Cyber risk quantification for enterprise buyers
Asked as “cyber risk quantification tool”, and as “CRQ platform”, on behalf of an enterprise B2B company. 43 first choices recorded across the direct, paraphrase, budget and scale prompts, twelve models each. Added to the September 2026 Edition; its answers are read by the distilled judge (ai-indexes-judge-qwen3-14b-run3), not the claude-opus-5 judge of the earlier categories: how the two compare.
Standing · first-choice share
56%
SAFE SecurityClear leader
56SAFE Security09RiskLens07Axio28others
56% of first choices, clear leader.
By buyer segment
The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.
The standing
Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all twelve models, for an enterprise B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrant
Show the three products at 0%, ordered by negative rate
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its product page.
One product takes 56% of first choices here, so the chart would put six markers in one corner and one at the far edge. The two measurements it plots are columns in the standing above: share, and the negative label rate. Zero products carry a negative rate above 25% in this category.
What they warned about
Five of twelve models held their first choice under the paraphrase. Claude Haiku 4.5, GPT-5.4 mini, Gemini 3.5 Flash, Mistral Small, Qwen 3.7 Flash, GLM 4.7 FlashX and MiniMax M2.5 changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
Archer40%
2 of 5 labels negative · 2 of 12 models · 1 hard negative
“GRC platforms (ServiceNow, Archer, OneTrust, etc.) now tout "CRQ capabilities"” DeepSeek V4 Flash, negative prompt
CyberSaint CyberStrong12%
2 of 17 labels negative · 2 of 12 models · 1 hard negative
“Avoid mid-market tools like CyberSaint ($30K–$80K) as they lack depth for thousands of users.” Grok 4.1 Fast, budget prompt
OneTrust67%
2 of 3 labels negative · 2 of 12 models · 1 hard negative
“GRC platforms (ServiceNow, Archer, OneTrust, etc.) now tout "CRQ capabilities"” DeepSeek V4 Flash, negative prompt
Open FAIR
100%
1 of 1 labels negative · 1 of 12 models · 1 hard negative
“Pure consulting-led or basic FAIR spreadsheets (e.g., legacy Open FAIR tools) lack scalability for large enterprises.” Grok 4.1 Fast, negative prompt
What they cite
Citations exist only for the models that return a source list: fourteen of the twelve in this edition, and all six flagship models on the expanded tier.
Sites the answers cite
80 of 84 answers in this category came back with a source list, from 14 of 12 models: citations where the model returns them, or the search results it consulted. 1182 links across 260 sites, every framing counted. Ranked by the number of answers carrying the site or page.
vendor site · Kovrr48 answers · 85 citations · 13 models
44 answers · 53 citations · 12 models
vendor site · Bitsight38 answers · 48 citations · 12 models
vendor site · CyberSaint34 answers · 44 citations · 12 models
34 answers · 44 citations · 10 models
30 answers · 37 citations · 10 models
vendor site · SAFE27 answers · 61 citations · 10 models
vendor site · G226 answers · 32 citations · 11 models
24 answers · 25 citations · 11 models
22 answers · 25 citations · 9 models
vendor site · MetricStream18 answers · 25 citations · 8 models
17 answers · 18 citations · 8 models
Pages the answers cite
The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.
42 answers · 11 models
32 answers · 11 models
32 answers · 12 models
28 answers · 10 models
26 answers · 10 models
23 answers · 10 models
23 answers · 10 models
22 answers · 9 models
17 answers · 8 models
15 answers · 8 models
Search against answers
Each company's standing in the answers beside its site's footprint in Google search, one row a site: the products the models named on it with their shares, and the share they add up to; monthly searches on Google, and DataForSEO's estimate of AI search demand (modeled from search signals, directional, not a count of queries to any assistant), for the most-searched of the company's and its products' names (the name is in each row's hover text); estimated monthly organic visits to the site; and its best position in Google's top ten for “best cyber risk quantification tool”, “cyber risk quantification tool”, “cyber risk quantification tools”. US estimates from DataForSEO and Google's Ads Transparency Center. A small company's site, or a mid-sized company's site for its flagship, is marked company; a product on a large parent's site (Google, Microsoft) has no site figures. A column with no figures for this category is left out, and an empty cell means none were seen, not none exist. Two measurements side by side: neither is read as the cause of the other.
| Company and products | Share | Own site cited | Name searches, Google | AI search demand, est. | Organic visits | Google ads, last 30 days | Best Google position |
|---|---|---|---|---|---|---|---|
| SAFE One safe.security SAFE Security 56%, SAFE One 7% | 63% | 115 | 2,400 | 5,496 | 1,015,372 | 12 | 8 |
| RiskLens risklens.com | 9% | 84 | 90 | 0 | |||
| Axio axio.com | 7% | 96 | 5,400 | 3,654 | 1,815 | 0 | |
| Balbix balbix.com | 2% | 46 | 480 | 5 | |||
| Axio360 | 2% | 50 | 0 | ||||
| RiskRecon riskrecon.com | 2% | 15 | 720 | 9 | 2,546 | 0 | |
| Derive Risk deriverisk.com | 2% | 2 | |||||
| CyberStrong | 2% | ||||||
| Derive | 2% | ||||||
| Safe Security – acquired RiskLens | 2% |
Google's top ten for the three searches hold 26 sites; 5 of them are among the sites the models cited here (cybersaint.io, kovrr.com, metricstream.com, safe.security, vcso.ai). The first result for “best cyber risk quantification tool” is cybersierra.co.
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.ShowHide
How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ShowHideModelDirect“What is the best cyber risk quantification tool for an enterprise B2B company?”Paraphrase“Which CRQ platform would you recommend to a large B2B company with thousands of employees?”Comparative“What are the top enterprise-grade cyber risk quantification tools and how do they differ?”Budget-constrained“What is the best cyber risk quantification tool for a large company that needs predictable total cost across thousands of users?”Scale-constrained“We are a 5,000 person company with SSO, SOC 2 and procurement review requirements evaluating a cyber risk quantification tool. What should we look at?”Negative“Which cyber risk quantification tools should a large enterprise avoid or be cautious about?”
Claude Haiku 4.5no first choiceSAFE SecurityChangedRiskLens, SAFE SecuritySAFE Securityno first choiceagainst: FAIR Model, LogicGate, MetricStream, OCTAVE Method
Five alternatives
Archer, Balbix, CyberSaint CyberStrong, Kovrr, LogicGate Risk CloudThree alternatives
Bitsight, Kovrr, MetricStreamGPT-5.4 miniSAFE SecurityServiceNowChangedRiskLens, SAFE Securityagainst: Drata, VantaSAFE Securityno first choicenothing named
Two alternatives
FAIR, Gartner Third-Party Cybersecurity InsightsOne alternative
RiskLensOne alternative
CYETwo alternatives
Axio, Qualys ETMGemini 3.5 FlashSAFE SecuritySAFE OneChangedSAFE SecurityCyberStrongno first choiceagainst: Bitsight, SecurityScorecard
Three alternatives
Axio, CyberSaint CyberStrong, KovrrTwo alternatives
Axio, KovrrFive alternatives
Axio, CyberSaint CyberStrong, DeNexus, Kovrr, ThreatConnectFour alternatives
Kovrr, LogicManager, SAFE One, SimpleRiskPerplexity SonarSAFE SecuritySAFE SecurityHeldno first choiceAxio, SAFE Securityno first choicenothing named
Four alternatives
Axio, Black Kite, Kovrr, RiskLensOne alternative
AxioTwo alternatives
Kovrr, RiskLensGrok 4.1 FastSAFE SecuritySAFE SecurityHeldSAFE SecuritySAFE Securityagainst: CyberSaint CyberStrongRiskLensagainst: Axio, Hyver by CYE, Open FAIR, Resilience, SAFE Security
Three alternatives
Axio, Balbix, KovrrTwo alternatives
Balbix, KovrrFour alternatives
Axio, Balbix, KPMG, KovrrFour alternatives
Axio, Balbix, Kovrr, ResilienceTwo alternatives
Balbix, KovrrMistral SmallAxio, SAFE SecurityRiskLens, SAFE SecurityChangedSAFE SecuritySAFE Securityno first choicenothing named
Two alternatives
Kovrr, RiskReconTwo alternatives
C-Risk, KovrrFour alternatives
Axio, Balbix, KPMG, KovrrTwo alternatives
Kovrr, ResilienceDeepSeek V4 FlashSAFE SecuritySAFE SecurityHeldagainst: KovrrSAFE SecuritySAFE SecuritySAFE Securityagainst: Archer, CyberSaint CyberStrong, OneTrust, ServiceNow
Three alternatives
Axio, KPMG Cyber Risk Insights, KovrrTwo alternatives
Axio, BalbixFour alternatives
Axio, CyQuant, Kovrr, RiskLensThree alternatives
Balbix, Bitsight Financial Quantification, RiskLensFour alternatives
Axio, CyberSaint CyberStrong, Kovrr, RiskLensLlama 4 Maverickno first choiceno first choiceHeldno first choiceno first choiceSAFE Securitynothing named
Four alternatives
Axio, Balbix, LogicGate Risk Cloud, MetricStreamQwen 3.7 FlashAxio, RiskReconSqualifyChangedSAFE SecurityRiskLensagainst: Diligentno first choiceagainst: Archer, OneTrust, ServiceNow Integrated Risk Management
Two alternatives
Kovrr, ResilienceThree alternatives
Kovrr, Mastercard Cyber Quant, X-AnalyticsTwo alternatives
Axio, ThreatConnectTwo alternatives
LogicGate One, WizKimi K2SAFE SecuritySAFE SecurityHeldSAFE SecurityDerive Riskno first choicenothing named
Two alternatives
Axio, Balbix Security CloudThree alternatives
Axio, Balbix, KovrrFive alternatives
Axio, Bitsight, Citalid, Kovrr, TenableTwo alternatives
Axio360, SAFE SecurityGLM 4.7 FlashXBalbix, SAFE Securityno first choiceChangedno first choiceSAFE Securityno first choicenothing named
Three alternatives
Axio, CyberSaint CyberStrong, KPMGSeven alternatives
Bitsight, CyQuant, CyberCube Analytics, Kovrr, RiskLens, SecurityScorecard, UpGuardTwo alternatives
Balbix, ObserveriMiniMax M2.5no first choiceSAFE SecurityChangedSAFE Securityno first choiceno first choicenothing named
Three alternatives
Axio, Balbix, KovrrFive alternatives
Axio, Balbix, Bitsight, KPMG Cyber Risk Insights, ServiceNow Integrated Risk ManagementBold is the first choiceAlternatives are counted; the count opens them.What the answer argued against
The record
One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency. Full answer text is in the free responses file. Download the record
Seventy-two rows: every prompt, every model, every answer.
| Prompt | Model | Version string | Time (UTC) | Searched | Sources | Latency |
|---|---|---|---|---|---|---|
| Direct recommendation | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-04 23:39 | yes | 9 | 7 s |
| Direct recommendation | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-05 01:46 | yes | 4 | 4 s |
| Direct recommendation | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-05 00:25 | yes | 21 | 31 s |
| Direct recommendation | Perplexity Sonar | sonar | 2026-10-05 00:57 | yes | 27 | 2 s |
| Direct recommendation | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-04 22:19 | yes | 23 | 12 s |
| Direct recommendation | Mistral Small | mistral/mistral-small via mistral | 2026-10-05 01:53 | yes | 5 | 5 s |
| Direct recommendation | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-05 00:58 | yes | 21 | 61 s |
| Direct recommendation | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-04 22:26 | yes | 5 | 2 s |
| Direct recommendation | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-04 23:53 | yes | 9 | 32 s |
| Direct recommendation | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-05 01:00 | yes | 21 | 31 s |
| Direct recommendation | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-05 01:25 | yes | 14 | 40 s |
| Direct recommendation | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-04 22:34 | yes | 10 | 34 s |
| Paraphrase | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-05 00:32 | yes | 9 | 6 s |
| Paraphrase | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-05 01:32 | yes | 2 | 5 s |
| Paraphrase | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-04 22:51 | yes | 16 | 26 s |
| Paraphrase | Perplexity Sonar | sonar | 2026-10-05 01:49 | yes | 33 | 2 s |
| Paraphrase | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-05 00:30 | yes | 23 | 9 s |
| Paraphrase | Mistral Small | mistral/mistral-small via mistral | 2026-10-05 00:45 | yes | 5 | 3 s |
| Paraphrase | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-05 01:25 | yes | 23 | 38 s |
| Paraphrase | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-05 01:46 | yes | 5 | 2 s |
| Paraphrase | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-04 23:09 | yes | 5 | 40 s |
| Paraphrase | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-04 22:21 | yes | 20 | 23 s |
| Paraphrase | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-04 22:22 | yes | 25 | 19 s |
| Paraphrase | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-04 23:20 | yes | 9 | 23 s |
| Comparative | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-05 01:21 | yes | 9 | 9 s |
| Comparative | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-05 00:22 | yes | 11 | 12 s |
| Comparative | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-04 23:06 | yes | 22 | 36 s |
| Comparative | Perplexity Sonar | sonar | 2026-10-05 01:00 | yes | 18 | 4 s |
| Comparative | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-05 01:38 | yes | 17 | 11 s |
| Comparative | Mistral Small | mistral/mistral-small via mistral | 2026-10-05 00:16 | yes | 17 | 12 s |
| Comparative | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-05 01:45 | yes | 20 | 43 s |
| Comparative | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-04 23:05 | yes | 5 | 2 s |
| Comparative | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-05 01:55 | yes | 14 | 52 s |
| Comparative | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-05 00:17 | yes | 21 | 67 s |
| Comparative | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-04 22:54 | yes | 23 | 70 s |
| Comparative | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-04 22:33 | yes | 25 | 30 s |
| Budget constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-05 01:04 | yes | 17 | 9 s |
| Budget constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-04 23:39 | yes | 6 | 5 s |
| Budget constrained | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-04 22:41 | yes | 20 | 29 s |
| Budget constrained | Perplexity Sonar | sonar | 2026-10-04 22:32 | yes | 24 | 4 s |
| Budget constrained | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-04 22:35 | yes | 15 | 11 s |
| Budget constrained | Mistral Small | mistral/mistral-small via mistral | 2026-10-05 00:16 | yes | 5 | 3 s |
| Budget constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-05 00:13 | yes | 24 | 22 s |
| Budget constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-05 01:46 | yes | 5 | 2 s |
| Budget constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-04 22:50 | no | 0 | 28 s |
| Budget constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-05 00:17 | yes | 21 | 38 s |
| Budget constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-05 00:32 | yes | 22 | 225 s |
| Budget constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-05 01:38 | yes | 21 | 51 s |
| Scale constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-04 23:49 | yes | 17 | 13 s |
| Scale constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-05 01:07 | yes | 5 | 11 s |
| Scale constrained | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-05 01:32 | yes | 6 | 27 s |
| Scale constrained | Perplexity Sonar | sonar | 2026-10-05 01:19 | yes | 16 | 8 s |
| Scale constrained | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-05 00:04 | yes | 18 | 10 s |
| Scale constrained | Mistral Small | mistral/mistral-small via mistral | 2026-10-05 00:48 | no | 0 | 10 s |
| Scale constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-05 01:27 | yes | 23 | 52 s |
| Scale constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-05 01:43 | yes | 5 | 4 s |
| Scale constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-04 23:56 | no | 0 | 27 s |
| Scale constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-05 01:07 | yes | 15 | 21 s |
| Scale constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-04 23:54 | yes | 22 | 195 s |
| Scale constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-05 01:01 | yes | 15 | 71 s |
| Negative framing | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-10-05 00:51 | yes | 18 | 13 s |
| Negative framing | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-10-05 01:16 | yes | 4 | 7 s |
| Negative framing | Gemini 3.5 Flash | gemini-3.5-flash | 2026-10-05 00:57 | yes | 18 | 28 s |
| Negative framing | Perplexity Sonar | sonar | 2026-10-05 00:52 | yes | 20 | 4 s |
| Negative framing | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-10-05 00:39 | yes | 21 | 18 s |
| Negative framing | Mistral Small | mistral/mistral-small via mistral | 2026-10-05 01:09 | yes | 5 | 5 s |
| Negative framing | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-10-04 23:46 | yes | 22 | 71 s |
| Negative framing | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-10-05 01:15 | yes | 5 | 3 s |
| Negative framing | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-10-04 22:12 | no | 0 | 34 s |
| Negative framing | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-10-04 23:42 | yes | 23 | 24 s |
| Negative framing | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-10-05 00:16 | yes | 18 | 49 s |
| Negative framing | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-10-05 01:56 | yes | 21 | 72 s |
Normalization in this category
Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.
ShowHide
Category-scoped readings
CyberSaint read as CyberSaint CyberStrong
CyberSaint (CyberStrong) read as CyberSaint CyberStrong
SAFE read as SAFE One
Unresolved, counted raw
Axio Global
Balbix Security Cloud
BitSight RiskRecon/Cyber Quant
Cyber Horizon
CyberStrong (by CyberSaint)
DeNexus (DeRISK Platform)
FAIR Model
Gartner Third-Party Cybersecurity Insights
Hyver by CYE
KPMG firms
LogicGate One
OCTAVE Method
Observeri
Qualys ETM
S&P Global/PRA Group
Safe Security – acquired RiskLens
Discontinued, still offered
No shut-down product was recommended here.