Zeron Open-Sources HSES and CRML to Advance Foundational Cyber Risk Intelligence

NEW YORK, Jan. 27, 2026 /PRNewswire/ -- Most cybersecurity failures do not originate from defective controls or absent tooling. They emerge from socio-technical systems that fail to model how humans make decisions under operational stress.

Today, Zeron announced the open-source release of two foundational frameworks designed to formalize cyber risk as a continuously computable system: the Human Security Exploitability System (HSES) and the Cyber Risk Modeling Language (CRML).

Both HSES and CRML are fully open-sourced, specification-driven, and transparently defined, enabling independent inspection, validation, and extension. Zeron's position is that cyber risk infrastructure must be auditable at the semantic level to be operationally trusted.

Together, these frameworks establish a shift from static, control-centric assessments to continuous, human-aware cyber risk intelligence.

HSES: Modeling Human Exploitability as a System Property

Despite extensive investment in automation and detection, empirical incident data continues to show that a majority of security failures originate from human decision-making under fatigue, alert saturation, and time compression. Conventional risk frameworks treat this as residual or non-quantifiable.

HSES treats it as a first-class risk surface.

The Human Security Exploitability System models human exploitability as an emergent system property, derived from measurable operational variables including alert volume, decision latency, cognitive load, workflow design, escalation paths, and organizational feedback loops.

Key characteristics of HSES:

• Defines human exploitability surfaces independent of individual fault
• Models' exploitability as a function of system conditions, not intent
• Enables early detection of unsafe operating regimes prior to incident manifestation

HSES is published with a transparent methodology, explicit assumptions, and clearly defined variables, allowing practitioners and researchers to evaluate, challenge, and evolve the model.

Learn more about HSES:
https://qber.org/hses/

CRML: A Foundational Language for Cyber Risk Systems

While HSES specifies where risk emerges, CRML defines the underlying structure by which cyber risk is represented, computed, and reasoned about.

CRML is an open-source, domain-specific language designed to serve as foundational infrastructure for cyber risk modeling. It provides the formal primitives required to describe assets, controls, dependencies, assumptions, uncertainty, and impact pathways in a machine-executable form.

CRML is intentionally positioned below dashboards, reports, and scoring frameworks. It is not an overlay or abstraction layer; it is the substrate upon which higher-order risk systems are built.

CRML enables:

• Deterministic representation of risk logic and dependency graphs
• Continuous computation of exposure as telemetry, controls, or context change
• Full traceability from raw signals to business-aligned impact

By exposing its grammar, evaluation of semantics, and inference paths, CRML ensures that cyber risk reasoning remains inspectable, explainable, and auditable, avoiding reliance on opaque or proprietary scoring models.

In effect, CRML transforms cyber risk from a descriptive narrative into a computational foundation.

Learn more about CRML:
https://zeron.one/what-is-crml-the-new-standard-for-cyber-risk-quantification/

Composable, Transparent, and Continuously Evaluated Risk

Most existing security programs assume stable human performance and static system boundaries. Real-world environments violate both assumptions.

By integrating HSES-derived human exploitability signals into CRML-based models, Zeron enables organizations to compute cyber risk as a dynamic function of technical state, human-system interaction, and organizational design.

This approach supports:

• Continuous risk evaluation rather than point-in-time assessment
• Explicit modeling of human-driven variability and uncertainty
• Decision-grade outputs suitable for executive governance and regulatory scrutiny

The result is a foundational, composable risk intelligence layer that can evolve alongside the enterprise.

About Zeron

Zeron is pioneering the future of AI-driven Cyber Risk Intelligence, redefining how enterprises perceive, quantify, and act on cyber risks. The company's mission is to transform fragmented and overwhelming security data into real-time, business-aligned intelligence that enables confident, strategic decision-making.

Zeron's platform continuously contextualizes cyber signals, quantifies financial impact, and translates technical risk into executive-level insight. By bridging the language gap between security teams, boards, and regulators, Zeron enables leaders to make decisions that are both secure and strategically aligned.

In an era where cyber risk equals business risk, Zeron serves as a single point of truth, turning complexity into clarity, uncertainty into foresight, and cyber defense into a measurable business advantage.

Learn more at www.zeron.one or follow Zeron on LinkedIn for insights on AI-powered cyber risk intelligence.

Media Contact:
Ankit Raj Pathak
[email protected]

Logo: https://mma.prnewswire.com/media/2798082/Zeron_Logo.jpg

SOURCE Zeron