2026 is the year cyber risk quantification stopped being niche

For most of the last decade, cyber risk quantification (CRQ) — putting a dollar figure on cyber risk instead of a red/amber/green heatmap — was a thing a handful of large banks and insurers did. In 2026 it became mainstream.

The numbers are striking. In the 2026 State of Cyber Risk Management Report, published in early June by GuidePoint Security and The FAIR Institute, organisations reported a clear shift toward financial risk management:

The vendor market has noticed. There is now a wave of "instant" CRQ products promising a board-ready financial risk number with minimal inputs — one launched this year offering results in as little as 24 hours. The category is consolidating around a single promise: faster, more automated, less manual effort.

That is genuine progress, and it is overdue. But it has quietly skipped past the oldest, hardest problem in the entire discipline. Speed and automation make a CRQ model faster. They do not make it right. And the same FAIR Institute report that shows all this momentum also shows the catch: 76% of organisations believe they're effective at turning risk assessments into business decisions, but only 35% say their governance groups are fully effective at it. Confidence is running well ahead of rigour.

So here's the question worth asking before you buy the fastest number on the market: where did the inputs come from?

Automation solved the wrong bottleneck

A CRQ engine is, underneath, an arithmetic machine. Most credible platforms — ours included — run a Monte Carlo simulation over a FAIR-style decomposition: how often a loss event happens (Loss Event Frequency), multiplied by how much it costs when it does (Loss Magnitude), simulated thousands of times to produce an Annual Loss Expectancy (ALE) with a distribution around it.

That maths is well understood and, frankly, commoditised. Automating it — pulling in scan data, wiring up live threat feeds, refreshing the model continuously — is the part the 2026 product wave has nailed. Kovrr's widely-read list of CRQ trends for the year is a good summary of where the energy is going: automated risk registers, integration with continuous threat-exposure management, real-time data feeds, AI-assisted scenario generation.

Useful, all of it. But notice what every one of those improvements has in common: they make the engine faster and the known data fresher. None of them touches the quality of the estimates the engine runs on.

A Monte Carlo simulation will perform flawless arithmetic on garbage and hand you back a beautifully formatted, precisely wrong number — in 24 hours instead of a fortnight.

This isn't a fringe concern. The FAIR community has been explicit about it for years: the answer to "garbage in, garbage out" is calibration — making estimates as a 90%-confidence range rather than a single confident point, by people trained and measured on how accurate their past estimates turned out to be. The problem is that calibration is exactly the part automation can't do for you. It's a property of the people and process feeding the model, not the software running it.

Confident is not the same as calibrated

Ask an uncalibrated expert how much a ransomware event would cost you and they'll often give you a single, confident figure: "About seven million." It sounds authoritative. It's also, statistically, almost certainly wrong — point estimates from unmeasured experts miss far more often than the experts believe.

A calibrated expert answers differently: "I'm 90% confident it's between six and fifteen million." That feels less satisfying to a board that wants one number. But it's far more likely to actually contain the truth — and it carries its own honesty about uncertainty, which is precisely what a risk decision needs.

The distinction matters because most CRQ inputs are not measured — they're estimated. Some factors you can pull from data. Many you can't, and a human has to make a judgement. If that human is confidently uncalibrated, automating the model around them just industrialises the error. You get wrong answers faster, more often, and with a more convincing dashboard wrapped around them.

This is the gap a fast-CRQ buyer should be probing. Not "how quickly does it produce a number?" but "how does it know whether the people supplying the estimates are any good — and does it get more accurate as it learns who is?"

And then there are the assets you can't scan at all

Calibration is the input problem for the data you have. There's a second, larger problem: the data you'll never have.

Automated CRQ depends on telemetry — scanners, agents, feeds. That works beautifully for IT: servers, endpoints, cloud workloads. It runs into a wall the moment you reach the systems that carry the highest consequence if they fail.

You cannot run an active scan against a live SCADA system controlling a water treatment plant — the scan itself can disrupt a safety-critical process. You cannot put an agent on an air-gapped defence network; that's the whole point of air-gapping it. You cannot install software on a third party's environment you don't administer, or on a legacy controller whose vendor went out of business in 2009.

These are the crown-jewel assets — the ones whose compromise makes the news and triggers the board attestation. And they are exactly the assets an automation-first CRQ tool is structurally blind to. Highest consequence, least data. A model that can only quantify what it can scan will hand a critical-infrastructure board a confident dollar figure that silently excludes the systems they most need to understand.

What "fixing the inputs" actually means

None of this is an argument against speed or automation. It's an argument that they're necessary, not sufficient. The CRQ tools worth buying in 2026 are the ones that automate the engine and take the input problem seriously. In practice that means looking past the headline pitch:

CyQuantiFi was built around those three answers rather than around speed for its own sake. For scannable assets, we automate exactly like the rest of the field — telemetry in, attack graph out, Monte Carlo over a FAIR decomposition, ALE in dollars. For the unscannable assets, we use structured expert consensus: a market-based mechanism where security experts contribute probability estimates, their accuracy is tracked over time, and better-calibrated experts carry more weight. The same dollar output, on the assets a scanner can't touch. That second mode is the subject of our filed patent, and it's the difference between a number that covers your IT and a number that covers your business.

What to do before you trust a CRQ number

The bottom line

2026 made cyber risk quantification fast, automated, and mainstream. That's worth celebrating — for years the bottleneck on CRQ adoption was manual effort and expert time, and the industry has genuinely attacked it.

But the field has automated the part that was already easy and largely left alone the part that was always hard. The arithmetic was never the problem. The inputs were. A Monte Carlo engine is indifferent to whether you feed it calibrated estimates or confident guesses; it will produce a crisp dollar figure either way, and the fast ones will produce it before you've finished your coffee.

For most organisations, the practical test is simple. The next time someone hands you a quantified cyber risk number, don't ask how quickly it was produced. Ask two things: how do you know the inputs are any good, and does this include the systems we can't scan? If the answers are vague, you don't have a risk number. You have a heatmap with a dollar sign in front of it.

The organisations that win the CRQ era won't be the ones with the fastest number. They'll be the ones with the most trustworthy one.

Related reading

• 2026 State of Cyber Risk Management Report — GuidePoint Security & The FAIR Institute
• Avoiding "Garbage In, Garbage Out" in cyber risk measurement — FAIR Institute / RiskLens
• CyQuantiFi: Risk quantification for the assets you can't scan