Summary
KPMG’s CRI product has been recognised as a ‘Leader’ and was the only Leader to have received above average customer feedback in the Forrester Wave™: Cyber Risk Quantification Solutions, Q2 2025 assessment.
The report evaluated the top vendors in Cyber Risk Quantification (CRQ) against three categories: current offering, strategy, and customer feedback. Among the “ten providers that matter most”, KPMG CRI was named a ‘Leader’.
CRI offers superior user experience, with a highly intuitive interface and some of the most in-depth in-product guidance to help technical and nontechnical users conduct risk analyses from start to finish.
Forrester Wave™: Cyber Risk Quantification, Q2 2025
What the 2025 report says – and what it means for you
Here are four of our standout takeaways from this assessment.
01
A clear vision for scalable, practical CRQ
“[CRI’s] vision of making CRQ more accurate, accessible, and actionable at scale reflects its deep understanding of modern risk management challenges”.
Our take
We’re not a tick-box solution. We help clients build insight, not just reports – combining scenario-driven analysis with global cyber risk expertise to add value to our customers. Today, CRI is used globally by over 100 organisations across 17 industries.
02
Unrivalled user experience and in-product guidance
“[CRI] offers superior user experience, with a highly intuitive interface and some of the most in-depth in-product guidance to help technical and nontechnical users conduct risk analyses from start to finish.”
Our take
From day one, we’ve prioritised human centred design across every aspect of CRI. Our development roadmap is shaped by continuous customer feedback – so as our users and the threat landscape evolve, so do we.
03
Transparent Models. Defensible Insights. Real Results.
“[CRI] shines in model transparency, scenario scoping, comparative analysis, prioritisation, and control performance monitoring.”
Our take
We know that trust in results starts with transparency. Our workflows explain every model component, backed by an in-product knowledge base that details the logic behind every calculation – so users can explore, understand, and explain their results at every step.
04
Benchmarking backed by real CRQ data
"Extensive benchmarks from the firm's global services insights further accelerate CRQ analyses."
Our take
Benchmarking in CRI is grounded in real-world data from two trusted sources: our Industry Insights Database and anonymised data from assessments conducted across our customer base. The resulting insights help users compare risk exposure, attack paths, and control performance with peers, adding valuable external context to internal decisions.
Our position on the Forrester WaveTM
Hear from our leadership
"Being recognised as a leader in the Forrester Wave™: Cyber Risk Quantification Solutions Q2 2025 is, for us, a testament to our commitment to innovation in cyber security. More than that, we feel it’s recognition of the partnership we have with our customers. Together, we’ve been able to push the boundaries of what CRQ can do – and we’re only just getting started."
Martin Tyley
Global Lead Partner, CRI
"This one’s personal. I’ve been working in CRQ for over a decade, but this journey started back in 2016 with a single spreadsheet built to help a few clients make better decisions. To see that evolve into a global SaaS solution used by over 100 organisations is something I’m incredibly proud of.
Being named a Leader is more than a recognition – we believe it’s validation of the hard work, the vision, and the belief that cyber risk management can and should be done differently. It’s a credit to the team and the clients who’ve helped shape this platform into what it is today.
We’re grateful for the recognition – and even more motivated for what comes next."
James Hanbury
Global Lead Director and Co-founder, CRI
Forrester does not endorse any company, product, brand, or service included in its research publications and does not advise any person to select the products or services of any company or brand based on the ratings included in such publications. Information is based on the best available resources. Opinions reflect judgment at the time and are subject to change. For more information, read about Forrester’s objectivity
here .
One product, multiple use cases.
Find out more about why we're a Leader and understand how CRI can help you make smarter cyber risk decisions.
Insights into the inner workings.
We're completely transparent about our modelling logic, to give you defensible Insights that deliver real results.
Get the report
Get your own copy of The Forrester Wave™: Cyber Risk Quantification Solutions, Q2 2025 report.
