We have infrastructure as a code, network as a code but dont have anything as Risk As a Code. CRML is an open, declarative, engine-agnostic and Control / Attack framework–agnostic Cyber Risk Modeling Language. It provides a YAML/JSON format for describing cyber risk models, telemetry mappings, simulation pipelines, dependencies, and output requirements — without forcing you into a specific quantification method, simulation engine, or security-control / threat catalog.
This is the 2nd launch from CRML. View more
CRML Code
Launched this week
CRML Code is an AI-powered CLI that brings CRML to practitioners who don’t want to write YAML. Give it a company name, vulnerability scan, or simple prompt, and it automatically generates structured CRML scenarios. It resolves organizational context, builds realistic cyber risk models, and runs large-scale simulations to produce financially grounded risk insights and control impact analysis.
Free
Launch Team / Built With
CRML
This looks like a really strong way to make CRML much more approachebale for practicioners who don't want to deal with YAML directly. Just curious, how you help users understand the assumptions behind the generated scenarios though – it feels like making this easier is a huge win, and at the same time transparency becomes even more important for trust