# A Dynamic Risk Assessment and Mitigation Model
## 6 Results  
With regard to the dynamic vulnerability severity process, the highest score is observed in the database (0.648) during risk scenario 1. This discrepancy is attributed to the original exploitability score (3.9/3.9) of CVE-2021-41773. This is further influenced by the \begin{table}
\begin{tabular}{l c c c c c} \hline \hline
**Asset** & **CVE** & **DVSV** & **DPTS** & **Impact** & **DRA** \\ \hline WebS & CVE-2019-0211 & 0.557 & 0.935 & 1.000 & 0.521 \\ WS1 & CVE-2017-8692 & 0.557 & 0.073 & 0.983 & 0.040 \\ DB & CVE-2021-41773 & 0.636 & 0.069 & 0.600 & 0.026 \\ \hline \hline \end{tabular}
\end{table} 
Table 22: DRA–risk scenario 4. \begin{table}
\begin{tabular}{l c c c c} \hline \hline
**Asset** & **CVE** & **DVSV** & **DPTS** & **Impact** & **DRA** \\ \hline WebS & CVE-2019-0211 & 0.557 & 0.935 & 1.000 & 0.521 \\ WS2 & CVE-2017-8692 & 0.557 & 0.073 & 0.983 & 0.040 \\ DB & CVE-2021-41773 & 0.636 & 0.069 & 0.600 & 0.026 \\ \hline \hline \end{tabular}
\end{table} 
Table 23: Risk scenario 4— CWE, KEY, CAPEC. \begin{table}
\begin{tabular}{l c c c c} \hline \hline
**Asset** & **CVE** & **KEV** & **CWE** & **CAPEC** \\ \hline WebS & CVE-2019-0211 & Yes & 416 & - \\ WS1 & CVE-2017-0143 & 0.599 & 0.876 & 0.983 & 0.516 \\ DB & CVE-2021-41773 & 0.645 & 0.830 & 0.600 & 0.321 \\ \hline \hline \end{tabular}
\end{table} 
Table 20: DRA–risk scenario 3.  
contributions of WS1 (0.610)--CVE-2017-0143 and the VPN (0.622)--CVE-2019-11510. In contrast, the database assets in the other three scenarios exhibit lower dynamic vulnerability severity values compared to risk scenario 1. Additionally, the VPN, which serves as the entry point along with the Web Server, exhibits higher initial (pre-execution) and post-execution vulnerability values compared to the Web Server alone. This disparity is attributed to the differing exploitability subscores, with the VPN scoring 3.9/3.9 and the Web Server scoring 1.8/3.9. Furthermore, WS1 (CVE-2017-0143) shows higher initial (original exploitability score) and post-execution vulnerability severity values than WS2 (CVE-2017-8692). Collectively, these factors render risk scenario 1 the most vulnerable among the four scenarios. Risk scenario 2 ranks as the second most vulnerable, followed by scenarios 3 and 4 in decreasing order of severity. These values are summarized in Table 5. Based on the above findings, it can be concluded that dynamic vulnerability severity values are influenced by the original exploitability scores and the influence of other vulnerability values, which are, in turn, determined by the network location of the assets. In the context of dynamic and proactive threat assessments (Table 15), the VPN demonstrates the highest dynamic and proactive threat score among all assets analyzed in this use case. This prominence is attributable to its exceptionally high EPSS score of 0.972, combined with its critical position within the target network topology. Both the VPN and the Web Server serve as potential entry points for attackers. The Web Server also exhibits a high dynamic and proactive threat score, driven by its EPSS score of 0.967. These two assets, the VPN and the Web Server, consistently retain the highest dynamic and proactive threat scores (post-Bayesian adjustment) due to their initially elevated EPSS scores and their strategic locations within the network. WS1, associated with CVE-2017-0143, has a high original EPSS score, which translates to dynamic and proactive threat scores of 0.885 in risk scenario 1 and 0.877 in scenario 3. Conversely, WS2, linked to CVE-2017-8692, demonstrates significantly lower dynamic and proactive threat scores of 0.074 and 0.073 in risk scenarios 2 and 4, respectively. This disparity stems from the substantial difference in their EPSS scores, with WS1 achieving a score of 0.968 compared to WS2's 0.28.