Quantifying software supply chain resilience through non-intrusive data-driven concentration risk analysis.
Cairnlytics is a spin-out of the Edinburgh Decentralisation Index (EDI), an ongoing project at the University of Edinburgh, initiated in 2022. EDI is a registered trademark in UK, US and Switzerland.
EDI website: https://informatics.ed.ac.uk/blockchain/edi
Organisations struggle to objectively assess resilience in their software supply chains. Vulnerabilities like Log4j and Heartbleed revealed systemic risks from overreliance on shared open-source libraries. Cairnlytics assesses cyber resilience in a quantitative, non-intrusive and data-driven way for IT companies, risk underwriters and insurers, by pinpointing points of failure and measuring concentration risk.
Software risk scores
Out of 1000
Historical risk scores
Today
1
1
(all time)
(last year)
Cairnlytics helps IT companies achieve regulatory compliance by delivering data-driven evidence aligned with key standards like DORA, FCA PS21/3, SBOM, the NCSC Cyber Assessment Framework, and the UK's Software Security Code of Practice. It also tackles NCSC Cross-Cutting Problems by making assessments more data-driven (CC2) and establishing meaningful security metrics (CC3).
Unique Selling Point: Unlike manual audits or historical GRC tooling, Cairnlytics delivers automated, quantifiable risk metrics using non-intrusive, proprietary models, enabling cost-effective supplier due diligence at scale.
Cairnlytics is at the pre-spinout stage and plans to build on top of the EDI codebase, which is open source under an MIT license.
Follow us on LinkedIn