Clever Risk Quantifier™

Clever Risk Quantifier™ is a specialized tool for quantitative cyber risk analysis and modeling. It connects risk scenarios, threats, vulnerabilities, controls and potential losses into a single analytical model that allows you to work not only with expected loss, but also with uncertainty, threshold exceedance probabilities and residual risk exposure.

It helps organizations determine how much they may lose as a result of individual scenarios or combinations of scenarios, how frequently losses may occur, which inputs influence the result most, how much exposure can be reduced by security controls, and whether the organization will remain above or fall below its defined risk appetite or other decision thresholds after those controls are implemented.

CRQ does not work with a single resulting number only. It models loss distributions, percentiles, Value at Risk, Expected Shortfall, Loss Exceedance Curves and the probability of exceeding risk tolerance, materiality thresholds, insurance coverage or other defined limits. It also supports the analysis of estimation uncertainty and the sensitivity of results to individual inputs.

Instead of vague categories such as “high risk”, you obtain a model that supports a concrete discussion: how much a scenario may cost, how likely a significant loss is, which factors actually drive the risk, which controls provide the greatest benefit, and whether the cost of those controls is justified by the reduction in exposure.

Dashboard preview

The dashboard brings together the main information needed for decision-making: current and residual risk exposure, the relationship to risk appetite and other decision thresholds, the loss exceedance curve, scenarios contributing most to total exposure, the structure of potential losses, and controls with the highest expected benefit.

Example demo model. The values shown are provided solely to illustrate the outputs of the tool.

Licensing and pricing

Clever Risk Quantifier™ is provided as an annual licence. The EDU edition is intended for learning, teaching and demonstrating the principles of quantitative risk modeling. Higher editions add functionality for professional analytical work and organizational use, including advanced scenario and loss modeling, uncertainty and tail-risk analysis, dashboards, RTC/LEC analysis, risk and control heatmaps, control-effectiveness modeling, report generation, threat and control catalogs, and multi-user support.

Each licence is valid for 12 months. Choose the edition that best matches how you intend to use the tool.

What the tool can do

Clever Risk Quantifier™ allows risk to be modeled from scenario definition through frequency and impact estimation to control evaluation, residual exposure and decision support. It is compatible with the logic of Open FAIR and works with threat-event frequency, vulnerability, loss-event frequency, loss magnitude and control effectiveness.

It is designed as a modular and localizable platform that can be extended with additional analytical, visualization and reporting functions.

An accessible path to quantitative analysis

Key risk factors do not have to be entered only as precise numerical intervals. CRQ also allows users to start with qualitative assessments.

Users therefore do not need to know exact probability-distribution parameters when creating their first model.

A model can begin with available expert estimates and be refined over time as additional data, observations, experience or analytical evidence becomes available.

Risk-scenario modeling

Risk scenarios can be modeled as branching attack, failure or misuse paths. A model can contain organizational units, Loss Events, individual risk scenarios, attack paths, vulnerabilities, threats, supporting and primary assets, and associated controls.

For individual parts of a scenario, users can define threat frequency, vulnerability, existing and planned controls, their effectiveness and their cost.

CRQ then calculates loss-event frequency, potential loss magnitude and resulting risk exposure.

Loss modeling

Scenario impact can be decomposed into individual loss baskets. CRQ supports primary and secondary losses and allows individual Loss Magnitude components to be modeled separately.

Instead of relying on a single aggregated loss estimate, users can analyze where the total impact comes from and which components are the main drivers of a particular scenario.

Uncertainty and sensitivity

CRQ does not rely solely on point estimates. Frequency, loss magnitude and other inputs can be modeled using ranges and probability distributions.

Simulation results can be expressed through expected value, median, percentiles, Value at Risk, Expected Shortfall and other measures of risk exposure.

The analysis can also include estimation uncertainty and sensitivity. This allows users to understand not only the estimated level of risk, but also the range of possible outcomes and which model inputs have the greatest influence on the final exposure.

Refining estimates

Threat-frequency and loss-magnitude estimates can be refined over time.

CRQ supports combining expert judgment with available observations and encourages the use of ranges instead of relying on a single apparently precise number.

A model can therefore start with relatively coarse estimates and become more precise as better data becomes available.

Control-effectiveness modeling

Security controls can be modeled directly within the risk scenario.

CRQ supports control effectiveness, coverage, maturity, cost, implementation status and dependencies between controls.

The model then shows how individual controls or combinations of controls affect the frequency or magnitude of a loss event, how they influence residual risk and what benefit they provide relative to their cost.

This allows alternative control strategies to be compared and helps identify combinations that provide the greatest reduction in risk exposure.

Current and residual risk

CRQ compares current and residual risk exposure.

Users can see how risk changes after planned controls are implemented, how much exposure is reduced and which scenarios remain significant even after treatment.

Results can be compared with risk appetite, risk tolerance and other decision thresholds.

Loss Exceedance Curves

CRQ provides scenario-level and aggregate Loss Exceedance Curves and allows them to be compared against organizational decision thresholds.

For individual scenarios and the aggregate model, users can analyze expected value, median, Value at Risk, Expected Shortfall and the probability of exceeding risk tolerance, material-loss thresholds, insurance coverage, enterprise value or other defined limits.

Curves can be displayed for both current and residual states, making it possible to evaluate not only the change in expected loss but also the change in the entire distribution of possible losses.

Tail-risk analysis

Average or expected loss alone may not adequately describe low-frequency, high-impact scenarios.

CRQ therefore supports analysis of the right tail of the loss distribution.

Value at Risk, Expected Shortfall, percentiles and Loss Exceedance Curves help assess less likely but potentially severe outcomes.

Visualization of major risks

Heatmaps and other visualizations display scenarios according to loss-event frequency, loss magnitude, total exposure and other parameters.

They support comparison between current and residual states and help identify scenarios that contribute most to total exposure or require more detailed analysis.

Control prioritization

Controls can be compared according to expected cost, effectiveness, return and contribution to overall exposure reduction.

This allows users to assess not only whether a control is technically appropriate, but also whether its implementation represents an economically rational response to a particular risk.

Dashboard

The dashboard brings key information about the entire risk model together in one place.

It presents current and residual exposure, relationships to decision thresholds, major scenarios, loss decomposition, the costs and benefits of controls, heatmaps and exceedance curves.

It serves both as an analytical view and as a management-level overview of the risk model.

Portfolio-level risk analysis

CRQ does not treat every scenario as an isolated item.

Individual risks can be aggregated and their combined contribution to the organization’s overall exposure analyzed.

This makes it possible to identify scenarios that are individually significant, scenarios that dominate the risk portfolio, and areas where risk is concentrated.

Reporting

The management report converts the analytical model into outputs suitable for executives, process owners, security teams, internal decision-making and client presentations.

The result is therefore not only a technical model, but also a basis for specific decisions.

Threat and control catalogs

CRQ supports reusable catalogs of threats and controls.

Threats can be modeled using TEF ranges or through Contact Frequency and Probability of Action.

Controls can be evaluated according to effectiveness, coverage, maturity, cost and implementation status.

Mappings between threats and controls allow reusable knowledge to be applied across multiple scenarios.

Catalogs can be exported and imported using delimited text files.

Financial and non-financial impacts

Financial units are the primary way of expressing quantified risk.

Where monetary valuation is inappropriate or insufficient, CRQ can also work with other units, such as affected persons, outage hours, unprocessed transactions, systems or locations.

This allows CRQ to be used in environments where decisions cannot be based solely on financial loss.

Modular architecture

Clever Risk Quantifier™ is designed around a modular architecture.

Analytical, modeling, visualization and reporting functions are separated into individual components that can be further developed and extended.

This architecture makes it easier to add new analytical methods, visualizations, reports or specialized functionality without changing the fundamental principles of the application.

CRQ can therefore continue evolving as new risk-modeling approaches and user requirements emerge.

Internationalization and localization

User-facing text is separated from application logic and stored in dedicated localization files.

Clever Risk Quantifier™ is currently available in Czech and English.

Additional languages can therefore be introduced primarily by creating the corresponding localization file rather than by making major changes to application code.

This architecture supports international deployment and makes further language versions significantly easier to implement.

Export, import and portable models

Risk models can be exported and imported in JSON format.

Users can therefore archive models, create alternative versions, transfer them between environments or share them according to their own internal rules.

The structured model format, together with the modular architecture, also facilitates further development, integration of additional analytical functionality and work with externally prepared models.

Outcome

Clever Risk Quantifier™ helps replace long registers of isolated risks with a smaller number of well-defined and analytically meaningful scenarios.

The result is not simply one number. It is a model that can support discussion between security teams, process owners, finance and executive management.

Instead of saying “this risk is high”, the organization can work with much more specific conclusions: this scenario has a certain expected exposure, there is a certain probability of exceeding a material loss, these inputs have the greatest influence on the result, these controls reduce exposure most effectively, and after implementing them the organization will or will not fall below its defined risk appetite.

Key information is available through the dashboard and analytical modules, where users can examine current and residual risk exposure, uncertainty, major contributors to risk, exceedance curves, tail risk and the expected benefit of controls.

The same conclusions can be converted into a management report that serves as a basis for decisions, discussion or presentation of results.