# A Dynamic Risk Assessment and Mitigation Model
## 7 Discussion and Limitations  
The proposed model is founded on the detection of vulnerabilities (CVEs) to retrieve and utilize critical data for dynamic risk assessment, establishing a direct relationship between CVEs and risk levels within its framework. Prior research has also leveraged CVEs for risk estimation [37; 38], as they enable the extraction of risk-related data from diverse sources, including the NVD. An advantage of the proposed model is its adaptability. Although it primarily utilizes the CVSS 3.x framework, it can also be applied to the CVSS 2.0 framework, as many CVEs are still assessed using CVSS 2.0. This is feasible because CVSS 2.0 provides the necessary exploitability and impact metrics required by our model. Since our approach directly employs the original CVSS exploitability and impact metrics without modifying them based on environmental factors--such as adjustments to the Attack Vector metric [30], which varies between versions (CVSS 2.0: Local, Adjacent Network, Network; CVSS 3.x: Physical, Local, Adjacent Network, Network)--the primary adaptation required is in the normalization process to integrate these metrics into the FCM model. For example, to normalize the CVSS 2.0 exploitability score, we divide by 10, as its maximum value is 10, whereas in CVSS 3.x, the maximum exploitability score is 3.9. Regarding the recently introduced CVSS 4.0 framework, no CVEs are currently assessed using this framework in the NVD. Consequently, we are unable to integrate \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Risk Scenario** & **VPN** & **WebS** & **WS1** & **WS2** & **DB** & **AVG** \\ \hline
1 & 0.588 & - & 0.531 & - & 0.326 & 0.482 \\
2 & 0.588 & - & - & 0.41 & 0.027 & 0.205 \\
3 & - & 0.521 & 0.516 & - & 0.321 & 0.453 \\
4 & - & 0.521 & - & 0.040 & 0.026 & 0.196 \\ \hline \hline \end{tabular}
\end{table} 
Table 24: Dynamic and proactive risk estimates—all scenarios. CVSS 4.0 into our model at this stage. However, given that CVSS 4.0 also provides exploitability and impact metrics, our model could be adapted to accommodate this version in the future once sufficient data becomes available. Table 25 presents a systematic analysis of key features of all models discussed in Related Work (Section 3). The majority of studies employ ML techniques to dynamically update the threat vector within the risk formula, where risk is defined as the product of _threat_, _vulnerability_, and _impact_. However, two models also dynamically adjust the impact vector [18; 20] within the risk formula. This adjustment is achieved through the application of a Markov models. A distinguishing feature of the proposed model is its ability to dynamically update the vulnerability vector within the risk formula using a separate model (FCM), while also providing dynamic updates to the threat vector using the Bayesian network. Consequently, the proposed methodology is the only approach that calculates risk as the product of a dynamic threat vector, a dynamic vulnerability vector, and the impact vector, thereby ensuring truly dynamic and comprehensive risk assessments. Attack graphs have been extensively utilized in prior research to generate and visualize multiple attack scenarios [39], identify system vulnerabilities and potential exploits [40], predict attacker movements [41], and develop mitigation strategies [42]. In contrast, our approach focuses on the creation of distinct attack paths and their corresponding separate risk scenarios. This enables our model to illustrate how an asset's risk score varies across different scenarios, providing valuable insights for dynamic and scenario-specific risk assessment. The majority of analyzed DRA models rely on real-time data or vulnerability-related data (e.g., CVSS) to generate risk assessments, thereby adopting a predominantly reactive approach. In contrast, our model uniquely integrates EPSS data, which provides probabilistic estimations of exploitation likelihoods over the next 30 days.