CRML is an open-source declarative language for cyber risk modeling that enables Risk as Code. It provides a YAML/JSON format for describing cyber risk models without forcing you into specific quantification methods or security frameworks.
CRML is an open-source cyber risk modeling language that enables Risk as Code (RaC). It targets cybersecurity risk professionals, GRC analysts, and security architects who need to standardize and automate their risk models. The language uses a declarative YAML/JSON format to describe scenarios, telemetry mappings, simulation pipelines, and dependencies without forcing a specific quantification method or security framework. Its core value is portability: risk models become versioned, reviewable artifacts that can be validated and executed consistently across teams and tools. By treating risk as code, CRML brings software engineering practices like Git-based reviews and CI validation to cyber risk management.
Cyber risk models are often trapped in spreadsheets, slide decks, or proprietary tools, making them difficult to review, audit, and reproduce. Control effectiveness and defense-in-depth assumptions are documented inconsistently, leading to varying results by analyst and by quarter. Threat and control frameworks such as ATT&CK, CIS, NIST, and ISO change over time, and their mappings are brittle and rarely versioned. Quantification engines differ—FAIR-style Monte Carlo, Bayesian QBER, actuarial models—causing costly rewrites and reinterpretation. Audit-ready evidence is fragmented, with unclear provenance of model inputs and outputs. CRML addresses these pain points by standardizing the description of cyber risk models, so different engines and organizations can exchange and execute the same model with clear validation and traceability.
A major feature of CRML is control effectiveness modeling, which allows users to quantify how security controls reduce risk, including defense-in-depth effects. Users define controls with an effectiveness coefficient against a specific threat. For example, in a ransomware scenario, multi-factor authentication can be modeled with a 0.35 effectiveness reduction, reducing the frequency or severity of loss. This enables precise evaluation of security investments by comparing expected risk with and without controls. The feature also integrates with control catalogs like SCF, making mappings explicit and versioned. This approach supports evidence-based security spending and demonstrates risk reduction to auditors and executives.
CRML introduces median-based parameterization for lognormal distributions, allowing users to specify median values directly instead of mean or custom parameters. This aligns with how risk practitioners intuitively think about losses, as median is often easier to estimate from experience or data. Multi-currency support enables modeling across different currencies with automatic conversion, which is essential for global organizations. These features reduce ambiguity and improve reproducibility of risk calculations across regions and business units. The median parameterization also simplifies calibration when historical data is sparse, as a single median estimate with a reasonable sigma can produce meaningful distributions for simulation.
Publisher
A
admin
Launch Date2026-02-09
Platformweb
Pricingfree
Tech Stack
#Python#TypeScript#Next.js#YAML#JSON