# A Dynamic Risk Assessment and Mitigation Model
## 6 Results
The dynamic and proactive threat scores of both WS1 and WS2 are lower than their original EPSS scores, reflecting the model's assumption that an attacker must first compromise either the VPN or the Web Server, depending on the risk scenario, before targeting WS1 or WS2. The database, associated with CVE-2021-41773 and an initial EPSS score of 0.973, achieves a dynamic and proactive threat score of 0.838 in risk scenario 1. This reduction, approximately 14%, is more significant compared to WS1, which experiences a decrease from 0.968 to 0.885 (around 9%) in the same scenario. The greater reduction for the database is attributable to the additional requirement in scenario 1 that an attacker must first compromise both the VPN and WS1 before exploiting the database. More specifically, the value of an asset is determined by its position within the network, evaluated from the attacker's perspective, as well as the threat scores of previously compromised assets. Notably, in scenarios involving WS2, the dynamic threat score of the database drops to nearly zero. These findings underscore that the threat score of an asset is not solely influenced by its initial estimation, such as the EPSS scores, but also by its position within the network topology and the threat scores of interconnected assets. Risk scenario 1 yields the highest dynamic and proactive threat scores, followed by scenarios 3, 2, and finally 4. The variation in these scores results from the dynamic and proactive threat scores of WS1 compared to WS2. Specifically, when WS1 is involved, the exploitation of the database results in relatively high scores of 0.838 and 0.830. Conversely, when WS2 is involved, the scores are nearly negligible, at 0.070 and 0.069. Table 24 presents the dynamic and proactive risk estimates for each asset across all the scenarios outlined. In addition, the last column of this table presents the average risk for each scenario. As observed, the highest risk is associated with the first risk scenario, followed by the third, second, and finally the fourth, which has the lowest risk. Since dynamic risk is a combination of dynamic vulnerability severity values, dynamic and proactive threat assessments, and impact, it is logical that risk scenario 1, with both the highest dynamic vulnerability severity value and the highest dynamic and proactive threat scores, also exhibits the highest dynamic risk. With regard to mitigation suggestions, the presented case study identified five distinct vulnerabilities (CVEs), four of which are included in the CISA KEV Catalog. Their inclusion indicates the availability of clear remediation actions, such as vendor-provided updates. The only CVE not included in the CISA KEV Catalog is CVE-2017-8692, associated with WS2, for which no patch is available. Regarding mitigation suggestions from CAPEC, out of the five identified CVEs, three could be correlated with relevant CAPEC entries, enabling our model to provide corresponding mitigation recommendations. Additionally, both CVE-2019-11510, detected on the VPN, and CVE-2021-41773, detected on the database (DB), were correlated with the same CWE (CWE-22). Consequently, the retrieved CAPEC-IDs and the resulting mitigation suggestions for these vulnerabilities are identical. This highlights cases where similar vulnerabilities share common mitigations due to their correlation with the same CAPEC entries.