Zeron has announced the open-source release of two major frameworks designed to fundamentally reshape how organizations understand and manage cyber risk: the Human Security Exploitability System (HSES) and the Cyber Risk Modeling Language (CRML). Together, these new tools introduce a shift away from static, control-focused assessments and toward continuously computed, human-aware cyber risk intelligence.
Most cybersecurity incidents do not stem from missing tools or broken controls. Instead, they arise within complex socio-technical environments where people must make high-stakes decisions under fatigue, pressure, and constant interruption. Recognizing this reality, Zeron has built HSES and CRML to formalize cyber risk as a living system one that continuously adapts to technical conditions, human behavior, and organizational design.
Importantly, both frameworks are fully open source, specification-driven, and transparently defined. As a result, researchers, security leaders, and engineers can independently inspect, validate, and extend them. Zeron emphasizes that cyber risk infrastructure must be auditable at the semantic level to earn operational trust. By opening these systems to public scrutiny, the company aims to support a new standard of transparency and rigor in cyber risk engineering.
Cyber Technology Insights: Zero Networks Expands Kubernetes Microsegmentation to Empower Security Teams with Greater Control
HSES: Turning Human Exploitability into a Measurable System Property
Although organizations continue to invest heavily in automation and threat detection, incident data consistently shows that many failures trace back to human decision-making under real-world constraints. Traditional frameworks often relegate these factors to residual risk or label them as unquantifiable. HSES challenges that assumption directly.
Instead of treating human error as an afterthought, the Human Security Exploitability System models human exploitability as a core system property. It derives this risk surface from observable and measurable operational variables, including alert volume, response times, cognitive load, workflow design, escalation paths, and organizational feedback mechanisms.
Through this lens, exploitability no longer depends on individual fault or intent. Rather, it emerges from system conditions. Consequently, HSES allows organizations to identify unsafe operating environments before incidents occur, offering the potential for earlier intervention and more resilient system design.
Moreover, Zeron has released HSES with clearly documented assumptions, transparent methodology, and defined variables. This openness enables the broader community to evaluate, test, and evolve the model, ensuring it can mature alongside changing operational realities.
Cyber Technology Insights: Zero Networks Advances Implementation of CISA’s New Zero Trust Microsegmentation Guidelines
CRML: Building the Computational Foundation for Cyber Risk
While HSES explains where and how risk arises, CRML provides the structural language to represent and compute that risk. The Cyber Risk Modeling Language is an open-source, domain-specific language designed to describe cyber risk in a machine-executable form.
CRML supplies formal building blocks to model assets, controls, dependencies, uncertainty, assumptions, and impact pathways. Unlike traditional frameworks that sit on top of dashboards or scoring tools, CRML operates at a deeper level. It serves as the underlying substrate upon which modern risk systems can be built.
As a result, CRML enables deterministic representation of risk logic, continuous recalculation of exposure as conditions change, and full traceability from raw technical signals to business-level impact. Because its grammar, semantics, and inference paths are openly defined, organizations can inspect and audit how conclusions are produced, avoiding reliance on opaque or proprietary scoring engines.
In effect, CRML transforms cyber risk from a descriptive exercise into a continuously computed, explainable system.
Toward Continuous, Human-Aware Risk Intelligence
Today’s operating environments rarely remain stable. Human performance fluctuates, and system boundaries constantly shift. By integrating HSES-derived human exploitability signals into CRML-based models, Zeron enables organizations to calculate cyber risk as a dynamic function of technology, human interaction, and organizational structure.
This combined approach supports continuous evaluation instead of periodic checklists, explicit modeling of uncertainty and human-driven variability, and decision-grade outputs suitable for executive governance and regulatory review. Ultimately, Zeron’s open frameworks lay the groundwork for a composable, transparent risk intelligence layer that can evolve as enterprises and threat landscapes change.
Cyber Technology Insights: Zero Networks Raises $55 Million Series C to Usher in the “Era of the Defender”
To participate in our interviews, please write to our CyberTech Media Room at info@intentamplify.com
