Citalid

Defines and models specific cyber threat scenarios such as ransomware, data breach, business email compromise, or cloud outage as the unit of quantification, tying each scenario to a business decision rather than an enterprise-wide average. Scenario library breadth and support for custom scenario authoring vary across products.

Estimates how likely or how often each modeled scenario is to occur, drawing on native or integrated threat and vulnerability intelligence, adversary technique mappings such as MITRE ATT&CK, historical incident data or actuarial loss datasets to ground the likelihood side of the calculation. Products differ in whether frequency is threat-intelligence-driven, actuarial or expert-estimated, and in whether the intelligence is native to the product or pulled through integrations.

Models the financial loss drivers that set the magnitude of each scenario, including incident response, business interruption, data recovery, regulatory fines, legal liability, and reputational harm. Coverage of secondary and long-tail losses varies across products.

Runs Monte Carlo or equivalent simulation to express exposure as probability distributions and ranges, such as annualized loss exposure and loss-exceedance curves, rather than a single-point figure. Some products report only point estimates.

Quantifies how the organization's existing security controls reduce financial exposure, expressing the monetary value of controls in place and the residual risk they leave, and can monitor control performance continuously from observed data rather than from periodic maturity self-assessment, for example through the FAIR-CAM control analytics standard. Products vary in whether control effectiveness is measured, monitored or self-reported.

Ranks and optimizes prospective security investments by financial risk reduction per unit of spend, supporting capital allocation, risk acceptance, and control-optimization decisions. Prescriptive optimization is stronger in some products than others.

Translates quantified exposure into board-ready, CFO-ready, and executive-ready reporting in financial terms, supporting capital trade-offs, oversight, and budgeting and strategic-planning cycles. Reporting depth and boardroom framing vary across products.

Quantifies exposure to inform insurance coverage adequacy, policy limits, and risk-transfer decisions, and to justify control effectiveness during underwriting and renewal. Dedicated insurance modules are a differentiator rather than a universal capability.

Exposes how the risk model calculates its outputs, which inputs and assumptions drive each figure and how uncertain each estimate is, through documented methods, tunable parameters and audit trails, so that quantified results can be explained to executives, auditors and insurers rather than presented as an opaque number. Products range from glass-box models with published methods and trust portals to proprietary calculations customers describe as a black box.

Expresses the monetary impact of material cyber events for regulatory and disclosure obligations, such as SEC cyber disclosure and materiality assessment. Dedicated disclosure workflows are present in some products and absent in others.

Distributes, collects and scores third-party assessments and security questionnaires from a maintained template library that spans risk domains and standards, with evidence requests, reminders, reviewer collaboration and scoring rules; stronger implementations scope questionnaire depth and cadence dynamically from the third party's risk profile rather than sending one template to every vendor.

Scores each third party's inherent and residual risk and measures its potential impact on the business or supply chain to produce an impact estimate, aggregating domain-level results into a composite score that can be rolled up across the portfolio and correlated with enterprise objectives and control performance.

Watches third parties between assessments for new risk events, such as security incidents, financial distress, sanctions or adverse-media hits and regulatory actions, and surfaces them through dashboards, reports, alerts, reminders and notifications; stronger implementations re-score the third party and trigger escalation or corrective action when an event crosses a defined threshold instead of only updating a dashboard.

Profiles each third party at intake, capturing criticality, data sensitivity, service type, geography and regulatory requirements, to determine which risk domains apply to it and to scope the depth and cadence of assessment accordingly.

Assigns each third party to a risk tier from its inherent risk profile and business criticality, with tier definitions and thresholds the customer can change, and uses the tier to set assessment depth, review cadence, approval routing and monitoring intensity so that workflows adjust automatically when a third party's tier changes.

Reads third-party-supplied documents such as SOC 2 reports, ISO certificates, policies and prior questionnaires with AI, extracts the relevant answers and evidence to prepopulate assessment responses, and evaluates submitted responses for gaps or inconsistencies so reviewers work the exceptions rather than reading every document.

Expresses a third party's risk in measurable, decision-ready terms, such as a financial exposure range or a calibrated score built from likelihood and impact, instead of a qualitative heat map, so third parties can be compared, prioritized and reported to executives on estimated impact.

Links critical third parties to the business processes, products, geographies and recovery objectives that depend on them, identifies concentration where several critical services rely on the same provider or the same fourth party, and supports contingency and exit planning, typically to meet operational-resilience regulation such as DORA.

Brings risk-domain data subscriptions into each third party's record, such as outside-in cybersecurity ratings, external attack surface findings, financial health, sanctions and adverse media, and ESG data, whether produced natively or ingested from a ratings or data-aggregator provider, and uses that data in scoring and ongoing monitoring so an indicator crossing a threshold updates the risk score and starts a workflow rather than only refreshing a dashboard.