CRML
Zeron Research Labs / CyberSec Consulting LLC · Coding
CRML (Cyber Risk Modeling Language) is an open, declarative language for describing cyber risk models in YAML or JSON, maintained by Zeron Research Labs and CyberSec Consulting LLC. Instead of locking risk assumptions inside spreadsheets or one vendor's tool, it lets you define the model, its telemetry mappings and its outputs as reviewable files, then run them through whatever cyber risk quantification engine you already use. As an open source risk tool it ships as a Python risk library, so teams that treat risk as code can validate, version and reproduce their numbers the same way they handle any other configuration.
About CRML
What Is CRML
CRML is a language for writing down cyber risk models, not for computing them. That distinction matters. The format describes scenarios, inputs, control assumptions and expected outputs, while the actual math stays with the engine of your choice, whether that's a FAIR-style Monte Carlo setup, a Bayesian or QBER approach, or an internal platform. Because a declarative risk model is just text, it can live in Git, go through review, and be re-run months later with the same result.
That's the Risk as Code idea. When compliance and security assumptions become versioned artifacts, auditors and analysts can see what was modeled, which parameters were used, and which data fed the result. That's a far cry from a slide deck nobody can reproduce.
So who is this for? Mainly teams that already treat config as code. A declarative risk model only pays off if you'll keep it in version control. Skip it otherwise.
The biggest limitation right now is maturity. The project labels itself a draft under heavy development, so the format and tooling can shift between versions, and anyone building on it should expect changes. That's a real cost. Still, the scope is narrow, and the core idea holds up.
Getting Started
- Install Python 3, then add the packages from PyPI with
pip install crml-langandpip install crml-engine. - Write a scenario document in YAML or JSON describing your risk model, telemetry mappings and output requirements.
- Validate it against the bundled JSON schema, for example by loading the file through the
validatehelper incrml-lang. - Bundle a portfolio if several scenarios reference shared packs, producing one self-contained artifact.
- Hand the plan to your quantification engine, or use the deterministic pipeline step from
crml-engineto run it.
Product Information
A quick look at CRML's pricing, supported platforms, and performance.
Best for
The users, tasks, and scenarios where this tool fits best.
Users
- Cyber risk and security analysts who need models that survive review
- Compliance and audit teams that must show how a number was produced
- Engineering-minded risk managers already using Python
Tasks
- Documenting a risk scenario so two analysts get the same result
- Comparing risk across business units or vendors
- Mapping threat and control frameworks like ATT&CK, CIS or NIST
- Justifying a security spend by modeling risk with and without a control
Scenarios
- Moving risk models out of spreadsheets and slide decks into version control, where changes get reviewed like code.
- Running the same model through different quantification engines without rewriting it each time.
- Producing audit-ready evidence on demand, since the description of what was modeled lives alongside the model itself.
Key features
Engine-agnostic model descriptions
CRML doesn't force a quantification method on you. You describe the model in YAML or JSON, and a FAIR Monte Carlo setup, a Bayesian or QBER engine, or your own platform all read the same file. That means switching engines stops being a rewrite project. Big difference. It's the practical pain it was built to remove.
Risk as Code workflow
The whole point is turning risk assumptions into versioned, reviewable artifacts. Because models are plain text, they fit into Git, pull requests and CI, so an analyst can see exactly what changed and why. For teams already living in code review, this is the natural home for risk work. No more mystery numbers.
Schema validation and typed models
The crml-lang package ships Pydantic models, a bundled JSON schema and a structured validator. You get a clear pass or fail before anything runs, which catches malformed parameters early instead of after a wasted simulation. Validation reports tell you what broke, not just that something did.
Portfolio bundling
When several scenarios share referenced packs, bundle_portfolio folds them into one self-contained artifact. Bundling can read from disk or straight from in-memory models, so it works in a filesystem-free pipeline too. The result is a single object you can archive or ship to another team.
Deterministic engine pipeline
The companion crml-engine package includes a planning step that turns a portfolio into a deterministic pipeline plan. It keeps the "what to run" phase separate from "run it," which makes the output reproducible and easier to debug when numbers look off.
Framework and catalog flexibility
Threat and control frameworks such as ATT&CK, CIS, NIST, ISO and SCF, plus internal catalogs, can be described without locking you into any one of them. Since those frameworks change over time, keeping the mapping in a versioned format means updates don't silently break your model.
Pros and cons
Pros
- Open source under the MIT license, so there's no license cost and the schema is inspectable.
- Engine-agnostic design means your model isn't tied to one vendor's quantification tool.
- Text-based YAML and JSON models fit cleanly into Git, review and automation.
- Bundled schema validation and typed Python models catch errors before a simulation runs.
- Current version installs from PyPI as `crml-lang` and `crml-engine` for Python 3.
Cons
- The project calls itself a draft under heavy development, so the format and packages can change between versions.
- It's a specification and library, not a finished product, so you'll write code and YAML rather than click through a UI.
- No standalone cloud service or graphical dashboard, which rules it out for teams that want a ready-made app.
Frequently asked questions
It gives you a standard way to write down cyber risk models, their inputs and their expected outputs. The language handles description and validation, while a separate engine does the actual quantification.
Related content
Explore related tools, skills, and articles for CRML.
CRML Alternatives
Base Code
Base44 (Wix) · Coding · ProductivityBase Code is a shared cloud development environment from Base44. Teammates describe changes to an existing GitHub codebase in chat, preview them live and send them back as pull requests.
Google EmbeddingGemma 2
Google DeepMind · Writing · Image · CodingGoogle EmbeddingGemma 2 is a 740M-parameter open model that turns text, code, images, audio, and video frames into vectors in one 768-dimension space, running on phones and laptops.
GitGlow
GitGlow · Coding · ProductivityGitGlow is a local-first desktop Git client that lets independent developers review their own code and their AI agents' changes in one place before shipping.