# A Dynamic Risk Assessment and Mitigation Model
## 8 Conclusions and Future Work  
In this article, we presented a dynamic risk assessment and mitigation model designed to assess cyber risk and provide corresponding mitigation recommendations. The proposed model integrates data from cybersecurity-related open sources with information from an \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Paper** & **ML Methods** & **Dynamic Element Update** & **Input Data** & **Mitigation Suggestions** \\ \hline [PERSON] et al. [15] & Bayesian networks & Threat & Security profile, data breach statistics, ISO 2700E compliance & No \\ [PERSON] et al. [16] & Fuzzy probability Bayesian network & Threat & Attack evidence (IDS), anomaly detection, expert and system knowledge & No \\ [PERSON] et al. [17] & Bayesian network & Threat & ICS Security knowledge, real-time evidence, attack history & No \\ [PERSON] [18] & Bayesian network, hidden Markov models & Threat, Impact & Vulnerability scanner, IDS, cybersecurity event history, CVE, CVSS & No \\ [PERSON] et al. [19] & Bayesian network & Threat & CVE, CVSS, IDS, security configurations & No \\ [PERSON] [20] & Markov model & Threat, Impact & CVE, CVSS, historical data & No \\ [PERSON] et al. [21] & Markov model & Threat & CVE, CVSS, security configurations, assets & No \\ [PERSON] et al. [22] & Attack-Defense Trees & Threat & IoT sensors, cloud infrastructure, security controls & No \\ [PERSON] et al. [23] & Attack Graph & Threat & Network scanner data, CVSS, configurations & No \\ [PERSON] et al. [24] & Bayesian network & Threat & CVE, CVSS & No \\ [PERSON] et al. [26] & (Not specified) & (Not specified) & CPE, CVE, CVE, CAPEC, CVSS, BTC & No \\ [PERSON] et al. [27] & (Not specified) & (Not specified) & CVE, CWE, CAPEC, Threat Reports & No \\ [PERSON] et al. [28] & FCM & Threat & CVSS & No \\ [PERSON] et al. [29] & Attack Graph & Threat & vulnerability inventory, security policies and configurations, mitigation actions & Yes \\ Proposed Method & Bayesian networks (Threat), FCM (Vulnerability) & Threat, Vulnerability & EPSS, CVE, CVSS, CWE, CAPEC, CISA & Yes \\  & & & KEY Catalog & \\ \hline \hline \end{tabular}
\end{table} 
Table 25: Comparison of cybersecurity risk assessment approaches. organization's internal environment to both assess risk and offer mitigation strategies to reduce it. The incorporation of EPSS data equips the model with dynamic and proactive capabilities. A key novelty of the proposed model lies in its ability to dynamically update both the threat and vulnerability vectors within the risk calculation formula. The effectiveness of the model was demonstrated through a comprehensive case study, showcasing its capability to accurately assess risk and propose mitigation measures. For future work, we plan to incorporate machine learning or artificial intelligence techniques [43; 52; 53] to automate and enhance the detection of CAPEC processes. Additionally, we aim to enhance the model's functionality by integrating mechanisms to evaluate the effectiveness of the proposed mitigation actions in reducing the assessed risk. These advancements will further increase the model's utility for dynamic and proactive risk assessment. Finally, we intend to apply the proposed methodology in a real-world environment to assess the model's effectiveness in practical scenarios. Conceptualization, P.C. and K.R. ; methodology, P.C. ; investigation, P.C. ; software, P.C. ; writing--original draft preparation, P.C. ; writing--review and editing, K.R. ; visualization, P.C. ; supervision, K.R. All authors have read and agreed to the published version of the manuscript. This research received no external funding. Not applicable. Data Availability Statement: Data is contained within the article. The authors declare no conflicts of interest. The following abbreviations are used in this manuscript: