Join waitlist
Back to products
CRML

CRML

CRML is a declaritive language for writing cyberrisk as code Open Source • Languages • GitHub 21 133 Framer Launch websites with enterprise needs at startup speeds. Design Tools • Website Builder • Artificial Intelligence

Website github.com
Overview

What it is

We have infrastructure as a code, network as a code but dont have anything as Risk As a Code. CRML is an open, declarative, engine-agnostic and Control / Attack framework–agnostic Cyber Risk Modeling Language. It provides a YAML/JSON format for describing cyber risk models, telemetry mappings, simulation pipelines, dependencies, and output requirements — without forcing you into a specific quantification method, simulation engine, or security-control / threat catalog.

Intent

I need it when

Create audit-ready evidence that documents exactly what was modeled, with which parameters, using which data, and producing which outputs

CRML treats risk models as versioned, reviewable artifacts with strict JSON Schema validation. Models capture assumptions, control mappings, threat catalogs, and dependencies explicitly. Combined with Git history and CI validation, this creates a complete, traceable audit trail of how risk was calculated—satisfying compliance and regulatory requirements for reproducibility.

Build and execute quantified cyber risk models (FAIR Monte Carlo, Bayesian QBER) without being locked into a single vendor's platform

CRML is engine-agnostic and framework-agnostic, allowing organizations to define risk models once and run them through any compliant simulation engine. The reference crml-engine provides immediate execution capability via CLI or Python API, while the standardized format lets teams swap engines or integrate with proprietary platforms without rewriting models.

Integrate threat frameworks (ATT&CK, NIST, CIS, ISO, SCF) and control catalogs into risk models while handling framework updates and mappings

CRML provides versioned catalog and mapping files for threat and control frameworks, with built-in support for SCF integration and OSCAL interoperability. When frameworks change, teams update the mappings rather than rewriting models, and all changes are tracked in version control—enabling consistent, maintainable framework alignment across the organization.

Standardize cyber risk models across teams and tools using version-controlled, machine-readable definitions

CRML provides a declarative YAML/JSON format for describing cyber risk models, control effectiveness, and threat mappings as code. This enables risk models to be versioned in Git, peer-reviewed in pull requests, and executed consistently across different quantification engines—eliminating spreadsheet silos and enabling reproducible, auditable risk management.

Map cyber risk to enterprise risk, insurance, and financial planning by quantifying risk distributions rather than qualitative ratings

CRML supports median-based parameterization of lognormal distributions, multi-currency modeling, and control effectiveness quantification. This enables organizations to move beyond high/medium/low qualitative assessments to estimated distributions of financial outcomes, making cyber risk comparable to other enterprise risks and suitable for insurance and financial decision-making.

Drop

Not a fit when

  • Organization requires proprietary, closed-source risk modeling tools with vendor lock-in and commercial support contracts
  • Team lacks Python expertise or comfort with YAML/JSON configuration and command-line interfaces
  • Business needs real-time, out-of-the-box risk dashboards without requiring custom simulation engine integration
  • Regulatory compliance requires certified, audited quantification engines rather than community-maintained reference implementations
  • Organization uses only legacy spreadsheet-based or proprietary GRC platforms with no API integration capability
Commercials

Pricing

Free, open-source