Risk Register & Cyber Risk Quantification
Prices cyber risk in money, not colours.
Overview
A risk register records what could go wrong, who owns it, and what is being done. Cyber risk quantification (CRQ) goes further and expresses that exposure in currency — annualized loss, a loss-exceedance curve, the value of a proposed control — usually via FAIR or a Monte Carlo model over frequency and magnitude. The category has consolidated fast: Safe Security absorbed RiskLens, Axio owns the scenario-stress-test niche, and Kovrr brings insurance catastrophe modelling. The buying question is whether you need defensible board-facing numbers, or whether a well-run qualitative register with real owners is the honest ceiling for your data quality.
Governance decisions and budget arguments both need risk stated in terms a board can act on.
Advantages
- Money units let security compete for budget on the same terms as every other function
- Loss-exceedance curves answer "how much is enough" better than a heat map ever has
- FAIR decomposition forces explicit assumptions that can be challenged and corrected
- Directly supports SEC, DORA and NIS2 style materiality and disclosure questions
- Quantified residual risk makes insurance limits and retentions an evidenced choice
Trade-offs
- Precision theatre: a Monte Carlo run over guessed inputs is still guessed, with more decimal places
- Calibration and scenario authoring need scarce, expensive expertise
- Enterprise CRQ platforms are among the priciest line items in the GRC stack
- Auto-ingested telemetry can bias the model toward whatever your scanners happen to see
- A quantified register nobody reviews is no better than the qualitative one it replaced
Open-source option
The FAIR standard itself is open and pyfair implements the Monte Carlo maths in Python, so the model is reproducible without a licence. What open source does not give you is the loss-magnitude data, the scenario libraries, the telemetry ingestion, or the board-ready reporting that the commercial platforms are actually sold on.
Vendors & tools in this area
FAIR-based register with AI-drafted risks from live findings.
Visit site →