Gane Index

All indexesEvery index and its categories GTMMarketing, sales, customer and revenue operations software ITSecurity, IT operations, cloud, developer and data software HRHR, payroll, recruiting, performance and learning software FinanceAccounting, planning, spend, billing and treasury software

Claim your listing

Index › IT › Products › NIST SP 800-30 · November 2026 Edition

Cyber risk quantification · Named, not ranked

NIST SP 800-30

–Too few to rank

2/14Models named it

1First choices

2Warnings

November 2026 Edition · all company sizes counted.

Ranked inCyber risk quantification #28 mid-market

What AI models recommend

Named, too few times to rank.

A product needs 10 labels in a category before a share is stated. NIST SP 800-30 has 2.

Why models recommend it

“start with the free frameworks (OCTAVE or NIST SP 800-30) to build your internal capabilities”Mistral Small · Budget-constrained question · first choice

What gives them pause

“Over-reliance on NIST SP 800-30, ISO 27005, or OCTAVE without quantitative extensions—these are frameworks, not tools, and frequently criticized for subjectivity”Grok 4.20 · Negative question · warning

Also on the shortlist

The products named in the same answers as NIST SP 800-30, over the 4 answers that named it, and how often each was the first choice instead.

Product	Named together	Picked instead
Axio360	3	0	View →
RiskLens	2	1	View →
Balbix	2	0	View →
ISO 27005	2	0	View →
OCTAVE	2	0	View →
SAFE Security	2	0	View →
WTW Cyber Quantified	2	0	View →
FairCRQ	1	1	View →
Ashish-1357/Cyber-risk-quantification	1	0	View →
Axio	1	0	View →

A side-by-side page exists where both products are among a category's top eight.

How this is measured

Fourteen AI models from 12 labs are asked the same buying questions six ways, for three company sizes. Standings refresh every edition.

Gane sells AI visibility software. No company can pay to change a result.

Read the method →

Sources returned with these answers

The sites and pages the answers that named NIST SP 800-30 came back with. A fact about retrieval, not a cause of the answer.

Fourteen of the fourteen models returned a source list in this edition: five return the pages they cited and nine the search results they consulted. These counts come from 4 of the 4 answers that named NIST SP 800-30 and are not a share of its labels.

Domains cited

techtarget.com4

bpb-eu-w2.wpmucdn.com3

cyberpress.org2

cyesec.com2

fairinstitute.org2

github.com2

it.tenable.com2

bestdefense.io1

cisa.gov1

comparitech.com1

No domain is on file for NIST SP 800-30, so its own site is not marked.

Pages cited

techtarget.com/news/Cyber-risk-quantification-challenges-and-tools-that-can-help/8369794

bpb-eu-w2.wpmucdn.com/blogs.bristol.ac.uk/dist/3/939/files/2024/08/RISCS-Cyber-Risk-Quanti3

cyberpress.org/crq-tools-review2

cyesec.com/blog/the-complete-guide-to-cyber-risk-quantification2

fairinstitute.org/blog/watch-out-for-these-5-cyber-risk-quantification-methods.-they-dont-2

github.com/AwpDemon/cyber-risk-quant2

it.tenable.com/cybersecurity-guide/learn/cyber-risk-quantification2

bestdefense.io/blog/risk-assessment-tools-a-2026-practitioners-shortlist1

Pages are listed as the models cited them.

By model

How each model answered on NIST SP 800-30 across every prompt where it was named for a mid-market B2B company. Fourteen models, six prompts per category.

Model	First choice	Warning	Labels
Claude Haiku 4.5	0	0	0
GPT-5.4 mini	0	0	0
Gemini 3.5 Flash	0	0	0
Perplexity Sonar	0	0	0
Grok 4.20	0	1	1
Mistral Small	1	0	1
DeepSeek V4 Flash	0	0	0
Llama 4 Maverick	0	0	0
Qwen 3.7 Flash	0	0	0
Kimi K2	0	0	0
GLM 4.7 FlashX	0	0	0
MiniMax M2.5	0	0	0
GPT-6 Luna	0	0	0
Muse Glimmer 30B	0	0	0