Cyber Risk Management Platform

Architecture

A layered control plane.

Your tools feed the data sources. The plane normalizes everything onto one data model and identity, interprets it, quantifies it, and dispatches governed agents — top to bottom, continuously.

▲ Decisions & actions flow upSignals flow in ▼

04Decisionsconsumers

Board · CVaR in $CISO · prioritized actionsAuditor · evidence trailUnderwriter · policy inputs

interpret & decide

03The control plane · Zeronone data model · one identity

Interno Vendor Pulse Conformity Cyber Navigator QBER quantification engine

dispatch ▾

02Agentic action · ZAKgoverned · ledger-logged

Threat HuntingVulnerability TriageVendor Risk WatcherCompliance Evidence+ build your own

connectors ▾

01Your security stackdata sources

EDR / XDRSIEMSOARCSPM / CNAPPIAM / PAMDLPGRCVMCMDBCloud · AWS / Azure / GCP

Four modules · one data model

Each stands alone. Together they compound.

Interno and Vendor Pulse flow up, Conformity interprets, Cyber Navigator decides — every module sharing one identity and one source of truth.

Capabilities

What each module does.

A unified data model means capabilities compound across modules instead of fragmenting across ten tools.

Capability	Interno	Vendor Pulse	Conformity	Navigator

The tech · QBER

How risk becomes a dollar figure.

QBER is Zeron's Cyber Risk Quantification model — it blends technical exposure with economic context into a measurable loss-exceedance curve. Peer-reviewed; indexed by NASA ADS & Harvard-Smithsonian.

01

Inputs

Industry, market cap, line of business, locations, solutions, regulations — plus live technical posture.

02

Model

QBER maps threat frequency × impact against your exposure to produce a probability distribution of annual loss.

03

Curve

The loss-exceedance curve: the probability of exceeding any given dollar loss in a year.

04

Decision

CVaR, mitigation efficiency and the next best action — board-ready and defensible.

Cyber Value-at-Risk · annual

$5.33M

P(loss > $5.33M) = 12.0% / yr
CVaR = E[ loss | loss > VaR ]

Under the hood

Collected, normalized, analyzed, acted on.

Every signal travels the same pipeline — ingested from your stack, normalized to the Open Cybersecurity Schema Framework (OCSF), correlated and scored, then turned into governed action.

Sources

EDR / XDR

3.1M events/day

SIEM

2.4M events/day

Cloud

1.0M events/day

Identity

0.5M events/day

Vendors

0.3M events/day

Normalize

OCSF schema

7.3M unified/day · 68% dedup

Analyze

Asset graph

de-dup · enrich · correlate

QBER scoring

EPSS · KEV · CVaR Δ

Outcomes

CVaR · $

board-ready

Findings

prioritized

Compliance

evidence

ZAK agents

governed action

live data flow 7.3M events normalized / day

01 Collect

Agentless & agent-based ingestion.

Connectors pull from EDR, SIEM, cloud, identity and vendor APIs; lightweight sensors stream logs and telemetry. Push (webhooks) and pull (scheduled) in parallel, deduplicated at the edge.

REST / GraphQLWebhooksSyslog / CEFCloud APIseBPF sensors

connectors/edr.crowdstrike.yamlingest

source: crowdstrike.falcon
mode: stream          # webhook + 60s poll backfill
auth: oauth2
events:
  - DetectionSummaryEvent
  - IncidentSummaryEvent
dedupe: hash(aid, event_id)
rate: 12000 # events / min

02 Normalize · OCSF

One schema for every source.

Raw vendor events are mapped to OCSF classes — so a CrowdStrike detection, a Wiz finding and a SentinelOne alert all become the same Detection Finding object, keyed to one asset identity.

OCSF v1.1class_uid 2004asset identity graph

raw · falcon event

{
  "event_simpleName": "DetectionSummary",
  "Severity": 70,
  "FileName": "mimikatz.exe",
  "ComputerName": "ZCN-HOST-039",
  "Technique": "T1003",
  "Timestamp": 1749535200
}

map

ocsf · detection_finding2004

{
  "class_uid": 2004,       // Detection Finding
  "severity_id": 4,       // High
  "time": 1749535200000,
  "finding_info": { "uid": "T1003" },
  "device": { "hostname": "ZCN-HOST-039" },
  "evidence": { "file": "mimikatz.exe" }
}

03 Analyze

Correlate, de-duplicate, score.

Normalized findings are stitched to the asset graph, de-duplicated across tools, enriched with EPSS/KEV and business context, then priced by QBER into a marginal CVaR contribution.

asset graphEPSS · KEVQBER scoringMITRE ATT&CK

analysis/score.qqber

# marginal contribution to annual loss
cvar_delta = P_exploit(epss, kev)
            × impact(asset.value, blast_radius)
            × exposure(internet_facing)

7.3M

Events / day normalized

68%

De-duplicated cross-tool

+$640K

CVaR Δ · this finding

04 Act

Policy-evaluated, agent-triggered.

Scored findings are evaluated against your policy DSL. When conditions match, ZAK dispatches a governed agent — with human-in-the-loop approval where you require it, and every step written to the ledger.

policy DSLHITL approvalSCF-mapped ledger

policies/auto-remediation.zpltrigger

on finding
where severity >= high
  and asset.exposure == "internet"
  and cvar_delta > 500_000
trigger agent("vuln-remediation")
  approval: slack("#sec-ops")
  ledger: true   # tamper-evident, SCF-mapped

Connects to your world

1,300+ integrations. 250+ frameworks.

Zeron sits above the tools you already run and maps to every regulator you answer to — connect once, normalize everything.

1,300+

Integrations

EDR · SIEM · cloud · identity · ITSM · vendor APIs

250+

Compliance frameworks

global · regional · sector-specific mandates

Integrates with

Compliance frameworks

Enterprise-grade SaaS

Secure, sovereign, and private by default.

Zeron runs as a fully-managed SaaS — with the data residency, tenant isolation and controls regulated enterprises require, built in from day one.

Sovereign by design

Your data stays in your region. In-region hosting, processing and storage keep it inside the jurisdiction your regulators require — and you always own it.

Secure by default

Per-tenant isolation, encryption in transit and at rest, SSO/SAML and RBAC — with every action written to a tamper-evident audit log.

Private by design

Strict access boundaries and data minimization — and we never train models on your data. Aligned to DPDPA, GDPR and DORA.

FAQ

Platform questions, answered.

What a cyber risk management platform does, how Zeron connects, and how it differs from the tools you already run.

What is a cyber risk management platform?+

A cyber risk management platform unifies signals from your security tools into one model, measures the risk, and helps you act on it. Zeron goes further — it prices risk in dollars (Cyber Value-at-Risk) and runs governed AI agents, so it doesn't just report risk, it reduces it.

How does Zeron connect to our existing security tools?+

Zeron sits above your stack with 1,300+ integrations and maps to 250+ frameworks. Connect once and every signal is normalized to a single data model — aligned to the Open Cybersecurity Schema Framework (OCSF) — and one identity.

Where is my data hosted, and is it sovereign?+

Zeron runs as a fully-managed SaaS, hosted in-region so your data stays within the jurisdiction your regulators require. Every tenant is isolated, data is encrypted in transit and at rest, and we never train models on it — aligned to DPDPA, GDPR and DORA.

How is Zeron different from a SIEM or GRC tool?+

A SIEM collects logs and a GRC tool tracks controls; Zeron is the control plane above them — unifying internal, external and vendor posture into one data model, quantifying risk in dollars, and acting through governed AI agents.

Get started

See the whole platform
in action.

Book a demo Explore ZAK agents

By industry

By role

Every signal in.
One command layer out.

A layered control plane.

Each stands alone. Together they compound.

What each module does.

How risk becomes a dollar figure.

Collected, normalized, analyzed, acted on.

1,300+ integrations. 250+ frameworks.

Integrates with

Compliance frameworks

Secure, sovereign, and private by default.

Platform questions, answered.

See the whole platform
in action.

A layered control plane.

Each stands alone. Together they compound.

What each module does.

How risk becomes a dollar figure.

Collected, normalized, analyzed, acted on.

1,300+ integrations. 250+ frameworks.

Integrates with

Compliance frameworks

Secure, sovereign, and private by default.

Platform questions, answered.

See the whole platformin action.

See the whole platform
in action.