Cyber risk quantification providers: who sells CRQ and what to ask them

Cyber risk quantification (CRQ) is sold by three kinds of provider: software platforms that run the model inside a product, insurance brokers and risk-analytics firms that apply loss models built for underwriting, and consultancies that run FAIR analyses as an engagement. All three deliver an estimate, in dollars, of how often a cyber loss is likely to occur and what it would cost. They differ in where the frequency and loss figures come from, and in how much of that you are allowed to see. Ask about the inputs first.

What a CRQ analysis produces

One published standard for this analysis is Open FAIR, from The Open Group. Its Open FAIR page says two standards, Risk Taxonomy (O-RT) and Risk Analysis (O-RA), "together form the Open FAIR Body of Knowledge," and that practitioners can use them "to build consistent and defensible risk statements that are measured in the same economic terms as other risks they have to manage."

The current editions are O-RT Version 3.1 and O-RA Version 2.1, both published May 22, 2025. They supersede O-RT 3.0.1 and O-RA 2.0.1, which the Open FAIR page still lists.

The Open Group's account of the 2020 revision describes the analysis in stages. The analyst defines a loss scenario, estimates Loss Event Frequency, then estimates Loss Magnitude, which is made up of Primary Loss Magnitude and Secondary Loss. Results can be presented as "the distribution generated by the Monte Carlo analysis or a single-number summary result, such as the average, most likely value, loss exceedance result, or the maximum/minimum simulated loss."

That is the deliverable to expect from any provider: a frequency, a loss range, and a distribution, tied to named scenarios.

The FAIR Institute describes itself as "a nonprofit corporation dedicated to advancing the discipline of cyber risk management through education, standards and collaboration," founded in 2016. It has a commercial link to one vendor. When SAFE announced its acquisition of RiskLens on July 12, 2023, it said RiskLens CEO Nick Sanna would join SAFE as President "and will continue to lead the FAIR Institute," and that FAIR author Jack Jones would join SAFE and "continue to act as Chairman of the FAIR Institute." Read FAIR Institute material on tools with that in mind.

Three kinds of CRQ provider

Software platforms. You license a product that holds the scenarios, runs the simulation and produces reports. Some are standalone. Others sit inside a GRC suite, so quantified risks live in the same register as everything else.

Insurance brokers and cyber-risk analytics firms. Firms that work in cyber insurance also quantify a client's own exposure. The output often comes paired with advice on retention, limits and program structure.

Consultancies. Analysts scope scenarios with your staff, collect estimates, run the analysis and hand over a report. You get judgment and facilitation. You may not get a model your own team can rerun next quarter.

Examples, in alphabetical order

These are examples, not a complete list. Each description comes only from the provider's own pages.

• Aon (broker). Its cyber risk page says its cyber impact analysis "helps to evaluate an organization's risk exposure through the financial quantification of relevant cyber scenarios," and that its approach "helps quantify probable cyber losses so businesses can make decisions to transfer the risk via cyber insurance."
• Archer (GRC platform). Archer Insight turns rate and impact estimates into expected annual loss, takes historical loss events as an input, and reports "VaR and CVaR across every hierarchy level." It assigns each control "an annual cost, a value in loss prevented, and a ratio between the two," and quantifies cyber events "with the same method the rest of the register uses."
• Axio (platform). Its CRQ page describes analyzing "the financial impacts of plausible cyber events, from minimum to maximum exposure." Users can "use Axio's estimated values or tailor calculations," probability data from Cyentia is built in, and control assessments feed the quantification. The page says Axio Quant subscribers receive D&O insurance coverage.
• Dataminr (platform). Continuous Control Monitoring with Risk Quantification, formerly Risk Quantifier, "ingests real-time signals from endpoint, network, identity, and cloud controls" and states that "risk is expressed in dollars at the asset, business unit, and portfolio level." The old threatconnect.com/risk-quantifier address now redirects there. Dataminr announced its intent to acquire ThreatConnect on October 21, 2025.
• Kovrr (platform). Its CRQ page lists outputs including "average annual loss, loss exceedance curves, 1:100 tail risk, and annual event likelihood." Top-down scenarios are modeled "with minimal data inputs" from "thousands of Monte Carlo simulations," a bottom-up register holds custom scenarios, and users can "compare modeled loss distributions against insurance coverage."
• Marsh (broker). Its cyber risk page offers to "quantify your cyber risk exposures with scenario-based loss modeling, benchmark potential cyber event losses and costs," consider control effectiveness "from a financial perspective," and "assess the economic efficiency of multiple cyber insurance program structures."
• Moody's (risk-analytics firm). Its cyber risk page offers assessments that "connect cyber risk to financial impacts." For insurers, it says the Moody's RMS Cyber Model identifies and quantifies "key risk variables that determine the frequency and severity of cyberattacks," within a framework that "can model individual and portfolio-level risks."
• SAFE (platform). Its FAIR page says SAFE One is "purpose-built on the FAIR™ Model." Its board reporting page promises "a defensible dollar-value estimate of your financial risk" and mapping "to FAIR, MITRE ATT&CK and NIST CSF." Its insurance page describes "inside-out telemetry" from the client's IT environment, used to translate "security controls into financial exposure for accurate underwriting."

Questions to put to every CRQ provider

Method. Which model produces the number? Is it Open FAIR, a variant, or the provider's own method? Can you see the factor tree and the formulas, or only the result? Axio's page advertises "flexible, transparent formulas." Ask every provider for the same.

Data inputs. Which inputs come from your environment (control telemetry, assessments, asset inventories, your loss history) and which come from the provider (industry incident data, claims data, peer benchmarks)? A top-down model run on firmographics describes organizations like yours, not yours. Ask which inputs move the result most.

Loss magnitude calibration. Where do the dollar figures come from: insurance claims, public incident costs, your finance team's estimates, or expert workshops? Ask for the ranges behind each loss form, who supplied them, and when they were last updated. Ask how the provider treats losses in the tail, where data is thinnest.

Outputs. Get sample reports for three audiences: the board (exposure for a handful of scenarios, with ranges), insurance (a loss exceedance curve you can set against your limits and retention), and budgeting (risk reduction per control dollar). Check that each can be traced back to the scenarios that produced it.

Integration with GRC. Does the quantified risk live in your risk register, or in a separate tool someone has to reconcile? Can control status from your GRC platform or security tools update the analysis without rekeying? Archer's page describes quantification inside the GRC register. Standalone platforms will need an integration.

Repeatability and ownership. Can your team rerun the analysis next quarter without the provider? If the provider is a consultancy, ask what model and data you keep at the end of the engagement.

Commercial ties. Does the provider sell insurance, place insurance, or sell security controls whose value the model will estimate? None of these disqualifies a provider. You should know about them before you read the output.

Frequently asked questions

What is a cyber risk quantification service? It is an analysis, delivered by software, a broker or a consultancy, that estimates the frequency and dollar cost of cyber loss scenarios for one organization. The output is a loss range or distribution, not a score.

Do all CRQ providers use FAIR? No. SAFE says its platform is built on FAIR. Axio describes its own method, and broker and insurance-model pages describe scenario-based loss modeling without naming FAIR.

What a CRQ number cannot tell you

It cannot tell you whether an incident is material. The SEC's 2023 cybersecurity disclosure rules (Release No. 33-11216) make a Form 8-K Item 1.05 disclosure generally due four business days after a registrant determines that an incident is material, and require registrants to "describe their processes, if any, for assessing, identifying, and managing material risks from cybersecurity threats." The determination belongs to the registrant. A CRQ estimate can inform it but does not make it.

It cannot tell you that a control works. A model that assumes a control is effective will report the risk reduction whether or not the control is deployed. Ask whether control effectiveness is measured from telemetry or taken from questionnaire answers.

It cannot be checked against your own history in the short run. A 1-in-100 figure describes a loss the model expects about once a century, so a year or two of your own results will not confirm or refute it. Treat tail figures as the output of the provider's data and assumptions, and ask to see both.

It does not replace the analyst. Two providers given the same organization can return different numbers because their scenarios, data and loss assumptions differ. Comparing them on the same three scenarios is the fastest way to learn which assumptions drive each result.

Related Reading

• Buyer's Guide: Governance, Risk & Compliance (GRC)
• Buyer's Guide: Third-Party Risk Management (TPRM)
• Buyer's Guide: Board Management & Entity Governance
• Buyer's Guide: Vulnerability Management Platforms
• A Cybersecurity Framework for CIOs
• How should a CIO choose cybersecurity software?
• GRC for Modern Enterprises: From Checklists to Continuous Assurance
• Third-Party Risk Management: A Framework for Vendor Security Assessment