Tools & Research
Open-source tools for cyber risk quantification. Built to support real decisions.
Security Decision Science
Interactive curriculum: Monte Carlo, Bayesian updating, survival analysis, causal inference, game theory, and behavioral traps — applied to security decisions. Companion decision-security library on PyPI.
Live docs · GitHub →
FAIR Simulator
Monte Carlo risk quantification with IRIS 2025 benchmarks. Scenario creation, sensitivity analysis, portfolio aggregation.
FAIR-CAM Agent-Based Model
Simulates how controls actually behave over time. Degradation, interaction, and cascade failure. Calibrated against empirical loss data.
Quorum
Structured LLM deliberation for loss estimation. 5 specialist agents produce calibrated FAIR loss distributions, grounded in empirical benchmarks.
LLM Classification Validator
Five-dimension psychometric validation for any LLM that produces structured classifications. Tests agreement, consistency, convergent validity, adversarial discrimination, and stability. Taxonomy-agnostic.
Survival Analysis for Vulnerability Management
Kaplan-Meier survival analysis applied to time-to-patch metrics using Qualys VMDR data.
Substrata
Empirical cyber risk data corpus. Curated public data spanning enforcement actions, litigation, settlements, insurance, threat frequency, control effectiveness, and financial impacts.
TEF Estimator
Data-grounded Threat Event Frequency estimation with vector decomposition. Calibrated against empirical threat data. Available on PyPI.
All tools are free and open. If they've been useful to you, you can support the work →
Model Risk Testing — companion documents
Practitioner resources accompanying the ERQI publication Model Risk Testing & Analysis for Cyber Risk Quantification (June 2026).
CRQ Vendor Validation Checklist
24 questions for evaluating commercial CRQ platforms CC BY-NC-ND · PDF ↓Model Documentation Template
Minimal model card — purpose, assumptions, limitations, conditions of use CC BY · PDF ↓VaR, CVaR & TVaR Practitioner’s Reference
When to report VaR, CVaR, or both — tail diagnostics and convergence CC BY · PDF ↓FAIR Validation Catalog
Validation tests mapped to each FAIR model component On requestLoss Distribution Validation Catalog
Frequency-severity models — data quality, tail estimation, aggregation On requestThe validation catalogs and further companion materials are available on request. Contact via LinkedIn.