CyQuantiFi - Cyber Risk Quantification in Dollars, Not Heatmaps

CyQuantiFi is an enterprise exposure assessment and cyber risk quantification (CRQ) platform built for Australian critical infrastructure. It replaces red/amber/green heatmaps with engineering-grade Annual Loss Expectancy in dollars - across the assets you can scan, and the OT, legacy and third-party systems you cannot.

The problem: The cybersecurity industry still cannot answer the board's most basic question - "How much could this cost us?" With 84,700+ cybercrime reports per year in Australia, an average business cost of $80,850 per incident (up 50% year on year), and SOCI penalty exposure reaching $3.3M, boards need dollar figures with confidence intervals, not colours in a cell.

CyQuantiFi ingests security findings, asset and identity information from across your enterprise estate (on-prem and cloud), correlates them into a single de-duplicated exposure register, models relationships between assets, identities, applications and cloud resources as a graph, identifies and validates attack paths, and expresses the resulting exposure in both technical and financial terms using the FAIR methodology over Monte Carlo simulation.

Key outputs:

• Annualised loss expectancy (ALE) and value-at-risk by business service
• Pre-remediation and post-remediation comparison of loss distributions
• Risk appetite control at conservative (P75), moderate (P90), or aggressive (P95) levels
• Portfolio aggregation via Gaussian copula with explicit coupling

• Exposure Correlation Engine: Resolves findings to assets, de-duplicates by deterministic fingerprint with lifecycle ageing. Human triage decisions survive re-ingest and are never overwritten by new scanner runs.
• Probabilistic Attack Graph with SAGE Validation: Autonomous engine tests whether modelled attack paths are actually traversable in your environment. CVE overlay binds live NVD data to graph nodes. MITRE ATT&CK overlay maps paths to techniques.
• Accumulation Map: Shows where separate parts of the estate share a dependency, modelling concentration risk across shared platforms such as Microsoft 365, AWS, CrowdStrike, Okta, Cisco and Snowflake.
• Quantify Unscannable Assets: OT, legacy, air-gapped and unagented assets are modelled via expert consensus and NetFlow - not guessed. This is a key differentiator: the majority of enterprise cyber exposure typically sits on assets no scanning tool can assess.
• What-If Analysis: Model control changes (e.g. EDR deployment) and see the dollar reduction in ALE with measurable ROI.
• CTI Intelligence Pipeline: Automated and continuous. Ingests TAXII v2.1, RSS feeds, NVD/CVE, custom APIs, email and document uploads. AI CTI Agent handles analysis, triage, indicator extraction and MITRE ATT&CK mapping.
• Expert Consensus Engine (Patent Filed): Combines AI agent and human expert inputs with calibration track records where higher accuracy equals more influence, producing defensible probability estimates for unscannable assets.
• Correlated Risk (Threat Tide): Models shared conditions that make linked supply-chain risks fail together - producing an honest worst case, not an artificially calm one.

• AWS Security Hub Connector: Ingests ASFF findings from GuardDuty, Inspector, Macie, Access Analyzer and control failures, bound to resource ARN
• AWS IAM Connector: Users, roles, groups with inline, managed and trust policy documents
• Amazon Bedrock (ap-southeast-2): Optional AI features including CTI agent and graph builder wizard, maintaining Australian data residency
• Deployed on AWS ap-southeast-2 (Sydney) with AWS role assumption using external ID for connector authentication - no static keys

• SOCI and CIRMP: Board-ready dollar figures mapped to the all-hazards CIRMP framework and annual reporting
• APRA CPS 234: Quantified information-security risk including third parties for regulated financial entities
• ACSC Essential Eight (ML0-ML3) and Australian Government ISM (1,192 controls)
• Additional frameworks: NIST CSF 2.0, ISO 27001:2022 Annex A, CIS Controls v8, NIST SP 800-53 Rev 5 with OSCAL import/export

Microsoft Entra ID, Microsoft Sentinel, Microsoft Defender, Microsoft Defender EASM, Azure RBAC, AWS Security Hub, AWS IAM, Obsidian SSPM, GitHub Advanced Security, ServiceNow, certificate transparency discovery, NetFlow REST and multiple CTI feeds.

Australian-incorporated, Australian-owned, Australian-operated and hosted in the AWS Sydney region. Defence-grade heritage with methodology tracing to risk-quantification frameworks used within Defence. All data remains in Australian jurisdiction with TLS 1.3 and hybrid post-quantum key establishment using ML-KEM.