Ahead. 
Previous post.
On July 14, 2026, 15 threat modeling enthusiasts gathered to delve into the world of quantitative risk: Daniel Agota and TMC DACH had invited attendees to a demonstration of his tool Risquanter.
Materials
You can download the slides here:
Risquanter is available as open source on GitHub. Risquanter
Why Quantitative Risk at All?
The presentation began by explaining why a risk-based approach is necessary in the first place. Given the large number of identified threats, guidance and prioritization are needed, since it is impossible to allocate a finite budget equally across all threats.
The presentation then highlighted problems with qualitative risk approaches, which, for example, classify probability of occurrence and damage into categories such as “low,” “medium,” and “high”:
Such classifications are often arbitrary, and even when using a predetermined evaluation standard, different people have vastly different ideas of what constitutes, for example, a “high probability.”
Furthermore, such a classification would categorize threats into only a very small number of categories, many of which would also be impractical: For example, a “low”/“medium”/“high” classification across both dimensions would result in only 9 categories. The truly relevant threats lie either in scenarios with high impact and low probability of occurrence—or in those that, individually, have only limited impact but collectively pose a significant risk. That’s practically useless for deciding how to address all of this!
This ultimately led to requirements for a risk management approach: It must be possible to do the following:
- compare,
- aggregate,
- sort (rank),
- run through scenarios,
- and analyze which components have the greatest impact on overall risk.
Fundamentals of Quantitative Risk
Daniel demonstrated how quantitative approaches meet these requirements.
A risk is simulated using Monte Carlo methods: In a series of trials, a loss may or may not occur with a certain probability. The amount of the loss, which is then expressed in financial terms, is drawn from a mathematical distribution.
This results in distribution curves showing the probability that a certain financial loss will occur.
These considerations led to the concept of the Loss Exceedance Curve (LEC). The LEC plots a monetary amount on the x-axis and, on the y-axis, the probability that a loss will exceed that amount.
He also addressed concerns: Expert estimates do not have to be exact; in the event of discrepancies, one can also run through different opinions as scenarios and then see how that affects the basis for decision-making. Often, a recommended course of action does not change, even if estimates differ.
There are methods for describing such a distribution using only a few parameters and expert estimates, without requiring in-depth mathematical knowledge.
Daniel explained how this approach meets the desired requirements, since risks can now be compared, aggregated, and sorted. Different scenarios can also be discussed.
Risquanter
Risquanter is a quantitative decision-making platform for risk management. It combines Monte Carlo simulations with an easy-to-use interface in which experts map hierarchical risk models as tree structures. Risks are described concisely using loss exceedance curves; portfolio nodes are aggregated via simulation. The system supports scenario analyses, historical comparisons (time travel), and management-oriented decision-making questions. In addition, Risquanter offers analytical functions for breaking down risks into their impact components, attributing individual contributions to the overall risk, and generating comparative risk rankings—in short, it quickly highlights the most important influencing factors in a way that is relevant for taking action.
Core Features
- Construction and visualization of hierarchical risk models
- Aggregation using Monte Carlo and presentation as LECs
- Scenario analyses and historical comparisons (time travel)
- Fuzzy query language for formulating natural management questions, e.g., “Do at least three-quarters of the assets have critical risks?”
- Decision support: sensitivity analyses, cost-benefit assessments, and comparative risk rankings
Discussion Points
During the discussion, the topic of the independence of various events was raised, and ways to model dependencies between events in the future were explored.
In addition, competitors to the open-source Risquanter were mentioned (“calpana and mitratech”), and participants shared their own experiences.
Conclusion
We would like to thank everyone for a wonderful evening and the fascinating insight into a topic that was new to many of the participants!
(Translated with deepl.com)