Report:

The Forrester Wave™: Cyber Risk Quantification, Q3 2023

Top Vendor Products for Cyber Risk Quantification in 2023

• Axio
• RiskLens
• ThreatConnect

Cyber Risk Quantification Vendor Product Comparisons 2023

• Axio - Leaders
  

  Pros:

  • Applies the power of CRQ to cyber program assessment and insurance decisions
  • Platform links control-based assessments with quantitative risk scenario analysis
  • Features predefined catalogs of scenarios and control initiatives to help users get started
  • Includes suggested formulas to help users quantify relevant financial losses based on context
  • Cyber insurance stress-testing feature and ability to conduct NIST CSF control assessments
  • Secured $23 million Series B funding round in mid-2022 to support robust roadmap
  • Roadmap includes updated AI and machine learning algorithms, new planning module, and expanded integration marketplace

  Cons:

  • Weaker in native third-party integrations to automatically source risk data inputs
  • Reference customers noted desire for stronger threat modeling
  • Reference customers wanted better visuals for nontechnical audiences in native reports
  • As it pursues international expansion, must ensure it can sustain innovation


• RiskLens - Leaders
  

  Pros:

  • One of the most recognizable names in CRQ thanks to role in creating Open FAIR standard
  • Leading the FAIR Institute, a nonprofit professional organization
  • Long history of introducing innovative features that make FAIR-based CRQ accessible
  • Aggressive product roadmap prioritizes next-generation automation capabilities and expanded data integrations
  • Platform prioritizes speed to results through use of data helpers that reduce duplicative data collections
  • Delivers best-in-class comparative scenario analysis
  • Automatically generates insights based on which control reduces most risk, is most cost effective, and fastest to implement
  • Reference customers highlight quantification model's defensibility and subject matter expert support as advantages
  • Good fit for seasoned or inexperienced cyber risk pros and highly regulated or audited companies

  Cons:

  • Pricing model based on use case and company revenue reflects feature-rich product but leaves room for competitors offering all-in-one packages
  • Has been slower to adopt automated methods for collecting risk input data
  • Reference customers cite cost as tough sell to executives


• ThreatConnect - Leaders
  

  Pros:

  • Sets the standard for a threat-driven approach to CRQ
  • Goal is to deliver automated, data-driven CRQ that reduces subjectivity and provides actionable mitigations
  • Roadmap prioritizes high level of analytical depth and breadth that benefits from threat intelligence offering
  • Gives customers three models for calculating risk: manual FAIR, semiautomated data-driven FAIR, and ML approach
  • Incorporates multiple industry data sources including security telemetry
  • Continually backtests models to ensure defensible financial loss calculation
  • Reference customers appreciated product's intuitive interface
  • Good fit for security operations and risk analysts looking to add financial quantification to threat and vulnerability management

  Cons:

  • Vision is more tactically focused than competitors
  • Partner ecosystem and adoption strategies are more technically focused than other Leaders
  • External benchmarks don't exist yet, though customers can benchmark against internal data
  • Reference customers cited limitations with CVSS-based vulnerability scoring


• Balbix - Strong Performers
  

  Pros:

  • AI-powered cybersecurity posture automation platform
  • One of the strongest at automating risk data inputs including assets, vulnerabilities, and threats
  • Provides more expansive offering of native integrations than most vendors
  • Strong innovation strategy with $70 million Series C funding round secured in early 2022
  • Reference customers praised Balbix's commitment to customer success
  • Breach likelihood metric important for prioritization decisions

  Cons:

  • Asset and vulnerability management tool first and CRQ tool second
  • Quantification model, scenario scoping, and financial loss data capabilities are below par
  • Only uses risk data that can be technically scanned, sacrificing ability to use custom or manual data inputs
  • Weaker with adoption strategy, which lacks dedicated CRQ training
  • Reference customers struggled to operationalize its CRQ offering
  • Roadmap leaves customers wanting more when it comes to CRQ assessment options


• KPMG - Strong Performers
  

  Pros:

  • Solid vision for the market backed by well-funded innovation plan
  • One of the few professional services firms to offer its own licensable product
  • Product offers strong user experience with one of the best interfaces evaluated
  • Quantification model and scenario scoping capabilities are sound
  • Reference customers praised product's native dashboards and visualizations
  • Reference customers claimed it improved their board reporting

  Cons:

  • One of the newest CRQ products on the market
  • Does not yet support integrations with other security tools
  • Lacks automated means to gather, analyze, and report on data - a significant gap
  • Roadmap features iterative improvements but many planned features already available in market
  • Adoption strategy lags and doesn't currently bundle CRQ training with product
  • Reference customers wanted KPMG to include active threat intelligence in platform


• Mastercard - Strong Performers
  

  Pros:

  • Acquired Cytegic in 2020 and rebranded as Cyber Quant product
  • Finds its footing in the financial services industry
  • Vision and innovation strategy closely aligned to deliver improved automated situational awareness
  • Approach to managing assessments and role-based access can help customers scale risk management programs
  • Reference customers valued the control maturity dashboards

  Cons:

  • Layers CRQ elements on control maturity but lacks essential risk modeling
  • Roadmap generally prioritizes features already available in the market
  • Quantification model and scenario scoping capabilities are below par
  • Users cannot conduct top-down risk assessments
  • Reference customers found lack of available integrations limiting


• X-Analytics - Contenders
  

  Pros:

  • Partners with National Association of Corporate Directors to deliver cyber risk reporting service
  • Launched version for private equity and investment firms to monitor portfolios' financial exposure to cyber risk
  • Leverages cyber incident data informed by cyber insurance industry
  • Performs well in reporting with board-friendly visualizations

  Cons:

  • Semantically positions itself as cyber risk decisioning tool rather than CRQ
  • Approach helpful for high-level risk monitoring but limits ability to scope and model company-specific scenarios
  • Weaker in ability to leverage threat and vulnerability telemetry from customers' existing security tools
  • Innovation strategy externally prioritized creating partnerships over product development in 2022
  • Unclear whether innovation strategy and product roadmap will keep pace with customer demand
  • Declined to participate in full Forrester Wave evaluation process


• Deloitte - Challengers
  

  Pros:

  • Draws on success in cyber risk consulting services to deliver risk analytics, reporting, and insights
  • Services-led background affords unique position to stay ahead of customer needs
  • Product includes unique features like metrics catalog and ability to generate program roadmaps based on CRQ analysis

  Cons:

  • Strong CRQ services experience but product struggles to shine
  • Underperforms strategically with consulting-focused rather than technology-focused vision
  • No clear innovation strategy or product roadmap
  • Unable to demonstrate how and to what extent capabilities function within product
  • Lags in automation and tool integration functionality
  • Declined to participate in full Forrester Wave evaluation process

Reference

• Forrester, The Forrester Wave™: Cyber Risk Quantification, Q3 2023, 18-Jul-2023, ID RES178449

View Market Definition
View Vendor Movements