, and release the implementation as open source. The simulation implements eight agent types, a multiplicative defense-in-depth susceptibility formula, a three-source variance model, budget-constrained remediation, and a narrative causation engine that produces a complete causal trace for every loss event. In a hospital ransomware scenario (N=1,000 iterations), three organizational dynamics emerge that static analysis cannot represent. First, emergent operational efficacy diverges from the analytical FAIR-CAM formula by approximately 17 percent, driven by correlated extrinsic variance; the divergence grows linearly with extrinsic frequency and vanishes under purely intrinsic drift. Second, a sharp queueing regime transition in the remediation pipeline approximately 2.8x expected loss when budget falls below a scenario-specific threshold (5-10 engineer-hours/month). Third, cascading monitoring failures propagate through the VMC topology: a single degraded VMC silently compounds undetected variance across the controls it manages. These dynamics are structural properties of the FAIR-CAM architecture and should generalize beyond the specific scenario studied.