Traditional information security risk assessment (RA) methodologies and standards, adopted by information security management systems and frameworks as a foundation stone towards robust environments, face many difficulties in modern environments where the threat landscape changes rapidly and new vulnerabilities are being discovered. In order to overcome this problem, dynamic risk assessment (DRA) models have been proposed to continuously and dynamically assess risks to organisational operations in (near) real time. The aim of this work is to analyse the current state of DRA models that have been proposed for cybersecurity, through a systematic literature review. The screening process led us to study 50 DRA models, categorised based on the respective primary analysis methods they used. The study provides insights into the key characteristics of these models, including the maturity level of the examined models, the domain or application area in which these models flourish, and the information they utilise in order to produce results. The aim of this work is to answer critical research questions regarding the development of dynamic risk assessment methodologies and provide insights on the already developed methods as well as future research directions.

In the current operational landscape, organizations face a growing and diverse array of cybersecurity challenges, necessitating the development and implementation of innovative and effective security solutions. This paper presents a novel methodology for dynamic risk assessment and mitigation suggestions aimed at assessing and reducing cyber risks. The proposed approach gathers information from publicly available cybersecurity-related open sources and integrates it with environment-specific data to generate a comprehensive understanding of potential risks. It creates multiple distinct risk scenarios based on the identification of vulnerabilities, network topology, and the attacker’s perspective. The methodology employs Bayesian networks to proactively and dynamically estimate the probability of threats and Fuzzy Cognitive Maps to dynamically update vulnerability severity values for each risk scenario. These elements are combined with impact estimations to provide dynamic risk assessments. Furthermore, the methodology offers mitigation suggestions for each identified vulnerability across all risk scenarios, enabling organizations to effectively address the assessed cybersecurity risks. To validate the effectiveness of the proposed methodology, a case study is presented, demonstrating its practical application and efficacy.

As cyberattacks grow in complexity, they pose increasing threats to organizations reliant on networked infrastructures. Conventional risk assessment methodologies often fail to adapt to the evolving nature of these threats. This paper introduces a novel cyber risk assessment model that adopts a proactive, dynamic, and time-aware approach to evaluating security risks. The proposed model leverages the Exploit Prediction Scoring System (EPSS) to estimate the short-term likelihood of exploitation over a 30-day period. To improve accuracy, Bayesian networks are employed to capture both system vulnerabilities and asset interdependencies within the network. This information is integrated into an absorbing Markov chain along with the identified attack paths, which are explored using Depth-First Search (DFS). The model generates exploitation probability distributions over the predefined time window, which, when combined with asset impact, facilitates dynamic, proactive, and time-sensitive risk assessments. Additionally, it provides valuable insights into attack progression by estimating the time required for an adversary to compromise critical assets. To demonstrate the practical applicability of the model, a case study is presented, showcasing its effectiveness in assessing cyber risks within a SCADA environment.

The convergence of information and communication technologies has introduced new and advanced capabilities to Industrial Control Systems. However, concurrently, it has heightened their vulnerability to cyber attacks. Consequently, the imperative for new security methods has emerged as a critical need for these organizations to effectively identify and mitigate potential threats. This paper introduces an innovative approach by proposing a dynamic vulnerability criticality calculator. Our methodology encompasses the analysis of environmental topology and the effectiveness of deployed security mechanisms, coupled with the utilization of the Common Vulnerability Scoring System framework to adjust detected vulnerabilities based on the specific environment. Moreover, it evaluates the quantity of vulnerabilities and their interdependencies within each asset. Additionally, our approach integrates these factors into a comprehensive Fuzzy Cognitive Map model, incorporating attack paths to holistically assess the overall vulnerability score. To validate the efficacy of our proposed method, we present a relative case study alongside several modified scenarios, demonstrating its effectiveness in practical applications.