# Cyber Risk Quantifier

> FAIR-aligned cyber risk quantification — transforms Tenable vulnerability data into board-ready financial risk PDFs

- Type: Agent
- Author: spacebar-tenb
- License: MIT
- Trust tier: contributed (passed automated validation and a baseline maintainer review)
- Last reviewed: 2026-07-16
- Source repository: https://github.com/spacebar-tenb/cyber-risk-quantifier
- Repo state: not archived
- Last push: 2026-07-16T12:41:56Z
- Stars: 3 (a popularity signal, not a safety signal)
- Forks: 0 (a popularity signal, not a safety signal)
- Open issues: 0
- Language: Python
- Health checked at: 2026-11-05T20:35:15.821Z
- Integrations: Tenable
- Domains: governance-risk-compliance, vulnerability-management
- Tags: cyber-risk, fair-model, risk-quantification, vulnerability-management, pdf-reporting, tenable
- Date added: 2026-07-16
- Listing page: https://exchange.tenable.com/agents/cyber-risk-quantifier
- Source file: https://github.com/tenable/cyberagents-exchange/blob/main/agents/cyber-risk-quantifier.md

Cyber Risk Quantifier is a Python CLI that takes Tenable One Vulnerability Management scan exports and produces board-ready PDF reports with defensible, per-exposure financial risk estimates using the FAIR (Factor Analysis of Information Risk) framework.

## What it does

- Parses Tenable One Vulnerability Management CSV exports with flexible column detection and deduplicates by Plugin ID + Host
- Quantifies each exposure using ALE = LEF × SLE (Annualized Loss Expectancy = Loss Event Frequency × Single Loss Expectancy)
- Derives LEF and loss magnitude from Tenable VPR scores — no reliance on static CVSS severity
- Generates multi-page PDF reports with executive summary, scope context, FAIR methodology, risk portfolio, business impact analysis, remediation recommendations with SLA targets, and detailed exposure breakdowns
- References IBM Cost of a Data Breach Report 2025 benchmarks across 17 industries
- Supports optional business context config for asset criticality, service mapping, and compliance frameworks

## How it works

The tool reads a Tenable One Vulnerability Management CSV export, deduplicates rows by Plugin ID + Host (one exposure per missing patch per asset), then scores each exposure independently using VPR-derived probability and loss magnitude against industry breach cost data. Priority tiers (P0–P3) are assigned based on financial thresholds, and a Recommendations section provides remediation impact analysis with investment justification framing for budget conversations.

This is the Markdown version of one of 140 listings on CyberAgents Exchange. The same listing as JSON: https://exchange.tenable.com/api/agents/cyber-risk-quantifier.json. The full index and how to read it: https://exchange.tenable.com/llms.txt