# A Dynamic Risk Assessment and Mitigation Model
## 1 Introduction  
Cyber-attacks have the potential to inflict a range of adverse consequences on organizations, including physical or digital damage, economic losses, psychological distress, reputational damage, and broader social and societal disruptions [1]. To effectively defend against the wide range of such threats [2], organizations require innovative approaches to cybersecurity. Conventional cybersecurity strategies, including Risk Assessment and Risk Management frameworks, such as ISO 31000:2018 [3] and the National Institute of Standards and Technology (NIST) 800-37 Risk Management Framework [4], are insufficient for sustaining an organization's security posture in contemporary, rapidly changing environments. Although these frameworks provide a foundational approach, they are limited in their ability to adapt to the dynamic and evolving threat landscape [5] in which modern organizations operate. In response to the limitations of traditional approaches, the scientific community has proposed various dynamic risk assessment (DRA) frameworks and models. Our previous work [6] has demonstrated that the majority of these frameworks rely on Bayesian networks as the primary analysis method for evaluating changes in the probability or likelihood of threat occurrence. This is based on the premise that risk can be assessed as a functionof probability, impact, and vulnerability. In addition, most DRA frameworks lack the capability to provide actionable information regarding potential mitigation strategies. In this study, we introduce a novel dynamic risk assessment and mitigation methodology. The proposed model consists of three key modules. The first module is responsible for retrieving essential external information. Specifically, our methodology utilizes Common Vulnerability and Exposure (CVE) records to obtain relevant Common Vulnerability Scoring System (CVSS) metrics, leveraging the National Vulnerability Database (NVD) and the CVSS 3.x framework. Additionally, the model uses the CVEs to retrieve Exploit Prediction Scoring System (EPSS) scores and Common Weakness Enumeration (CWE) records. These are further linked to matching Common Attack Pattern Enumeration and Classification (CAPEC) entries. Finally, the model checks whether a detected CVE appears in the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) Catalog. The second module is responsible for creating multiple risk scenarios by considering identified vulnerabilities, environment-specific factors and the attacker's perspective. The third module then integrates the output of the second module, along with the information gathered by the first module, to provide proactive and dynamic risk assessments and mitigation suggestions for each of the generated risk scenarios. The innovation of the proposed methodology lies in its integration of Bayesian networks to dynamically and proactively update threat probabilities, combined with the dynamic adjustment of vulnerability severity values using Fuzzy Cognitive Maps. These updates are further integrated with impact estimation to generate accurate, dynamic, and proactive risk assessments. By providing proactive risk estimates alongside tailored mitigation suggestions, this work offers organizations actionable insights to reduce the estimated risk before incidents occur. Furthermore, the methodology addresses the limitations of subjective cybersecurity evaluations, which are often imprecise or unreliable [7], by employing objective data collection and analysis. The remainder of this paper is structured as follows: Section 2 provides the background information pertinent to this study, while Section 3 presents a review of related work. Section 4 outlines the proposed methodology, followed by a comprehensive application of this methodology within an artificial environment in Section 5.