Measuring Risk Likelihood in Cybersecurity
Source abstract
Abstract
Cybersecurity risk is commonly expressed through impact and likelihood, yet likelihood remains difficult to estimate because cyber incidents are underreported, heterogeneous datasets are weakly comparable, and attacker behavior changes faster than conventional probability baselines. This article proposes a method for operationalizing likelihood through a cyber exposure profile that integrates external cyber knowledge and organization-specific telemetry into a graph-based representation. The contribution is a formally specified artifact chain—from unified data model through organization-specific profiling, metric registry, likelihood scoring, and control prioritization—that operationalizes four constructs grounded in incident evidence: exposure, traceability, motivation, and systems update. The pipeline provides a pathway from heterogeneous source evidence to a bounded likelihood indicator comparable across organizations and observation periods. An evaluation in 15 real organizations shows that those implementing the cyber exposure profile were associated with reduced incident frequency and faster detection and response times, providing preliminary empirical support for the framework’s directional claims.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Information and Cyber Security · Supply Chain Resilience and Risk Management · Infrastructure Resilience and Vulnerability Analysis
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
INFOTEC Center for Research and Innovation in Information and Communication Technologies, Mexico City 14050, Mexico
National Supreme Court of Justice, Mexico City 06065, Mexico
Faculty of Law of Mazatlan, Autonomous University of Sinaloa, Mazatlán 82120, Mexico
ESIME Culhuacan, Instituto Politecnico Nacional, Mexico City 04440, Mexico
References (46)
Show source-provided references
1. (2022). Information Security, Cybersecurity and Privacy Protection—Information Security Controls (Standard No. ISO/IEC 27002:2022).
2. (2022). Information Security, Cybersecurity and Privacy Protection—Guidance on Managing Information Security Risks (Standard No. ISO/IEC 27005:2022).
3. (2024). The NIST Cybersecurity Framework (CSF) 2.0 (Standard No. NIST CSF 2.0 (CSWP 29)).
4. Caralli, R.A., Stevens, J.F., Young, L.R., and Wilson, W.R. (2007). Introducing OCTAVE Allegro: Improving the Information Security Risk Assessment Process (CMU/SEI-2007-TR-012), Carnegie Mellon University, Software Engineering Institute.10.21236/ADA470450 ↗
5. Quinn, S.D., Coyne, R., and Dempsey, K.L. (2021). Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management (NISTIR 8286A), National Institute of Standards and Technology (NIST).
6. European Union Agency for Cybersecurity [ENISA] (2010). Incentives and Challenges for Information Sharing in the Context of Network and Information Security, ENISA.
7. OASIS Open (2021). STIX Version 2.1, OASIS Open. Available online: https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html.
8. OASIS Open (2021). TAXII Version 2.1, OASIS Open. Available online: https://docs.oasis-open.org/cti/taxii/v2.1/os/taxii-v2.1-os.pdf.
9. Current state and modeling of research topics in cybersecurity and data science
10. Cybersecurity data science: An overview from machine learning perspective10.1186/s40537-020-00318-5 ↗
11. FIRST.org, Inc. (n.d.). (2026, March 19). The EPSS Model. Available online: https://www.first.org/epss/model.
12. Exploit Prediction Scoring System (EPSS)
13. Kumar, V., Srivastava, J., and Lazarevic, A. (2005). Topological analysis of network attack vulnerability. Managing Cyber Threats, Springer.10.1007/b104908 ↗
14. Ou, X., Govindavajhala, S., and Appel, A.W. (2005). MulVAL: A logic-based network security analyzer. Proceedings of the 14th USENIX Security Symposium, Baltimore, MD, USA, 31 July–5 August 2005, USENIX Association.
15. Phillips, C., and Swiler, L.P. (1998). A Graph-Based System for Network-Vulnerability Analysis. Proceedings of the 1998 Workshop on New Security Paradigms, Charlottesville, VA, USA, 22–25 September 1998, ACM.10.1145/310889.310919 ↗
16. An attack graph-based probabilistic security metric10.1007/978-3-540-70567-3_22 ↗
17. Design science in information systems research10.2307/25148625 ↗
18. A design science research methodology for information systems research10.2753/MIS0742-1222240302 ↗
19. Kaloroumakis, P.E., and Smith, M.J. (2021). Toward a Knowledge Graph of Cybersecurity Countermeasures, The MITRE Corporation. Available online: https://d3fend.mitre.org/resources/D3FEND.pdf.
20. Strom, B.E., Applebaum, A., Miller, D.P., Nickels, K.C., Pennington, A.G., and Thomas, C.B. (2020). MITRE ATT&CK®: Design and Philosophy, The MITRE Corporation.
21. Data sources and datasets for cloud intrusion detection modeling and evaluation
22. Aldribi, A., Traoré, I., Moa, B., and Nwamuo, O. (2019). Documentation for the ISOT Cloud Intrusion Detection Dataset, University of Victoria, Department of Electrical and Computer Engineering. Technical Report No. ECE-2020-10-10.
23. Hypervisor-based cloud intrusion detection through online multivariate statistical change tracking10.1016/j.cose.2019.101646 ↗
24. Abbiati, G., Ranise, S., Schizzerotto, A., and Siena, A. (2021). Merging datasets of cybersecurity incidents for fun and insight. Front. Big Data, 3.10.3389/fdata.2020.521132 ↗
25. Passeri, P. (2026, May 30). Hackmageddon: Cyber Attacks Statistics, Maps and Infographics. (2011–2026). Available online: https://www.hackmageddon.com/category/security/cyber-attacks-timeline/.
26. Adams, N.M., and Heard, N. (2018). Unified host and network data set. Data Science for Cyber-Security, World Scientific.
27. Ferriyan, A., Thamrin, A.H., Takeda, K., and Murai, J. (2026, May 30). HIKARI-2021: Generating Network Intrusion Detection Dataset Based on Real and Encrypted Synthetic Attack Traffic (Version 1.4.0) [Data Set]. Zenodo. Available online: https://zenodo.org/records/6463389.
28. Manning, C.D., Raghavan, P., and Schütze, H. (2008). Introduction to Information Retrieval, Cambridge University Press.10.1017/CBO9780511809071 ↗
29. Term-weighting approaches in automatic text retrieval10.1016/0306-4573(88)90021-0 ↗
30. Indexing by latent semantic analysis10.1002/(SICI)1097-4571(199009)41:6<391::AID-ASI1>3.0.CO;2-9 ↗
31. Finding structure with randomness: Probabilistic algorithms for constructing approximate matrix decompositions10.1137/090771806 ↗
32. Concept decompositions for large sparse text data using clustering10.1023/A:1007612920971 ↗
33. Spherical k-means clustering10.18637/jss.v050.i10 ↗
34. Arthur, D., and Vassilvitskii, S. (2007). k-means++: The advantages of careful seeding. Proceedings of the 18th Annual ACM-SIAM Symposium on Discrete Algorithms, New Orleans, LA, USA, 7–9 January 2007, SIAM.
35. (2016). Information Technology—Security Techniques—Information Security Management—Monitoring, Measurement, Analysis and Evaluation (Standard No. ISO/IEC 27004:2016).
36. (2011). Information Security Continuous Monitoring (ISCM) for Federal Information Systems Organizations (Standard No. NIST SP 800-137).
37. Agresti, A. (2013). Categorical Data Analysis, Wiley. [3rd ed.].
38. McCullagh, P., and Nelder, J.A. (1989). Generalized Linear Models, Chapman & Hall. [2nd ed.].10.1007/978-1-4899-3242-6 ↗
39. Organisation for Economic Co-operation and Development & Joint Research Centre [OECD & JRC] (2008). Handbook on Constructing Composite Indicators: Methodology and User Guide, OECD Publishing.
40. Reproducible research in computational science10.1126/science.1213847 ↗
41. Guidelines for conducting and reporting case study research in software engineering10.1007/s10664-008-9102-8 ↗
42. Yin, R.K. (2018). Case Study Research and Applications: Design and Methods, SAGE Publications. [6th ed.].
43. Shadish, W.R., Cook, T.D., and Campbell, D.T. (2002). Experimental and Quasi-Experimental Designs for Generalized Causal Inference, Houghton Mifflin. [1st ed.].
44. (2022). Information Technology—Information Security, Cybersecurity and Privacy Protection—Information Security Management Systems—Requirements (Standard No. ISO/IEC 27001:2022).
45. (2025). Health Informatics—Information Security Controls in Health Based on ISO/IEC 27002 (Standard No. ISO 27799:2025).
46. (2018). Security for Industrial Automation and Control Systems (Standard No. IEC 62443).