Safe, Axio, KPMG Dominate Cyber Risk Quantification Rankings

Safe Security and Axio remained atop Forrester’s cyber risk quantification rankings, with KPMG climbing onto the leaderboard and ThreatConnect falling off the leaderboard.

See Also: OnDemand | Proverbial GRC: Navigating Stormy Seas with Strategic Parables

Cyber risk quantification tools have moved beyond basic risk modeling to automate recommendations, analyze trends and orchestrate insights across systems, said Forrester Senior Analyst Cody Scott. Rather than relying on analysts to manually input data and derive insights, modern CRQ platforms now automatically generate remediation strategies, trend analyses and cross-functional orchestration, Scott said.

“These tools have leaned extensively into automation, which in 2023 was more of a highly desired but nice-to-have feature, and now it’s the standard,” Scott told Information Security Media Group.

Scott said CRQ tools have begun to replace traditional GRC platforms in many companies since outputs from the latter are often compliance-driven and rarely evolve into strategic decision-making tools. CRQ tools, on the other hand, offer real-time control analytics, automated risk monitoring and decision-making support grounded in measurable financial impact, which Scott said enables smarter investments.

“These CRQ tools are coming in with continuous monitoring capability, continuous risk assessment and the financially quantified view that are completely upsetting what GRC has done for organizations, because it’s turning into actual risk management, not the perception of risk being managed,” Scott said.

Legacy approaches to third-party risk management rely on vague, subjective scores to evaluate vendors. CRQ tools are replacing those with quantifiable financial models that assess potential losses more objectively, he said, and cyber insurers are starting to use CRQ tools to underwrite policies more precisely, shifting away from broad risk categories to scenario-based, financially quantified assessment (see: RiskLens, Axio Lead Cyber Risk Quantification Forrester Wave).

“CRQ has stepped in to say, ‘Look, we’re not going to sit here and debate on the credibility of different scores that different vendors are going to put out there publicly about your company,'” Scott said. “‘Let’s actually focus on what you stand to lose, and let’s just root this in dollars and cents so we can give you a more objective view based on the same insights that doesn’t boil down to a very subjective score.'”

How Do CRQ Leaders Stand Apart From the Pack?

Leading CRQ platforms integrate generative AI and AI agents to help analysts perform assessments and interpret complex risk scenarios more intuitively, Scott said. They designed interfaces and workflows that guide users through assessments and simplify communication with stakeholders, especially non-technical ones. And they address a broad range of use cases from cyber insurance to AI governance.

“‘Do I feel confident presenting financially quantified cyber risk results to non-technical folks in a way that even I understand and feel confident explaining?'” Scott asked. “That’s super hard to do, but Axio and KPMG are examples of companies who have done this to such an extreme degree that is so helpful that really eliminates that hurdle, because it is one of the biggest barriers to CRQ implementation.”

As CRQ capabilities become embedded across cybersecurity, standalone vendors will face consolidation. By 2027, the core function of CRQ – modeling and quantifying cyber risk – will be fully automated. Users will no longer need to manually estimate losses or threat probabilities. Instead, AI agents will deliver risk assessments on demand, drawing from real-time data, historical losses, and organization-specific inputs.

“The whole idea of going in and having to model risk – that’s going to completely go away,” Scott said. “It’s going to just be, ‘What is my risk?’ And the tool is going to be set up in such a way to be able to answer those questions rapidly. That capability is already starting to come to play, but it’s going to become the norm by 2027 for sure.”

From a strategy perspective, Forrester once again gave Safe Security the gold, with KPMG climbing from sixth in 2023 to second this year, Balbix improving from fourth to third, and Axio falling from second to fourth. As far as the offering is concerned, Safe improved from second to first, Axio jumped from third in 2023 to second in 2025, KPMG climbed from fourth to third, and ThreatConnect plummeted from first to fourth.

Outside of the leaders, here’s how Forrester sees the cyber risk quantification market:

• Strong Performers: Balbix, ThreatConnect, CYE;
• Contenders: X-Analytics, Zscaler, Kovrr, Mastercard.

Safe Brings Automation, Agentic AI, Real-Time Telemetry

Safe Security prioritized automating the data intake process by integrating telemetry from a wide variety of cybersecurity tools, which co-founder and CEO Saket Modi said helps the company ingest and analyze real-time security data from client environments. Safe also developed agentic generative AI systems designed not just to detect risk, but also to recommend and even execute remedial actions.

Unlike traditional cybersecurity vendors that only have access to their own product data, Modi said Safe aggregates and harmonizes data across a client’s security stack, which is processed through frameworks including FAIR and MITRE ATT&CK to deliver accurate, scenario-based risk modeling. Instead of periodic or static assessments, Safe offers continuous, real-time updates to its risk models as new data flows in (see: Safe Security Buys Cyber Risk Quantification Vendor RiskLens).

“We have all of that data coming in, and then we massage that data using open standards like FAIR and MITRE ATT&CK to do scenario mapping and then produce what the risk of the scenarios is,” Modi told ISMG. “So, there’s the complexity of bringing all of that data together and looking at that in a continuous way, in a real-time way, and then changing your risk scenario based on that.”

Forrester said Safe customers want improvements in asset and exposure tagging at scale and a better way to export and format data after performing custom queries. Modi explained that Safe has adopted a modern, generative AI-driven approach to reporting, which might be unfamiliar to some users. Instead of traditional static dashboards, users generate customized reports by interacting with AI agents.

“We use GenAI agents where you go and say, ‘Hey, I’m looking for this, this, this, this,’ then you have to tweak that query that you’re talking and based on that, you get a particular PDF report,” Modi said.

Axio Pursues Ease of Implementation, Customizable Insights

Axio reengineered the CRQ onboarding process into a lightweight experience so that users can engage with the platform in just five minutes and begin deriving valuable insights, said CEO Scott Kannry. The company addressed the “signal-to-noise” problem by processing vast datasets to recommend the most impactful next steps, helping organizations move from passive insight to proactive improvement.

Rather than providing one-size-fits-all data, Kannry said Axio’s platform adjusts models based on the unique attributes of the client organization. This ensures the loss estimates and threat scenarios presented are directly applicable, increasing their credibility and usefulness. For clients, this personalization translates into more accurate risk forecasting and better-informed decision-making, he said (see: Re-Defining Banking’s Unique Cyber Risk).

“Historically speaking, the process to implement has been arduous, grueling, months-long,” Kannry told ISMG. “And as a result of that, most people have said, ‘Despite the benefits, I just don’t have the time and effort to commit to it, so sorry.’ We’ve really, really changed that in terms of very lightweight, wizardized implementation scheme where a company and a user can get started in five minutes.”

Forrester criticized Axio for limited threat and vulnerability intelligence capabilities and for taking too long to build and roll out new features. Kannry said Axio has released 38 new features in the past year and continues to invest heavily in its product road map. Kannry said Axio’s platform is technically capable of incorporating threat intelligence data and plans to include these capabilities in the future.

“We’ve prioritized the things that I’ve mentioned, instead of either building up or wiring in some type of a threat and vulnerability capability,” Kannry said. “So, that’ll be coming. We’ve just taken a different approach to innovation. It’s not that we can’t do it. We just have done it a different way thus far.”

KPMG Excels with Intuitive Interface, Taking on Risk Management

Forrester said KPMG’s vision of making CRQ more accurate, accessible and actionable at scale reflects its deep understanding of modern risk management challenges, and excels at providing sophisticated onboarding and guided support. KPMG’s highly intuitive interface and in-depth in-product guidance to help technical and nontechnical users conduct risk analyses from start to finish, according to Forrester.

But KPMG needs to expand its support for integrations and automations, and its cyber insurance assessment offering, to meet customers’ needs, according to Forrester. Improving KPMG’s supporting services will help customers with more targeted security assessment needs, and Forrester pointed out that generated files aren’t as polished as the on-screen view when extracting a report.

A spokesperson told ISMG that KPMG executives weren’t available for additional comment.