Welcome to CRQ Pro

Quantify cyber risk in dollars with FAIR-based Monte Carlo simulation, right on your desktop.

CRQ Pro is a desktop application for cyber risk quantification (CRQ). It helps risk analysts and security teams express cyber risk in financial terms using the Open FAIR model and Monte Carlo simulation, so you can answer questions like:

What is our expected annual loss from ransomware?
What is the 1-in-20-year loss for our top scenarios combined?
Which scenarios drive the most tail risk in our portfolio?
Does this exposure exceed our risk appetite?

Everything runs locally on your machine. Your risk data is encrypted at rest and never leaves your computer.

How it works

Model a scenario

Describe a loss event (for example, "Ransomware outbreak across corporate domain") and estimate its Loss Event Frequency and Loss Magnitude using ranges, not single guesses. Decompose factors further using the FAIR taxonomy when you have the data to support it.

Simulate

CRQ Pro runs tens of thousands of simulated years in seconds and builds a full annual loss distribution for the scenario, or for a whole portfolio of scenarios at once.

Rate and report

Results are rated Low, Moderate, High, or Critical against your risk appetite, and you can generate board-ready Word reports and Excel workbooks in a couple of clicks.

Key features

FAIR-based modeling: estimate factors directly or decompose them (TEF x Vulnerability, Primary + Secondary loss, the six forms of loss, and more).
Fast Monte Carlo engine: 10,000 to 250,000 iterations per run, with reproducible results.
Portfolios: aggregate scenarios into a combined loss distribution and see which scenarios contribute most.
Reusable components: build a library of shared estimates (threat frequencies, loss tables) and link them into scenarios.
Risk appetite ratings: rate results against dollar thresholds you define, per workspace or per scenario.
Reports and exports: Word risk reports, Excel workbooks, risk register exports, CSV and PNG chart exports.
Local and encrypted: all data is stored on your machine, sealed with AES-256-GCM.